Data Privacy and Personal Data Protection Policy

Protection of Personal Data
At Generali Investments, Management Company LLC, we pay particular attention to data protection and handle personal data with care, responsibility and accordance with the applicable regulations. We respect your right to privacy and process your data in a manner that safeguards your interests, fundamental rights and freedoms. We process personal data lawfully, fairly and in a transparent manner that ensures an appropriate level of security of personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, through appropriate technical and organisational measures. Before commencing the processing of your personal data, we carefully assess the proportionality of the intended processing against any positive or negative effects it may have on you and on your rights relating to the protection of personal data.

Legal basis
The legal basis for the processing of personal data is provided by:

• Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation -GDPR);
• the Personal Data Protection Act (ZVOP-2);
• the Investment Funds and Management Companies Act (ZISDU-3);
• the Electronic Communications Act (ZEKom-2);
• the Prevention of Money Laundering and Terrorist Financing Act (ZPPDFT-2);
• the Rules on the technical conditions to be met by secure remote or electronic procedures and means of identification;
• tax regulations;
• any other applicable regulations governing the processing and/or protection of personal data.

Controller of personal data
The controller of personal data is Generali Investments, Management Company LLC, Dunajska cesta 63, 1000 Ljubljana (hereinafter: Generali Investments). Access to your personal data, and the right to process it for precisely defined purposes, is granted only to authorised employees of Generali Investments and to carefully selected authorised processors engaged by the company (IT service providers, the custodian, etc.) who are able to provide sufficient guarantees, including as regards the security of processing, and who have entered into a personal data processing agreement with us, under which they are bound by the same standards of personal data processing as apply to us.

Generali Investments has appointed a Data Protection Officer. The Data Protection Officer may be contacted at dpo@generali-investments.si.

Personal data
Personal data means any information relating to an individual, such as name, surname, tax number, e-mail address, and any other data capable of identifying an individual or relating to them.

When entering into a business relationship or registering for a consultation, you are required to provide us with your true, accurate and complete personal data and to notify us of any subsequent changes.

Purposes of the processing of personal data

We process your personal data on the basis of our business relationship with you (a signed accession statement or contract), on the basis of law, on the basis of our legitimate interest, and on the basis of your consent.

Processing of data for purposes other than those for which the personal data were originally collected is permitted only where such processing is compatible with the purposes for which the personal data were originally collected, or where this is provided for by applicable regulations.

We will not disclose your personal data to any third party without your written consent, except in cases determined by law. As a rule, we process your personal data within the EU and the European Economic Area (“EEA”). In certain cases, however, we also transfer your data to recipients outside the EU and the EEA; in such cases, too, the same level of protection of personal data will be ensured as if we were carrying out the processing ourselves, and all requirements of the regulations governing the transfer of personal data to third countries will be observed.

Processing based on contract
We process your personal data in connection with the provision of the following services:

• management of the sub-funds of the Generali Umbrella Fund
• management of alternative investment funds, and
• management of financial instruments (including the management of individual investment accounts – INR),

for the purpose of fulfilling our obligations under our business relationship with you.

When entering into the relationship (by signing an accession statement or contract), we request from you all data that we are required to obtain from you under applicable regulations. If you do not provide us with all the necessary data, we will ask you to do so; if you subsequently still do not wish to provide the data, we reserve the right not to enter into the relationship with you, or to terminate it. When entering into the relationship, or subsequently, you may also voluntarily provide us with other data that are not expressly required when entering into the relationship. In certain cases, in accordance with the regulations, we may also obtain certain data from third parties or from public sources.

Before entering into the relationship, we may process the data you provide to us in order to contact you regarding advisory services, to determine your financial profile for the purpose of providing suitable product advice, or to inform you about our offering (sending the weekly commentaries of the fund management team and e-newsletters, informing you about the company’s promotional activities, and sending articles, our own magazines, invitations to events, offers, promotional materials, greeting cards, newspapers and prize competitions).

