Your Bank over time - BPS (SUISSE)

Personal Data Protection Policy – BPS (SUISSE) MONACO

Last updated : 11/05/2026

1. Preamble
Banca Popolare di Sondrio (Suisse) SA, Monaco Branch (hereinafter "BPS (SUISSE) MONACO" or the "Institution") attaches particular importance to the protection of personal data and is committed to ensuring its confidentiality, integrity and security, in accordance with Monegasque Law No. 1.565 of 3 December 2024 on the protection of personal data and its implementing texts.

This policy aims to provide clear and transparent information to all data subjects – existing and prospective clients, employees, applicants, subcontractors, external service providers, visitors and partners – on how their personal data is collected, processed, stored and protected in the context of the Institution's banking activities.

The Institution provides information on multiple levels. Specific information notices are given for certain interactions (e.g. account opening, online forms, recruitment, video surveillance, professional messaging).

2. Definitions
Personal data
Any information that directly or indirectly identifies a natural person (such as name, account number, address, bank details, etc.).

Processing of personal data
Any operation or set of operations performed on personal data, regardless of the method used (collection, recording, organisation, storage, adaptation, alteration, extraction, consultation, use, disclosure by transmission or dissemination, matching, restriction, erasure or destruction, etc.).

Data Controller
BPS (SUISSE) MONACO, who determines the purposes and means of processing the personal data of its clients and contacts.

Data Subject
Any natural person whose data is collected or processed by BPS (SUISSE) MONACO (existing and prospective clients, job applicants, etc.).

Processor
Any natural or legal person who processes personal data on behalf of BPS (SUISSE) MONACO and on its express instruction.

Recipient
Any natural or legal person authorised to receive personal data processed by BPS (SUISSE) MONACO (including regulatory authorities and authorised technical service providers).

3. Security and confidentiality
BPS (SUISSE) MONACO attaches great importance to the security and confidentiality of your personal data. Because of this, the Bank implements appropriate technical and organisational measures to protect your data against any loss, alteration, disclosure, misuse or unauthorised access.

These measures include, in particular:

The use of physical and IT security mechanisms (such as firewalls, antivirus software and password-protected access checks)
Restricting access to personal data to only those employees and service providers who require it to perform their duties?and assignments
Regular staff awareness and training on data protection
Contractual confidentiality obligations imposed on all employees and service providers (confidentiality disclaimer)
The securing of premises where data is processed
Regular backups to prevent accidental loss.

4. Personal data processing activities
As part of its banking, regulatory and operational activities, BPS (SUISSE) MONACO carries out a number of personal data processing activities.
Each processing activity corresponds to a specific use of the data (such as account management, regulatory compliance, security or human resources management) and is subject to specific information notices.

In accordance with Law No. 1.565 of 3 December 2024, for each processing activity, the following notices specify the purposes pursued, the categories of data concerned, the data subjects, the applicable retention periods and the recipients of the data.

4.1 Banking relationship management
Purpose
Opening, managing and monitoring accounts, loans, financial instruments, online banking services (GO-Banking) and the execution of banking transactions.

Categories of data processed

Identification data: surname, first name, sex, date and place of birth, nationality, account number, signature, copies of identity documents, residence permit where applicable, residency status.
Contact details: postal addresses (private and professional), tax addresses, email addresses, telephone numbers.
Family and asset-related data: family situation, beneficiaries, beneficial owners, ownership structures, declared asset information, movable and immovable assets held.
Professional data: occupation, employer, status (employee, manager, self-employed, company).
Economic, financial and tax data: income, assets, tax residence, tax identifiers.
Banking data: accounts, IBANs, subscribed products and services, payment instruments, bank cards.
Transactional data: orders, transfers, payments, transaction histories.

Data subjects
Clients, authorised representatives, legal representatives, beneficial owners, administrators, company directors and managers, cardholders.

Retention period
Data is retained for the period necessary to achieve the purposes of the processing, then archived where applicable in accordance with legal, regulatory, tax, accounting and prudential obligations, as well as applicable limitation periods.

Recipients
Authorised employees, technical service providers, competent authorities.

4.2 Regulatory obligations (AML/CFT, CRS, FATCA)
Purpose
Compliance with legal obligations relating to anti-money laundering, counter-terrorist financing, anti-corruption, and international tax reporting requirements.

