Harmonic Group Disclosure Notice Regarding Compliance With Data Protection Law 2017 Of The Cayman Islands – Cayman Entities

Harmonic Group Disclosure Notice Regarding Compliance With Data Protection Law 2017 Of The Cayman Islands – Cayman Entities

 

INTRODUCTION AND DEFINITIONS

We are providing you with this Disclosure Notice because you have a business relationship with Harmonic (as defined below) as Harmonic’s client (“Client Relationship”) pursuant to a services agreement (howsoever called, for example, administration agreement) between Harmonic and you (“Services Agreement”).

In this Disclosure Notice certain other defined terms appear, whose meaning is as follows:

  • “AML/ATF/APF” means anti-money laundering, anti-terrorism financing and anti-proliferation financing;
  • “Data Subject” means the living individual to whom the Personal Data relates;
  • “DPL” means the Cayman Islands Data Protection Law, 2017, as amended;
  • “Harmonic” means the relevant Harmonic Cayman operating entity which has the Client Relationship with you;
  • “Harmonic Cayman” means any of Harmonic Fund Services, Wavelength Financial Technology Ltd., Harmonic Corporate Services Limited or Ancova Limited;
  • “Personal Data” means data relating to a living individual who can be identified and includes data such as
    • the living individual’s location data, online identifier or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the living individual;
    • an expression of opinion about the living individual; or
    • any indication of the intentions of the data controller or any other person in respect of the living individual;
  • “processing”, in relation to data, means obtaining, recording or holding data, or carrying out any operation or set of operations on Personal Data, including –
    • organizing, adapting or altering the Personal Data;
    • retrieving, consulting or using the Personal Data;
    • disclosing the Personal Data by transmission, dissemination or otherwise making it available; or
    • aligning, combining, blocking, erasing or destroying the Personal Data;
  • “Sensitive Personal Data” means, in relation to a Data Subject, Personal Data consisting of any types of data specified in the DPL, of which those types most relevant are any criminal history of the Data Subject (which may be obtained as part of background and screening checks).

THE DATA PROTECTION LAW, 2017 OF THE CAYMAN ISLANDS AND EFFECT ON HARMONIC GROUP

The DPL will enter into effect from 30 September 2019. The DPL will affect any operating entity of Harmonic Cayman which controls or processes Personal Data in the course of its business.

In the course of its business activities Harmonic is required to receive and handle a wide range of data and information. Some of that data and information will be Personal Data and accordingly the DPL will apply to the collection, use and retention of that Personal Data. In certain limited circumstances that Personal Data may also be Sensitive Personal Data as defined above. This Disclosure Notice outlines Harmonic Group’s policy statement as to its data protection obligations and your data protection rights as they relate to your Client Relationship with Harmonic under the DPL.

THE DATA PROTECTION PRINCIPLES

Harmonic is committed to complying with the data protection principles enshrined in the DPL, summarised as follows:

  • Personal Data shall be processed fairly and only if the conditions specified in the DPL are met.
  • Personal Data shall be obtained only for one or more specified lawful purposes, and shall not be further processed in any manner incompatible with that purpose or those purposes.
  • Personal Data shall be adequate, relevant and not excessive in relation to the purpose or purposes for which it is collected or processed.
  • Personal Data shall be accurate and, where necessary, kept up to date.
  • Personal Data processed for any purpose shall not be kept for longer than is necessary for that purpose.
  • Personal Data shall be processed in accordance with the rights of Data Subjects under the DPL
  • Appropriate technical and organizational measures shall be taken against unauthorized or unlawful processing of Personal Data and against accidental loss or destruction of, or damage to, Personal Data.
  • Personal Data shall not be transferred to a country or territory unless that country or territory ensures an adequate level of protection for the rights and freedoms of Data Subjects in relation to the processing of Personal Data. Certain exceptions to this principle apply, as set out in the DPL.

ROLE OF HARMONIC

In Harmonic’s use of Personal Data, Harmonic will be characterised either as a “data controller” (meaning the person who, alone or jointly with others determines the purposes, conditions and manner in which Personal Data is, or is to be, processed) or as a “data processor” (meaning any person who processes Personal Data on behalf of a data controller) under the DPL.