Processing based on law
Under various pieces of legislation, we process personal data in order to fulfil our legal obligations, for purposes imposed on us by the regulations (e.g. tax regulations, regulations governing the prevention of money laundering and terrorist financing, etc.).

Identification of clients in the mobile application – biometric data
Within the framework of the use of the Generali Investments mobile application, and for the purpose of implementing the provisions of the Prevention of Money Laundering and Terrorist Financing Act, we establish and verify the identity of clients using remote or electronic procedures, namely with the assistance of an external contracted provider who, for this purpose, independently carries out the capture and processing of biometric facial data (the captured facial image, identity verification and liveness detection) in accordance with applicable regulations. Biometric data are not transferred to, and are not processed by, the company. From the external provider, the company receives only the personal data that it retains pursuant to Article 8 of the Rules on the technical conditions to be met by secure remote or electronic procedures and means of identification and Article 142 of the Prevention of Money Laundering and Terrorist Financing Act, together with information on the outcome of the identification procedure carried out, which is necessary for the fulfilment of legal obligations. Before the identification procedure begins, the individual is informed of the processing of personal data and, in accordance with Article 7 of the Rules on the technical conditions to be met by secure remote or electronic procedures and means of identification, gives explicit consent to the performance of such an identification procedure and to the retention of data for the periods laid down by law.

Processing based on legitimate interest
We may process personal data in order to pursue our legitimate interests or the legitimate interests of third parties, except where such interests are overridden by the interests or fundamental rights and freedoms of the individual to whom the personal data relate, which require the protection of personal data, in particular where the data relate to a child. Legitimate interests are our interests relating to the pursuit of our activity in a customer-friendly and secure manner, in compliance with the applicable requirements. We substantiate processing on the basis of legitimate interest by means of an impact assessment, in which we identify the legitimate interest pursued and assess whether the interests of the individuals whose data are to be processed might override the company’s legitimate business interest.

The company’s legitimate interests are the development, advertising and offering of savings products and services, the improvement of business processes, ensuring legal compliance of operations, ensuring the security of operations and of data processing, better tailoring of our offering, and improving your user experience.

Processing based on consent

We may also process personal data on the basis of your voluntary consent. By giving your consent, you agree that personal and other data collected in connection with the provision of our services, or through other forms of interaction (including, for example, information collected via a web browser), may be collected, stored and used for the selected purposes. We receive data directly from you or from other sources (social networks, websites or other public sources), or they are provided to us by contracted providers who, under our authorisation, collect personal data or carry out surveys or market research. Where a consent is only partially completed, you authorise us to enter into the database the missing data that we hold on the basis of other conclusory, transactional or sales-related documentation.

Within the scope of your consent, you may specify one or more of the following purposes of processing of personal data:

• direct marketing (e.g. informing you about the company’s promotional activities and targeted (segmented) marketing, such as the sending of news, articles, our own magazines, invitations to events, offers, promotional materials, greeting cards, newspapers and prize competitions),
• surveys or market research for our own purposes,
• statistical processing,
• profiling and monitoring of the client’s purchasing behaviour (including for past periods) on the basis of past activities, and the receipt of messages and benefits tailored and addressed to you.

Consent primarily serves the development of our products and services, the tailoring of our offering, the improvement of your user experience, the provision of company notices, and assistance with financial decisions. Your consent does not affect any prior consents you may have given us before it took effect, insofar as it is not inconsistent with them. Notification on the basis of consent is carried out through the communication channels you selected when giving your consent. Notwithstanding the foregoing, you have the right, at any time, free of charge and without giving reasons, to withdraw your consent to the processing of your personal data for direct marketing purposes (right to object). In that case, we will no longer process your personal data for those purposes.

Processing within the Generali ZAME Loyalty Programme
If you are a member of the Generali ZAME Loyalty Programme, your personal data are processed, together with the co-founder, GENERALI zavarovalnica d.d., in accordance with the Rules of the Generali ZAME Loyalty Programme.

