VPS takes your privacy seriously. We are constantly working to ensure that your personal information is safe with us. On these pages you can find information about how we process your personal information.
VPS and account operators are jointly responsible for your personal information
Anyone who alone or together with others determines the purpose of processing personal information and the means to be used has the role of data controller. The data controller is responsible for the processing of personal data in accordance with the law.
VPS is the only company that has a license to operate securities registers in Norway. We offer registration of shares and other financial instruments, and provide infrastructure and services related to settlement and registration of securities rights. VPS supplies the directory services to investors and issuers through a network of securities companies (brokers), banks and management companies. These have the role of account operators and manage customer relations.
VPS and account operators are jointly responsible for processing your personal information in a good way and in accordance with the Personal Information Act. Accountants and others who register information in the securities register are responsible for ensuring that the information is correct and collected legally and that you are informed in accordance with the law. We in VPS are responsible for ensuring that your personal information registered in the securities register is safe and not stored longer than statutory storage duties and the purpose indicates. If you want access to your information or exercise another right, please contact your account operator.
What personal information do we process about you?
Personal information is information or assessments that can be linked to you as a person. This may for example be name, contact information, account number and securities / transactions. The personal information we process is mainly registered in the securities register by an account operator or generated from your securities market activity, but it also retrieves information from other sources such as the Population Register.
The following categories of personal data are processed:
Identity information: Information about your identity, such as name, social security number, citizenship and possibly tax country / tax rate relevant for deduction of withholding taxes. The information is registered by the account owner who receives the information from you or the information is retrieved from the Population Register operated by the The Norwegian Tax Administration
Contact Information: Information that enables us to have dialogue with you, such as address, phone number and email address. The information is registered by the account operator who receives the information from you or are retrieved from the Population Register, which is operated by the The Norwegian Tax Administration
Account Information: VPS account number and account type, bank account number for bank account associated with a VPS account. VPS account number is generated by establishing an account relationship. It is verified by posting in the Account and Address Book that a bank account associated with a VPS account belongs to the person who creates a VPS account.
Transaction Information: Information about transactions related to your customer relationship, such as the amount and time of purchase and sale of securities, dividends and other transactions. This is generated through your activity and use of our services or corporate actions.
Information about others: Information about other persons associated with a VPS account, such as disposals, pledges and other rights holders.
Web Information: Information we register for visits to www.vps.no, through cookies or scripts on the web pages as a location (using IP address, location data, or the like), information about the pages you visit, information about any products and services you order, and other technical information (such as user behavior, user equipment, browser, and operating system). Unless you sign in or otherwise enter your identity on the site, we will not be able to associate this information with you.
Camera surveillance: VPS premises are monitored to prevent and detect criminal offenses.
How do we use personal information?
The purpose of our use of information about you is primarily to fulfill the obligations we have attached to the operation of the securities register and the provision of registry services through account operators.
Customer Administration: VPS will use your personal information to fulfill the obligations we have undertaken for the implementation of securities registry services. We process, among other things, the name, birth number, address, bank account, citizenship, e-mail address, phone number, holdings and transactions, tax country / tax rate, and if a person is disqualified. It is regulated in section 6-8 of the Securities Register Act and the Securities Register Regulations Section 9 which information is to be included in the register, while information on tax country / tax rate is recorded in accordance with the Tax Payment Act.
Adaptation: We use web information to conduct analysis, personalization of our website, and providing customer service. We use Google Analytics for traffic analysis on our sites. This is based on our legitimate interest in improving and providing our services. However, Google Analytics is configured so that the data obtained from activity on our web pages can not be linked to IP addresses, and therefore, the data can not be linked to you as a person.
Security: VPS conducts continuous technical and organizational security measures to ensure that your personal information is safe with us. We ensure, among other things, that your personal information is protected from loss, destruction, unauthorized change, and unauthorized access. We have a security framework that is regularly updated in line with the threat and technological development.
Logging: Your activity is logged in order to track back what changes have been made and who, for example, if there is a security breach or if there is an error in the systems.
For how long do we store your personal information?
We store information about you only as long as we have a statutory retention obligation or it is necessary for the purpose for which the information was collected.
As a rule, we store personal information during these periods:
• Transaction information and other information deleted from the securities register shall be kept for at least ten years after the Securities Register Act section 6-6.
