Mortgage Privacy Policy

"Personal data" is data relating to an identified or identifiable person; in other words, the data or corre-sponding additional data can be used to make inferences about their identity. "Processing" refers to any handling of personal data, e.g. collection, storage, use, disclosure and deletion. "Particularly sensitive personal data" includes data about the person's intimate sphere, health data and other data subject to special protection under data protection law. 

For each data processing operation, there are one or more bodies who bear primary responsibility for ensuring that the data processing complies with the requirements of data protection law. This body is referred to as the "controller." It is responsible, among other things, for responding to requests for in-formation (section 10) and for ensuring that personal data is secure and is not used in a way that devi-ates from what we tell you or from what is permitted by law. Details of third parties with whom we co-operate and who are responsible for their own processing can be found in sections 1, 4 and 6. 

The master data primarily includes the information from the application form and the respective ap-pendices, such as name and contact details, date and place of birth, citizenship, marital status and chil-dren, information on the relationship between multiple applicants, information on the employment situation, on property pledged as collateral and associated legal circumstances, on financing and on securities, as well as other information from application documents, information from identification data (e.g. from your passport, your ID card or other identification documents) and, where applicable, data in connection with risk assessments. For information on financial and tax circumstances, see below under "Financial data."

Master data also includes details regarding relationships with third parties that are affected by the data processing, e.g. advisors, authorized representatives and beneficial owners of equity, interest and re-payments.

We receive master data from the applicants (directly or via general agents and intermediaries), but we may also use data from third parties. These may include other Zurich Group companies and credit bu-reaus, media monitoring companies, participating financial service providers and banks, address dealers, Internet analysis services, authorities, parties to proceedings and publicly available sources such as the commercial register, media and sources on the Internet, public and other registers, etc. 

This data includes information in connection with the initiation, conclusion, fulfillment and manage-ment of the loan relationship (e.g. information in connection with the consultation and customer ser-vice). Contract data also includes information in connection with the property pledged as collateral (e.g. its value, its condition and any tenancy), insurances (fire and natural hazards insurance), insurance claims, complaints and contractual amendments, as well as information about customer satisfaction, which we may collect, for example, by means of surveys. We receive this information from the appli-cants, but possibly also from third parties, e.g. from general agents, intermediaries, authorities, govern-ment agencies, courts and lawyers, and external bodies from which we obtain creditworthiness and financial information. 

Behavioral data refers to details about certain actions, e.g. payments, the use of electronic communica-tions (e.g. whether and when an email was opened), the location (e.g. when a website of ours is used; concerning this subject, please refer to the separate privacy policy), the purchase of products and ser-vices from us, interaction with our social media profiles, contact with general agents and intermediaries, and participation in events, prize draws, competitions and similar events.

Preference data tells us, for example, about needs, about interest in products or services, or when and how our messages are responded to. We obtain this information from analyzing existing data such as behavioral data in order to get to know borrowers better, to tailor our consultation services and offers more precisely to borrowers and to improve our offerings in general. To improve the quality of our anal-yses, we may combine this data with other data that we also obtain from third parties such as address dealers, websites and government agencies, e.g. information on the household size, income class and purchasing power, shopping behavior, contact details of relatives and anonymous information from statistical offices.

Communication data includes name and contact details, the manner, place and time of the communica-tion and usually its content, e.g. details in emails or letters from you or to you or from third parties or to third parties, if the latter also relate to you. This also includes direct and indirect contact with us, e.g. customer service and your customer consultant (e.g. via a website or an app, in a chatbot on the Inter-net or an app). 

There are certain services that we can only make available to you if we are provided with registration data, e.g. because we or our contracting partners wish to know who, for example, has responded to an invitation to an event, because this is technically necessary or because we wish to communicate with you. If you or someone you represent (e.g. a company as your employer) wishes to enter into or realize a contract with us, we need to collect relevant master, contract and communication data from you, and we process technical data when you use our website or other electronic offerings.

To conclude mortgage agreements, we especially process master data, contract data, financial data and communication data of the applicants and of general agents and intermediaries or their contacts. 

Our customer service and our advisory service may also fall under this purpose, as may the assertion of legal claims from contracts (debt collection, legal proceedings, etc.), accounting, the termination of con-tracts and public communication. We also process data for the purpose of assessing and documenting compensation paid to general agents and intermediaries (see also section 6).

We may draw upon other bodies, e.g. IT and logistics companies, advertising service providers, banks or credit bureaus, which may make data available to us for the initiation and conclusion of contracts and the fulfillment and enforcement of contractual relationships. We also collect data via ZIC and via distrib-utors and third-party brokers that work for ZIC. For further information on this, please see section 6. 

When cooperating with companies and business partners, e.g. with partners in projects or with parties in legal disputes, we also process data to initiate and fulfill contracts, for planning purposes, for ac-counting purposes and for other purposes related to the contract.

