Your privacy is very important to us. In this notice (this "Privacy Notice"), "we", "us" and "our" means MetLife Investment Management Europe Limited ("MIM Europe"). We are registered in Ireland and our registered address is 20 on Hatch, Lower Hatch Street, Dublin 2, Ireland.
1. ABOUT THIS PRIVACY NOTICE
1.1 For the purposes of the Regulation (EU) 2016/679 (General Data Protection Regulation or the "EU GDPR") and other applicable data protection laws within your EU Member State, we are a controller in respect of your personal data. We are responsible for ensuring that we process your personal data in compliance with the EU GDPR and the applicable data protection laws within your EU Member State. The terms "controller", "processor", "data subject", "personal data", and "processing" used in this Privacy Notice have the meanings given to them in the EU GDPR. This Privacy Notice is issued on behalf of MIM Europe.
This Privacy Notice applies to:
1.2.1 visitors to our website: investments.metlife.com (the "website");
1.2.2 visitors to our premises; and
1.2.3 officers, directors, employees, advisors, intermediaries and other representatives of our suppliers, advisers and other service providers,("you", "your" or "data subject").
2. PERSONAL DATA THAT WE COLLECT ABOUT YOU
2.1 We will collect the following personal data about you:
2.1.1 Information that you provide to us or one of our affiliates. This includes information that you provide us directly, through face-to-face discussions, giving us a business card (or similar), during a telephone conversation, through our website or any other means of correspondence, such as email or forms we may ask you to complete.
2.1.2 Information we collect or generate about you. This is information which we might generate ourselves in relation to you, such as emails (and related data), telephone conversations, website usage data, or other electronic communications with our employees and other staff members, through which our information technology systems may record details of for the purposes of entering into a business arrangement with you.
2.1.3 Information that the website collects about you. If you visit the website, it will automatically collect some information about you and your visit, including internet or other network activity such as the internet protocol (IP) address used to connect your device to the internet and some other information such as yourbrowser type and version and the pages on the site that you visit. The sites may also download "cookies" to your device or place cookies onto your browser. For a description of the cookies that we use on the sites, please refer to our separate cookie policy.
2.1.4 Information that our other systems collect about you. If you exchange emails or other communications with us, our information technology systems may record details of those conversations, sometimes including their content. Some of our premises have CCTV systems which may record audio and visual information about you if you visit our premises, for security and safety purposes.
2.1.5 Information collected from other sources. We may collect some information from other sources. For example, if we have a business relationship with the organisation that you represent, your colleagues or other business contacts may give us information about you such as your contact details or details of your role in the relationship.
2.2 Examples of the personal data that we may collect about you:
2.2.1 identifiers: for example, name, postal address, email address, telephone number;
2.2.2 internet or other network activity: for example, browsing or search history, information regarding interaction with the website or related applications or advertisements, as well as online identifiers such as cookies;
2.2.3 professional or work-related information: for example, your professional role, occupational history, business relationship with MIM Europe, and any other personal data which may be incidentally processed if you contact us; and
2.2.4 identification information: information we need in order to identify you and complete necessary security checks if you visit our physical premises.
3. USES OF YOUR PERSONAL DATA
3.1 Your personal data may be processed by us for the following purposes:
3.1.1 Purpose and Processing Operations: to provide you with information, products and services that you request from us.
Categories of Data: Personal data that you provide directly to us or in connection with our dealings with you. See paragraphs 2.1.1, 2.1.2, 2.1.4, 2.1.5, 2.2.1 and 2.2.3 above for details of the types of personal data that we may collect.
Lawful Basis: The lawful bases of such processing are:
(i) Article 6(1)(b) GDPR where the processing is necessary to take steps at your request prior to entering into a contract with you; or
(ii) Article 6(1)(f) GDPR where the processing is necessary on the basis of our legitimate interests in managing our relationship with you. In doing so, we will consider your interests and ensure that our interests are not overridden by yours and that there is a fair balance between our legitimate interests and your fundamental rights.
3.1.2 Purpose and Processing Operations: to operate, manage, develop and promote our business and, in particular, our business relationship with you or the organisation you represent.
Categories of Data: Personal data that you provide directly to us or in connection with our dealings with you or that we generate about you. See paragraphs 2.1.1, 2.1.2, 2.1.4, 2.1.5, 2.2.1 and 2.2.3.
Lawful Bases: The lawful bases of such processing are:
(i) Article 6(1)(b) GDPR where the processing is necessary to enter into or perform a contract for a product or service with you; or
(ii) Article 6(1)(f) GDPR where the processing is necessary on the basis of our legitimate interests in managing our relationship with you and your organisation and promoting our business. In doing so, we will consider your interests and ensure that our interests are not overridden by yours and that there is a fair balance between our legitimate interests and your fundamental rights.
