Version 1. Last updated 24 March 2022.

Please read this Privacy Notice carefully to understand our practices with respect to your Personal Data.

References to “Data Controller”, “Data Subject”, “Personal Data”, “Process”, “Processed”, “Processing”, “Data Protection Officer” and “Data Processor” in this Privacy Notice have the meanings set out in, and will be interpreted in accordance with the Applicable Laws. “Applicable Laws” shall mean the relevant data protection and privacy laws, including but not limited to, the General Data Protection Regulation (EU) 2016/679, and the Data Protection Act, Chapter 586 of the Laws of Malta and subsidiary legislation thereto, as may be amended from time to time.

  1. Data Controller Details

The Data Controller of your Personal Data is IZI Finance P.L.C., a company registered in Malta, bearing company registration number C 101228 and having its registered address at Portomaso Business Tower, Level 11, St Julians, STJ 4011, Malta (“We”, “Us”, “Our” or the “Company”).

We are committed to respecting your privacy. If you wish to contact Us about Our privacy practices please feel free to do so by post at the above-registered address or by email at [email protected].

  1. Updates

We may update this Privacy Notice at Our sole discretion including as result of a change in any Applicable Law or processing activities. Any such changes will be communicated to you prior to the commencement of the relevant processing activity.

  1. Personal Data

The term “Personal Data” refers to all personally identifiable information about you and includes all the information you provide to Us or information that is provided to us by third parties, such as parents and guardians, which can be identified with you personally.

 

The following are the Personal Data that We collect:

  • identification data (e.g., name, personal identification code, date of birth, place of birth, nationality, information about and copy of identification document, results of face/ID recognition, voice, picture, video, signature, address);
  • contact data (e.g., address, phone number, e-mail address, language of communication);
  • bank data (e.g., bank ID, account holder, account number, transaction information from your bank account);
  • professional data (e.g., current and former employer and position);
  • financial data (e.g., salary, income, assets, liabilities, properties, tax data);
  • data concerning origin of assets (e.g., data concerning employer, transaction partners, business activities and actual beneficiaries, data showing the source of your income and wealth);
  • data concerning creditworthiness/trustworthiness (e.g., data concerning payment behaviour, damages caused to the Company or other persons, data that enables the Company to perform the due diligence measures regarding money laundering and terrorist financing prevention and to ensure the compliance with international sanctions);
  • data obtained when performing an obligation arising from the law (e.g., information received from enquiries submitted by investigative bodies, notaries, tax authorities, courts, and bailiffs);
  • communications data (e.g., e-mails, phone call recordings); and/or
  • data related to the products and services of the Company (e.g., the performance of the Contract or the failure thereof, transactions history, submitted applications, requests, and complaints).

 

  1. Purposes of Processing

We are Data Controllers of your Personal Data and shall Process your Personal Data for the following purposes, where applicable:

  • In relation to your investment in the 4.25% unsecured bonds 2029 having ISIN number MT002631209 on admission to trading (a “Bondholder”), which Processing includes the following:
  • The document which you fill in as an investor with your personal details, including bank account details, in order to subscribe for the bonds allocated to you, and then to receive interest thereon, whether such subscription takes place on the primary or secondary market;
  • To have your Personal Data recorded on the electronic register of Bondholders maintained by the Central Securities Depository (the “CSD”) at the Malta Stock Exchange (the “MSE”) on Our behalf. The electronic register will contain your name, addresses, identity card number, registration number and MSE account number, as well particulars of the securities held by you. You have, at all reasonable times during business hours, access to the electronic register held at the CSD for the purpose of inspecting information held on your account. Please contact the MSE for this purpose;
  • We may receive a copy of the register of Bondholders maintained by the CSD on demand;
  • We may access the back-end of the MSE website to access a list of all trades which would have taken place during a specific time frame;
  • We may receive copies of the interest warrants which are sent to you on a yearly basis, which warrants contain details relating to the yearly interest paid by the Company to you with respect to your investment in the Company, together with your name, address, identity card number, registration number and MSE account number.

 

  • Other processing may include:
  • to manage Our relationship with you as a Bondholder;
  • for the detection and prevention of fraud and other criminal activity which We are legally bound to report;
  • for the allocation of bonds to you, and then to receive interest thereon;
  • personal data that We may process as a result of legal obligations imposed on Us;
  • your bank account details and other financial information;
  • meetings that we may call/hold on an annual or other basis, and Our communications with you as a Bondholder and performance details;
  • as part of Our internal due diligence;
  • Personal Data lawfully generated by Us in the course of executing your instructions;
  • Personal Data which you may voluntarily provide to Us;
  • for purposes of a legitimate interest pursued by Us or by a third party, provided that such interest is not overridden by your interests, fundamental rights and freedoms; and
  • the purposes you would have requested when providing your Personal Data to Us.

Irrespective of the manner that We have collected your Personal Data, We will only Process such data for the purposes indicated in this Privacy Notice or other purposes which are inherently related thereto, including the fulfilment of any legal or regulatory obligation imposed on Us.

Generally, you would have provided your Personal Data to Us for the purposes indicated in this Notice; however, in some instances, We may collect Personal Data about you from third party sources, such as authorised financial intermediaries through whom you may have subscribed for bonds in the Company. Third parties such as Our clients and business partners, may also have provided your Personal Data to Us.

 

  1. Legal Basis

The legal bases of processing your Personal Data are the following:

  • For the performance of our agreement with you as a Bondholder as indicated in this Notice, as a result of your investment in the Company;
  • Our legitimate interests – in particular legitimate interests which may arise directly or indirectly in relation to your instructions and in keeping you updated with information in relation to the Company. We also have a legitimate interest to Process your Personal Data for safety and security. When we process your Personal Data on the basis of Our legitimate interests, we ensure that the legitimate interests pursued by Us are not overridden by your interests, rights and freedoms; and
  • Compliance with legal obligations imposed on Us – in particular as a result of money-laundering, tax, crime detection, and reporting, and other obligations imposed upon us in terms of any applicable law.

