Introduction

Nordnet commits to ensure that the following principles are being followed in every processing activity that Nordnet is responsible for. No processing of personal data shall occur unless these basic principles are met.

Lawfulness and fairness

Processing of personal data is only lawful and fair when based on a valid and approved legal basis. The eligibility of each legal basis depends on the purpose for which Nordnet needs to process personal data. Nordnet has established processes to ensure that no personal data may be processed before the purpose and its legal basis has been determined and subject to legal assessment. Nordnet also has a separate process for assessing legitimate interest as a legal basis, where the weighing of interests are documented to ensure fairness and proportionality. Nordnet’s processing activities upon consent as legal basis are conditioned by an active and explicit consent from each data subject after the provision of relevant information on the processing and their rights.

Transparency

Nordnet’s data flows are designed to ensure that data subjects have been informed about the data processing in a concise, transparent, intelligible and easily accessible form. Nordnet provides privacy notices on its external websites, which are available to the data subjects at all times, and any updates are communicated through established communication channels with the data subjects

In the event of a data breach incident that is likely to result in a high risk for the data subjects, Nordnet will ensure that affected data subjects are duly notified about the incident in order to enable necessary precautions. Such communication shall be made without undue delay.

Purpose limitation

Processing of personal data is only allowed if it is processed in a manner that it is compatible with the purposes the data was collected for. The purpose must be specified and explicit.  Nordnet keeps records of processing activities which strictly determines each business function’s processing activities – any planned deviation must undergo new assessments and procedures.

Data minimization

Nordnet shall ensure that processing activities only use the personal data necessary in relation to the purposes for which the data is being processed. This means that in each and every set of processing, Nordnet shall make sure that no more personal data than what is absolutely necessary to fulfill the purpose of the specific processing are used. This obligation applies to the amount of personal data collected, the extent of their processing, the period of their storage, and their accessibility.

Accuracy

Nordnet shall take all reasonable steps to ensure that processing activities are performed on correct and relevant data. This means that Nordnet has implemented mechanisms for safe authentication and verification of the information we collect. Nordnet also undertakes to whenever possible and as often as deemed necessary and adequate, follow-up on and update personal information based on public registers (e.g. SPAR, or similar public registers in respective country). Any inaccurate data shall be rectified or deleted without undue delay.

Storage limitation

No personal data at Nordnet shall be kept in a form which permits direct or indirect identification of a data subject for longer than what is absolutely necessary for the purpose(s) for which the personal data was initially collected and processed. This means that Nordnet has to remove personal data, either by deleting/destroying it or by anonymizing it, as soon as the purpose has seized to exist. To ensure that personal data are not stored for longer than necessary, Nordnet has introduced specific deadlines and routines for deletion and anonymization.

Security and confidentiality

As a data controller, Nordnet continuously work to ensure that our products and services as well as our internal processes meets the requirements set by privacy regulations. Nordnet commits to always implement leading data protection standards and continuously educate our employees regarding data privacy management. Our security is based on well-established standards for architecture and security that ensures continuous maintenance and improvements in accordance to the ongoing changes of the threat landscape. Audits, vulnerability scans and security tests are an integral parts of Nordnet’s ongoing risk and security management.

Nordnet shall take all reasonable steps to ensure that all processing activities are carried out in a manner which ensures appropriate security of the personal data. Such consideration includes, but is not limited to, the nature, scope, context and purposes of processing, likelihood and severity of the risks posed by the processing activities, cost of implementation, and the current state of art. Examples of security measures are pseudonymization, encryption of personal data and effective access controls. Internal confidentiality, like between departments and staff groups, are regulated by internal policies and access controls.

Nordnet has adopted rigorous processes for every planned processing activity, which include impact and risk assessments to ensure that all risks of security and confidentiality breaches are handled properly. In the event of an occured data breach incident, e.g. unlawful disclosure or an unintentional loss of personal data, Nordnet has an established procedure for detection, investigation, assessment, mitigation actions and reporting.

Personal data can in rare cases be transferred to and processed in countries outside the EU/EEA-area (so-called third countries). These transfers only occur under the condition that there is an adequate level of protection or that appropriate measures have been taken, e.g. standard contract clauses approved by the EU-commission with supplementary safeguards whenever required to ensure a substantially equivalent level of protection that is guaranteed by the GDPR. Nordnet conducts transfer impact assessments for data transfers to third countries that aren’t subject to the EU Commission’s adequacy decision in order to evaluate whether such level will be met.

Accountability

In accordance with Article 5(2) of the GDPR, Nordnet is responsible for and shall be able to demonstrate compliance with what has been stated under this section.

General

The CEO is ultimately responsible for Nordnet’s compliance and for ensuring that Nordnet has the expertise and resources necessary in order to fulfill the objectives and processes stated in this overview. To ensure this, there are internal rules to provide more detailed guidance on professional conduct that are reviewed on a regular basis.

To make sure that Nordnet handles personal data in a compliant manner, all employees must comply with all applicable laws and regulations as well as Nordnet’s internal standards and routines. Every single employee within Nordnet is therefore contributing to the work of ensuring that Nordnet’s processing of personal data is appropriate and compliant, of course with the provision of appropriate trainings, tools and resources for this objective. The legal, security and risk departments are, severally or jointly, involved in privacy related processes and provides support and guidance to all departments.

Nordnet is responsible for handling any data breach incident that occurs in Nordnet’s own operations and throughout the chain of data processors. If the incident is deemed likely to result in a risk for the data subjects, a report will be submitted to the supervisory authority without undue delay and within 72 hours after becoming aware of the incident.

Data Protection Officer (DPO)

Nordnet has appointed a DPO with vast knowledge within the data privacy regulations. The DPO shall perform controls and verifications of Nordnet’s compliance with applicable rules on the privacy area. The DPO shall provide recommendations, e.g. in regards of privacy impact assessments. The DPO also functions as a contact point, not only for the data subjects, but also towards the supervisory authority e.g. in case of a data breach incident or a prior consultation on a planned processing activity.

The DPO reports to the highest level of management and Nordnet has constructed the organization in a way that enables and secures the DPO’s independency in relation to the management so that data protection can remain the DPO’s one and only objective and nothing else.

Third parties

As a part of Nordnet’s operations, information may be shared with third parties (including usage of third party tools and services), e.g. entities within the Nordnet corporate group, external suppliers, sub-suppliers, trusted partners and also administrative authorities. In respect to this, Nordnet never shares more information than what is strictly necessary for the relevant processing purpose about which information has been provided to the data subjects. Nordnet takes appropriate and relevant contractual, technical and organizational measures to ensure that suppliers, both in and outside of the EU/EEA, handle personal data in a secure and correct manner in compliance with applicable privacy regulations and Nordnet’s privacy and security policies.

Facilitation of data subject rights

Nordnet’s privacy notices provide information to data subjects about their rights under the GDPR, how to enforce them and all relevant contact details in case they have questions, concerns or complaints in regards of Nordnet’s data processing. The remedies available for the data subjects entail both digital (e.g. functions available in logged-in state) and offline (paper forms available on websites) alternatives, where accurate identification and safety standards aren’t compromised.

Nordnet has established guidelines and routines for the handling of data subject rights, with designated departments for every step, in order to ensure that these requests are correctly managed. The data subject rights do not exist without conditions and exemptions as according to the GDPR, so in a situation where a data subject’s request is partially or entirely denied, an accurate explanation must be provided by Nordnet to the data subject with relevant references.