3.1.3 Purpose and Processing Operations: to operate, administer and improve our website and premises, including to protect the security of our website and premises.
Categories of Data: Personal data that we may process in connection with this purpose is set out in paragraphs 2.1.2, 2.1.3, 2.1.4, 2.2.2 and 2.2.4.
Lawful Basis: The lawful basis for such processing is Article 6(1)(f) GDPR where the processing is necessary on the basis of our legitimate interests in improving our website and security and fraud prevention protections in order to safeguard our website, premises and customer data. In doing so, we will consider your interests and ensure that our interests are not overridden by yours and that there is a fair balance between our legitimate interests and your fundamental rights.
3.1.4 Purpose and Processing Operations: to monitor the quality of our products and services.
Categories of Data: Personal data that we may collect in connection with this purpose is set out in paragraphs 2.1.1, 2.1.2, 2.1.3 and 2.2.2.
Lawful Basis: The lawful basis for such processing is Article 6(1)(f) GDPR where the processing is necessary on the basis of our legitimate interests in monitoring and improving the quality of our products and services and in carrying out market research, to develop predictive and analytical models concerning products and services and data insights. In doing so, we will consider your interests and ensure that our interests are not overridden by yours and that there is a fair balance between our legitimate interests and your fundamental rights
3.1.5 Purpose and Processing Operations: to train our staff. In connection with this, we may record or otherwise process your calls and other interactions with us for training purposes.
Categories of Data: Personal data that we may process in connection with this purpose is set out in paragraphs 2.1.1, 2.1.2, 2.1.4, 2.2.1 and 2.2.3.
Lawful Basis: The lawful basis for such processing is Article 6(1)(f) GDPR where the processing is necessary on the basis of our legitimate interests in training our staff, measuring our performance, creating efficiencies in our business and delivering organisational benefits. In doing so, we will consider your interests and ensure that our interests are not overridden by yours and that there is a fair balance between our legitimate interests and your fundamental rights.
3.1.6 Purpose and Processing Operations: to protect our business from fraud, money-laundering, breach of confidence, theft of proprietary materials and other financial or business crimes.
Categories of Data: Personal data that we may process in connection with this purpose is set out in paragraphs 2.1.1, 2.1.2, 2.1.3, 2.1.4, 2.1.5, 2.2.1, 2.2.2, 2.2.3 and 2.2.4.
Lawful Bases: The lawful bases for such processing is:
(i) Article 6(1)(f) GDPR where the processing is necessary on the basis of our legitimate interests in protecting our business from fraud, any breach of confidentiality or misappropriation of our intellectual property, confidential information or other assets and protecting and vindicating our legal rights and ensuring compliance with our legal obligations. In doing so, we will consider your interests and ensure that our interests are not overridden by yours and that there is a fair balance between our legitimate interests and your fundamental rights; or
(ii) Article 6(1)(c) GDPR namely the processing is necessary to discharge a relevant legal or regulatory obligation to which we are subject including under the Criminal Justice (Money Laundering and Terrorist Financing) Acts 2010 to 2021.
3.1.7 Purpose and Processing Operations: to confirm your identity and to comply with our legal and regulatory obligations and bring and defend civil, regulatory and criminal claims or respond to queries and other lawful requests received from regulatory authorities, law enforcement and other governmental agencies such as the Central Bank of Ireland.
Categories of Data: Personal data that we may process in connection with this purpose is set out in paragraphs 2.1.1, 2.1.4, 2.1.5 and 2.2.4.
Lawful Bases: The lawful bases for such processing is:
(i) Article 6(1)(f) GDPR where the processing is necessary on the basis of our legitimate interests in protecting our business from fraud, complying with our legal and regulatory obligations, co-operating with and responding to requests and investigations from regulatory authorities, law enforcement and other governmental agencies and protecting and vindicating our legal rights. In doing so, we will consider your interests and ensure that our interests are not overridden by yours and that there is a fair balance between our legitimate interests and your fundamental rights; or
(ii) Article 6(1)(c) GDPR namely the processing is necessary to discharge a relevant legal or regulatory obligation to which we are subjectincluding under the Criminal Justice (Money Laundering and Terrorist Financing) Acts 2010 to 2021, European Union (Anti-Money Laundering: Beneficial Ownership of Corporate Entities) Regulations 2019, the Companies Act 2014, European Union (Alternative Investment Fund Managers) Regulations 2013, the European Communities (Undertakings for Collective Investment in Transferable Securities) Regulations 2011, the European Union (Markets in Financial Instruments) Regulations 2017, as well as the Central Bank of Ireland’s AIF Rulebook, guidelines and policy updates issued by the Central Bank of Ireland from time to time.
