Personal Data Protection (GDPR)

The management company IAD Investments, management company, joint-stock company, with its registered office at Malý trh 2/A, 811 08 Bratislava, Slovak Republic, Company ID: 17 330 254, registered in the Commercial Register of the Municipal Court Bratislava III, Section: Sa, Entry No.: 182/B (hereinafter referred to as „IAD“), provides basic information on IAD’s approach to the processing and protection of personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) as amended (hereinafter referred to as „GDPR“), and in accordance with Act No. 18/2018 Coll. on Personal Data Protection and on Amendments to Certain Acts, as amended (hereinafter referred to as „Personal Data Protection Act“).

For questions concerning the processing of personal data or other matters relating to personal data, you may contact IAD by e-mail at info@iad.sk, by telephone on the toll-free infoline: 0800 601 601 (for the Slovak Republic), 800 127 000 (for the Czech Republic), or in writing by letter sent to IAD’s registered office: IAD Investments, správ. spol., a.s., Malý trh 2/A, 821 07 Bratislava.

In the area of personal data processing and protection, IAD is a controller that has, alone or jointly with others, defined the purpose and means of processing personal data and processes personal data in its own name. Within the meaning of the Personal Data Protection Act, a data subject is any natural person whose personal data are processed.

IAD processes personal data of selected categories of data subjects. The categories of data subjects, the purpose and legal basis for processing their personal data, the recipients of personal data, and the retention period for personal data are set out below:

1. Processing of personal data without the consent of the data subject
1.1. Investors, clients
Purpose: issuance and redemption of units of mutual funds, distribution of securities of foreign collective investment undertakings, provision of investment services and related activities (in particular conclusion of contracts, identification of investors and clients and their representatives, execution and subsequent verification of investors’ or clients’ transactions, protection and enforcement of IAD’s rights against investors or clients, documentation of IAD’s activities, exercise of supervision, and fulfilment of IAD’s tasks and obligations arising from relevant legislation)
Legal basis: processing of personal data is necessary under a specific regulation or an international treaty by which the Slovak Republic is bound (Act No. 203/2011 Coll. on collective investment, as amended; Act No. 566/2001 Coll. on securities and investment services and on amendments to certain acts (Securities Act), as amended; Act No. 297/2008 Coll. on protection against the legalization of proceeds of criminal activity and on protection against the financing of terrorism and on amendments to certain acts, as amended; Act No. 359/2015 Coll. on the automatic exchange of information on financial accounts for tax administration purposes and on amendments to certain acts, as amended; legislation of the state in which authorization for the activity of the foreign undertaking was issued and in which it is subject to supervision).
Recipients of personal data (categories of recipients of personal data or third parties to whom personal data may be disclosed):

IAD has entrusted the processing of personal data to:

• financial agents who carry out financial intermediation or other services for IAD. A list of financial agents is available on IAD’s website at www.iad.sk/kontakty/financni-sprostredkovatelia or www.iad.sk/cs/kontakty/financni-zprostredkovatele
• for the purpose of informing investors and clients (sending confirmations, regular and annual statements, information sheets), the company ZPC Group, s.r.o., Krasovského 3986/14, 851 01 Bratislava – Petržalka district, Company ID: 50 540 301

Categories of other recipients of personal data or third parties to whom personal data may be disclosed:

• depositary of IAD mutual funds, auditor of IAD and IAD mutual funds
• persons entrusted with the exercise of supervision for the purposes of supervision / the National Bank of Slovakia for the purposes of its supervisory activities
• court, including a notary as judicial commissioner, for the purposes of civil proceedings in which an investor or client of IAD is a party or the subject matter of which is the assets of an investor or client of IAD
• law-enforcement authority for the purposes of criminal proceedings
• criminal police service, judicial police service, and financial police service of the Police Force for the purposes of fulfilling tasks established by specific legislation
• tax authority for the purposes of tax proceedings or customs authority in customs matters
• state-administration authority for the purposes of enforcement of a decision under specific legislation
• Slovak Information Service for the purposes of fulfilling tasks established by specific legislation
• managing authority and audit authority in the exercise of control or audit of financial instruments
• competent authority of the Slovak Republic under specific legislation in fulfilment of reporting obligations
• In connection with the distribution of securities of a foreign collective investment undertaking carried out by IAD, personal data may also be disclosed to the following categories of other recipients of personal data or third parties: the foreign collective investment undertaking (which issued the securities of the foreign collective investment undertaking), the foreign management company (managing the foreign collective investment undertaking that issued the securities of the foreign collective investment undertaking), and service providers under specific legislation for the foreign collective investment undertaking that issued the securities of the foreign undertaking (e.g. auditor, central administrator, depositary), supervisory authorities or other financial regulators, state authorities and public authorities (in particular courts and law-enforcement authorities in the state in which authorization for the activity of the foreign undertaking was issued and in which it is subject to supervision), and only to the extent necessary under the relevant legislation.

