Privacy Policy

[1] Legal or contractual duties to maintain confidentiality to which BME is subject in relation to the User's personal data are not affected by this Privacy Statement. The websites of BME may contain hyperlinks to other websites which are not operated or monitored by BME. Third-party websites are not subject to this Privacy Statement. BME is not responsible for their content or how they handle personal data.

Data protection is first and foremost the protection of the individual – BME therefore attaches high priority to compliance with the applicable laws and to the protection of the privacy and the private sphere of the individuals concerned in order to comply national and international legal requirements. The basic principle is that a high level of data protection and security must be guaranteed wherever personal data is processed.

This Privacy Statement is applicable to and informs Users and other interested parties about the processing of personal data that may be collected within the framework of their web visit, contractual or corporate relationship with responsible companies.

The purpose of this Privacy Statement is to provide you with full information about the nature and extent of the data processing and to enable you to exercise your rights and obtain information about the storage of your data.

The legal entities listed below are controller of your personal data and responsible for processing your data. 

SIX Group Services Ltd.
Pfingstweidstrasse 110
8005 Zurich
Switzerland

E-Mail: communication@six-group.com

Finanzmuseum:
Stiftung Sammlung historischer Wertpapiere
Baslerstrasse 100
4600 Olten
Switzerland

E-Mail: info@finanzmuseum.ch

Below you will find our EU and UK representatives:

EU representative: SIX Financial Information Deutschland GmbH in Frankfurt
Theodor-Heuss-Allee 108
D-60486 Frankfurt am Main
Germany

UK representative: SIX Financial Information UK Ltd. in London
33 St Mary Axe, 4th Floor Exchequer Court
EC3A 8AA  London
UK

BME Group
BME Bolsas y Mercados Españoles, Sociedad Holding de Mercado y Sistemas Financieros, S.A
Plaza de la Lealtad 1
28014 Madrid
España

Without prejudice to the above, BME Group companies included in the holding company are listed here and can be contacted at  info@grupobme.es

BME processes personal data where:

• The user visits and/or contacts websites of  BME,the user applies for or uses products or services offered by BME online; this includes, in particular, registration for specific services or web content only accessible by means of a personal login and subscriptions to print media or online newsletters,

• the user obtains, installs and/or uses apps of BME from the relevant app stores, or
• takes part in a competition.
• BME processes the users personal data for the following reasons:
• Technical management as well as research and further development of websites,
• User administration, marketing, and market research, including to send communications, newsletters and information on BME campaigns products and services that may be of their interest based on the consent provided by the data subject in their request, existence of a prior contractual relationship and, where applicable, on the legitimate interest of  BME in keeping them informed in the framework of the relationship.
• User information on the services and products rendered by BME, provided the User has given their consent for this,
• to formalize registration, enrolment, participation, submission of documents and training material, as well as other procedures derived from the relationship with the data subject as a student at Instituto BME, amongst other legal entities, in order to provide the requested courses, based on the legal of the consent provided by the student through registering and the legitimate interests of BME Group in maintaining the relationship.
• Selecting competition winners and awarding prizes,
• to manage registration, attendance and realization of corporate actions offered and organized by BME or its partners. The realization of events may incidentally include the processing of the image (general shots) and/or voice (ambient sound at the event) that may appear in the photographs and videos taken during the corresponding event, as well as their editing and subsequent disclosure in online and offline media, the corporate intranet and its profiles on social networks. The legal grounds for this processing are: (1) the consent granted by the data subject through registration; and (2) the legitimate interest in the edition and dissemination of audio-visual pieces in online and offline media, the corporate website, the intranet and its profiles on social networks for image campaigns and promotion of the brand.
• Management of data subject right requests.
• BME processes in general the personal data such as name, gender, address, e-mail address, telephone that the user expressly and actively makes available to us. This also applies if the user takes part in events of BME (online or in person). The web server of BME – and in the case of www.six-structured-products.com the web server of Ariva.de AG – automatically records details of the user's visit such as IP address, browser type and version, operating system used, originating website, pages accessed, date, length of visit.
• In the case of registration, attendance and realization of events, BME may incidentally process the image and/or voice that appears in the photographs and videos taken during the corresponding event. BME shall restrict as far as possible such processing of images and/or voice during the realization, editing and broadcasting of events.