A. HARMONIC AS DATA CONTROLLER

Harmonic is data controller in respect of Personal Data of or provided by its clients but only in respect of Personal Data in relation to the client provided by the client to satisfy Harmonic’s own obligations to verify identity of its client under applicable AML/ATF/APF laws and regulations.

You understand that by virtue of your Client Relationship with Harmonic and your associated interactions with Harmonic (including the recording of electronic communications or phone calls where applicable) or by virtue of you otherwise providing Harmonic with personal information on individuals connected with you, for AML/ATF/APF or other reasons, (for example directors, trustees, employees, representatives, shareholders, investors, clients, beneficial owners or agents), you will provide Harmonic with certain personal information which constitutes Personal Data. This includes, but is not restricted to, data such as name, residential address, email address, telephone number, place of birth, date of birth, passport number, social security number, tax ID number, bank account details, personal details required to complete background checks and personal details required to complete AML/ATF/APF checks (including but not limited to identification verification information, source of funds information and source of wealth information).

Harmonic processes this Personal Data for the following purposes: (i) the performance of the Services Agreement; and (ii) compliance with legal obligations to which Harmonic is subject (such as AML/ATF/APF obligations).

Harmonic may from time to time provide you with information on products and services that may be of interest. Personal Data is also processed by Harmonic for quality control, business and statistical analysis, tracking fees and costs, training and related purposes. It should be noted that any such use of your Personal Data in either of these two ways would of course be subject to any relevant overriding prohibitions or restrictions in such use by Harmonic in the Services Agreement.

Accordingly, you understand and consent that Harmonic may use your Personal Data for such purposes as described above, provided that Harmonic is acting fairly and in accordance with the conditions under the DPL and also noting your right to withdraw your consent at any time, as discussed below.

Your continuation of the Client Relationship with Harmonic shall constitute signification of your agreement to Harmonic’s processing of your Personal Data as indicated above. Should Harmonic wish to use your Personal Data for other specific purposes that require your consent, Harmonic will of course contact you to request this.

B. HARMONIC AS DATA PROCESSOR

Harmonic’s clients provide Harmonic with certain Personal Data in the course of their Client Relationship, including in respect of investors in a fund client. Harmonic is data processor in respect of Personal Data provided by its clients (other than Personal Data provided by the client to satisfy Harmonic’s own obligations to verify identity of its client under applicable AML/ATF/APF laws and regulations) in the performance of Harmonic’s obligations under the Services Agreement. The Services Agreement contains data processing/protection obligations on both Harmonic and the client, and the client remains the data controller who determines the purposes, conditions and manner in which the Personal Data transmitted to Harmonic is processed. The obligations of Harmonic and rights of Data Subjects described in this Disclosure Notice only apply to Personal Data processed by Harmonic as data controller.

HARMONIC’S DISCLOSURE/TRANSFER AND STORAGE OF PERSONAL DATA

It may be necessary for Harmonic to transfer Personal Data for processing, back-up or storage to an agent, delegate, subcontractor or other representative of Harmonic appointed by Harmonic (pursuant to authority in the terms of the Services Agreement, if applicable) to carry out sub-processing activities on behalf of Harmonic (each a “Permitted Processor”) under an appropriate written agreement between the Permitted Processor and Harmonic. Such Permitted Processors may be in the Cayman Islands or outside the Cayman Islands and may be Harmonic Group affiliates or unaffiliated with Harmonic Group. The current list of Permitted Processors for Harmonic Cayman is attached as Appendix 1 and such list may be revised from time to time and will be posted on Harmonic’s website.

Harmonic may only transmit Personal Data (a) to Permitted Processors with the prior written consent of the counterparty to the Services Agreement (“Counterparty”); or (b) where required to do so under applicable law.

In addition, it may be necessary for Harmonic to transfer Personal Data to certain third parties, upon the instruction of the Counterparty, whose involvement is necessary to carry out all or part of Harmonic’s duties and obligations contemplated under the Services Agreement and in accordance with Harmonic’s internal written procedures. In such instances any such third party will not be a Permitted Processor of Harmonic and will instead be engaged directly by the Counterparty as a processor. Finally, where Harmonic is required to transfer Personal Data to a legal, regulatory or taxation authority under applicable law any such transfer shall not constitute the engagement of a Permitted Processor by Harmonic.