Retention period for personal data:

• data and copies of documents proving the identity of investors for 18 years and clients for 10 years, and documents on the determination of ownership of funds used by investors for 18 years and by clients to execute a transaction, and contracts and other documents on executed transactions for 10 years
• data relating to investors’ and clients’ transactions for at least 10 years
• data and written documents in the exercise of due diligence on an investor and client and in the identification of an unusual transaction for 10 years from the termination of the contractual relationship, and all data and written documents on a transaction for 10 years from the execution of the transaction
• data of investors and clients relating to information on financial accounts for 10 years from the end of the calendar year in which the data on financial accounts were provided

Transfer to a third country or international organization does not take place.

1.2. Investors, clients
Purpose: provision of IAD ONLINE Access
Legal basis: processing of personal data is necessary for the purposes of performance of a contract (IAD ONLINE Access agreement)
Recipients of personal data (categories of recipients of personal data or third parties to whom personal data may be disclosed):
IAD has entrusted the processing of personal data to:

• financial agents who carry out financial intermediation or other services for IAD. A list of financial agents is available on IAD’s website at www.iad.sk/kontakty/financni-sprostredkovatelia or www.iad.sk/cs/kontakty/financni-zprostredkovatele
• for the purpose of informing investors and clients (sending confirmations, regular and annual statements, information sheets), the company ZPC Group, s.r.o., Krasovského 3986/14, 851 01 Bratislava – Petržalka district, Company ID: 50 540 301

Categories of other recipients of personal data or third parties to whom personal data may be disclosed:

• depositary of IAD mutual funds, auditor of IAD and IAD mutual funds
• persons entrusted with the exercise of supervision for the purposes of supervision / the National Bank of Slovakia for the purposes of its supervisory activities
• court, including a notary as judicial commissioner, for the purposes of civil proceedings in which an investor or client of IAD is a party or the subject matter of which is the assets of an investor or client of IAD
• law-enforcement authority for the purposes of criminal proceedings
• criminal police service, judicial police service, and financial police service of the Police Force for the purposes of fulfilling tasks established by specific legislation
• tax authority for the purposes of tax proceedings or customs authority in customs matters
• state-administration authority for the purposes of enforcement of a decision under specific legislation
• Slovak Information Service for the purposes of fulfilling tasks established by specific legislation
• managing authority and audit authority in the exercise of control or audit of financial instruments
• competent authority of the Slovak Republic under specific legislation in fulfilment of reporting obligations
• In connection with the distribution of securities of a foreign collective investment undertaking carried out by IAD, personal data may also be disclosed to the following categories of other recipients of personal data or third parties: the foreign collective investment undertaking (which issued the securities of the foreign collective investment undertaking), the foreign management company (managing the foreign collective investment undertaking that issued the securities of the foreign collective investment undertaking), and service providers under specific legislation for the foreign collective investment undertaking that issued the securities of the foreign undertaking (e.g. auditor, central administrator, depositary), supervisory authorities or other financial regulators, state authorities and public authorities (in particular courts and law-enforcement authorities) in the state in which authorization for the activity of the foreign undertaking was issued and in which it is subject to supervision, and only to the extent necessary under the relevant legislation.

Retention period for personal data:

• data and copies of documents proving the identity of investors for 18 years and clients for 10 years, and documents on the determination of ownership of funds used by investors for 18 years and by clients to execute a transaction, and contracts and other documents on executed transactions for 10 years
• data relating to investors’ and clients’ transactions for at least 10 years
• data and written documents in the exercise of due diligence on an investor and client and in the identification of an unusual transaction for 10 years from the termination of the contractual relationship, and all data and written documents on a transaction for 10 years from the execution of the transaction
• data of investors and clients relating to information on financial accounts for 10 years from the end of the calendar year in which the data on financial accounts were provided

Transfer to a third country or international organization does not take place.