By processing personal data according to this Privacy Statement, BME is able to improve the quality of its products and services. Depending from the processing purpose, the legal basis for the processing of the User’s personal data will be one of the following:

• necessary for taking steps to enter into or executing a contract with the User for the services or products requested or for carrying out our obligations under such a contract,
• User’s consent,
• necessary for the legitimate interests of BME.

Examples of the ”legitimate interests of BME” referred to above are:

• pursuing certain of the above mentioned purposes,
• exercising BME’ rights, including the freedom to conduct a business and right to property,
• providing products and services and assuring a consistently high service standard across the whole BME Group, and keeping our customers, employees and other stakeholders satisfied, and
• meeting our accountability and regulatory requirements.

In each case provided, such interests are not overridden by the User’s privacy interests.

The User authorizes BME to transmit Personal Data to employees, agents or other third parties within or outside the country where the User lives in order to provide services and for the purposes indicated above. Data transfer can take place to the following countries: Austria, Belgium, Denmark, France, Germany, Ireland, Italy, Japan, Luxembourg, Monaco, Morocco, Netherlands, Norway, Poland, Singapore, Spain, Sweden, Switzerland, United Kingdom, United States. Employees, agents and other third parties which have access to Personal Data are required by BME to ensure compliance with all applicable data protection provisions. Any person who authorizes BME to access their Personal Data as defined in this Privacy Statement will be made aware of the data security and data protection implications. When Personal Data of the User are transferred to other countries, BME will ensure data protection by granting the protection level required by the applicable law, e.g. by adopting EU Standard Contractual Clauses (SCC) or other legally recognized mechanism.

Notwithstanding the above and based on the legitimate interest of BME, depending on the different needs that may arise and respecting the principles of data protection, the data may be communicated, to other companies of BME Group and/or  SIX Group.

BME reserves the right to disclose Personal Data to regulatory and supervisory authorities, as well as, pursuant to this Privacy Statement, to Analysis Service Providers. In so doing, BME will comply at all times with applicable regulations, laws, court orders or official requests.

BME protects Personal Data with appropriate physical, electronic and process-related security measures, such as firewalls, personal passwords, encoding and authentication technologies. Personal Data collected via a website owned by BME will be encrypted during transmission using SSL Secure Sockets Layer (SSL) technology, which currently provides the best-available security for data transfers.

BME will only retain your personal data for as long as necessary to fulfill the purpose for which they were collected or to comply with legal or regulatory requirements.

Users whose personal data is processed within the scope of this Privacy Statement have the following rights:

• to receive information on whether BME may save Personal Data and what form this Personal Data may take (which categories of data, recipients or categories of recipients, retention periods for Personal Data or criteria governing retention periods),
• to request the rectification of personal data if it is incorrect,
• to request the deletion of personal data,
• to request restrictions on processing personal data, to receive personal data in a structured, accessible and machine-readable format (if available), or
• to submit an objection to processing, especially for the purpose of direct advertising.

The rights specified above may be denied or restricted if the interests, rights and freedoms of third parties take precedence or if processing is necessary to establish, exercise or defend legal claims of BME.

Queries in relation to processing personal data are to be directed to the Data Protection Officers of BME:

To exercise your rights with regards to data protection please use this link.

You can also direct your queries to:

SIX Group Services Ltd.
Data Protection Officer
Hardturmstrasse 201
8005 Zurich
Switzerland
E-Mail: dataprotection@six-group.com

Or

BME Group 
Plaza de la Lealtad, 1 
28014 Madrid 
Spain 
E-Mail: protecciondedatos@grupobme.es

Users have also the right to make a complaint to the data protection authority responsible for them or in the place where they think an issue in relation to the Data has arisen.

Functions (plugins) of third-party providers or social media platforms (Facebook, Twitter, Google+, etc.) are embedded into the websites of BME. These plugins enable the User to share content on the social networks mentioned. The interfaces are deactivated by default when the website is accessed. This means that no personal data is transmitted to the respective third-party providers without intervention on the part of the User. Once the User has activated the interfaces, data (incl. also personal data) is automatically transmitted to the relevant third-party providers by the plug-ins. If the User is simultaneously logged in to the network of the respective third-party provider when they visit the website, the third-party provider can assign the visit to the User's network account. BME has no influence on this. The purpose and scope of such a form of data collection and the further processing and usage of personal data are outlined in the data protection guidelines of the individual social networks. Users can also obtain information there on rights and settings options in relation to protecting their privacy.

