Who is the data controller for the personal data?
The data controller for the personal data is Altamar Private Equity, S.G.I.I.C., S.A.U. (the ‘Management Entity’ or ‘Altamar’).
Grupo Altamar has appointed a Data Protection Officer, who is responsible for overseeing compliance on the subject of data protection, and who can be contacted by email at: email@example.com
What type of personal data does Altamar process and how is it obtained?
As a result of the Investment agreement, Altamar may engage in the processing of identification data for: (i) the Investor; (ii) the Investor’s legal representative(s); (iii) the Investor’s beneficial owners; (iv) the owners that indirectly control the company; (v) members of the Investor’s management team; (vi) family members and minors, if applicable. In addition, as a result of the Investment Commitment, Altamar may engage in processing of socio-economic data; data on reputation, solvency, risk, and fraud; and data on compliance or non-compliance with financial obligations. Here, all this data will be referred to jointly as the ‘Personal Data’.
Altamar obtains the Personal Data using the following means, as applicable: (i) from the commitment letter and suitability test; (ii) from interviews with the Management Entity or from telephone conversations, whether in relation to queries, requests, or contracting of any product, or in relation to any transaction or operation; (iii) from third-party databases maintained for purposes of combatting money laundering and fraud; (iv) from various open-access media; (v) from the records of public entities; and finally (vi) from databases on compliance or non-compliance with financial obligations. All this personal data may be stored in the Management Entity’s computerised file systems.
In order to process the Investor’s request, it is compulsory for all data requested to be provided. The above is understood as without prejudice to the need to provide any other data the Management Entity may ask for in conformity with the legislation applicable at the time when that request is being managed, and refusal to provide that data may make it impossible to manage such requests.
What is the purpose and legal basis for Altamar’s processing of an Investor’s personal data?
- The following types of processing are required in order to carry out the investment agreement:
- The Management Entity must process the Personal Data in order to formalise the investment being made by means of the Commitment Letter.
- Also, depending on the Fund selected, the Management Entity may transfer Personal Data, but only the data necessary, to the third-party depositary entities for the funds contracted. If an Investor would like to know the identity of the depositary entities for the funds, this information can be obtained by contacting the Management Entity.
- Compliance with accounting, legal, tax-related, and administrative obligations.
- Management of queries, suggestions, claims, and complaints.
- The Management Entity may view and process the Investor’s data related to financial solvency and credit history as obtained from entities that provide services on information about financial solvency and credit, and it may also communicate data about the Investor’s situation to such entities when applicable.
- As a result of the various investments performed by the funds managed by the Management Entity, the Management Entity may disclose any identification data. That data may include, among other information, data collected or obtained in compliance with the legislation on prevention of money laundering and financing of terrorism. That personal data may therefore be disclosed to the underlying funds, co-investments, or investments in other types of vehicles; to their depositary entities; and to the various companies that may provide services to them, all for the sole purpose of making it possible to perform or maintain those investments. Disclosure of such data will also take place in compliance with all the guarantees, and in accordance with the principles of proportionality and minimisation for personal data. Those entities may be located within or outside of the European Union, and the Investor will be periodically informed of their identities. In any event, if an Investor would like further details about the information related to such entities, this can be requested from Altamar’s Data Protection Officer.
For the purpose of preventing any fraudulent conduct, the Management Entity may disclose the Investor’s Personal Data to centralised information systems, and also to entities based within the European Union in which Altamar Capital Partners S.L. directly or indirectly holds an ownership interest, with further details available at the following link: https://www.altamarcapital.com/estructura/.
- As a result, by participating in the Investment Agreement the Investor is aware of and accepting the conditions described above.
- Compliance with a legal obligation:
- In circumstances related to advising and portfolio management services, the Management Entity will collect information related to the Investor’s financial situation, including the capacity to support losses.
- Also, as a result of the obligations on prevention of money laundering and financing of terrorism, the Management Entity is required to formally identify the Investor’s actual professional or business activities, or those of other parties requesting products from the Management Entity. The Management Entity will request any documents it considers necessary from the Investor in order to verify the activities being declared.
- For purposes of compliance with measures on prevention of money laundering and financing of terrorism, transfer of the Investor’s Personal Data to the entities based in the European Union in which Altamar Capital Partners S.L. has a direct or indirect ownership interest, with details on those entities being available at the following link: https://www.altamarcapital.com/estructura/.
- Collection and updating of the Investor’s personal data, either using the internal databases maintained by Grupo Altamar or external sources, also for purposes of prevention of money laundering and financing of terrorism.
