Nedbank Corporate and Investment Banking London

If you have any questions about this privacy notice for either Nedbank London or N.B.S.A. or our collection or processing of your personal data, or if you wish to exercise your data protection rights including making a complaint, our contact details are below. We are committed to working with you to obtain a fair resolution of any complaint or concerns about privacy.  Please indicate which entity your query relates to so that we can respond more effectively,

Post:

Chief Compliance Officer
Nedbank Limited, London Branch
7^th Floor
12 Arthur Street
London
EC4R 9AB
United Kingdom

Email: londoncompliance@nedbank.co.uk  

The above contact details are also valid for N.B.S.A. Limited.

We may collect personal data about you in the following manner:

• you give us the personal data:
  • when filling in forms that we (or the client on our behalf) asks you to complete;
  • communicating with us in person, or by email, telephone, post or otherwise.
  • our systems collect the personal data about you;
  • the client or your colleagues provide us with the personal data;
  • third parties provide us with the personal data – these would be:
• our service providers, agents and sub-contractors like couriers and other persons we use to offer and provide products and services;
• Nedbank Group members, any connected companies, associates, affiliates or successors in title and/or appointed third parties (like their authorised agents, partners, contractors and suppliers);
• other financial institutions or other credit providers in the course of a transaction relating to the client or its business;
• On payment third party data and screening providers, and other open sources such as the internet, the media, public registers of companies;
• attorneys, tracing agents, debt collectors and other persons that assist with the enforcement of agreements;
• payment processing services providers, merchants, banks and other persons that assist with the processing of payment instructions from the client;
• insurers, brokers, other financial institutions or other organisations that assist with insurance and assurance underwriting, the providing of insurance and assurance policies and products, the assessment of insurance and assurance claims and other related purposes;
• law enforcement and fraud prevention agencies and other persons tasked with the prevention and prosecution of crime;
• regulatory authorities, governmental departments, local and international tax authorities;
• credit bureaux;
• courts of law or tribunals; and
• marketing list providers.

Recording and Monitoring

As a financial institution we are legally required to record all mediums of communications used for business purposes, which means also supplier engagements and prospective client communications.  We treat this type of information as personal data.

The types of communications that we must keep a record of:

• Multiplatform messaging applications: applications that allow to share documents, video, calls or texts.
• Traditional Landlines and/or corporate mobile calls, and texts.
• Corporate emails and respective attachments.
• Traditional hard copy letters and other documents.

With the advancements in technology, you should be aware that any business-related communication channel will be recorded.

We need to record to meet our legal and regulatory obligations that require us to actively monitor our business activity to ensure that poor practices are not being carried out which can result in a determinant to you and wider society.  We have strict controls limiting access to these recordings and protocols to minimise un-necessary intrusion when monitoring.

The personal data detailed here will be kept for a maximum of six years or less in accordance with the lawful basis for processing the personal data and have measure in places to destructive and erase personal data in accordance with our Record Retention Schedule and Destruction Policy.

We may disclose personal data about you for the legitimate purposes, to:

•  Nedbank Group companies, and specifically Nedbank Limited as Nedbank Group are our processors of personal data due to sharing the technology and security infrastructure.
• In the case of any events organised by Nedbank or to which Nedbank invites you, to suppliers of the events such as an event organiser, venue provider, security, printers and caterers.

Also closely aligned with How we collect data from you we also may share information with:

• Insurance companies
• Professional or legal advisors
• Financial and Fraud investigation authorities
• Relevant regulatory authorities
• External auditors or inspectors
• Professional consultants
• Organisations we’re legally obligated to share personal data with
• Emergency services (where necessary)
• Previous employers

Your personal data may be transferred to or in countries outside the United Kingdom, including, for example, the Republic of South Africa. 

These countries may not have data protection laws as strict as those applicable in the United Kingdom. In such cases, we perform an assessment on how your rights may be affected which also requires to identify the technical organisation and security measures in place (i.e., appropriate safeguards) through a data transfer agreement so to have comfort that your personal data will be handled in accordance with UK General Data Protection (UK GDPR) and UK Data Protection Act 2018.  

You may contact us for further information in this regard.

Depending on the data protection laws that are relevant to your situation and residence, you may have certain rights in respect of your personal data. If you are within the scope of UK GDPR, you have the following rights:

• Right to be informed – the right to ask us for information about what personal data of yours is being collected and processed by us, and why it is being collected and processed;
• Right of access – the right obtain access to copies of your personal data;
• Right of rectification – the right to have your personal data corrected if it is inaccurate or incomplete;
• Right to erasure or ‘to be forgotten’ – the right to request that we erase your personal data in certain circumstances, such as when the data is no longer necessary for the purpose, the data was unlawfully processed or there are no longer lawful grounds for us to collect or process the personal data.
• Right to restrict processing – the right to request that we restrict the way we process your personal data. This right might be used when you contest the accuracy of your personal data, our processing is unlawful but you do not want the data erased or when we no longer need the data but you require it to establish, exercise or defend a legal claim;
• Right to object to processing – the right to object to processing of your personal data in circumstances where the processing is (i) based on legitimate interests, the performance of a task in the public interest or the exercise of official authority (including profiling); (ii) direct marketing (including profiling); or (iii) processing for scientific/historic research or statistic;
• Right to data portability – You have the right to ask that we transfer the personal data you gave us to another organisation, or to you, in certain circumstances.
• Right to withdraw consent – When we use consent as our lawful basis you have the right to withdraw your consent.

Please contact us if you wish to exercise any of these rights.

If you have any concerns about our use of your personal data, you can make a complaint to us using the contact details at the beginning of this notice.

If you remain un-satisfied with how we’ve used your data after raising a complaint with us, you can also complain to the ICO.

The ICO address:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Helpline number: 0303 123 1113

Website: https://ico.org.uk/make-a-complaint/