Our Privacy Policy

1. Important information about us and this policy


Verðbréfamiðstöð Íslands hf., ID no. 451015-2140 (also referred to as “VBM” or “we”) is committed to the integrity, security and confidentiality of personal data. VBM is the controller of personal data processed by the company. This privacy policy explains how we process personal data, including personal data concerning individuals registered in VBM’s customer system, individuals who contact us, individuals acting as contacts on behalf of legal entities doing business with us, and other contacts (collectively referred to as “customers” or “you”), and informs you of your privacy rights.


All processing of personal data by VBM is carried out in accordance with the data protection laws in force at any given time, currently Act No. 90/2018 on Data Protection and the Processing of Personal Data, and Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, repealing Directive 95/46/EC (the General Data Protection Regulation).


If you have any questions about this privacy policy or VBM’s processing of personal data, please feel free to contact us, for example by email at vbm@vbm.is.


2. What personal data does VBM process?


VBM is licensed as a central securities depository in accordance with the provisions of the Act on Central Securities Depositories, Settlement and Electronic Registration of Financial Instruments. This primarily involves the electronic registration of securities: we are responsible for their electronic issuance and registration, as well as recording ownership of them.


We collect, use, store and transfer various types of information about our customers in connection with our business activities. Personal information is any information relating to an identified or identifiable natural person. A person is identifiable if they can be identified, directly or indirectly.


The personal information we collect about you depends on our relationship with you—for example, whether you do business with us in your own capacity or act on behalf of a legal entity. In all cases, we ensure that the personal information is adequate, relevant and limited to what is necessary for the purpose of processing.


The following are examples of personal data we process about individuals registered in VBM’s customer system:

 

  • Contact information, such as name, address, registered domicile, telephone number and email address;
  • national ID number;
  • communications history, including other information disclosed in communications;
  • account information;
  • information about an individual's securities holdings;
  • other personal information that an individual provides to us.

 

The following are examples of personal information we process about individuals who act on behalf of legal entities in their dealings with us:

  • Contact details, such as name, phone number and email address;
  • Communication history, including other information disclosed during communications.


The following are examples of personal data we process about individuals who contact us:

  • Contact information, such as name, telephone number and email address;
  • Communication history, including other information disclosed in communications. This may also include information relating to job applications.


The above is not an exhaustive list of the personal data we may process about individuals. It may also include, for example, other information that individuals provide to us themselves.


3. How and for what purposes does VBM process personal data?


All access to information at VBM is access-controlled and logged. We process personal data to provide services to account management institutions that have an agreement with VBM; supervisory authorities, as required; account holders, once a year as required by law; and, in specific cases, at the request of securities owners.


Specifically, we collect information about you in the following ways:

  • Information provided directly by the individual – such as names and contact details provided by customers when they begin using our services, as well as information provided in connection with the services we provide or when individuals contact us, for example to apply for a job.
  • Information about services provided – details of the services used by the customer, such as a statement of securities holdings.
  • Information from third parties – we may need to obtain certain information from third parties, such as credit reference agencies, government authorities, and Registers Iceland. Information may also be collected from the internet, where applicable.
  • Automatic collection of information through use of our website – we collect information using cookies, web logs and similar technologies about how customers use the company’s website. This enables us to design the website to best serve our customers.


If you wish to restrict or correct the processing of your personal data, or object to it, please contact us. We will process your request as soon as possible, and no later than one month after receiving it.


We process personal information only for legitimate purposes and in accordance with the data protection legislation in force from time to time. For example, we may need the information to identify and contact customers, and to provide the services requested.


Information is generally processed on the basis of the following sources:

  • Where necessary to protect the legitimate interests of the company or others, provided those interests are not overridden by the individual’s fundamental rights and freedoms
  • When necessary to perform a contract between the company and an individual.
  • When necessary to comply with a legal obligation applicable to the company.
  • When the individual has consented to the company’s use of the information.


We will use personal data only for the purpose for which it was collected.


4. How long is personal data retained?


We retain your personal data only for as long as necessary and in accordance with the purpose for which it was collected, including to meet legal and accounting obligations. When determining an appropriate retention period, we take into account the scope, type and nature of the data concerned, and the risk of unauthorised access to or use of the data.


5. Cookies


Cookies are small text files stored on your computer or other smart devices when you visit a website. First-party cookies come from the same domain as the website you visit (in this case, personuvernd.is), while third-party cookies come from other domains. Our website, www.vbm.is, uses first-party cookies that are necessary for the website to function. Cookies are also used for web analytics; we use Google Analytics to analyse website usage. This is to gather statistics that help us improve and develop the website and the information published on it. We collect information about website visits, such as the time and date, search terms, the source of the visit, and browser and operating system type.


6. When is my information disclosed to third parties?


In certain cases, personally identifiable information about customers and related individuals may be shared with other companies or public authorities, to the extent permitted. Examples include:

  • To third parties in connection with the administration of estates, bankruptcy or inheritance matters, but only where we are required to comply with such a request and in accordance with existing written authorization (e.g. a court order).
  • To provide information to public authorities, such as the police and courts, but only where we are legally obliged to comply with such a request.


The Company requires all third parties to whom it may disclose information as described above to ensure the security of the personal data and handle it in accordance with the law. They may not use the personal data for their own purposes and may only process it for specific purposes in accordance with our instructions.


We will not transfer personal data to countries outside the European Economic Area (“EEA”) unless the data are guaranteed a level of protection equivalent to that within the EEA, or with specific consent in each case. If it is necessary to transfer data to countries outside the EEA, we will do so only where appropriate safeguards have been put in place in accordance with data protection legislation, for example by using standard contractual clauses approved by the European Commission or by other appropriate means.


7. Security of Personal Information


We place great emphasis on the security of personal data processing. We have therefore implemented appropriate security measures, including technical and organisational measures, to ensure that personal data is not lost, disclosed to third parties or altered. For example, we control access to information and ensure that employees are bound by confidentiality obligations with respect to information they receive and their work for the company. Employees remain bound by confidentiality even after they leave their position.


If a personal data breach occurs, the Data Protection Authority and, where appropriate, the individuals affected will be notified, unless the breach is unlikely to result in a high risk to individuals.


8. Your rights in relation to the personal data processed by VBM


In certain circumstances, you have specific rights under data protection laws. For example, you have the right to obtain confirmation as to whether or not we process your personal data. If we do, you may request access to the personal data about you that we hold. You also have the right to request correction of the data we process about you. In certain circumstances, you may request that your personal data be erased or that we restrict its processing, and in some cases you may object to the processing. If we process your personal data on the basis of your consent, you may withdraw your consent at any time. In certain cases, you may also have the right to data portability to another controller.


These rights are not absolute, and your request may therefore be refused as provided by law. If we refuse your request in whole or in part, we will endeavour to explain the grounds for doing so. In general, there is no charge for accessing data or exercising your rights. However, we reserve the right to charge a reasonable fee if a request is manifestly unfounded, repetitive or excessive.


If you have any questions about how we process personal information or wish to exercise your statutory rights, please feel free to contact us by email at vbm@vbm.is.


If you have a concern about how your personal information is handled, you may file a complaint with the Data Protection Authority by emailing postur@personuvernd.is.




9. Changes to this Privacy Policy


We may amend this Privacy Policy to reflect changes in applicable legislation or changes to the company’s processing of personal data.


Any changes made to the policy will take effect once the updated version has been published on the company's website.


It is important to us that the personal information we process about you is accurate and up to date. Please contact us if your personal information changes during our business relationship.


This Privacy Policy was last approved on 4 March 2020