Automated processing
We sometimes use automated decision-making, such as profiling, to process your Personal Data.
We use automated statistical analysis of the information we collect about you as part of our business:
- When you apply for a financial product, for example a request to trade complex products, we may evaluate the application using simple scoring rules to determine whether or not the product best meets your needs along with a human review of the application.
- To decide the type of financial service suitable for you, or to decide other terms – for example, by assessing your risk profile and informing our decision and offering based on that risk profile.
Why we use automated decision-making:
Automated analysis of our customer information (including your information) as a whole helps us to manage our business for our legitimate interests. It enables us to:
- Make more informed business decisions; including improving the quality of products and services we can offer (including for the purposes of direct marketing, unless you have objected to us using your details in this way). For example, if you give us permission we may use your transaction history/account information to identify your financial habits and offers that are relevant to you based on your account transactions or behaviour.
- Test and maintain the stability and performance of our systems.
- Carry out long-term statistical modelling, provided that such modelling does not affect any decision we make about you.
Automated analysis of your information also enables us to form a single view of your relationship with Davy. We use this information for customer service and administrative purposes. This is intended to help us to manage and build our relationship with you and is an important part of managing our business in our legitimate interests.
- For example, it enables us to establish your eligibility for certain products or services, to identify opportunities to help you improve your financial wellbeing.
Automated analysis of your information assists us to comply with our legal obligations.
- For example, in connection with our money laundering, fraud and terrorist financing prevention obligations, we may use automated processing to screen for suspicious transactions, or to identify applicants which may be subject to international sanctions and to monitor calls, transactions and patterns to prevent and investigate fraud.
There are certain automated analyses of your information that we will only carry out where you have given us your consent (which you can withdraw at any time). We will only automatically process your information to enable us to undertake the following activities where we have your consent:
- Use your biometric information to help identify you when you open or operate an account.
- Where required, use sensitive or special categories of data, as set out in the GDPR.
Disclosure of your personal data
We only share your Personal Data within Davy and with third parties in limited circumstances (“Recipients”). We may share it with the following Recipients:
Recipient Category |
Details |
Davy Group Companies and BOI Group |
- Davy Group companies (including J & E Davy Unlimited Company, J & E Davy (UK) Limited, Davy Corporate Finance Unlimited Company, Davy Securities Unlimited Company) (to manage and administer your account, provide you with the specific products or services you request and to pursue our legitimate interests);
- BOI Group or its member companies or subsidiaries (to protect and pursue our legitimate interests, in pursuance of our legal obligations and in cases of joint ventures and business cross-referrals). Companies which are members of the Bank of Ireland Group include: Bank of Ireland, Bank of Ireland Mortgage Bank u.c., Bank of Ireland Insurance Services Limited, Bank of Ireland Leasing Limited and New Ireland Assurance Company plc;
- Our shareholders;
- Our Board of Directors; and
- Internal business units (that assist with your requests related to our products and services, for example Compliance, Client Services, Capital Markets, Legal & Risk).
|
Third Party Service Providers |
- Your authorised representatives (for example, this can include your attorney (under a Power of Attorney) and any other party authorised by you to receive your personal data);
- Financial institutions (that facilitate the services or products you request);
- Pension fund administrators, trustees of collective investments, undertakings and pensions trustees;
- Third parties that facilitate or execute investments or transactions you have made (e.g. third party custodians) and those you ask us to share your Personal Data with;
- IT service providers;
- Other service providers who provide support services or require your Personal Data to perform the services requested by us; and
- Training and professional programme providers.
|
Joint Account or Product Holder |
- If you open or hold a joint account or product, this may mean that your Personal Data will be shared with the other applicant. (For example, transactions made by you will be seen by your joint account holder, and you will see their transactions or we may act on the authority of one joint account holder to share or allow a third party access to your account information for the provision of payment services including transaction details.)
|
Third Party Advisors / Professionals |
- External advisors e.g. lawyers, accountants, insurers, insurance brokers and auditors (as necessary to protect our legitimate and legal interests).
|
Prospective Buyers |
- Prospective buyers of business assets (to facilitate the acquisition of Davy or part of Davy or a substantial portion of our assets by a third party).
|
Legal / Regulatory Bodies |
- Regulatory authorities and law enforcement agencies (where we are under a duty to disclose or share your Personal Data in order to comply with any legal or regulatory obligation or request) such as the Central Bank of Ireland, the European Central Bank, Revenue Commissioners, the Data Protection Commission, the Irish Courts, An Garda Síochána, Financial Services and Pensions Ombudsman Bureau of Ireland, Criminal Assets Bureau, US, UK, EU and other designated authorities in connection with combating financial and other serious crime.
|
Transfers of your personal data
Please note that, in order to administer your account some of your Personal Data may be transferred outside the European Economic Area or the United Kingdom to other entities within the Davy Group and other Recipients. Certain Recipients who process your Personal Data on our behalf may transfer your Personal Data outside the EEA or the UK to a country that does not provide an adequate level of protection to your Personal Data. In most instances, these transfers are carried out to the United States, India, Colombia or Singapore. Where such transfers occur, it is our policy that: a) they do not occur without our prior written authority; and b) that an appropriate transfer mechanism is put in place to protect your Personal Data such as: (i) Module 1 (controller-to-controller) or Module 2 (controller-to-processor) of the European Commission's Standard Contractual Clauses; (ii) an adequacy decision of the European Commission (namely, the UK adequacy decision); or (iii) any other transfer mechanism approved by the European Commission (e.g. a EU-US data privacy framework). If you would like to find out more about any such transfers, please contact our Head of Data Protection at dataprotection@davy.ie.
How long we hold your personal data
The length of time we hold your Personal Data depends on a number of factors, such as regulatory rules and the type of financial product/service we have provided to you.
Those factors include:
- The regulatory rules contained in laws and regulations set by authorities like the Central Bank of Ireland, for example, in the Consumer Protection Code.
- The type of financial product/service we have provided to you. For example, we may keep data relating to a pension product for a longer period compared to data regarding an investment product.
- Whether you and we are in a legal or some other type of dispute with another person or each other.
- The type of data we hold about you.
- Whether you or a regulatory authority asks us to keep it for a valid reason.
Generally, your Personal Data will be retained until the end of your client relationship with Davy or after an investment has matured/encashed plus a reasonable period of time after that (in most cases 7 years) to: a) respond to any client account related enquiries; b) deal with any legal matters (e.g. legal proceedings); or c) comply with applicable Irish or European Union law.