Personal data retention period

The retention period for personal data depends on the type of personal data, the purpose of their processing, and the applicable legal requirements. Under the Prevention of Money Laundering and Terrorist Financing Act, most personal data are retained for 10 years after the termination of the business relationship or after the transaction has been carried out. Personal data processed for tax purposes are retained for 10 years after the end of the year to which they relate. Personal data processed on the basis of an individual’s consent are retained until the consent is withdrawn, unless the law provides otherwise. In individual cases, applicable legislation may also prescribe longer retention periods.

On expiry of the prescribed periods, or as soon as the purpose of processing ceases to apply and there is no longer an appropriate legal basis for further retention, personal data are deleted or anonymised in accordance with applicable legislation.

Personal data processed for the purposes of one-off events (conferences, meetings, lectures, prize competitions, visits and excursions) are retained in accordance with applicable legislation and the rules applicable to the particular event, or until consent is withdrawn.

In the event of a request for the erasure of data, we will implement the request in such a way that the processing of data is limited solely to the purposes determined by applicable regulations or by internal rules.

Where we anonymise personal data in such a way that they can no longer be linked to a specific individual, we may retain and process them without any retention-period limit.

Rights of the individual

We ensure the exercise of your rights relating to the processing of personal data without undue delay, and in any event within one month of receipt of the request. This period may be extended by a further two months where necessary, in which case we will inform you, within one month of receipt of the request, of the extension and the reasons for the delay.

With regard to your personal data, you have the following rights:

• the right to be informed / to transparency,
• the right to inspect your personal data, i.e. the right of access to data,
• the right to have inaccurate data rectified. In this regard, we reserve the right to request documentation from you evidencing the changes,
• the right to a transcript and copy of data. You are entitled to one free copy of your personal data in electronic or printed form. For additional copies, we may charge a reasonable fee based on administrative costs,
• the right to restriction of processing for legitimate reasons,
• the right to object to processing and the right to erasure of data (the right to be forgotten),
• the right to be notified of rectification, erasure or restriction of processing,
• the right to withdraw consent,
• the right to be provided with a list of the recipients to whom your personal data have been disclosed, when, on what basis and for what purpose,
• the right to information on the purpose of the processing and the type of personal data being processed, together with all necessary explanations in this regard, including all available information on the source, where the personal data were not collected from the data subject,
• the right to an explanation in the case of automated decision-making involving the processing of personal data,
• the right to lodge a complaint with the supervisory authority if you consider that the processing infringes applicable legislation,
• the right to an effective remedy and to compensation.

Where you have given voluntary consent, you may withdraw or amend that consent at any time; withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal. You may arrange this at our registered office, at our branches, or by sending a notice to nasvet@generali-investments.si. For any further explanations, we are available on our free telephone number 080 80 24.

If you are a member of the Generali ZAME Loyalty Programme and you withdraw your voluntary consent for direct marketing purposes, that withdrawal automatically also entails your withdrawal from the Generali ZAME Loyalty Programme.

Generali Investments is not liable for any disclosure of personal data or misuse of an individual’s identity resulting from inadequate protection of one’s own privacy and personal data, or of the computer or other equipment on which personal data are stored, by the individual concerned or by third parties.

Right to lodge a complaint
If you consider that your rights have been infringed in connection with the processing of your personal data, you may lodge a complaint by sending it to Generali Investments d.o.o., Dunajska cesta 63, 1000 Ljubljana, or by e-mail to dpo@generali-investments.si.

You also have the right to lodge a complaint with the supervisory authority if you consider that the processing infringes applicable legislation. The supervisory authority is the Information Commissioner of the Republic of Slovenia, https://www.ip-rs.si.

Members of the Generali ZAME Loyalty Programme
The provisions on the protection of personal data for members of the Generali ZAME Loyalty Programme are available at the following link: https://www.generali-zame.si/vop.

Amendments to the Privacy Policy
This Privacy Policy may be amended or supplemented at any time. You will be notified of any amendments on this website and, in the case of material changes affecting the processing of personal data, also by e-mail.

This Privacy and Personal Data Protection Policy takes effect on 4 August 2026.