Anyone affected by the processing of personal data can withdraw their consent to this effect at any time. You can unsubscribe from our newsletters by using the dedicated link. In all other cases please contact the Data Protection Officer of or SIX.

The websites of BME uses cookies, tags, pixels, and third party tools to enhance your experience and provide valuable insights.

You can read more about our cookies and web analysis in our Policy on cookies and web analysis.

This Privacy Statement explains how and why Securities Services & Exchanges of BME processes personal data. It applies to all natural persons with whom we come into contact (referred to as “you” in this document). This includes employees, officers, directors, beneficial owners and other personnel of our customers as well as service providers, authorities, and other business counterparties.

ecurities Services & Exchanges aims at strong protection of natural persons in regards to processing of their personal data. Our services are offered to institutional customers only,  nonetheless the processing of transactions might include personal data where this is necessary to ascertain  the business purpose. In addition, we process personal data in the context of business contact information.

The legal entities of Securities Services & Exchanges listed below are the controllers of your personal data. They are responsible for processing your data.  

• SIX Exfeed AG 
  Hardturmstrasse 201 
  8005 Zúrich 
  Suiza 

• SIX Repo AG 
  Hardturmstrasse 201 
  8005 Zúrich 
  Suiza 

• SIX Securities Services AG 
  Hardturmstrasse 201 
  8005 Zúrich 
  Suiza 

• SIX SIS AG 
  Baslerstrasse 100 
  4601 Olten 
  Suiza

• SIX Swiss Exchange AG 
  Hardturmstrasse 201 
  8005 Zúrich 
  Suiza

• SIX Trade Repository AG 
  Hardturmstrasse 201 
  8005 Zúrich 
  Suiza 

• SIX x-clear AG 
  Hardturmstrasse 201 
  8005 Zúrich 
  Suiza 

• BME Markets & Exchanges, S.A.U. 
  Plaza de la Lealtad 1 
  28014, Madrid 
  España 

• Sociedad Rectora de la Bolsa de Valores de Barcelona, S.A.U. 
  Paseo de Gracia 19 
  08006, Barcelona 
  España 

• Sociedad Rectora de la Bolsa de Valores de Bilbao, S.A.U. 
  Calle José María Olabarri 1 
  48003, Bilbao 
  España 

• Sociedad Rectora de la Bolsa de Valores de Valencia, S.A.U. 
  Calle Pintor Sorolla 23 
  46002, Valencia 
  España 

• Sociedad de Bolsas, S.A. 
  Plaza de la Lealtad 1 
  28014, Madrid 
  España 

• Sociedad de Gestión de los Sistemas de Registro, Compensación y Liquidación de Valores, S.A.U. 
  Plaza de la Lealtad 1 
  28014, Madrid 
  España 

• BME Clearing, S.A.U 
  Plaza de la Lealtad 1 
  28014, Madrid 
  España 

• BME Regulatory Services, S.A.U. 
  Plaza de la Lealtad 1 
  28014, Madrid 
  España 

• MEFF Tecnología y Servicios, S.A.U. 
  Paseo de Gracia número 19 
  08006, Barcelona 
  España 

• BME Post Trade Services, S.A.U. 
  Plaza de la Lealtad 1 
  28014, Madrid 
  España 

• Bolsas y Mercados Españoles Inntech, S.A.U. 
  Plaza de la Lealtad 1 
  28014, Madrid 
  España 

We process personal data about you where:

• It is necessary to enter into a contract or carry out a contract with our customer.
• It is necessary to comply with our legal obligations, or
• It is in our legitimate business interests, e.g. for security compliance if you visit our office, or to protect our IT infrastructure.

We process your personal data for the following reasons:

• To enable internal collaboration and commercial follow-ups across different business units within BME, particularly in the context of events and business development activities.
• For advertising purposes.
• To enter into contract.
• To record and register certain telephone calls and electronic communications, legitimately in compliance with the legal obligations applicable to entities, as well as based on BME's legitimate interest in guaranteeing the quality of service, verifying the veracity and integrity of communications and for evidential purposes.
• To provide services and products to our customers including any communication required to render them.
• To ensure fair and orderly markets.
• To receive customer requests and improved services/products accordingly.
• To receive, investigate and respond to customer complaints.
• To  inform customers, suppliers and authorities about incidents and their impacts and resolution.
• To manage relationships with our business partners, customers and service providers.
• To carry out analyses with the intention to strengthen our relationships and improve the quality of our services and products.
• For testing and support purposes.
• To operate and maintain our information technology.
• To comply with the requirements of the regulatory authorities, administrative and/or judicial authorities and the legal obligations of BME, based on the legal grounds of fulfilment of the legal obligations required.
• To establish, exercise and/or defend legal claims and rights.
• To protect, exercise and enforce our rights, property or safety, or to assist our customers or others to do so.
• For other purposes.