1.3. Financial agents, subordinate financial agents
Purpose: financial intermediation of mutual funds, securities of foreign collective investment undertakings, and other services for IAD
Legal basis: processing of personal data is necessary for the purposes of performance of contracts (financial intermediation and provision of other services agreement, cooperation agreement)
Recipients of personal data (categories of recipients of personal data or third parties to whom personal data may be disclosed):

• depositary of IAD mutual funds, auditor of IAD and IAD mutual funds
• persons entrusted with the exercise of supervision for the purposes of supervision / the National Bank of Slovakia for the purposes of its supervisory activities
• court, including a notary as judicial commissioner, for the purposes of civil proceedings in which an investor or client of IAD is a party or the subject matter of which is the assets of an investor or client of IAD
• law-enforcement authority for the purposes of criminal proceedings
• criminal police service, judicial police service, and financial police service of the Police Force for the purposes of fulfilling tasks established by specific legislation
• tax authority for the purposes of tax proceedings or customs authority in customs matters
• state-administration authority for the purposes of enforcement of a decision under specific legislation
• Slovak Information Service for the purposes of fulfilling tasks established by specific legislation
• managing authority and audit authority in the exercise of control or audit of financial instruments
• competent authority of the Slovak Republic under specific legislation in fulfilment of reporting obligations
• the company ECOMAIL.CZ, s.r.o., Na Zderaze 1275/15, 120 00 Praha 2, Czech Republic, Company ID: 027 62 943, for the purpose of sending information from IAD under the financial intermediation agreement, monitoring the behaviour and responses of financial agents and subordinate financial agents to e-mails sent, notification of statistics, and their evaluation
• the company SENDINBLUE SAS (Brevo) (société par actions simplifiée), 17 rue de Salneuve, 750 17 Paris, France, Company ID: 498 019 298, for the purpose of sending information from IAD under the financial intermediation agreement, monitoring the behaviour and responses of financial agents and subordinate financial agents to e-mails sent, notification of statistics, and their evaluation
• In connection with the distribution of securities of a foreign collective investment undertaking carried out by IAD, personal data may also be disclosed to the following categories of other recipients of personal data or third parties: the foreign collective investment undertaking (which issued the securities of the foreign collective investment undertaking), the foreign management company (managing the foreign collective investment undertaking that issued the securities of the foreign collective investment undertaking), and service providers under specific legislation for the foreign collective investment undertaking that issued the securities of the foreign undertaking (e.g. auditor, central administrator, depositary), supervisory authorities or other financial regulators, state authorities and public authorities (in particular courts and law-enforcement authorities) in the state in which authorization for the activity of the foreign undertaking was issued and in which it is subject to supervision, and only to the extent necessary under the relevant legislation.

Retention period for personal data:

• contracts with financial agents, cooperation agreements – 10 years
• when providing personal data to the company ECOMAIL.CZ, s.r.o., Na Zderaze 1275/15, 120 00 Praha 2, Company ID: 027 62 943, and the company SENDINBLUE SAS (Brevo) (société par actions simplifiée), 17 rue de Salneuve, 750 17 Paris, France, Company ID: 498 019 298, the retention period for personal data is for the duration of the financial intermediation agreement

Transfer to a third country or international organization does not take place.

1.4. IAD employees
Purpose: fulfilment of IAD’s obligations as an employer in connection with employment or a similar relationship (e.g. under agreements on work performed outside an employment relationship), including pre-contractual relationships
Legal basis: processing of personal data is necessary under a specific regulation or an international treaty by which the Slovak Republic is bound (employment contract, Act No. 311/2001 Coll., the Labour Code, as amended; Act No. 552/2003 Coll. on the performance of work in the public interest, as amended; Act No. 580/2004 Coll. on health insurance and on amendments to Act No. 95/2002 Coll. on insurance and on amendments to certain acts, as amended; Act No. 461/2003 Coll. on social insurance, as amended; Act No. 595/2003 Coll. on income tax, as amended; Act No. 43/2004 Coll. on old-age pension savings and on amendments to certain acts, as amended; Act No. 650/2004 Coll. on supplementary pension savings and on amendments to certain acts, as amended; Act No. 5/2004 Coll. on employment services and on amendments to certain acts, as amended; Act No. 462/2003 Coll. on compensation for income during temporary incapacity for work of an employee and on amendments to certain acts, as amended; Act of the National Council of the Slovak Republic No. 152/1994 Coll. on the social fund and on amendments to Act No. 286/1992 Coll. on income taxes, as amended; Act No. 124/2006 Coll. on occupational health and safety and on amendments to certain acts, as amended; Act No. 355/2007 Coll. on the protection, promotion, and development of public health and on amendments to certain acts, as amended; Act No. 570/2005 Coll. on compulsory military service and on amendments to certain acts, as amended; Act No. 54/2019 Coll. on the protection of whistleblowers of anti-social activity and on amendments to certain acts, as amended)
Recipients of personal data (categories of recipients of personal data or third parties to whom personal data may be disclosed):