You understand that in certain circumstances and at all times in compliance with applicable law Harmonic and/or Permitted Processors may be legally obliged to share your Personal Data and other financial information with respect to your Services Agreement with their local authorities including regulatory, law enforcement or other governmental authorities (including tax authorities) or courts (collectively “Government Bodies”) and the local Government Bodies, in turn, may exchange this information with foreign Government Bodies including Government Bodies located in the Cayman Islands or elsewhere through automatic reporting, information exchange or otherwise.

As is evident from Appendix 1, certain Harmonic Group operating entities (including of course Harmonic Cayman) and Permitted Processors are located in the Cayman Islands and so Personal Data will be stored on servers in the Cayman Islands, and certain Harmonic Group operating entities and certain Permitted Processors are located outside the Cayman Islands and in that case Personal Data will be stored on servers outside the Cayman Islands.

Subject to applicable provisions of the DPL, the Personal Data shall not be shared other than as described herein. In this context then, it is important for you to note that Personal Data may be transmitted, stored and processed on systems located outside of the Cayman Islands, which systems are or may be operated by a Permitted Processor (and therefore authorities including regulatory or governmental authorities or courts in a jurisdiction (including jurisdictions where these parties are established or hold or process Personal Data) may obtain access to Personal Data which may be held or processed in such a jurisdiction or accessed through automatic reporting, information exchange or otherwise in accordance with the laws and regulations applicable in such jurisdiction).

THE DATA PROTECTION MEASURES HARMONIC TAKES

Any transmission of Personal Data by Harmonic to a Permitted Processor shall be in accordance with the conditions in the DPL.

Harmonic applies and contractually obligates Permitted Processors to apply appropriate information security measures designed to protect Personal Data in Harmonic’s/Permitted Processors’ possession from unauthorized or unlawful processing and against accidental loss, destruction, or damage.

YOUR DATA PROTECTION RIGHTS

Where Harmonic is acting as data controller, you understand that you have certain rights under the DPL regarding Harmonic’s use of Personal Data such as:

  • the right to access your Personal Data;
  • the right to request to cease processing, or to not begin processing, or to cease processing for a specified purpose or in a specified manner, your Personal Data;
  • the right to request to cease, or to not begin processing for the purposes of direct marketing, your Personal Data;
  • the right to receive information regarding any entities to which Harmonic discloses your Personal Data; and
  • the right to lodge a complaint with the Cayman Islands Ombudsman in accordance with the procedure set out in the DPL.

Please note that the right to request that your Personal Data cease being processed, not begin to be processed or cease being processed for a specified purpose or in a specified manner is not likely to be applicable to most, if not all, of the Personal Data provided to Harmonic, given the specific nature of the purposes for which Harmonic uses the Personal Data, as described above.

Harmonic shall notify you of any Personal Data breach affecting you, meaning a breach of security leading to the accidental or unlawful destruction, loss, alternation, unauthorized disclosure of or access to, Personal Data transmitted, stored or otherwise processed. The DPL sets out the procedure to be followed for such notification.

HARMONIC’S RETENTION OF YOUR PERSONAL DATA

Harmonic or Permitted Processors may retain your Personal Data following the conclusion of your Client Relationship with Harmonic for such minimum period as may be required by applicable laws.

GETTING IN TOUCH

A member of staff has been designated as Responsible Person Group-wide for each of (i) the receipt of any queries relating to data protection under the DPL or in the event a Data Subject wishes to discuss his/her data protection rights under the DPL with Harmonic (“General Queries”), and (ii) communicating with the Cayman Islands Ombudsman. As at the date of this Disclosure Notice the following is the email address for General Queries: GDPR@harmonic.ky

 
 

APPENDIX 1

Harmonic Fund Services:

1) Permitted Processors who are Harmonic Affiliates

Harmonic Affiliates Location
Wavelength Financial Technology Ltd. Cayman Islands
Harmonic Corporate Services Limited. Cayman Islands
Ancova Limited. Cayman Islands
Harmonic Fund Services Canada Inc. Toronto, Canada
Harmonic Fund Services Ireland Limited. Dublin, Ireland
Harmonic Consulting Ireland Limited. Dublin, Ireland
Harmonic Fund Services Luxembourg S.A. Luxembourg
Harmonic Fund Services (Shanghai) Co. Ltd. Shanghai, China
Harmonic S.A. Geneva, Switzerland