Personal data processed by Securities Services & Exchanges is limited to basic contact information for individuals. In general this includes name, job title, position, work address, telephone number, email address. Other categories depend on the respective business product or service, e.g. voice recording, beneficial owner identifiers in transaction reports.

We collect data from the following sources:

• Personal data obtained from customers when you
  -  Give us contact data for relationship management, sales or any other purpose
  -  Send us your data on forms, e-forms, e-mail or by post
  -  Send us information for client on-boarding or admission
  -  Provide us data to enter into a contract or service level agreement including billing
  -  Provide us with data during the performance of our services for issue management, collection of customer experience,  service improvement and other legitimate reasons
• Personal data obtained from service providers required to
  -  Establish and maintain a contact
  -  Enter into and maintain contracts, service level agreements and other types of service descriptions
  -  Facilitate billing and payment
  -  Monitor and control service delivery to ensure and enhance quality
  -  Collaborate on solution design and delivery
• Personal data we receive from other sources
  -  Background information from third party providers
  -  Information from authorities
  -  Information from publicly available sources
• Other BME Group companies

Your personal data may be disclosed to and / or transferred to

• Our business partners (e.g. custodians, correspondent banks) if your data is included in business transactions which need to be processed by them
• Your own organization in connection with issue and problem resolution, contract management, service and billing requests, requests of your compliance office, client relationship management concerns
• The Swiss National Bank (SNB) and the Bank of Spain
• Competent regulatory (e.g. FINMA, CNMV), prosecuting, judicial authorities or tax authorities
• Our auditors and legal advisors involved in or contemplating legal proceedings
• Our technology suppliers that provide support for incident handling
• Other persons where disclosure is required by law

Personal data may be transferred to other legal entities of BME and to the relevant supervisory bodies, law enforcement agencies, tax authorities and courts as well as service providers and other business partners of BME that are involved both within and outside the European Economic Area (EEA). This includes countries whose data protection standard deviates from the EEA standard. If data is transferred to a recipient in a country with a lower level of  data protection appropriate safeguards are implemented to ensure an adequate level of protection. These safeguards may include data transfer agreements based on standard contractual clauses or other legally recognized mechanism.

In the international custody business data may be transferred in the countries in which the sub-custodian is located. For other services, data may be transferred to the following countries if necessary for the provision of the service: Austria, Belgium, Colombia, Cyprus, France, Germany, Greece, Hungary, Ireland, Italy, Liechtenstein, Luxembourg, Netherlands, Norway, Poland, Singapore, Spain, Sweden, United Arab Emirates, United Kingdom, United States.

As a general rule, we keep personal data as long as we have a client relationship. After a client relationship ends, we usually must keep it for a period of 10 years. In cases where the relevant client or counterparty informs us that employment of a certain persons has ceased, the retention period starts from that point in time.

You can ask us to: (i) to provide information on whether we may save personal data and what form this personal data may take (which categories of data, recipients or categories of recipients, retention periods for Personal Data or criteria governing retention periods); (ii) correct your personal data; (iii) erase your personal data; or (iv) restrict our processing of your personal data. You can also opt out of the processing of your personal data for direct marketing purposes or object to our other processing of your personal data. These rights will be limited in some situations; for example, where we are required to process your personal data by law.

To exercise these rights or if you have questions about how we process your personal data, please contact us using the contact details on the last page. You can also complain to the relevant data protection authorities where you live or work or where the alleged infringement of data protection law occurred.

To exercise your rights with regards to data protection please use this link.

You can also direct your queries to:

SIX Group Services Ltd.
Data Protection Officer
Hardturmstrasse 201
8005 Zurich, Switzerland
E-Mail: dataprotection@six-group.com

and/or

BME Group
Data Protection Officer
Plaza de la Lealtad, 1
28014 Madrid, Spain
E-Mail: protecciondedatos@grupobme.es

This Privacy Statement was last updated on 19/03/2026. Future updates may be required in response to changing legal, technical or business developments.