Categories of data processed

Identity data
Residency status and residence permit, where applicable
Tax addresses
Tax identifiers
Beneficial owners, ownership structures, directors and representatives
Transactional data and supporting documentation
Asset-related and structural information required for checks
Information resulting from compliance checks

Data subjects
Clients, authorised representatives, legal representatives, beneficial owners, administrators, company directors and managers, cardholders, beneficiaries.

Recipients
Local and head-office compliance teams, specialised service providers, competent authorities.

4.3 Security (video surveillance, access checks, IT security)
Purpose
Protection of individuals, property, premises and information systems.

Categories of data processed

Images from video-surveillance cameras
Time-stamped information
IT identifiers, connection logs, IP addresses

Data subjects
Employees, visitors, clients, service providers.

Recipients
Authorised personnel, security service providers, authorities in the event of an incident.

4.4 Communication and telephony
Purpose
Management of professional communications, service-quality monitoring and evidence of communications.

Categories of data processed

Email addresses and correspondence
Telephone numbers
Voice recordings where required
Technical communication data (date, time, numbers, email addresses, duration, technical identifiers)

Data subjects
Existing and prospective clients, employees, and any person sending or receiving emails.

Recipients
Authorised employees and, where applicable, competent authorities.

4.5 Human Resources
Purpose
Recruitment, administrative management of staff, payroll, access rights, training, career management and offboarding.

Categories of data processed

Identification and contact details
CV, certificates, employment history, criminal record certificate
Contractual data (position, working hours, remuneration)
Management data (leave, absences, appraisals, access rights)
Social and tax data

Data subjects
Employees, candidates.

Recipients
Local and head-office HR teams, management, social-security and IT service providers, and competent authorities where applicable.

4.6 Archiving (paper and electronic documentation)
Purpose
Retention of documents for legal, evidential and auditing purposes.

Categories of data processed
Client files, HR files, tax, accounting and legal documents.

Data subjects
All persons affected by the processing operations.

Recipients
Authorised departments, archiving service providers, competent authorities where applicable.

4.7 Complaints, litigation and whistleblowing
Purpose
Management of complaints, disputes, defence of rights and professional whistleblowing mechanisms.

Categories of data processed

Identity of the parties
Correspondence and documents
Contractual data and factual elements

Data subjects
Clients, employees, whistleblowers.

Recipients
Legal teams, management, competent authorities where applicable.

4.8 Data protection (rights and breaches)
Purpose
Managing requests to exercise rights and managing personal data breaches

Categories of data processed

Identity of the applicants
Requests, exchanges, decisions
Data relating to incidents and breaches

Data subjects
Data subjects affected by the processing operations.

Recipients
Data Protection Officer (DPO), relevant internal departments, APDP where applicable.

5. Origin of the data
The personal data processed by the Institution may come from:

The information you provide directly when opening an account, subscribing to a product or service, or in the context of your interactions with the Bank
Authorised third parties involved in the banking relationship (such as external managers, representatives or contractual partners)
Legitimate external sources, such as public registers, commercial registers, legally accessible databases, sanctions lists, competent authorities, as well as service providers specialised in the verification, analysis and monitoring of business relationships (notably in relation to client screening, anti-money-laundering, counter-terrorist-financing, anti-corruption, fraud and reputation checks)

In this context, certain searches or checks may generate technical traces (logs) on the part of these bodies or service providers, in accordance with applicable legal obligations.

The Institution undertakes to process this data in compliance with the principle of minimisation and to inform the data subjects of any specific collection in accordance with the applicable regulations.

6. Retention principle
Personal data is retained by BPS (SUISSE) MONACO for a period not exceeding that strictly necessary for fulfilling the purposes for which it is processed, in accordance with the requirements of Law No. 1.565 of 3 December 2024 and with legal, regulatory, prudential, accounting, tax and anti-money-laundering and counter-terrorist-financing obligations.

The applicable retention periods are determined in particular according to:

The nature of the processing and the data concerned
The existence of a contractual relationship or a business relationship
The applicable legal or regulatory obligations
Limitation periods and evidential requirements

Certain data may be subject to intermediate archiving when its retention is necessary to meet legal or regulatory obligations, or for the defence of the Institution's rights and interests, before its final deletion or anonymisation.

More detailed information on the retention periods applicable to certain processing operations may be provided in specific information notices or at the request of the Data Protection Officer.

