The following information gives you an overview of the way in which Xtrackers and Xtrackers II (each a “Company”) and other third parties may process your personal data and your rights under data protection law. The specific types of data processed, and how they are processed, are largely determined by the requested/agreed services in question.
1. Who we are
The Company is a data controller in respect of your personal information that we process in connection with our business. In this Notice, reference to "we", "us" or "our" are references to the Company.
This Notice applies to you and to any third parties whose information you provide to us in connection with our relationship with you. Please ensure that a copy of this Notice is provided to any third parties whose personal data you provide to us. We may update this Notice from time to time and we will notify you in writing of any changes we make.
You, as an investor, remain responsible to inform any of your potential authorised representatives or beneficial owners about the existence and content of this Privacy Notice.
2. The Types of Personal Data that we Process
Due to our contractual relationship with you, or in order to fulfil our legal obligations, we must collect certain personal information from you. If you do not provide this personal data to us, we may not be able to process your investor application or otherwise maintain a business relationship with you or provide you with our services.
We process some or all of the following types of personal data:
Name, address/other contact details (telephone, email address), date/place of birth, gender, nationality, language, marital status, legal capacity, professional group key/type of partnership (employed/self-employed), identification data (e.g. ID card data), authentication data (e.g. specimen signature), tax ID and information, FATCA status, current occupation or previous occupation if relevant and financial status (assets, liabilities, income from employment/self-employment/trade or business, expenses).
3. Why do we process your data (purpose of processing) and on what legal basis?
Your personal data will be processed to process, manage and administer your holding(s) and any related accounts, on an ongoing basis. This includes the assessment of your application, the management of your investment, maintaining the register of investors, and the provision of associated services to you (such as account statements or other communications relevant to your application or investment), directly or through the use of service providers.
We process your personal data for the purposes above to the extent necessary to perform our contractual obligations to you.
In addition, we are subject to various Luxembourg and international legal and regulatory obligations or statutory requirements (e.g. Luxembourg company law, UCITS Law, laws and regulations relating to anti-money laundering, tax laws) as well as supervisory requirements (e.g. of the Luxembourg Commission de Surveillance du Secteur Financier). We will process your personal data to the extent necessary to comply with our legal and regulatory obligations, including identity verification, prevention of fraud and money laundering, prevention and detection of crime and compliance with monitoring and reporting duties required by tax law such as reporting to the tax authorities under Foreign Account Tax Compliance Act (FATCA), the Common Reporting Standard (CRS) or any other tax identification legislation to prevent tax evasion and fraud as applicable.
We may be obliged to collect and report any relevant information in relation to you and your investments (including but not limited to name and address, date of birth and U.S. tax identification number (TIN), account number, balance on account) to the Luxembourg tax authorities (Administration des contributions directes) which will exchange this information (including personal data, financial and tax data) on an automatic basis with the competent authorities in the United States or other permitted jurisdictions (including the U.S. Internal Revenue Service (IRS) or other US competent authority and foreign tax authorities located outside the European Economic Area) only for the purposes provided for in FATCA and CRS at OECD and European levels or equivalent Luxembourg legislation.
It is mandatory that you answer questions and requests with respect to your identification and investment and, as applicable, FATCA and/or CRS. We reserve the right to reject any application for investment if you do not provide the requested information and/or documentation and/or if you do not comply with the applicable requirements. You acknowledge that failure to provide relevant information may result in incorrect or double reporting, prevent you from acquiring or maintaining your investment and may be reported by us to the relevant Luxembourg authorities.
We may also ask for your specific consent to the processing of your personal data for other specific purposes (e.g. to provide marketing or more general information about our services to you). You will have the right to withdraw such consent at any time.
We may also process your personal data in furtherance of our legitimate business interests, which include:
- Assertion of legal entitlements and defence in the event of legal disputes;
- Ensuring IT security and IT operations of the Company;
- Prevention of criminal acts;
- Measures for business control and the further development of products;
- Risk management.
In assessing our legitimate interests listed above, we consider that the processing of your personal data in furtherance of these objectives does not prejudice your interests, fundamental rights or freedoms as a data subject. If you wish to obtain additional information in relation to this, please get in contact with us ('Questions and Concerns').
Where processing is based on the furtherance of our legitimate interest, you have the right to object to this processing of your personal data.
4. Disclosure of your information
Your personal data will be disclosed to, and processed by, State Street Bank International GmbH, Luxembourg Branch which will be the administrator of your investment(s) for the purposes of this Notice, and is acting as depositary, administrative agent, paying agent, domiciliary agent as well as registrar and transfer agent for the Company.
