Privacy Statement

The processing of your data (in general)

Swift (with registered office at Avenue Adele 1, B-1310 La Hulpe, Belgium) is committed to protecting your privacy. For any questions related to your privacy, you can contact the Swift Privacy Officer at the aforementioned address or by e-mail at privacy.officer@swift.com. This Privacy Statement explains how your personal data is processed by Swift when using the Sanctions Testing website. In this regard, Swift will process all your personal data in compliance with the EU General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679) and other applicable data protection legislation (hereinafter "Data Protection Laws").

In general, Swift will process your personal data supplied during your use of this website for the following purposes: facilitating your surfing behaviour, conducting website usage surveys and, more generally, for the exercise of Swift''s obligations, rights and remedies as set out in this Privacy Statement and the related General Terms and Conditions.

For these purposes, Swift will process the following data pertaining to you: your IP address, last name, first name, company name, contact details (e-mail address, mobile number).

This data will be primarily processed for the performance of your contract with Swift in order to use the Sanctions Testing website. All mandatory data needed for this, are indicated with an asterisk. Failing to provide this mandatory data, will prevent Swift from performing its contract with you (in accordance with the related General Terms and Conditions).

Finally, we process your personal data as well for security purposes (as detailed below). This is both in Swift''s and your legitimate interest in order to prevent any threats or incidents to be happening, with this Website.

Data Security

Swift is committed to protect your personal data against accidental or unlawful destruction, accidental loss, alteration, and unauthorised disclosure or access. Therefore, we monitor and record the traffic, both incoming and outgoing, in order to preserve the security, integrity and availability of our infrastructure. These data are kept for up to one year. Please be aware that we cannot ensure the security of your data on your computer or during transmission over the Internet. In this regard, we advise you to take every possible precaution to protect personal data stored on your computer and transiting on the Internet.

IP Addresses

When you browse the public part of our websites, you do so anonymously. For our internal purposes, we may use IP addresses (the Internet address of your computer) stored in web logs to generate aggregate statistics on surfing behaviour, such as traffic patterns and time spent on a page.

Cookies

In addition, this Website uses cookies. Cookies are small pieces of information that are stored by your browser on your computer''s hard drive or in your browser memory. The information stored with cookies may include login ID.

Hyperlinks to other websites

This Website contains links to other websites not owned or operated by Swift. Swift is not responsible for the privacy practices of these websites.

Web Acceleration Services

For purposes of accelerating the consultation of our websites, we use the services of a supplier specialised in web acceleration services. This requires caching the content of our websites on a substantial number of servers worldwide. This supplier only processes data on our instructions, provides sufficient guarantees in respect of technical and organisational data security measures, and has committed to notify us in case of a security breach compromising your personal data (see also ''Sharing Data'' section below).

Statistics

We may use the personal data you provide for Swift''s own internal statistical purposes. These statistics will only include aggregated data and will be used in aggregated form for taking internal management decisions.

Subcontracting and sharing of data

If required for the purposes mentioned above, Swift may share your data with other offices in the Swift group (see the Swift Offices page). In addition, Swift reserves the right to sub-contract (a) part(s) of its data processing operations to third party service providers. In such case, the appointed third party service provider may only process your data on behalf of and under the written instructions and sole control of Swift. You acknowledge and agree that, where Swift shares data with other offices in the Swift group or sub-contracts part(s) of its data processing operations to a third party service provider, this may involve the transfer of your personal data to a country located outside the European Economic Area. Where such country does not offer a level of data protection considered as adequate under applicable the EU Data Protection Laws, Swift will ensure the lawfulness of such transfers by a legitimate data transfer agreement (i.e. the Model Contractual Clauses as adopted by the European Commission) or any other valid arrangement. For more information on these transfers, you can consult the Swift Privacy Officer at Privacy.Officer@swift.com.

No further sharing of your data

Notwithstanding the forgoing, Swift shall not disclose, sell, rent or exchange your personal data to any other organization or entity, unless you are first notified and have expressly agreed with it, or unless as otherwise required by law or requested by government agencies, such as law enforcement authorities, for example in the framework of a judicial procedure.

Your Data Protection Rights

Notwithstanding the forgoing, Swift shall not disclose, sell, rent or exchange your personal data to any other organization or entity, unless you are first notified and have expressly agreed with it, or unless as otherwise required by law or requested by government agencies, such as law enforcement authorities, for example in the framework of a judicial procedure.

Your personal data will be kept by Swift for 6 months upon termination of the contract, after which your personal data will be deleted. During this period, you have the right to consult, correct, restrict and even erase your own personal data (in accordance with the Data Protection Laws) and can oppose to the use of your personal data for direct marketing purposes. In addition, you can withdraw your consent at any time and without motivation for those types of data processing to which you consented. Note however that this does not affect the lawfulness of the data processing based on your consent before the withdrawal. Finally, you have as well the right to oppose to the processing of your personal data for the security purposes mentioned above if you believe that in this case the legitimate interest of Swift is overridden by your own interests and/ or data protection rights. In this case, Swift shall no longer process your personal data for these security purposes unless it can demonstrate compelling legitimate grounds for this processing which override your interests and/ or data protection rights or for the establishment, exercise or defense of legal claims. You can update your own privacy settings and change your personal data at any time through your preference center. In addition, you may exercise your data protection rights by sending your request together with a proof of your identity to Swift''s Privacy Officer (privacy.officer@swift.com).

If you have any other questions or complaints regarding the processing of your personal data, you can also contact Swift''s Privacy Officer or lodge a complaint with the supervisory data protection authority. As Swift is established in Belgium, it is subject to the Belgian data protection authority:

• Commission for the Protection of Privacy
• Rue de la Presse 35, 1000 Brussels
• Phone: +32 (0)2 274 48 00
• Fax: +32 (0)2 274 48 35
• E-mail: commission@privacycommission.be
• Website: www.privacycommission.be

Miscellaneous

This Privacy Statement will be updated each year and without prior notice to you. Swift will indicate at the top of this Privacy Statement when it was most recently updated.

Please note as well that this Privacy Statement only applies to the processing of personal data as outlined above. Our other data processing activities are covered by other Swift policies. They are:

• The Swift Personal Data Protection Policy: it explains how we process our customer contact details (when collected on our websites - this part is common to this Statement - or on paper) and personal data that our customers encapsulate in Swift messages or files ("message data"). Where relevant for the purposes of this Statement, we will explicitly refer to that Policy.
• The Swift Data Retrieval Policy: it explains how we retrieve, use, and disclose message and traffic data. It is not relevant for the purposes of this Statement.