Promontoria Privacy Policy
Cerberus Global Investments B.V. and its affiliates acting under the trade name "Promontoria" (hereinafter jointly referred to as "Promontoria" or "we") are part of the Cerberus Group and are involved in the acquisition of loan, real estate or other assets, or interests in such assets, by either the acquisition of shares of companies that hold such assets, or by direct or indirect asset acquisitions.
This Privacy Policy applies to any individuals ("you" or "your organisation") who are directly or indirectly related to an asset, or interest in an asset, held or owned by Promontoria, or who otherwise engage or interact with us and to individuals accessing and using the website www.promontoria.nl ("Site").
This Privacy Notice explains how Promontoria collects, uses, stores, discloses, transfers, or otherwise handles (collectively, "processing") your personal data and which rights you have in this respect. Please note that where this Privacy Notice explains applicable law and your rights, this applies only to personal data which is processed under the EU General Data Protection Regulation ("GDPR") or the GDPR as incorporated into UK law by the Data Protection Act 2018 ("UK GDPR"). Where the processing of your personal data is not subject to these laws, different rules may apply under your applicable law.
Click on one of the links below to jump to the listed section:
- Who is responsible for your personal data
- For which purpose and legal basis we use your personal data
- Categories of personal data we process
- How we collect your personal data
- With whom do we share personal data
- How we protect your personal data
- Where we process your personal data
- Data Retention
- Data Protection Principles
- Your Data Subject Rights
- Changes to the Privacy Policy
- Contacting Promontoria
1. Who is responsible for your personal data
The responsible controller for any personal data that you provide to us is the Promontoria entity which owns, or has in interest in, an asset relating to you or your organization, or otherwise has a business relationship with you, and is identified in relevant communication with you.
Promontoria entities incorporated in the Netherlands are resident at Oude Utrechtseweg 32, 3743 KN Baarn, The Netherlands. Promontoria entities incorporated in Ireland are resident at 3 Fleming Court, Fleming's Place, Dublin 4, Ireland.
You may also contact each Promontoria entity at any time under the contact details set out below (see Contacting Promontoria).
In addition, Cerberus Global Investments B.V., Oude Utrechtseweg 32, 3743 KN Baarn, The Netherlands, is a responsible controller for your personal data where it manages the business operations for Promontoria entities.
Your personal data may be shared with further controllers within Promontoria or the Cerberus Group as required in connection with our business relationship.
In particular, your personal data may be shared with Cerberus Capital Management, L.P. ("CCM"), 875 Third Avenue, New York, NY 10022, United States, and its affiliates for purposes of compliance with anti-money laundering, sanctions or other legal, compliance or regulatory obligations and for portfolio management purposes. Please refer to CCM’s Privacy Policy for further details on the processing of your personal data and your related rights.
Please note that, in the event that legal title to an asset relating to you or your organization is held by a third party outside of Promontoria, such party does typically not determine the purposes and means of processing of your personal data and, thus, is not responsible for your personal data as a controller unless specifically notified to you.
2. For which purpose and legal basis we use your personal data
Depending on the nature of our relationship with you or your organization, Promontoria may collect and process your personal data for the purposes in the table below. We have also identified in the table below the legal basis we rely on for each purpose.
| Purpose | Legal Basis |
| Business Purposes | |
| Due diligence procedures in respect of the acquisition of real estate, loan or other assets, or interests in such assets, and related security or collateral | Performance of a contract |
| Concluding, performing, managing and administering your or your organization's business relationship with Promontoria, including communicating with our service providers, professional advisers and counterparties, accounting and auditing accounts, risk monitoring, keeping internal records, notifying you about changes to our terms of business or this Privacy Policy | Performance of a contract Legitimate Interest to manage our contract relation with your organisation |
| Financial management and administration, including monitoring of the obligations under relevant loan, real estate or other asset related agreements and collection of the amounts due, such as any principal sum, interest, default or penalty interest in relation to loans | Performance of a contract Legitimate Interest to manage our contract relation with your organisation |
| Conducting market research, surveys, and similar inquiries to help us understand trends, client needs and testing and upgrading our systems and processes to support technological development and to improve and enhance our products, and services and technology | Conducting market research, surveys, and similar inquiries to help us understand trends, client needs and testing and upgrading our systems and processes to support technological development and to improve and enhance our products, and services and technology Legitimate Interest: to improve our products, services and technologies |
| Analysing the payment behaviour of debtors and related data in order to ensure the sustainability of the recovery, and analysing payment or other financial or asset related data for purposes of improvement and development of our investments and other products and services | Legitimate Interest: to recover debt owed to us and to improve our products and services |
| Processing and sharing of aggregated anonymous data relating to assets and other investments for statistical and business purposes Legitimate Interest: to improve our products and services and to operate our business | Legitimate Interest: to improve our products and services and to operate our business |
| Selling or otherwise divesting or restructuring of loan, real estate, and other assets or asset holding entities | Performance of a contract Legitimate interest to perform our contract with your organisation. |
| Maintaining and protecting the security of our premises and facilities, IT systems, databases, websites, or other digital infrastructure, preventing and detecting security threats, fraudulent or other illegal or malicious activities and prosecuting those responsible for that activity, service, testing and maintenance of our IT systems | Legitimate interest: office and facilities security and administration and to maintain our IT systems, network, and data security |