• the company Pro Partners Holding, a.s., Malý trh 2/A, 811 08 Bratislava, Company ID: 47 257 521
• health insurance companies
• Social Insurance Agency
• tax offices
• Central Office of Labour, Social Affairs and Family
• supplementary pension management companies
• pension management companies
• state-administration and public authorities for the exercise of control and supervision (e.g. labour inspectorate)
• statistical office
• courts
• law-enforcement authorities
• bailiffs
• Office for the Protection of Whistleblowers of Anti-Social Activity (ÚOOPČ)

Retention period for personal data: IAD retains personal data in accordance with applicable legislation and IAD’s records-retention schedule.
Transfer to a third country or international organization does not take place.

1.5. Persons representing a contracting party or persons authorized to act on behalf of a contracting party
Purpose: contractual relationships
Legal basis: processing of personal data is necessary for the purposes of performance of contracts
Recipients of personal data (categories of recipients of personal data or third parties to whom personal data may be disclosed):

• depositary of IAD mutual funds, auditor of IAD and IAD mutual funds
• persons entrusted with the exercise of supervision for the purposes of supervision / the National Bank of Slovakia for the purposes of its supervisory activities
• court, including a notary as judicial commissioner, for the purposes of civil proceedings in which an investor or client of IAD is a party or the subject matter of which is the assets of an investor or client of IAD
• law-enforcement authority for the purposes of criminal proceedings
• criminal police service, judicial police service, and financial police service of the Police Force for the purposes of fulfilling tasks established by specific legislation
• tax authority for the purposes of tax proceedings or customs authority in customs matters
• state-administration authority for the purposes of enforcement of a decision under specific legislation
• Slovak Information Service for the purposes of fulfilling tasks established by specific legislation
• managing authority and audit authority in the exercise of control or audit of financial instruments
• competent authority of the Slovak Republic under specific legislation in fulfilment of reporting obligations
• In connection with the distribution of securities of a foreign collective investment undertaking carried out by IAD, personal data may also be disclosed to the following categories of other recipients of personal data or third parties: the foreign collective investment undertaking (which issued the securities of the foreign collective investment undertaking), the foreign management company (managing the foreign collective investment undertaking that issued the securities of the foreign collective investment undertaking), and service providers under specific legislation for the foreign collective investment undertaking that issued the securities of the foreign undertaking (e.g. auditor, central administrator, depositary), supervisory authorities or other financial regulators, state authorities and public authorities (in particular courts and law-enforcement authorities) in the state in which authorization for the activity of the foreign undertaking was issued and in which it is subject to supervision, and only to the extent necessary under the relevant legislation.

Retention period for personal data: IAD retains personal data in accordance with applicable legislation and IAD’s records-retention schedule, for a period of at least 10 years.
Transfer to a third country or international organization does not take place.

1.6. Visitors to IAD’s website
Purpose: necessary cookies
Legal basis: Section 109(8) of Act No. 452/2021 Coll. on electronic communications, as amended
Recipients of personal data (categories of recipients of personal data or third parties to whom personal data may be disclosed): third parties depending on the requirements of the specific purpose – Google, social networks.
Retention period for personal data: IAD retains personal data for the period stated in the document entitled Use of Cookies, available on IAD’s website at www.iad.sk/cookies.
Transfer to a third country or international organization, where IAD is the recipient of personal data, does not take place; in the case of third-party services, transfer and processing of data may occur in the USA or in other countries outside the European Union; further information on transfer to a third country is set out in the privacy policies of third parties.

