PRIVACY POLICY – PERSONAL DATA REGARDING CLIENTS 

CHELTON AB

This privacy notice contains information about Chelton AB’s processing of personal data for you as a client.

(Personal data) controller

Chelton AB, reg.no. 559056-6641 is the personal data controller for processing data within the operations. Address: Föreningsgatan 28, 211 65 Malmö (”Chelton”).

Chelton conducts “other financial activities” under 1 § 2 pt. of the Currency Exchange and Other Financial Activities Act (1996:1006) (Sw: lag (1996:1006) om valutaväxling och annan finansiell verksamhet) as a registered financial institution (Institution number with Finansinspektionen: 70413). Chelton’s business activities are to provide its clients with a discretionary currency management service.

Peter Borggren is the contact person for questions about Chelton’s processing of personal data. Questions and remarks regarding Chelton’s processing of personal data can be directed to the contact person.

Peter Borggren

peter@cheltonwealth.se

+46 (0)40-692 85 70

Information regarding Chelton’s processing of personal data

Chelton processes personal data as further described below within

• marketing of its currency management services,
• conducting legally required client knowledge measures and
• execution of its currency management services.

Further, Chelton also processes personal data related to employees, potential employees, service providers, etc., which is not covered in this document.

Marketing of the currency management services

General

Chelton markets its currency management services to potential clients through direct marketing measures.

Purpose and legal grounds

Chelton’s processing of personal data within the marketing activities is based on legitimate interest.

Chelton’s potential clients consist of both physical persons and legal entities. In the case of legal entities, the personal data is, for example, processed regarding the legal entity’s contact persons, authorised signatories, owners, etc. The legal basis in such cases is a legitimate interest that derives from the relation with the client (the legal entity).

Within its marketing activities, Chelton might receive and handle lists of potential clients (the “Prospect lists”) to market currency management services to these potential clients. Processing of personal data within Prospect lists is based on legitimate interest. When a potential client from a Prospect list is contacted and expresses that they are not interested in the currency management services offered by Chelton, that client’s data shall be sorted out and deleted. Personal data regarding clients who are in contact with Chelton and have expressed interest in the currency management services will be processed for further marketing purposes.

Categories of personal data

Chelton processes the following categories of personal data.

When the client is a legal entity:

• contact information such as name, address, email address, and phone numbers of contact persons, authorised signatories, owners and others, and
• financial information, mainly the client’s investments.

When the client is a private individual:

• name, address, phone number and email address,
• potential attorney and
• financial information, mainly the client’s investments.

The personal data is registered in Chelton’s CRM, e-mail, and, where applicable, meeting minutes.

Recipient of personal data

Where applicable, external IT suppliers may also receive the personal data, in addition to Chelton’s employees.

Storage of personal data

Chelton applies routines for sorting out and deleting personal data where the client has revoked its consent; there is no longer any need for the personal data, the personal data is obsolete, etc.

Conducting legally required client knowledge measures

General

As a registered financial institution Chelton is required to comply with the Act (2017:630) on Measures Against Money Laundering and Terrorism Financing (Sw: lagen (2017:630) om åtgärder mot penningtvätt och finansiering av terrorism) (the “AML Act”). The AML Act states, among other things, that Chelton must obtain client knowledge (KYC) before a business relationship is commenced and during its duration.

Purpose and legal grounds

The purpose of processing personal data in question is to comply with the AML Act regarding client knowledge. The basis for Chelton’s KYC measures, for which personal data is processed, is thus a legal requirement. Chelton’s client knowledge procedure includes verifying the identity of representatives of the legal person and, where applicable, the beneficial owner, as well as checking whether the beneficial owner (legal person) or client (natural person) constitutes a so-called PEP (Politically Exposed Person) and whether the representative, beneficial owner or client is inserted on a sanction list. Further, Chelton checks the purpose and type of the business relationship and the origin of the assets that Chelton manages.

Categories of personal data

Chelton processes the following categories of personal data when conducting client knowledge measures.

When the client is a legal entity:

• contact information such as name, address, email address, and phone numbers of contact persons,
• authorised signatories,
• owners and others,
• ID information (such as copies of passport or ID documents),
• PEP position (including profession/title) of representatives and beneficial owners,
• if a representative or beneficial owner is inserted on a sanction list and
• financial information, mainly the client’s investments.

When the client is a private individual:

• name, address, social security number, phone number and email address,
• potential attorney,
• Chelton positions,
• ID information (such as copies of passport or ID documents),
• PEP-position (including profession/title) and
• if a client or representative is inserted on a sanction list,
• account information and
• financial information, mainly the client’s investments.

