Privacy Policy

1. Background and Scope

In 2020, ETC Group established this Privacy Policy (this Policy) to govern how we deal with data protection, privacy and associated issues, including how we may process your Personal Data. Supporting this Policy are certain other documents as referred to in section 10 of this Policy.

This Policy was developed with a view to applicable law in the United Kingdom, but it applies to the business wherever conducted, and may be supplemented from time to time with provisions that are applicable in specific jurisdictions. Except where expressly stated to the contrary, this Policy applies to all legal entities forming part of ETC Group, and to all of its personnel and staff, including directors, officers, employees and contractors of any such legal entity.

In this Policy, we use terms like “we”, “us”, “our” and the “business”, to refer to ETC Group generally as a business; these references are not limited to specific legal entities in ETC Group. When we refer in the policy to “you”, we mean any person (including legal entities) who we deal with in the course of our business. Other important defined terms used in this Policy document, such as “GDPR” and “Personal Data”, are detailed under section 12, “Definitions”.

Section 13, “Policy Administration”, contains details about the owner and other key roles in relation to this Policy, as well as information about how and when this Policy is reviewed and updated.

2. Data Controller

In relation to this Policy and any Personal Data processed, the data controller is ETC Management Limited, whose details are below:

ETC Management Ltd
Gridiron, One Pancras Square
London, N1C 4AG
United Kingdom
Email: privacy@etc-group.com

ETC Management Limited is registered with the Information Commissioner’s Office in the United Kingdom, under registration number ZA820221. Its current registration runs until 30 November 2022.

3. Principles and Practices of Personal Data Processing

3.1 Data Protection Principles

We will comply with data protection law, including the DPA 2018 and the applicable provisions of the GDPR. This says that the Personal Data we hold about you must be:

• • Used lawfully, fairly and in a transparent way
• • Collected only for valid purposes that we have clearly explained to you and not used in any way that is incompatible with those purposes
• • Relevant to the purposes we have told you about and limited only to those purposes
• • Accurate, kept up to date and stored securely
• • Kept only as long as necessary for the purposes we have told you about

3.2 Categories of your Personal Data and purposes of our processing

For anyone other than staff members (staff members, please see section 10 and the Data Protection Notice referred to there), the following categories of your Personal Data will be processed for the purposes described in the following use cases:

• 3.2.1 Name, address, telephone number or e-mail address if you wish to make direct contact through the contact form, register for a newsletter or a closed user group (if applicable). Which Personal Data is collected in the various entry masks depends on the individual entry fields. Mandatory information fields will be marked accordingly. All other information shall be voluntary.


• 3.2.2 Our web servers will only store the shortened address of your internet service provider (i.e. the shortened IP address), the name of the website from where you visit us, our website pages that you retrieve, the used web browser type and the date and duration of your visit. Any relation to an individual person is not established due to the shortened IP address.
• 3.2.3 If you are a holder of certain securities issued by our subsidiary ETC Issuance GmbH and submit a redemption request in respect of those securities directly to ETC, we need to undertake certain checks and establish your identity, in order to process your redemption request. The actual evidence you supply may vary, but it will contain at least your name and address, and may contain further personal data (for example, that which would appear on the photograph page of a passport supplied by you).
• 3.2.4 Where you or your organisation is seeking to establish or maintain a supplier or counterparty relationship with us, we may, as part of our KYC procedures from time to time, need to obtain evidence of your identify and proof of address. The actual evidence you supply may vary, but it will contain at least your name and address, and may contain further personal data (for example, that which would appear on the photograph page of a passport supplied by you).

3.3 Legal basis for our processing of your Personal Data

Our processing of your Personal Data is allowed by applicable law. The particular legal bases are:

• - processing as described in Sections 3.2.1 and 3.2.2: The legal basis for is Article 6(1)(b) of the GDPR, permitting the processing of your Personal Data for the purposes of providing personalized services to you.


• - processing as described in Sections 3.2.3 and 3.2.4: The legal basis for processing of Personal Data in order to process direct redemptions or undertake KYC is Article 6(1)(b) and (c) of the GDPR, which permits us to process your Personal Data to perform (or prepare) a contract with you, as well as to fulfil our legal obligations under applicable laws in relation to money laundering and terrorist financing.

3.4 Do you have to provide your Personal Data to us?

The provision of your Personal Data is necessary to make direct contact with us, or to receive a newsletter, or to process a redemption request or in some cases to do business with ETC. Although you are obliged to provide your Personal Data to us as part of these activities, the consequences if you do not want to provide your Personal Data to us are that the respective service offered may no longer be available, or you will not be able to access certain sections of our website or ETC may not be able to process your redemption request or do business with you or the organisation you represent.

3.5 Do we make automated decisions on you?

We do not make any automated decisions solely on automatic processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.