2. Processing of personal data on the basis of IAD’s legitimate interests
2.1. Investors, clients, intermediaries, whistleblowers, visitors to IAD’s premises, other data subjects in connection with IAD’s legitimate interests
Purpose: prudent business conduct of IAD, provision of supplementary services to investors, clients, and intermediaries of IAD (IAD ONLINE Access), quality control of services provided (e.g. audio recordings of telephone calls to the client centre, AML officer, Wealth Management department), development and testing of IAD information systems, IAD information security, protection of the safety of employees, investors, and clients of IAD, marketing purposes (in particular marketing information, campaigns, and offers in IAD’s electronic environment for investors or clients), demonstration, assertion, and defence of IAD’s legal claims, prevention and detection of financial crime
Legal basis: on the basis of IAD’s legitimate interests
Recipients of personal data (categories of recipients of personal data or third parties to whom personal data may be disclosed): third parties depending on the requirements of the specific purpose
Retention period for personal data:
IAD determines the retention period for personal data depending on the requirements of the specific purpose, taking into account the protection of the rights of data subjects in accordance with the principle of data minimization.
Transfer to a third country or international organization does not take place.

3. Processing of personal data with the consent of the data subject
3.1. Job applicants at IAD
Purpose: IAD recruitment processes
Legal basis: consent to the processing of personal data
Recipients of personal data (categories of recipients of personal data or third parties to whom personal data may be disclosed): third parties depending on the requirements of the specific purpose
Retention period for personal data: IAD retains personal data for the duration of the purpose of processing personal data and specifies it in the data subject’s consent to the processing of personal data.
Transfer to a third country or international organization does not take place.

3.2. Competition entrants – data subjects who are not investors or clients of IAD, visitors to IAD’s website or IAD’s social networks
Purpose: marketing of financial products provided by IAD (in particular marketing competitions), other marketing competitions of various kinds
Legal basis: consent to the processing of personal data
Recipients of personal data (categories of recipients of personal data or third parties to whom personal data may be disclosed): third parties depending on the requirements of the specific purpose
Retention period for personal data: IAD retains personal data for the duration of the purpose of processing personal data and specifies it in the data subject’s consent to the processing of personal data (it forms part of the competition rules).
Transfer to a third country or international organization does not take place.

3.3. Visitors to IAD’s website
Purpose: marketing cookies and statistical cookies
Legal basis: consent to the processing of personal data within the meaning of Section 109(8) of Act No. 452/2021 Coll. on electronic communications, as amended
Recipients of personal data (categories of recipients of personal data or third parties to whom personal data may be disclosed): third parties depending on the requirements of the specific purpose – Google, social networks.
Retention period for personal data: IAD retains personal data for the period stated in the document entitled Use of Cookies, available on IAD’s website at www.iad.sk/cookies/.
Transfer to a third country or international organization, where IAD is the recipient of personal data, does not take place; in the case of third-party services, transfer and processing of data may occur in the USA or in other countries outside the European Union; further information on transfer to a third country is set out in the privacy policies of third parties.

3.4. Visitors to IAD’s website
Purpose: sending of IAD newsletter
Legal basis: consent to the processing of personal data
Recipients of personal data (categories of recipients of personal data or third parties to whom personal data may be disclosed):
IAD has entrusted the processing of personal data to:

• the company ECOMAIL.CZ, s.r.o., Na Zderaze 1275/15, Nové Město, 120 00 Praha 2, Czech Republic, Company ID: 027 62 943, for the purpose of sending IAD newsletter, monitoring the behaviour and responses of visitors to IAD’s website to e-mails sent, notification of statistics, and their evaluation
• the company SENDINBLUE SAS (Brevo) (société par actions simplifiée), 17 rue de Salneuve, 750 17 Paris, France, Company ID: 498 019 298, for the purpose of sending IAD newsletter, monitoring the behaviour and responses of visitors to IAD’s website to e-mails sent, notification of statistics, and their evaluation

Categories of other recipients of personal data or third parties to whom personal data may be disclosed:
third parties depending on the requirements of the specific purpose
Retention period for personal data: IAD retains personal data for the duration of the purpose of processing personal data, i.e. for the duration of sending IAD newsletter
Transfer to a third country or international organization does not take place.

3.5. IAD employees
Purpose: presentation of IAD and its business activities (publication of other personal data of IAD employees on its website or in marketing materials, on IAD’s social networks, e.g. photograph, education, etc.) or processing of other personal data of IAD employees (events organized by IAD, anniversary or other occasions of the employee)
Legal basis: consent to the processing of personal data
Recipients of personal data (categories of recipients of personal data or third parties to whom personal data may be disclosed): third parties depending on the requirements of the specific purpose
Retention period for personal data: IAD retains personal data for the duration of the purpose of processing personal data and specifies it in the data subject’s consent to the processing of personal data
Transfer to a third country or international organization does not take place.