For example, this includes the legally regulated combating of money laundering and terrorism financing. As a result, we may be under the obligation to make certain inquiries about legal and reputational risks such as political connections ("know your customer"), e.g. by means of relevant third-party directories, or to file reports under certain conditions. Moreover, compliance with disclosure, information or report-ing obligations, e.g. in connection with regulatory obligations, compliance with archiving obligations and support in preventing, exposing and clarifying crimes and other infringements may necessitate or involve the processing of personal data. This includes the receipt and processing of complaints and other re-ports, the surveillance of communication, internal or external checks or the disclosure of documents to a public authority if we have a material reason for so doing or are required to by legal obligations. For these purposes, we especially process master data, contract and financial data, communication data and, under certain circumstances, behavioral data of applicants and customers. Legal obligations may arise from statutory provisions, but also from self-regulation, industry standards, the company's own corporate governance and official instructions and requests. 

For these purposes, we especially process master data, contract data, claims and benefits data, financial data as well as behavioral and communication data. For example, we are required to take measures against fraudulent claims. We may also carry out profiling and create and process a profile (see section 5) for the above purposes and in order to protect you and us from tort and abuse.

We strive to continuously improve our products and services and to be able to react quickly to changing needs. We therefore analyze how, for example, offers are used and how new products and services can be created. This gives us an indication of the acceptance of existing products and services in the market and the market potential of new ones. To this end, we process, in particular, your master data, behav-ioral data, preference data as well as communication data and information from customer surveys, polls and studies and other information, e.g. from the media, from social media, from the Internet and from other public sources. As far as possible, however, we use pseudonymized or anonymized data for these purposes. We may also use media monitoring services or perform media monitoring ourselves, whereby we process personal data in order to carry out media work or to understand and respond to current developments and trends.

We may also disclose data to other Zurich Group companies for market research purposes (section 6).

We may send you information, advertising and product offers from us and from selected third parties, such as as newsletters, via apps and messenger services, as printed matter or by phone, on a regular basis or as part of individual promotions (such as for events, competitions, etc.). We may also personalize notifications so that our information and offers better meet your needs and expectations. To do this, we link data that we process about you, determine preference data and use this data as the basis for personalization (see section 3). We may also carry out profiling for marketing purposes (see section 5). We also process data in connection with contests, prize draws and similar events. Customer care also includes addressing existing customers – in a manner that may be personalized on the basis of behavioral and preference data or data from customer surveys – and organizing customer events (e.g. sponsoring, sports, cultural and promotional events).  In the case of customer events, we process personal data to carry out the events, as well as to inform the participants and to provide them with information and advertising before, during and after the event.

All of this processing is not only important to enable us to promote our offers in the most effective way possible, but also to make relationships with customers and other third parties more personal and positive, to concentrate on our most important relationships and to use our resources as efficiently as possible. 

We may also disclose data to other Zurich Group companies for marketing purposes (section 6).

We continuously review and improve the appropriate security of facilities and buildings and our IT. For this purpose, we process data, for example, in connection with the surveillance of buildings and publicly accessible premises. We are not able to rule out data breaches with absolute certainty, but we do our best to reduce the risk. Thus, we process data, for example, to monitor, control, analyze and test our networks and IT infrastructures, to carry out system and error checks, for documentation purposes and in the context of security copies. 

These other purposes may include training and educational purposes, administrative purposes (such as the management of master data, accounting and data archiving or the management of real estate and the testing, management and ongoing improvement of IT infrastructure), the protection of our rights (e.g. for the enforcement of claims in court, out of court or prior to going to court, before authorities in Switzerland and abroad or to defend ourselves against claims, e.g. by securing evidence, through legal clarifications and by participating in judicial or official proceedings) and the evaluation and improvement of internal processes. In the course of developing our business, we may also sell or acquire businesses, operations or companies to or from other companies or enter into partnerships, which may also result in the exchange and processing of data (including from you, e.g. as a customer or supplier or as a supplier representative). This also includes the protection of other legitimate interests, which cannot be named exhaustively.

Profiling is the automated processing of data for analysis and forecasting purposes. The most important examples are profiling to combat money laundering and terrorist financing in investment products, to combat fraud, for customer care and for marketing purposes (as described in more detail in section 4). For the same purposes, we may also create profiles, i.e. we may combine behavioral and preference data, as well as master data, contract data and technical data assigned to you, in order to better understand you as a person and your different interests and various characteristics. 

In every case, we pay attention to the appropriateness and reliability of the results and take measures against the misuse of this profile or profiling. 

We will inform you in each individual case or mark the decision accordingly if it takes place automatically and results in negative legal consequences or a similar significant impairment for you. In this case, you shall have the rights set out in section 9 if you do not agree with the outcome of the decision.

In the context of the initiation, conclusion, fulfillment and possibly enforcement of the loan relationship and the respective clarifications, we may collect data from third parties (section 3), but also forward data to these, e.g. to authorities (e.g. land register and tax offices and offices for bankruptcy proceedings), notary's offices, courts, respondents and lawyers, and jointly and severally liable debtors. Particularly in the case of divorce or the dissolution of a registered partnership, inheritance disputes or other disputes, we will provide personal data to courts and other retirement provision or vested benefits institutions. When receiving payments, we exchange data with banks. 