The KYC process uses Due PTL, which Due Compliance AB provides. The information is retrieved from the tool.

Chelton may also collect information from Bisnode or UC.

Recipient of personal data

Personal data is stored in Due PTL, a tool that Due Compliance AB provides for this process. Personal data processed with Chelton’s KYC measures is also stored in Dropbox, Chelton’s cloud-based document storage service. Furthermore, Chelton may share the information with other IT and system vendors supporting its systems and cloud services. Chelton may also share information with the Financial Intelligence Unit within the Swedish Police if such disclosure is prescribed by law.

Storage of personal data

The personal data collected within the scope of KYC measures is stored during the ongoing business relationship and for five years from the termination thereof or such longer period that the AML Act may require.

Execution of the currency management services

General

The currency management service requires that the client has currency accounts at an account-/custody institute (the “Depositary”) where the assets subject to the management service are deposited. Chelton and the client agree with the currency management service and provide Chelton with a power of attorney to execute spot-fx transactions with the client’s assets at the Depositary within the agreed management mandate. Currency transactions are then conducted at Chelton’s discretion, where spot-fix orders are submitted to the Depositary on behalf of the client. The currency management service is provided under the agreement with the client until the client terminates the agreement with Chelton.

Purpose and legal grounds

Chelton’s processing of personal data within the execution of the currency management services is based on an agreement with the client.

Categories of personal data

Chelton processes the following categories of personal data.

When the client is a legal entity:

• contact information such as name, address, email address, and phone numbers of contact persons, authorised signatories, owners and others, and
• financial information, mainly the client’s investments.

When the client is a private individual:

• name, address, social security number, phone number and email address,
• potential attorney,
• account information and
• financial information, mainly the client’s investments.

The personal data is registered in Chelton’s CRM, e-mail, and, where applicable, meeting minutes.

Recipient of personal data

Where applicable, external IT suppliers may also receive the personal data, in addition to Chelton’s employees.

Storage of personal data

Chelton stores personal data for so long as the currency management agreement with the client is valid and, after that, for ten years after the termination of the agreement (under the general prescription period for claims (Sw: allmänna preskriptionsfristen).

Use of cookies

Cookies are small text files containing letters and numbers sent from Chelton’s web server to be saved on the visitor’s web browser or device. On www.cheltonwealth.se, Chelton uses the following cookies:

• Third-party cookies (cookies established by a third party’s website). Chelton uses these primarily for analyses, such as Google Analytics.

The cookies used generally improve Chelton’s marketing activities. Chelton uses cookies to collect general analytical information about your usage of its web page and to save specific functional settings such as language and other data. You can read more about cookies concerning Chelton at www.cheltonwealth.se.

To manage the cookies and similar technologies used (tracking pixels, web beacons, etc.) and related consents, we use the consent tool “Real Cookie Banner”. Details on how “Real Cookie Banner” works can be found at <a href=”https://devowl.io/rcb/data-processing/” rel=”noreferrer” target=”_blank”>https://devowl.io/rcb/data-processing/</a>. The legal basis for the processing of personal data in this context are Art. 6 (1) lit. c GDPR and Art. 6 (1) lit. f GDPR. Our legitimate interest is the management of the cookies and similar technologies used and the related consents. The provision of personal data is neither contractually required nor necessary for the conclusion of a contract. You are not obliged to provide the personal data. If you do not provide the personal data, we will not be able to manage your consents.

The rights of the data subject

The right to access (so-called extract from the register)

You are entitled to be informed about Chelton’s processing regarding you. This must include a description of the purpose and legal basis of the processing, which categories of personal data it concerns and who receives the personal data. Chelton has compiled this information for your ease of reference. An extract from the register means you are provided with an overview of the processing to understand if and for what purpose your data is processed.

Right to rectification, erasure or restriction

Suppose you believe Chelton has processed your data incorrectly or may need rectification. In that case, you have the right to request that Chelton correct the data, and if you do not want Chelton to continue processing the personal data, you have the right to request that Chelton erase the data. If possible, Chelton will rectify or delete the personal data regarding our purpose for the processing and the legal requirements that Chelton must follow.

Suppose you believe that the personal data Chelton store about you is inaccurate. In case Chelton’s processing is illegal or Chelton does not need the data for a specific purpose, you have the right to request that Chelton restrict its processing of your data. You can also request that Chelton restrict the process of your data while Chelton investigates whether your request to exercise any other rights can be granted.