| Legal Compliance | |
| Ensuring compliance with our legal, compliance and regulatory obligations, such as our obligations regarding anti-money laundering ("AML") and know-your-client ("KYC"), sanction and anti-terrorism screening, fraud prevention, conflicts of interest checks and other due diligence checks, record keeping, disclosures to tax or other regulatory authorities, and handling complaints, requests, and reports from you | Legal or regulatory obligation Legitimate Interest: to comply with our legal obligations |
| Preventing and detecting crime, including fraud or criminal activity and misuses of our products or services | Legal or regulatory obligation Legitimate Interest: to comply with our legal obligations |
| Interacting with competent supervisory, law enforcement or other governmental or regulatory authorities and complying with or supporting requests or investigations by such authorities | Legal or regulatory obligation Legitimate Interest: to comply with our legal obligations |
| Monitoring and auditing compliance with internal policies and procedures, legal obligations and to meet requirements and orders of regulatory authorities | Legal or regulatory obligation Legitimate Interest: to comply with our legal obligations |
| Solving disputes, enforcing our contractual agreements, including foreclosure of asset-related security or collateral, and to establish, exercise or defend legal claims | Legal claim |
| Marketing and Communication Purposes | |
| Informing you, where permitted by applicable law, about investment opportunities and other products or services related to our business relationship with you or your organization | Consent (where required) Legitimate interest to promote our products and services |
We will not use your personal data for any purpose inconsistent with this Privacy Notice without your permission. You may opt out of our direct marketing at any time by clicking the opt-out links in any electronic marketing communication we send to you or by using the contact details in the "Contacting Promontoria" section below.
3. Categories of personal data we process
Promontoria processes the personal data that is required in view of the purposes set out above which may, depending on the nature of our business relationship with you or your organization and your place of residence, include the following categories of personal data:
- Personal and contact information, such as full name, gender, age, date of birth, nationality, address, city and country of residence, telephone and fax number, signature, marital status and number of children, dependants, occupation, email address, copy of ID, citizen service number (Burger Service Nummer, BSN), or other government issued ID, data concerning previous employment, including position, job title and employer's name;
- Financial data such as bank account details, utility bill details, data in relation to income (including salary, benefits, and pensions) and liabilities and obligations;
- Data generated from our business relationship with you or your organization, including data in relation to loan, real estate and other assets and related security or collateral which Promontoria owns or has an interest in, such as principal loan amount, interest, default or penalty interest and payment history;
- Information from publicly available resources, such as integrity data bases and sanctions lists or by professional agencies including data obtained from credit agencies or background check agencies;
- Data required for regulatory compliance purposes, including data from compliance screening or procedures under AML, KYC, or related diligence such as information about your status as a politically exposed person, relevant litigation, or other legal proceedings against you or a third party related to you;
- Data generated from your use of our website or other online services such as mobile device unique identifier and IP address, browser type and version and plug in types or operating system;
- Special categories of personal data. In certain circumstances, where required by law or where you have permitted us to do so, we may collect special categories of your personal data which are specifically protected under data protection law.
4. How we collect your personal data
We will collect your information (i) directly from you or your organization; (ii) from your nominated financial institution or other representative (i.e., solicitor acting on your behalf); (iii) where you act as a representative on behalf of an entity, from that entity or (iv) where required from third parties including from AML, KYC, or due diligence service providers, publicly available resources, or credit agencies.
5. With whom do we share personal data
We may share your personal data as required for the purposes set out above as follows:
- With our affiliates within Promontoria and the Cerberus Group if, and to the extent required, for the purposes as outlined above and as legally permitted. In such cases, these entities will use your personal data for the above purposes only and under the same conditions as outlined in this Privacy Notice.
- With CCM for purposes of compliance with anti-money laundering, sanctions or other legal, compliance or regulatory obligations and for portfolio management purposes.
- With third parties that are engaged in providing financial, legal, IT and other administrative services to Promontoria. These service providers will act as data processors. Some of these service providers will have access to and process your personal data on behalf of and under the instruction of Promontoria for the purpose of performing loan servicing and administration services in respect of the loans. These services include the collection of all sums due in relation to the loan and, if necessary, enforcement actions. Promontoria will retain control over and will remain fully responsible for your personal data and will use appropriate safeguards as required by applicable law to ensure the integrity and security of your personal data when engaging such service providers.
- With courts, regulators, law enforcement or other competent authorities as required or permitted under applicable law to comply with a legal obligation or for the establishment, exercise, or defense of legal claims.
- With credit reference agencies and other companies for use in credit decisions, for fraud prevention and to collect debts.
- With third parties if we sell or buy any loan, real estate or other assets or asset holding entities, including in connection with the due diligence undertaken by the prospective seller or buyer and its professional advisers.