2)Permitted Processors who are not Harmonic Affiliates

Entity Purpose Country Website
KPMG (Cayman Islands) LLP Harmonic’s External Auditor Cayman Islands https://home.kpmg/ky/en/home.html
Cayshred Document Shredding Services Cayman Islands http://www.cayshred.com/
Filesafe Document Archiving Cayman Islands
Lexis Nexis KYC and AML processing USA https://internationalsales.lexisnexis.com
Microsoft Corporation Cloud Services provider USA www.microsoft.com

 
 

Harmonic Corporate Services Limited:

1) Permitted Processors who are Harmonic Affiliates

Harmonic Affiliates Location
Wavelength Financial Technology Ltd. Cayman Islands
Harmonic Fund Services. Cayman Islands
Ancova Limited. Cayman Islands
Harmonic Fund Services Canada Inc. Toronto, Canada
Harmonic Fund Services Ireland Limited. Dublin, Ireland
Harmonic Consulting Ireland Limited. Dublin, Ireland
Harmonic Fund Services Luxembourg S.A. Luxembourg
Harmonic Fund Services (Shanghai) Co. Ltd. Shanghai, China
Harmonic S.A. Geneva, Switzerland

2) Permitted Processors who are not Harmonic Affiliates

Entity Purpose Country Website
KPMG (Cayman Islands) LLP Harmonic’s External Auditor Cayman Islands https://home.kpmg/ky/en/home.html
Cayshred Document Shredding Services Cayman Islands http://www.cayshred.com/
Filesafe Document Archiving Cayman Islands
Lexis Nexis KYC and AML processing USA https://internationalsales.lexisnexis.com
Microsoft Corporation Cloud Services provider USA www.microsoft.com

 
 

Ancova Limited:

1) Permitted Processors who are Harmonic Affiliates

Harmonic Affiliates Location
Wavelength Financial Technology Ltd. Cayman Islands
Harmonic Corporate Services Limited. Cayman Islands
Harmonic Fund Services. Cayman Islands
Harmonic Fund Services Canada Inc. Toronto, Canada
Harmonic Fund Services Ireland Limited. Dublin, Ireland
Harmonic Consulting Ireland Limited. Dublin, Ireland
Harmonic Fund Services Luxembourg S.A. Luxembourg
Harmonic Fund Services (Shanghai) Co. Ltd. Shanghai, China
Harmonic S.A. Geneva, Switzerland

2) Permitted Processors who are not Harmonic Affiliates

Entity Purpose Country Website
KPMG (Cayman Islands) LLP Harmonic’s External Auditor Cayman Islands https://home.kpmg/ky/en/home.html
Cayshred Document Shredding Services Cayman Islands http://www.cayshred.com/
Filesafe Document Archiving Cayman Islands
Lexis Nexis KYC and AML processing USA https://internationalsales.lexisnexis.com
Microsoft Corporation Cloud Services provider USA www.microsoft.com

 
 

Wavelength Financial Technology Ltd:

1) Permitted Processors who are Harmonic Affiliates

Harmonic Affiliates Location
Harmonic Fund Services. Cayman Islands
Harmonic Corporate Services Limited. Cayman Islands
Ancova Limited. Cayman Islands
Harmonic Fund Services Canada Inc. Toronto, Canada
Harmonic Fund Services Ireland Limited. Dublin, Ireland
Harmonic Consulting Ireland Limited. Dublin, Ireland
Harmonic Fund Services Luxembourg S.A. Luxembourg
Harmonic Fund Services (Shanghai) Co. Ltd. Shanghai, China
Harmonic S.A. Geneva, Switzerland

2) Permitted Processors who are not Harmonic Affiliates

Entity Purpose Country Website
KPMG (Cayman Islands) LLP Harmonic’s External Auditor Cayman Islands https://home.kpmg/ky/en/home.html
Cayshred Document Shredding Services Cayman Islands http://www.cayshred.com/
Filesafe Document Archiving Cayman Islands
Lexis Nexis KYC and AML processing USA https://internationalsales.lexisnexis.com
Microsoft Corporation Cloud Services provider USA www.microsoft.com