On the basis of Our legitimate interests or compliance with legal obligations, as applicable, We may also process your Personal Data for the purposes of establishing, exercising or defending legal proceedings.

 

  1. Recipients

We may share your Personal Data with third party recipients who are:

  • selected individuals within Our Company, on a need-to-know basis;
  • our affiliates;
  • Other companies forming part of the same group of companies which we form part of;
  • any service providers that may have access to your Personal Data in rendering Us with their support services, including the security trustee, IT, audit, legal, tax, registered office, company secretarial and accounting service providers;
  • third parties to whom disclosure may be required as a result of your investment in the Company;
  • any business partners to whom you may have requested that We transfer your Personal Data;
  • the MSE and the Malta Business Registry;
  • third parties to whom disclosure may be required as a result of legal obligations imposed on Us;
  • your beneficiaries, intermediaries, correspondent and agent banks; and/or
  • as the case may be, appointed Authorised Financial Intermediaries, Administrators, Portfolio Managers, Depositaries, Compliance Officer, Money Laundering Reporting Officer, Prime Brokers and/or Investment Managers respectively (insofar as they may be appointed from time to time), for the collection, storage and processing of Personal Data relating to prospective investors.

 

Individuals with access to your Personal Data shall be subject to the same limitations under this Privacy Notice.

Unless specifically instructed and consented by you or unless We are obliged to do so by law, We do not share your Personal Data with any entity located outside of the EU or EEA.

 

  1. Automated Decision-Making and Profiling

Your Personal Data will not be used for any decision solely taken on the basis of automated decision-making processes, including profiling, without human intervention. We will not be carrying out any profiling of Data Subjects.

In the steps leading up to your investment and during our relationship with you, We may collect information from you in order to, amongst others, comply with Our obligations and/or for any other purpose connected with Our agreement and/or the performance of Our obligations at law. As stated, no automated-decision will result from Our use of such systems.

 

  1. Data Retention Period

We will retain your Personal Data for the duration of your investment in the Company in accordance with Our internal retention policies and any regulations imposed on Us. Thereafter, your Personal Data shall be immediately and irrevocably destroyed, unless We have a statutory obligation imposed on Us, a business need to retain the Personal Data, and/or require the Personal Data to exercise or defend legal claims.

 

Any Personal Data which We may hold on the basis of your consent shall be retained exclusively until you withdraw your consent.

 

  1. Your Rights

For as long as We retain your Personal Data, you have certain rights in relation to your Personal Data including:

 

  • Right of access – you have the right to ascertain the Personal Data We hold about you and to receive a copy of such Personal Data;
  • Right to complain – you have the right to lodge a complaint regarding the processing of your Personal Data with the supervisory authority for data protection matters. In Malta this is the Information and Data Protection Commissioner (contact details provided below);
  • Right to Erasure – in certain circumstances you may request that We delete the Personal Data that we hold about you;
  • Right to Object – you have a right to object and request that We cease the processing of your Personal Data where We rely on Our, or a third party’s legitimate interest for processing your Personal Data;
  • Right to Portability – you may request that We provide you with certain Personal Data which you have provided to Us in a structured, commonly used and machine-readable format (except where such Personal Data is provided to us in hand-written format, in which case such Personal Data will be provided to you, upon your request, in such hand-written form). Where technically feasible, you may also request that we transmit such Personal Data to a third party controller indicated by you;
  • Right to Rectification – you have the right to update or correct any inaccurate Personal Data which We hold about you;
  • Right to Restriction – you have the right to request that We stop using your Personal Data in certain circumstances, including if you believe that We are unlawfully processing your Personal Data or the Personal Data that We hold about you is inaccurate;
  • Right to withdraw your consent – where Our processing is based on your consent. Withdrawal of your consent shall not affect the lawfulness of the processing based on your consent prior to the withdrawal of your consent; and,
  • Right to be informed of the source – where the Personal Data We hold about you was not provided to Us directly by you, you may also have the right to be informed of the source from which your Personal Data originates.

 

Please note that your rights in relation to your Personal Data are not absolute and we may not be able to entertain such a request if we are prevented from doing so in term of an applicable law.

You may exercise the rights indicated in this section by contacting Us at the details indicated above.

 

  1. Complaints

If you have any complaints regarding our Processing of your Personal Data, please note that you may contact Us at the details indicated above. You also have a right to lodge a complaint with the Office of the Information and Data Protection Commissioner in Malta (www.idpc.gov.mt).

 

  1. Where Your Provide Us with Personal Data Related to Third-Party Data Subjects

If you are a non-natural person and you supply to Us Personal Data of third party Data Subjects such as your employees, affiliates, service providers, underlying clients/customers, directors or any other individuals connected to your business, you shall be solely responsible to ensure that:

 

  • you immediately bring this Privacy Notice to the attention of such Data Subjects and direct them to it;
  • the collection, transfer, provision and any Processing of such Personal Data by You fully complies any applicable laws;
  • as Data Controller You remain fully liable towards such Data Subjects and shall adhere to the Applicable Law;
  • you collect any information notices, approval, consents or other requirements that may be required from such Data Subject before providing Us with their Personal Data;
  • you remain responsible for making sure the information you give us is accurate and up to date, and you must tell us if anything changes as soon as possible.

 

You hereby fully indemnify Us and shall render Us completely harmless on first written demand against all costs, damages or liability of whatsoever nature resulting from any claims or litigation (instituted or threatened) against Us as a result of your provision of said Personal Data to Us.