To the extent necessary to perform our services and fulfil our contractual obligations to you and/or our legal or regulatory obligations, we will disclose your personal data to:
- DWS Investment S.A., Luxembourg, acting in its capacity as the management company of the Company or any of its duly authorised agents or any of its affiliates and their duly authorised agents;
- State Street Bank International GmbH, Luxembourg Branch acting in its capacity as depositary or any of its duly authorised agents;
- DWS International GmbH, acting in its capacity as investment manager, or any of its duly authorised agents;
- DWS Investments UK Limited , acting in its capacity as distributor, investment manager and/or sub-portfolio manager, or any of its duly authorised agents;
- Harvest Global Investments Limited, acting in its capacity as investment manager, or any of its duly authorised agents;
- International Financial Data Services (Canada), in its capacity as provider of information technology applications;
- Syntel Services Privacy Limited, which will assist with operations, including account set-up;
- Victor Buck Services S.A., as issuer of contract notes, monthly statements and other update information;
- DST Financial Services International Limited, in its capacity as provider of information technology applications;
- State Street Bank and Trust, which will assist with client account opening;
- Other credit and financial services institutions, comparable institutions and order processors, to which we transfer personal data for the purpose of managing and administering the Company and managing our investment relationship with you;
- The Luxembourg Commission de Surveillance du Secteur Financier and any other public or regulatory entities or institutions which we are required to disclose your data to pursuant to a legal requirement; and
- Other third parties including professional, legal or financial advisors, auditors and/or technology providers.
We take all reasonable steps to ensure the safety and integrity of your personal information and may, as appropriate, enter into contracts with such third parties to protect the privacy and integrity of any personal data supplied to us.
5. Keeping your information secure
We take all reasonable steps to ensure the safety, privacy and integrity of your personal data. We ensure that we have appropriate technical, organisational and security measures, appropriate to the sensitivity of your information to ensure it is secure.
6. Transfers outside the European Economic Area
We will transfer your personal data to countries outside the European Economic Area if this is necessary for the performance of our contractual obligations to you, or to the extent that this is required by law. Transfers to countries outside the European Economic Area will, to the extent required, be made to Australia, Canada, Japan, Hong Kong, India, Singapore, Thailand and the United States.
For any transfers of your personal data outside the European Economic Area, we will ensure that appropriate safeguards are in place, which might include one or more of the following:
- The country which we are transferring the personal data to may be approved by the European Commission as offering an adequate level of data protection;
- The recipient of the data may have signed 'standard contractual clauses' approved by the European Commission, obliging them to protect the personal data;
- If the recipient is located in the United States, it might be a certified member of the EU-US Privacy Shield (or such equivalent scheme approved by the appropriate regulatory bodies from time to time).
We may also transfer your personal data to countries outside the European Economic Area where we have obtained your consent to do so. You will be entitled to withdraw such consent at any time.
You can obtain more information about data transfers, appropriate safeguards and standard contractual clauses by contacting us ('Questions and Concerns').
7. How long is my data stored for?
Personal Data will be retained by Company and/or its processors until investors cease to hold shares and a subsequent period of 10 years thereafter to the extent necessary to comply with laws and regulations applicable to them or to establish, exercise or defend actual or potential legal claims, subject to the applicable statutes of limitation, unless a longer period is required by laws and regulations applicable to them. In any case, your personal data will not be retained for longer than necessary with regard to the purposes and legal and regulatory obligations or statutory requirements contemplated hereunder (or any other information notice provided by the Company from time to time), subject always to applicable legal minimum retention periods. If you have any questions, please contact us ('Questions and Concerns').
8. What data protection rights do I have?
Under certain circumstances, by law you have the right to:
Request access to your personal information (commonly known as a "data subject access request"). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it;
Request correction of the personal information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected;
Request erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing (see below);
Object to processing of your personal information where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your personal information for direct marketing purposes;
Request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it;
Request the transfer of your personal information to another party.
If you want to review, verify, correct or request erasure of your personal information, object to the processing of your personal data, or request that we transfer a copy of your personal information to another party, please contact us in writing ('Questions and Concerns').
9. Questions and Concerns
There is no need to take any action as a result of receiving this letter. If you have any questions or concerns about how we handle your personal data, further information can be obtained from State Street Bank International GmbH, Luxembourg Branch (49, Avenue J.F. Kennedy, L-1855 Luxembourg, Grand Duchy of Luxembourg), acting in its capacity as administrator and transfer agent of the Company (ssbquerydesk@statestreet.com).
If you are unhappy with how we are handling your personal data, or how we respond to a query/complaint about the processing of your personal data, you have the right to make a complaint to the relevant data protection supervisory authority.