Data subjects have the following rights in connection with the processing of personal data at IAD:
Right of access to personal data – the right to request confirmation from IAD as to whether personal data concerning the data subject are being processed at IAD, and access to personal data and information on:

• a) the purpose of processing personal data
• b) the category of personal data processed
• c) the identification of the recipient or the category of recipient to whom the personal data have been or are to be disclosed, in particular the recipient in a third country or international organization, if possible
• d) the retention period for personal data; if that is not possible, information on the criteria for determining it
• e) the right to request from the controller rectification of personal data concerning the data subject, their erasure or restriction of their processing, or the right to object to the processing of personal data
• f) the right to lodge a complaint with a supervisory authority – a proposal to initiate proceedings
• g) the source of personal data, if the personal data were not obtained from the data subject
• h) the existence of automated individual decision-making, including profiling.

The information that IAD provides to the data subject on the basis of the right of access to personal data within the meaning of points (a) to (f) above concerning personal data processed is set out by IAD in this Personal Data Protection document. Confirmation as to whether IAD processes the data subject’s personal data and the data subject’s personal data that IAD processes will be provided by IAD to the data subject on the basis of a request.

Right to rectification of personal data – the right to have IAD rectify inaccurate personal data or complete incomplete personal data concerning the data subject.

Right to erasure of personal data – if the personal data are no longer necessary for the purpose for which they were obtained or processed, or consent to their processing has been withdrawn, or the data subject objects to the processing of personal data and there are no overriding legitimate grounds for their processing, or they are being processed unlawfully, or the reason for erasure is fulfilment of obligations under legislation, or the personal data were obtained in connection with the offer of information-society services.

Right to restriction of processing of personal data – if the data subject contests the accuracy of the personal data, or the processing is unlawful and the data subject requests restriction of their use instead of erasure, or IAD no longer needs the personal data but the data subject needs them to assert a legal claim, or the data subject objects to the processing of personal data pending verification of whether the legitimate grounds on IAD’s side override the legitimate grounds of the data subject.
IAD shall inform the data subject before it lifts the above restrictions on the processing of personal data.

Right to data portability – the right to obtain personal data in a structured, commonly used, and machine-readable format and the right to transmit those data to another controller, where technically feasible, and if the personal data are processed on the basis of the data subject’s consent or for the purposes of performance of a contract and if the processing is carried out by automated means. The right must not adversely affect the rights of other persons.

Right to object to the processing of personal data – the data subject shall have the right to object, on grounds relating to their particular situation, at any time to processing of personal data concerning them which is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in IAD, or processing of personal data which is necessary for the purposes of the legitimate interests pursued by IAD or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. Processing of personal data for direct marketing purposes, including profiling, may also be objected to. If the data subject objects to the processing of personal data for direct marketing purposes, IAD shall no longer process the personal data for such purposes.

Automated individual decision-making, including profiling – the data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them, unless it is necessary for entering into, or performance of, a contract between the data subject and IAD, or is authorised by a specific regulation or an international agreement to which the Slovak Republic is bound, and which also lays down suitable measures to safeguard the data subject’s rights and legitimate interests, or is based on the data subject’s explicit consent. IAD does not use automated individual decision-making, including profiling.

Right to lodge a complaint with a supervisory authority – the right to submit a proposal for initiating proceedings with the Office for Personal Data Protection pursuant to Section 100 of the Personal Data Protection Act – if the data subject’s rights have been violated.

Should an investor or client fail to provide IAD with personal data that IAD is obliged to obtain for purposes specified in generally binding legal regulations in the areas of collective investment, securities, protection against money laundering and terrorist financing, automatic exchange of financial account information for tax administration purposes, and which IAD obtains through applications, forms, questionnaires, and other documents, IAD is obliged to refuse to conclude or execute a transaction with the investor and client, or to terminate the business relationship.

Should a contracting party, or persons representing them, fail to provide IAD with personal data that IAD is obliged to obtain for the aforementioned purposes, IAD cannot conclude a contract.

Should an employee fail to provide IAD with personal data that IAD is obliged to obtain for the aforementioned purposes, IAD is obliged to refuse to conclude an employment contract.

This document becomes effective on 18.03.2026.