6. How we protect your personal data
We take the obligation to protect the integrity and safety of your personal data very seriously. Your personal data will be kept confidential in accordance with our applicable policies and procedures. We will use all reasonable efforts to ensure that all personal data is kept secure and safe from any loss or unauthorized disclosure or use. All reasonable efforts are made to ensure that any personal data held by us are stored in a secure and safe place, and accessed only by authorized users, and according to applicable policies and procedures.
7. Where we process your personal data
We may transfer your personal data to locations outside your home country in order to provide our services to you as outlined in this Privacy Notice.
This transfer may include a transfer of your personal data to countries outside the European Economic Area ("EEA"), which do not have the same level of data protection as that afforded by data protection laws in the EEA or the UK. For example, if your personal data is transferred to CCM, it will be transferred to the United States. When doing so we will comply with applicable data protection requirements and apply appropriate safeguards to ensure the security and integrity of your personal data, in particular by entering into data transfer agreements with the data recipients which are in the form of EU Standard Contractual Clauses which are available here and/or equivalent data transfer agreements under the UK GDPR. Please contact us using the contact details below if you would like to learn more about the specific transfer safeguards applied.
Where required in consideration of the data protection laws and other laws of the recipient country, we will apply appropriate supplementary safeguards to ensure that the recipients can comply with their obligations under the relevant data transfer agreements and that an adequate level of data protection is ensured.
We will hold your personal data for at least as long as it is necessary in order to fulfil our contractual, regulatory, and statutory obligations, and to provide the services, products, or information you have requested and to administer your business relationship with us. If you have asked us not to communicate with you, we will hold this information as long as required to comply with your request.
The criteria we apply to determine the appropriate retention period include, but are not limited to the following:
- The duration of our business relationship with you or your organization and the purposes for which we process your personal data;
- Any relevant legal obligations requiring us to retain data (for example, we may be required to keep records of certain transactions for a certain period of time) and
- Whether retention is appropriate in consideration of our legal position (such as applicable statutes of limitations, pending or threatened litigation or regulatory investigations).
In respect of the collection, holding, storage, use, and processing of your personal data:
- We will process your personal data lawfully, fairly and in a transparent way.
- We will obtain your personal data only for valid purposes that we have clearly explained to you and not used in any way that is incompatible with those purposes
- The personal data we collect will be relevant to the purposes we have told you about and limited only to those purposes.
- We will take reasonable steps to ensure that your personal data is accurate and kept up to date.
- Subject to applicable legal or other requirements, we will keep your personal data only as long as necessary.
- We will use appropriate technical and/or organizational measures to ensure appropriate security of your personal data.
Subject to certain legal conditions, you may request access to, rectification, erasure, or restriction of processing, of your personal data. You may also object to processing or request data portability. Additionally, you have the right to request a copy of the personal data that we hold about you. If your request is unfounded or excessive, we reserve the right to make an administrative charge for this. Please refer to Articles 15-22 of the GDPR for details on your data protection rights.
If you have given us your consent for the processing of your personal data you can withdraw the consent at any time with future effect, i.e., the withdrawal of the consent does not affect the lawfulness of processing based on the consent before its withdrawal. In case consent is withdrawn, we may only further process the personal data where there is another legal ground for the processing.
For any of the above requests, please send a description of your personal data concerned stating your name, account information, and if applicable, your date of birth as proof of identity to the contact details below. We may require additional proof of identity to protect your personal data against unauthorized access. We will carefully consider your request and may discuss with you how it can best be fulfilled.
If you have any concerns about how your personal data is handled by us or wish to raise a complaint on how we have handled your personal data, you can contact us at the contact details below to have the matter investigated. You can also complain to the competent data protection supervisory authority in your country. For example, if you are from The Netherlands, you may contact the Autoriteit Persoonsgegevens via their website (www.autoriteitpersoonsgegevens.nl). Alternatively, if you are from Ireland, you may contact the Data Protection Commission via their website (www.dataprotection.ie).
Promontoria may make changes to this Privacy Policy from time to time. Promontoria advises you to visit the Site regularly to check for any amendments. In addition, we may communicate material changes to you through the appropriate channel we normally use to communicate with you.
Your loans or other assets relating to you, or your organization are typically administered by a third-party service provider who is acting on behalf of Promontoria. This service provider already is or, if the relevant loan or other asset has just been acquired by Promontoria, will shortly be in contact with you. The service provider will be happy to assist you with any requests, complaints or enquiries relating to you or your organization’s business relationship with Promontoria. If you have any questions about this Privacy Policy or in case you want to assert your data protection rights, please do not hesitate to contact us.
Cerberus Global Investments B.V.
Oude Utrechtseweg 32 3743 KN Baarn
+ 31 (0)35 548 8710
dataprotection@promontoria.nl
Promontoria
Cerberus Global Investments B.V.
Oude Utrechtseweg 32
3743 KN Baarn
info@promontoria.nl
C.O.C. Number 34208986
VAT Number NL8134.85.034.B01