Our Privacy Policy

1. Important information about us and this policy


Verðbréfamiðstöð Íslands hf., ID No. 451015-2140 (also “VBM” or “we”) is committed to the accuracy, security and confidentiality of personal data. VBM is the data controller for the processing of personal data carried out by the company. This Privacy Policy explains how we process personal data, including personal data relating to individuals registered in VBM’s customer system, individuals who contact us, individuals acting as contacts on behalf of legal entities that do business with us, and other contacts (collectively referred to as “customers” or “you”), as well as informing you of your privacy rights.


All processing of personal data by VBM is carried out in accordance with the data protection laws in force at any given time, including Act No. 90/2018 on Data Protection and the Processing of Personal Data, as well as Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (the General Data Protection Regulation).


If you have any questions about this Privacy Policy or VBM’s processing of personal data, please feel free to contact us, for example by email at vbm@vbm.is.


2. What personal data does VBM process?


VBM is licensed as a central securities depository in accordance with the provisions of the Act on Central Securities Depositories, Settlement and Electronic Registration of Title to Financial Instruments. This primarily involves the electronic registration of securities: we handle the electronic issuance and registration of securities and record ownership of them.


We collect, use, store and transfer various types of information about our customers in connection with our business. Personal information means any information relating to an identified or identifiable individual. An individual is identifiable if they can be identified, directly or indirectly.


The personal data collected about you depends on our relationship with you—for example, whether you are a client in your own right or act on behalf of a legal entity. In all cases, we ensure that personal data is adequate, relevant and limited to what is necessary for the purposes for which it is processed.


The following are examples of personal data we process about individuals registered in VBM’s customer system:

 

  • Contact details, such as name, address, registered domicile, phone number and email address;
  • national ID number;
  • communication history, including other information disclosed in communications;
  • account details;
  • information about an individual's securities holdings;
  • other personal information that an individual provides to us.

 

The following are examples of personal information we process about individuals who represent legal entities in their dealings with us:

  • Contact details, such as name, phone number and email address;
  • Communication history, including other information arising from communications.


The following are examples of personal information we process about individuals who contact us:

  • Contact details, such as name, phone number and email address;
  • Communications history, including other information provided in communications. This may also include information relating to job applications.


The above is not an exhaustive list of the personal data we may process about individuals. This may include, for example, other information that individuals provide to us themselves.


3. How and for what purposes does VBM process personal data?


All access to information at VBM is access-controlled and logged. We process personal data to provide services to account operators that have an agreement with VBM; to supervisory authorities, as required; to account holders, once a year as required by law; and, in certain cases, in response to requests from securities owners.


Specifically, we collect information about you in the following ways:

  • Information provided directly by the individual – such as names and contact details that customers give us when starting a service, as well as information provided in connection with a service or when individuals contact us, for example to apply for a job.
  • Information about the services provided – details of the services used by the customer, such as a securities portfolio statement.
  • Information from third parties – we may need to obtain certain information from third parties, such as credit reference agencies, government authorities and Registers Iceland. Information may also be collected online, where applicable.
  • Automatic information collection when you use our website – we collect information using cookies, web logs and similar technologies about how customers use the company’s website. This enables us to design the website to best meet our customers’ needs.


If you wish to restrict or correct the processing of your personal data, or object to it, please contact us. We will process your request as soon as possible and no later than one month after receiving it.


We process personal information only for legitimate purposes and in accordance with the data protection legislation in force at any given time. For example, we may need the information to identify and contact our customers, and to provide the services requested on each occasion.


Information is most often processed on the following legal bases:

  • When necessary for the legitimate interests of the company or others, provided the individual’s fundamental rights and freedoms do not override those interests
  • Where necessary to perform a contract between the company and an individual.
  • Where necessary to comply with a legal obligation incumbent on the company.
  • Where an individual has consented to the company using the information.


We will only use personal data for the purpose for which it was collected.


4. How long do we retain personal data?


We retain your personal data only for as long as necessary and in accordance with the purpose for which it was collected, including to meet legal and accounting obligations. When determining an appropriate retention period, we consider the volume, type and nature of the information concerned, and the risk of unauthorised access to or use of that information.


5. Cookies


Cookies are small text files stored on your computer or other smart devices when you visit a website. First-party cookies come from the same domain as the website you visit (in this case personuvernd.is), while third-party cookies come from other domains. Our website, www.vbm.is, uses first-party cookies that are necessary for the site to function. Cookies are also used for web analytics; we use Google Analytics to analyse how the website is used. This helps us gather statistics that are used to improve and develop the website and the information published on it. We collect information about website visits, such as the time and date, search terms, referral source, browser type and operating system.


6. When is my information disclosed to third parties?


In certain cases, personally identifiable information about customers and individuals associated with them may be shared with other companies or public authorities, where permitted. Examples include:

  • To third parties in connection with estate settlements, bankruptcy or inheritance matters, but only where we are required to comply with the request and have written authorization (e.g. a court order).
  • To provide information to public authorities, such as the police and courts, but only where we are legally required to comply with such a request.


The Company requires all third parties to whom it may disclose information as described above to ensure the security of the personal data and handle it in accordance with the law. They may not use the personal data for their own purposes and may only process it for specific purposes in accordance with our instructions.


We will not transfer personal data to countries outside the European Economic Area (“EEA”) unless we can ensure that the data receives a level of protection comparable to that within the EEA or have obtained specific consent in each case. Where it is necessary to transfer data to countries outside the EEA, we will do so only if appropriate safeguards have been put in place in accordance with data protection legislation, such as by using standard contractual clauses approved by the European Commission or by other appropriate means.


7. Security of Personal Information


We place great emphasis on the security of personal data. We have therefore implemented appropriate security measures, including technical and organisational safeguards, to ensure that personal data is not lost, accessed by third parties or altered. For example, we control access to information and ensure that employees are bound by confidentiality obligations regarding what they learn and the work they perform for the company. Employees remain bound by this duty of confidentiality even after their employment ends.


If a personal data breach occurs, the Data Protection Authority and, where applicable, the individuals concerned will be notified, unless the breach is unlikely to pose a high risk to individuals.


8. Your rights regarding the personal data processed by VBM


In certain circumstances, you have specific rights under data protection laws. For example, you have the right to obtain confirmation as to whether or not we process personal data about you. If we do, you may request access to the personal data we hold about you. You also have the right to request the correction of data we process about you. In certain circumstances, you may request that your personal data be erased or that we restrict the processing of your personal data, and in some cases you may object to the processing. If the processing of your personal data is based on consent, you may withdraw your consent at any time. In certain cases, you may also have the right to data portability to another controller.


These rights are not absolute, and your request may therefore be refused where permitted by law. If we refuse your request in whole or in part, we will seek to explain the grounds for doing so. Accessing your data or exercising your rights is generally free of charge. However, we reserve the right to charge a reasonable fee if your request is manifestly unfounded, repetitive or excessive.


If you have any questions about how we process personal information or wish to exercise your statutory rights, please contact us by email at vbm@vbm.is.


If you have a concern about how your personal information is processed, you may submit a complaint to the Icelandic Data Protection Authority by emailing postur@personuvernd.is.




9. Amendments to this Privacy Policy


We may amend this Privacy Policy to reflect changes in applicable legislation or changes to the company’s processing of personal data.


Any changes to this policy will take effect once the updated version has been published on the company’s website.


It is important to us that the personal information we process about you is always accurate and up to date. Please contact us if your personal information changes during our business relationship.


This Privacy Policy was last approved on 4 March 2020