• The annual assignments we have sent to you show which information we have provided to the IRS are stored for five years after the Accounting Act and the Accounting Regulations.
• Change messages we have sent you are stored for two years.
• Technical logs from our systems and databases are stored for up to six years.
Who do we share your personal information with?
VPS and account operators are subject to confidentiality in the Securities Register Act when processing your personal information. VPS discloses your personal information to others only when it follows from the Securities Register Act or other legislation that we may share the information or are required to complete the agreement with you. We also use certain subcontractors that process your personal information on our behalf regulated in data processing agreements with us.
Account operator, security issuer and others: When we deliver our services and products, this may mean that we must disclose information about you. For example, it will be necessary to disclose certain information in order to transfer your securities to another person by order from you or your account owner, or if you change the account owner. A mortgagee or proprietor of another limited right registered in an account has the right to obtain all information registered in the account that may affect the right. Before we share such information, we will always ensure that we comply with the relevant provisions on confidentiality in the financial and securities sector.
Subcontractors: If VPS issues tasks that require a supplier to process personal information on behalf of VPS, VPS is responsible for our subcontractors processing your personal information in accordance with the Personal Information Act. To ensure that subcontractors process your personal information in a good way and in accordance with the Data processer agreement, we have entered into data processing agreements with our subcontractors.
The Norwegian Tax Administration: VPS is required as a securities register to provide information to the National Tax authorities for pre-completion of the tax report and for control purposes. Every year in February, we send you an annual assignment that shows what information we have sent to the The Norwegian Tax Administration.
The Financial Supervisory Authority of Norway has the right to access information in the securities register in connection with supervisory duties and responsibilities.
Police: The police have the right to access information in the securities register in connection with the prevention and combating of crime.
Enforcement Officer trustees, etc.: Enforcement Officer, trustees and some others are entitled to information
about a person’s ownership in financial instruments when relevant to their case processing.
Oslo Stock Exchange: Persons with key positions in listed companies (primary insiders) shall report their transactions in these companies to Oslo Stock Exchange so that the market is informed of their transactions. VPS delivers information to Oslo Stock Exchange on transactions undertaken by primary insiders so that Oslo Stock Exchange can check that such transactions are reported in accordance with current rules. The extradition is done by law.
Others: Everyone has access to static data on a financial instrument that is not subject to confidentiality. It may also result from special legislation that other than those in front of you are entitled to confidential information in the register.
The Norwegian Central Securities Depository at the general manager is the ata controller for processing your personal information. You can contact us by e-mail firstname.lastname@example.org or phone: 22 63 53 00.
You can also contact our Data Protection Officer (DPO) Marius Meisdalen Sagen by sending an e-mail to email@example.com
You have rights regarding the processing of information about you. Under certain conditions you may, for example, request access to information we have and complain about what you consider to be improper use of information about you.
Data transparency and data portability
The access request gives you the right to gain access to data we have saved about you. This applies to information provided by you, information we have obtained from external sources, and information about processing of the information. If you want access to your personal information, you can log in to Investor Services or contact your account operator.
The right of access does not include internal assessments and similar information that we have prepared based on the personal information we have about you. The right of access also does not apply to certain personal information we have obtained to fulfill statutory obligations, such as anti-money laundering obligations. You will find detailed information and history of your securities accounts and securities in VPS Investor Services.
Data portability is your right to receive personal information you have given to your data controller. The information must be sent in a machine-readable format. This applies to information you have provided directly, based on your consent or to fulfill an agreement.
Opposition to data processing
You have the right to object to the processing of your personal information if VPS’s legitimate interests with processing the data do not exceed your interests.
Contact your account owner to protest against processing your personal information.
Right to delete personal information
We are obliged to keep your personal information as long as they are necessary for the purpose for which they are obtained or they are subject to statutory storage obligations. VPS is required by law to keep information, for example pursuant to the Securities Register Act, for accounting, tax reporting and government reporting.
If you find that we keep your personal information unlawful, you are entitled to request that these be deleted (“the right to be forgotten”).
Contact your account administrator if you wish to request the removal of personal information.
Amendment of incorrect information
If the information is incorrect or incomplete, you have the right to get the information directed to the limitations provided by the law.
Contact your account operator to request amendment of incorrect information.