VAM Investments Group S.p.a.
Compliance with anti-money laundering rules
Compliance with anti-money laundering rules
The controller, as a company operating in the private equity sector, processes investors' personal data in order to comply with the obligations laid down by anti-money laundering legislation. The processing includes customer due diligence (identification of the investor and of the beneficial owner, verification of Politically Exposed Person status), obtaining information on the source of wealth and of funds, retaining the documentation and, where the conditions are met, reporting suspicious transactions.
Why we process the data and on what legal basis
- Prevention of money laundering and terrorist financing.Legal basis: Legal obligation (Art. 6(1)(c) GDPR)
The relevant legislation is D.Lgs. 231/2007 (the Italian anti-money laundering decree), as amended.
Categories of data subjects
- Investors in the fund (natural persons)
- Directors, legal representatives and authorised signatories of investors that are legal persons
- Beneficial owners (UBOs) of investors that are legal persons
Data subjects requiring greater protection: B2B customers and/or suppliers
Categories of personal data
- Identification data (e.g. first name, surname, date and place of birth)
- Data relating to identity documents (e.g. copy of identity documents)
- Data relating to Politically Exposed Person status (e.g. political or public office or role held)
- KYC/AML information (e.g. source of wealth and source of funds)
Special categories of data
- Political opinions
Grounds for processing special categories of data
- Reasons of substantial public interest (Art. 9(2)(g) GDPR)
Categories of recipients
- Judicial authorities and police forces in the event of investigations or specific requests
- Banca d'Italia (Bank of Italy), for supervisory activities and financial controls
- Unità di Informazione Finanziaria (UIF, Italy's Financial Intelligence Unit) for the reporting of suspicious transactions
Processors
- XION Informatica S.a.s. di Cattivelli & C. (IT services)
- Datev Koinos S.r.l. (Software services)
- Microsoft Ireland Ltd. (Software services)
Transfers to third countries
Some personal data are transferred to countries outside the European Economic Area (EEA). Below you will find, for each transfer, the party involved, the destination country and the safeguard that makes it lawful:
- Microsoft Ireland Ltd. (Software services) — United States (safeguard: EU-US Data Privacy Framework)
Microsoft has obtained certification under the EU-US DPF, which is covered by an adequacy decision of the European Commission.
Retention period
The data are retained for 10 years from the end of the ongoing relationship or from the execution of an occasional transaction (Art. 31 D.Lgs. 231/2007).
Consequences of not providing the data
Providing the data is mandatory, as it is required by anti-money laundering legislation. Without the data requested, VAM cannot carry out customer due diligence and, consequently, cannot establish or continue the relationship with the investor.