3.1.8 Purpose and Processing Operations: to investigate any complaint you may make.
Categories of Data: Personal data that we may process in connection with this purpose may include that set out in paragraphs 2.1.1, 2.1.2, 2.1.4, 2.1.5 and 2.2.3.
Lawful Bases: The lawful basis for such processing is Article 6(1)(f) GDPR where the processing is necessary on the basis of our legitimate interests in investigating and resolving complaints. In doing so, we will consider your interests and ensure that our interests are not overridden by yours and that there is a fair balance between our legitimate interests and your fundamental rights. We may also be required to address a complaint as a matter of law (including under the European Union (Alternative Investment Fund Managers) Regulations 2013, the European Communities (Undertakings for Collective Investment in Transferable Securities) Regulations 2011, the European Union (Markets in Financial Instruments) Regulations 2017 and any such processing will be based on Article 6(1)(c) GDPR as is necessary for compliance with a legal obligation;
3.1.9 Purpose and Processing Operations: to provide evidence in any dispute or anticipated dispute between you and us.
Categories of Data: Personal data that we may process in connection with this purpose may include that set out in paragraphs 2.1.1, 2.1.2, 2.1.4 and 2.1.5 and any other personal data that may be relevant to the dispute.
Lawful Basis: The lawful basis for such processing is Article 6(1)(f) GDPR where the processing is necessary on the basis of our legitimate interests in providing information or evidence as part of legal and/or regulatory investigations, proceedings or processes and to comply with orders made in the context of civil or criminal proceedings. In doing so, we will consider your interests and ensure that our interests are not overridden by yours and that there is a fair balance between our legitimate interests and your fundamental rights.
3.1.10 Purpose and Processing Operations: Unless you have opted-out, we will use relevant personal data to enable us to provide you with information about products and services that may be of interest to the organisation you work for, represent, or similar.
Categories of data: Personal data processed may include your contact details and marketing preferences.
Lawful Basis: The lawful basis for such processing is Article 6(1)(f) GDPR where the processing is necessary on the basis of our legitimate interests in promoting our business and its products and services. In doing so, we will consider your interests and ensure that our interests are not overridden by yours and that there is a fair balance between our legitimate interests and your fundamental rights.
3.2 Where you use our website, we will process your personal data collected by using cookies in accordance with our cookie policy.
4. DISCLOSURE OF YOUR PERSONAL DATA TO OTHERS
4.1 We may share your personal data with affiliates or third parties for the following purposes:
4.1.1 the other members of the MetLife group of companies;
4.1.2 third party agents and contractors, including IT and communications service providers, law firms, accountants, auditors, and administrators. These third parties will be subject to confidentiality requirements and they will only process your personal data as described in this notice (or as otherwise notified to you);
4.1.3 governmental, judicial, or prosecution bodies, tax authorities, regulators and courts;
4.1.4 third parties for the purposes of establishing, exercising or defending our legal rights;
4.1.5 third parties in connection with investments in, or the sale of, our business or assets or an acquisition of our business (or a part of our business) by a third party; and
4.1.6 your colleagues within the organisation that you represent.
4.2 Some recipients will process your personal data on our behalf as processor. Others will determine the purposes and means of processing of your personal data, acting as separate controllers, and may be permitted to disclose your personal data to other parties in accordance with applicable law.
4.3 You should be aware that when you are on the website, you could be directed to other websites that are beyond our control. Our website may contain links to other websites operated by third parties. We cannot guarantee that the privacy policies of these third parties meet our standards. You should read the privacy notice of any new website you visit.
5. PERSONAL DATA OF THIRD PARTIES
5.1 To the extent that you provide us with personal data of third parties, you agree and acknowledge that you have informed them of, and they have agreed to, our use, collection and disclosure of their personal data including the purposes of such use, collection and disclosure of personal data as set out in this notice.
6. TRANSFERS OF YOUR PERSONAL DATA OUTSIDE THE EEA
6.1 Your personal data may be transferred to, or stored in, a destination outside the EEA, in countries which may not have similarly strict data protection and privacy laws. It may also be processed by individuals operating outside of the EEA who work for us or for one of our service providers.
6.2 To the extent required by law, where personal data is transferred outside the EEA, we will ensure that our arrangements to transfer such personal data are governed by appropriate safeguards or data transfer agreements, designed to ensure that your personal data is protected as required under applicable data protection law (including, where appropriate, under an agreement on terms approved for this purpose by the European Commission).