In addition to master data, this includes, for example, information for the marketing of our products, also in personalized form. General agencies and intermediaries are required by law and contract to comply with the provisions of the Swiss Data Protection Act. 

We may involve third parties, e.g. advisors and lawyers, for the enforcement of any claims and disclose data to them in the process, e.g. on a mortgage agreement, on outstanding claims and on communication between you and us. 

To the extent necessary, we may share your data with other companies of the Zurich Group, including pensions plans of Zurich Life Insurance Company Ltd, especially for risk measurement and assessment. We may also engage companies of the Zurich Group as service suppliers (see below). We may also disclose your data – especially your master data, contract data and registration data as well as behavioral and preference data – to other companies belonging to the Zurich Group for the purpose of offering their products and services tailored to your individual needs and for their own market research purposes. 

In connection with the exercising of rights, the defense against claims and the fulfillment of legal requirements, we may forward personal data to authorities, government agencies (e.g. bankruptcy offices), courts and other public bodies, e.g. in the context of official, judicial, pre-judicial and extra-judicial proceedings and in the context of statutory information and cooperation obligations. For example, recipients may include offices for bankruptcy proceedings, criminal courts and criminal investigation authorities and tax offices. Data will also be disclosed if we receive information from public bodies, e.g. from tax offices (see above). The authorities process data about you, which they receive from us, under their own responsibility.

The loan relationship and the resulting claims may be transferred by way of assignment or other processes, e.g. for refinancing and other purposes according to the contractual agreements. In this context and for the preparation of such transactions, the required personal data may be sent to potential and actual acquirers and other bodies, e.g. to rating agencies.

We may disclose data, for example, to persons involved in proceedings before courts or authorities, but also to potential buyers of assets and other third parties about whom we will inform you separately where possible, e.g. in declarations of consent or special privacy policies. Other persons include, but are not limited to, authorized representatives, advisors, correspondent banks, other financial institutions and other bodies involved in a legal transaction.

We procure services from providers to ensure that we can deliver our products and services securely and cost-effectively and can concentrate on our core competencies. For example, these services include sales (see section 4), IT services, the dispatch of information, marketing, sales, communication or printing services, facility management, security and cleaning, the organization and holding of events and receptions, debt collection, credit bureaus, anti-fraud measures and services provided by trustees, consultancies and auditing firms. In each case, we provide service suppliers with the data necessary for their services. For example, hosting service suppliers store electronic data on our behalf, which may include sensitive data such as health data. Our service suppliers are each subject to contractual and/or statutory confidentiality and data protection obligations. In exceptional justified cases, they may use such data for their own purposes, e.g. information on outstanding debts and your payment history in the case of credit bureaus or anonymized information for the purpose of improving services.

In many cases, the disclosure is necessary in order to process contracts or provide other services. Even non-disclosure agreements usually do not rule out such types of data disclosure or disclosure to service suppliers. However, given the sensitivity of the data and other circumstances, we take care to ensure that these third parties handle the data in an appropriate manner. 

Many countries outside Switzerland or the EU and EEA currently do not have any laws that guarantee an adequate level of data protection from the perspective of the Swiss Data Protection Act or the GDPR. The contractual arrangements mentioned above may partially compensate for this weaker or missing statutory protection. However, contractual precautions cannot eliminate all risks (in particular with regard to state intervention abroad). You should be aware of these residual risks, even though the risk may be low in individual cases and we take additional measures to minimize it (e.g. pseudonymization or anonymization). 

Therefore, the period for which we retain data depends on legal and internal regulations and on the purposes of processing (see section 4), which also include the protection of our interests (e.g. for the enforcement of claims, for the defense against claims, for archiving purposes and to ensure IT security). If these purposes have been achieved or no longer apply, and if there is no longer a retention obligation, we will delete or anonymize your data as part of our normal procedures.

Documentation and evidence purposes include our interest, processes, interactions and other facts in the event of legal claims and discrepancies, for IT and infrastructure security purposes and to provide evidence of good corporate governance and compliance. Retention may be technically necessary if certain data cannot be separated from other data and we therefore need to retain it with this other data (such as in the case of backups or document management systems). 

Our security precautions may include measures such as encrypting and pseudonymizing data, logging, access restrictions, storage of backup copies, instructions to our employees, confidentiality agreements, audits, etc. We also oblige our contracted data processors to take appropriate security precautions. In general, however, security risks cannot be completely ruled out; certain residual risks are unavoidable. 

When your data is transmitted via our web pages, we protect it during transport using suitable encryption mechanisms. However, we can only secure areas that are under our control. 
If you contact us by email, you do so at your own risk and acknowledge the respective information in the General Terms and Conditions. 

In particular, we may need to process and store your personal data in order to fulfill a contract with you, to protect our legitimate interests, such as the assertion, exercising or defense of legal claims, or to comply with statutory obligations. To the extent legally permissible, in particular to protect the rights and freedoms of other data subjects and to safeguard sensitive interests, we may therefore also reject a data subject's request in whole or in part (e.g. by blacking out certain content relating to third parties or our trade secrets).