- Disclosure of the Investor’s Personal Data to government offices and regulatory bodies located within or outside of the European Union, when such transfer is mandatory under the legislation in force, for important reasons of public interest.
- Legitimate Interest:
- The Management Entity may send the Investor information about its funds or other products, both by ordinary means and electronically, and unless the Investor has expressed its opposition to processing of that type.
- For administrative purposes and for coordination of activities related to its company objects involving advising and management for alternative assets, disclosure of the Investor’s Personal Data to entities based within the European Union in which Altamar Capital Partners S.L. has a direct or indirect ownership interest, with details on these entities being available at the following link: https://www.altamarcapital.com/estructura/.
Those types of processing will take place based upon the Management Entity’s legitimate interest, and in no case will this cause any reduction to the Investor’s data protection rights, since the data processed will be solely and exclusively that required for the purposes indicated. In all cases, the Investor will always be able to express opposition to such processing using the means described under How can I exercise my rights on the subject of data protection?
In order to guarantee protection of your personal data in cases where it is transferred to countries outside of the European Union, and where the level of protection has not been recognised by the European Commission, Altamar applies the appropriate guarantees established by the General Data Protection Regulation, such as application of contractual clauses approved by the European Commission. More information on this subject can be obtained by contacting Altamar’s Data Protection Officer at the following email address: firstname.lastname@example.org.
Do we process data on third parties?
The Management Entity may process the personal data of third parties such as: the Investor’s legal representative(s) or beneficial owners, persons having indirect control over the company, members of the management team, family members, and minors. The Investor is declaring that the Personal Data and information it has provided in relation to third parties is accurate and reflects their actual situation; that those third parties have been informed about disclosure of their data; and that their consent has been obtained for disclosure of their personal information during the corresponding process. In cases where the data processed is related to a minor, the Management Entity will only process that information related to a minor with proper authorisation from the legal representative (mother/father/guardian).
Do we transfer your data to third-party entities, or can they gain access to it?
The Management Entity will only disclose your Personal Data to:
• The depositary entities for the funds contracted.
• The management entities for the underlying funds, or to those funds.
• Regulatory bodies and public institutions from Spain’s national, regional, and local governments, or to other authorities that may be located within or outside of the European Economic Area, when provision of data to them is required by law.
• Courts or tribunals.
• Databases on financial solvency or credit risk: these may be either databases that record failures to comply with financial obligations or the Bank of Spain’s Risk Information Centre.
• For the purpose of preventing fraudulent conduct, Personal Data may be sent to the various companies belonging to Grupo Altamar, or to centralised information systems.
Also, the Management Entity has third-party service providers that can access personal data for purposes of providing their services, such as auditors, outside experts, lawyers, consultation services, advisers, IT maintenance firms, financing services, potential buyers or investors, administrative services, and document destruction services, among others. The Management Entity pre-screens these providers based on criteria related to data protection compliance. It has also signed agreements with all of them on this subject, and it monitors their compliance with the resulting obligations.
How long will we store your personal data?
Any personal data to which access is given will be processed for as long as the contractual relationship exists between the Management Entity and the Investor. The Management Entity will also store the personal data after the contractual relationship has ended, but with access appropriately blocked, until the limitation periods have expired for any legal actions that could be derived from the relationship maintained with the data subject. In all cases, the Management Entity will store all information that it is obligated to possess by the legislation on Prevention of Money Laundering and Financing of Terrorism, for a period of 10 years after termination of the business relationship or execution of the transaction.
How can I exercise my rights on the subject of data protection?
In relation to the data provided at any time, the Investor can exercise the rights to access, rectify, and erase for that data, and the right to oppose or restrict processing of that personal data, and oppose being subject to automated individual decisions, by sending a written request to the Management Entity’s Data Protection Officer / Control Department at Paseo de la Castellana, 91, 28046, Madrid, Spain, attaching a copy of the Investor’s national identification number or other official identity document. This can also be done by email, using the address email@example.com.
Where can claims on the subject of data protection be submitted?
If any of the Investor’s data protection rights appear to have been violated, or for any other claim related to personal information, the Investor can write to Grupo Altamar’s Data Protection Officer to request resolution of that claim at: firstname.lastname@example.org. In all cases, the data subjects can submit a claim to the Spanish Data Protection Agency (AEPD), which is Spain’s supervisory authority on the subject of data protection: http://www.agpd.es. C/Jorge Juan número 6, 28001, Madrid, Spain. Tel: 901 100 099/91 266 35 17