7. Legal bases for processing
Depending on the nature of the processing carried out, the collection and use of your personal data by BPS (SUISSE) MONACO has one or more of the following legal bases:

The performance of a contract or pre-contractual measures taken at your request (for example, when opening an account or providing a banking service)
Compliance with a legal obligation which the Bank is subject to (such as obligations relating to anti-money-laundering, counter-terrorist-financing or tax regulations)
The legitimate interest of BPS (SUISSE) MONACO, in particular to ensure the security of individuals, premises and its systems, to guarantee efficient management and to improve the quality of the services offered, while respecting your rights and interests
Your express consent where required for certain specific processing operations (for example, for direct marketing activities or the use of sensitive data).

8. Recipients and data transfers
The personal data processed by BPS (SUISSE) MONACO is accessible only to:

Authorised Bank staff
Service providers (in particular IT, secure hosting, technical platforms, support)
Sub-contractors and partners acting on behalf of the Bank under contracts that govern their activities
Public authorities or competent institutions where required by law or regulation
The Group, where it is necessary to ensure the performance of a service or as part of its AML/CFT-C due-diligence measures

As part of its due-diligence and regulatory compliance obligations (notably in the areas of anti-money-laundering, counter-terrorist-financing, anti-corruption, international sanctions and client due diligence), the Institution may be required to disclose certain personal data to specialised service providers (e.g. client information research).

Some of these service providers may be located outside Monaco or the European Union. In such cases, the Institution implements all appropriate safeguards required by the applicable regulations to ensure an adequate level of protection for personal data, in particular through the use of standard contractual clauses or equivalent mechanisms.

9. Your rights
In accordance with Monegasque regulations on the protection of personal data, you have the following rights:

Right of access: to obtain confirmation as to whether or not your personal data is being processed by BPS (SUISSE) MONACO and, where applicable, to access it and obtain a copy within the limits provided for by the regulations.
Right to rectification: to have inaccurate or incomplete personal data concerning you corrected.
Right to object: to object, on grounds relating to your particular situation, to the processing of your personal data under the conditions provided for by the regulations.
Right to restriction of processing: to request the temporary restriction of the processing of your personal data where provided for by law.
Right to portability: to receive the personal data you have provided in a standard and easily usable format, or to request that it be transmitted directly to another institution where technically possible and legally applicable.
Right to deletion ("right to be forgotten"): to obtain the deletion of your personal data within the limits provided for by legislation, except where there are legal retention obligations or legitimate grounds justifying its retention.

To exercise any of these rights, you are free to contact the Data Protection Officer (DPO) by email at dataprotection@bps-suisse.mc or by post at the following address: [BPS (SUISSE) MONACO, 3, rue Princesse Florestine B.P. 416, MC - 98011 Monaco Cedex]. Proof of identity may be requested to ensure the confidentiality of your information.

If, after contacting us, you consider that your rights are not being respected, you may refer the matter to the Monegasque Personal Data Protection Authority (APDP) to lodge a complaint.

10. Cookies and trackers
When you browse our website, cookies that are strictly necessary for the operation of the site may be placed on your device.
These cookies make it possible, in particular, to manage your session, display information banners and ensure the proper functioning of the site's features.

The cookies used by BPS (SUISSE) MONACO are exclusively technical cookies (such as session cookies or consent-management cookies) and are not used for advertising purposes or to track your browsing for profiling purposes.

You can configure your browser to block or delete these cookies. However, refusing certain technical cookies may result in a deterioration of the site's functioning.

For more information, please see our Cookies Policy below.

11. Changes and updates
This personal data protection policy may be amended at any time to take into account legal, regulatory or organisational developments in the field of personal data protection. We invite you to consult this page regularly to take note of any updates or changes made to this policy.

12. DPO contact/complaints
If you have any questions relating to this personal data protection policy or to the processing of your personal data, or if you wish to exercise your rights or lodge a complaint, please contact our Data Protection Officer (DPO):

By email: dataprotection@bps-suisse.mc
By post: BPS (SUISSE) MONACO, 3, rue Princesse Florestine B.P. 416, MC - 98011 Monaco Cedex.

In the event of the DPO's absence or unavailability, a deputy DPO is appointed to ensure continuity in handling requests and communications with data subjects and with the Personal Data Protection Authority (APDP).