3.6 Retention periods

The period for which your Personal Data will be stored by us is shown below:

• Personal Data: Name, address, telephone number or email address, depending upon which of those you have shared with us
• Shortened IP address: The shortened IP address is deleted without delay as soon as it is no longer required.
• Retention Period: As long necessary to carry out our relationship with you (in accordance with the GDPR storage limitation principle)..

4. Transfer of Personal Data to Third Parties

Generally, we will not transfer your Personal Data to third parties except such transfer is permitted by law or you have explicitly consented to the transfer. We may transfer your Personal Data to public authorities where this is required by the applicable law. A transfer of your Personal Data is also permitted if there is a suspicion of a criminal offence or the abuse of the services offered on our website. In this event, we shall be entitled to transfer your Personal Data to the criminal prosecution authority. Otherwise, your personal data will be stored exclusively in our database and on our servers, or on those of our commissioned data processing providers. We will only share your Personal Data with other controllers for their own purposes such as cooperation or advertising partners under the condition that you explicitly and voluntarily agreed to such transfer of your Personal Data; in this case, we will obtain your consent separately from this Policy.

5. Data retention period

Unless a longer retention period is required or permitted by applicable law, your Personal Data will only be stored for the period necessary to fulfil the purposes outlined in this Policy or until you request that your Personal Data be deleted.

6. Links to third-party websites

Our website may, from time to time, provide links to external websites. We do not have control over such websites and are not responsible for the content of these websites. ETC does not take responsibility for the data privacy policies of external websites, and this Policy does not extend to your use of such websites. You are advised to read the privacy policy or statement about privacy of other websites prior to using them.

7. Advertising

The advertising published on our website may be based on cookies placed on your computer, in order to adjust advertising for products and services based on your individual interests. These cookies collect data on the utilization of the websites in anonymized form and do not permit profiling which is not anonymized. You can inactivate the cookie option in your browser.

8. Use of Cookies

We use two types of cookies to provide a pleasant online experience with our website: technically required cookies, without which the functionality of our website would be limited, and optional cookies to enhance user-friendliness. It is important to us that users can easily access the information provided by us. We therefore strive to continuously improve and develop our website. Cookies help us achieve this objective.
At the same time, the protection of your privacy is of utmost importance to us. We handle personal data very carefully and would therefore like to inform you in detail which cookies we use for which purpose.

Required cookies: These cookies are necessary to ensure the smooth functioning of this website (e.g. session cookies, cookie to store the selected cookie preferences, etc.). These required cookies can therefore not be deactivated.

Optional cookies: Functional cookies are used to ensure the smooth functioning of all tools on the website. The entire and proper function of the website is available to the user only with the use of functional cookies. The use of analysis cookies serves the ongoing quality improvement of this website and its content. By using them, we aim to maximise user satisfaction.

You may enable or disable cookies in your browser. By default, most browsers accept cookies but this can be changed. For further details, please visit the help section of your browser. You can choose to delete cookies at any time; however you may lose information that enables you to access the website more quickly and efficiently including, but not limited to, personalization settings.

It is recommended that you ensure that your browser is up-to-date and that you consult the help and guidance provided by the developer of your browser if you are unsure about adjusting your privacy settings.

9. Your Rights

Under applicable data protection laws, you have rights

• • of access to, rectification of, and/or erasure of your Personal Data;
• • to restrict or object to its processing;
• • to tell us that you do not wish to receive marketing information; and
• • (in some circumstances) to require certain of your Personal Data to be transferred to you or a third party, which you can exercise by contacting us at the details in section 2

To the extent our processing of your Personal Data is based on your consent, you also have the right to withdraw your consent, without affecting the lawfulness of our processing based on your consent before its withdrawal. To exercise your rights, you can contact us as set out in section 2. You can also lodge a complaint about our processing of your Personal Data with a data protection authority.

10. Ancillary Documents

We may from time to time introduce more detailed procedures, or other ancillary documents to support this Policy. Those ancillary documents will always be consistent with the principles in this Policy. Currently, the only such ancillary document in place is a Data Protection Notice which we provide to new recruits (either as part of the recruitment process, when making a job offer, or as of their start date) that describes how we process Personal Data of our staff members.

11. Training and awareness

All personnel are made aware of data protection and privacy laws and are trained annually in relation to these laws and this Policy.

12. Definitions

In this Policy document, we use various abbreviations and terms with initial capital letters, which have the following meanings:

13. Policy Administration

The entity with overall responsibility and oversight for this Policy is the Policy Owner. The Policy Owner will formally review this Policy at least annually (scheduled for review in the fourth quarter), or more frequently, where circumstances require. The Policy Admin may approve non-material changes to this Policy document between regular Policy Owner reviews, so long as such changes are endorsed by the Policy Owner at its next regular review. The Policy Admin may, in its discretion, refer any questions or matters of interpretation in relation to this Policy up to the Policy Owner.

The version history of this Policy is set out in the table below. The table will be updated each time a new version is approved.