However, it should be noted that the right to rectification or erasure may be limited in some cases, as Chelton is a registered financial institution and, hence, required by law to store certain information.

The right to object in certain circumstances

You have the right to object at any time to the processing of your data if the legal basis for the processing consists of performing a task in the public interest or balancing interests. If you object, Chelton will examine whether its interest in processing your data outweighs your interest in not processing it.

You also have the right to object at any time to processing your personal data for direct marketing purposes.

The right to data portability

You have the right to retain the personal data that have been provided to Chelton and have the right to transfer this data to another personal data controller subject to:

1. it is technically feasible; and
2. the legal basis for the processing consists of consent or the processing being necessary to fulfil an agreement.

The right to withdraw consent

If the processing of personal data is based on consent, you have the right to withdraw your consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.

The right to complain about the processing of personal data

You always have the right to contact the Swedish Authority for Privacy Protection to lodge a complaint linked to Chelton’s processing of personal data. Below is the contact information for the Swedish Authority for Privacy Protection.

Telephone number: 08-657 61 00

Email address: imy@imy.se

As a data subject, you can find Chelton’s contact information in Section 1 if you wish to exercise your rights or respond to other questions. You have the right to contact Chelton as an alternative to contacting the Swedish Authority for Privacy Protection.

How Chelton protects your data

Chelton uses IT systems to protect secrecy, privacy, and access to personal data. Chelton has performed specific security measures to protect your data against unlawful or unauthorised processing (such as illegal access, loss, destruction, or damage). Access is provided only to authorised persons who are required to process your data so that Chelton can fulfil the purposes set out above.

Transfer of data to third parties

Chelton always aims only to process personal data within the EU/EEA. Where appropriate, Chelton may share personal data with a third party in a country outside the EU/EEA, a so-called third country. In the event of a transfer to a third country, Chelton will ensure that such transfer is made by applicable data protection legislation, either by basing the transfer on an adequacy decision by the European Commission or by using the European Commission’s standard contractual clauses in combination with organisational and technical safeguards.

Personal data may be transferred to the following recipients outside the EU/EEA:

Depositary

Chelton’s currency management service requires that the client have currency accounts at Axi Financial Services Limited (“Axi”), LMAX Global Limited, and Alpha Trade Pty Ltd. Axi and LMAX are domiciled in the UK. In contrast, Alpha Trade is domiciled in Australia and is not a member of the EU/EEA. Forms and other documents for account opening may hence be transferred outside of the EU/EEA, which is only done after the client’s instruction and subject to the client’s consent.

For more information about the Brokers’ processing of personal data, please refer to:

Axi: https://www.axi.com/uk/legal-documentation/privacy-policy

LMAX: https://www.lmax.com/documents/LMAXGroup-Privacy-Policy.pdf

Alpha Trade: https://alphatrade.com.au/privacy-policy/

System providers

In the operation of Chelton’s business, we use Microsoft Office 365 as a system provider. In connection with Microsoft receiving personal data about you, your data may be transferred to, for example, the United States. For more information about how Microsoft processes personal data, see:

https://privacy.microsoft.com/en-us/privacystatement

To read more about the transfer of personal data to third countries and to access the standard contractual clauses, see:

https://learn.microsoft.com/en-us/compliance/regulatory/offering-eu-model-clauses

Social media

When you visit Chelton’s social media platforms (Facebook, Instagram, and LinkedIn), your data is collected and processed by companies (Meta and LinkedIn). These companies may transfer personal data to the United States when they receive it.

Facebook and Instagram

When using the services in question, your data will be processed by Meta Platforms Ireland Limited. For more information on the processing transfer of personal data to third countries and to read the standard contractual clauses, see:

https://www.facebook.com/privacy/policy/?entry_point=facebook_page_footer

https://www.facebook.com/help/566994660333381?ref=dp&helpref=faq_content

LinkedIn

By using the service, your data is processed by LinkedIn Ireland Unlimited Company. For more information on the processing transfer of personal data to third countries and to read the standard contractual clauses, see:

https://www.linkedin.com/legal/privacy-policy

https://www.linkedin.com/help/linkedin/answer/a1343190

Changes to this privacy notice

Chelton reserves the right to change and update this privacy notice. Chelton will appropriately provide information should the privacy notice be materially changed or if personal data is to be processed differently than what is stated in the privacy notice.

Valid as of April 20, 2024