6.3 We will ensure that any such transfers are carried out in compliance with applicable law, including, where necessary, being governed by data transfer agreements (such as the European Commission approved Standard Contractual Clauses) designed to ensure that your personal data is protected on terms approved for this purpose by the European Commission or as otherwise required under EU GDPR, including that appropriate safeguards are implemented. When personal data is transferred to the United Kingdom, we rely on an adequacy decision from the European Commission which recognises the UK as ensuring an adequate level of protection for personal data transferred to it. When personal data is transferred to the United Kingdom, we rely on an adequacy decision from the European Commission which recognises the UK as ensuring an adequate level of protection for personal data transferred to it. When personal data is transferred to the United States, we rely on Standard Contractual Clauses approved by the European Commission. If you want to request a copy of any such agreements or information about the safeguards used, please contact us using the details set out in "Contacting Us" below.
7. RETENTION OF PERSONAL DATA
7.1 Subject to applicable law, we retain your information for (as the case may be):
7.1.1 as long as it is required for our legitimate purpose;
7.1.2 as long as it is required to perform our contractual obligations;
7.1.3 as long as we have your consent; or
7.1.4 such period as is required or required by law or regulatory obligations which apply to us; and
7.1.5 we will delete or anonymise your personal data when it is no longer required.
8. AUTOMATED DECISION-MAKING (INCLUDING PROFILING)
We do not currently use any processing systems which make decisions and produce legal effects for you, or which may otherwise significantly affect you, based solely on automated processing of your personal data.
9. YOUR RIGHTS
9.1 You have a number of legal rights in relation to the personal data that we hold about you. These rights include:
9.1.1 the right to obtain information regarding the processing of your personal data and access to the personal data that we hold about you; in some circumstances, the right to receive personal data in a structured, commonly-used and machine-readable format and/or to request that we transmit that data to a third party where this is technically feasible. Please note that this right only applies to personal data which you have provided to us;
9.1.2 the right to request that we rectify your personal data if it is inaccurate or incomplete;
9.1.3 in some circumstances, the right to request that we erase your personal data. Please note that your right to erasure that applies in certain circumstances under the EU GDPR is not likely to be available in respect of the personal data we hold, given the purposes for which we collect such data, as described above. Additionally, please note that there may be circumstances where you ask us to erase your personal data, but we are legally entitled or required to retain it;
9.1.4 in some circumstances, the right to object to our processing of your personal data. Again, there may be circumstances where you object to our processing of your personal data, but we are legally entitled or required to continue processing your personal data;
9.1.5 in some circumstances, the right to request that we restrict our processing of your personal data;
9.1.6 the right not to be subject to solely automated decisions, including profiling, which have a legal or similarly significant effect on you; and
9.1.7 the right to lodge a complaint with the data protection authority (details of which are provided below) if you think that any of your rights have been infringed by us.
9.2 You can exercise your rights by contacting us using the details set out under "Contacting Us" below. When exercising any of these rights, we may request specific information from you to prove your identity to our satisfaction so that we can safeguard your personal data from unauthorised access by someone impersonating you.
9.3 You can lodge a complaint or find out more information about your rights by contacting your EU Member State's data protection supervisory authority. For a list of these authorities and their contact details, please visit https://edpb.europa.eu/about-edpb/about-edpb/members_en.
9.4 We review and verify data protection rights requests.
We apply non-discriminatory principles when we action requests relating to your data, in accordance with applicable data protection laws and principles.
9.5 If you do not want MIM Europe to send you e-mail or postal mail, you can opt out at any time by contacting MIM Europe by e-mail at MetLifeInvestmentsEUPrivacyChampion@metlife.com.
10. CONTACTING YOU
10.1 We may contact you through one or more of the following communications channels: by telephone, mail, email, text (SMS) message, instant messaging or other electronic means.
10.2 We record some telephone calls and other electronic communications for regulatory reasons and for audit purposes. We store call and other communication recordings securely in accordance with our retention policies and applicable data protection laws. Access to those recordings is restricted to those individuals who have a need to access them for the purposes set out in this notice.
11. CONTACTING US
If you would like further information on the collection, use, disclosure, transfer or processing of your personal data, or to exercise of any of the rights listed above, please address questions, comments and requests to MetLifeInvestmentsEUPrivacyChampion@metlife.com.
12. UPDATES
We may amend this Privacy Notice from time to time. Any material changes we make to this Privacy Notice in the future will be posted to our website (https://investments.metlife.com/regulatory-disclosures/metlife-investment-management-europe-limited/). This Privacy Notice was last updated on 22 April 2022.