Europe, Middle East and Africa (EMEA)

Wells Fargo International Customer Privacy
NoticeThis notice applies to the United Kingdom (“UK”), countries in the European Union (“EU”) and the Dubai International
Financial Centre (“DIFC”).
Effective: 19 July 2024

Part 1. Introduction
What is this document and why should you read it?
“We”, “our”, “us”, or “Wells Fargo” refers to the Wells Fargo entity listed in Part 4 with which you or your organization
have a relationship. As a data controller, Wells Fargo provides this privacy notice ("Notice") to describe our processingof information related to you (“Personal Data”). Wells Fargo may process your Personal Data where you or yourorganization have a relationship with us. As described below, we may also process your Personal Data where providing
financial products and carrying out investment, treasury management, payment, and other financial services.
The “Wells Fargo Group” includes, in addition to the Wells Fargo entities listed in Part 4, different Wells Fargo affiliates
across the globe (“Affiliated Entities”). Each Affiliated Entity, if not listed in Part 4, uses a different privacy notice todescribe its practices and guide its processing activities. The privacy notices for those Affiliated Entities are available atwww.wellsfargo.com/privacy-security. If you or your organization has a relationship or shares Personal Data with an
Affiliated Entity that is not listed in Part 4, that separate privacy notice will govern the Personal Data provided to that
Affiliated Entity, not this Notice. Even in that case, Personal Information shared with Wells Fargo is governed by thisNotice.
What types of Personal Data do we collect?
Wells Fargo collects different types of Personal Data. In EMEA, we primarily have relationships and accounts withcorporations and other legal entities. We may, however, collect information about individual representatives of ourcustomer organizations ("Customers") or other individuals who have a connection with our Customers or our services(collectively, "Individuals"). This information may include:•

General data: first name, middle name, and surname (including any previous names used); personal
contact details (home and mobile telephone numbers, email addresses, and home address); date andplace of birth; citizenship; marital status; gender; and veteran/military status..

•

Position or employment/work description: employer; title; position held; length of tenure and work
authorization status.

•

Identification and Authentication data: national or governmental identification such as passport ornational identification card; driver’s licence; national insurance number or tax and/or social insurance
number; information required for tax reporting; health insurance information; home address andtelephone number; documents that verify address; date of birth; country of domicile; documents thatverify employment; and signature authorization or information we use to identify and authenticate© 2024 Wells Fargo Bank, N.A. All rights reserved.
IPN EU2511 (Rev 19/07/2024)

you e.g. your signature or additional information we get from external sources that we need forcompliance purposes.
•

Financial data and payment details: salary and other income; bank account details; sources of wealth;assets; financial relationships; and financial transactions.

•Marketing and communications data: marketing preferences and customer service interactions;
responses to voluntary surveys; recordings of telephone calls with customer service and otherrepresentatives (to the extent permitted by law); and copies of electronic communications you
provide to or receive from us.

•

Background or credit check data: to the extent required or permitted by local law, credit checkinformation and background check information including credit and criminal checks and screening;prior employment history; data associated with verification of politically exposed persons; education
history; professional memberships and qualifications; and other information contained in yourcurriculum vitae or resume.

•

Customer access or system usage data: information given by completing forms and surveys as well as
data about your use of our application systems, including authentication credentials such asusernames or IDs and passwords to log into portals or applications; location data; user display nameand identifier; other website or product access information; and use of credit card.

•

Market data: information from market research, any data obtained and opinions expressed whenparticipating in any customer or market surveys.

•

Geographical data: information about your location.

•

Investigation data: data collected for Wells Fargo investigation process (if used) e.g. due diligence
checks, fraud, sanctions and anti-money laundering checks, external intelligence reports, and content
and metadata related to relevant exchanges of information among individuals, organizations,
including, emails, live chat, voicemail etc.

•

Complaints data: data collected for the processing in relation to any Wells Fargo customer complaints
procedures.

•

Regulatory data: information we need to support our regulatory obligations.

•

Cookies and similar technologies: data that websites store and access on your computer or mobile
device when you visit a website, allowing a website to recognize your visit and collect information
about how you use that website The Company use these technologies to recognize you, remember
your preferences and tailor the content we provide to you.

Wells Fargo may also collect certain types of special category personal data as permitted and/or required by local law
or with your explicit consent, such as health/medical information (collectively, "Sensitive Personal Data"). We collectthis information for specific purposes, such as health/medical information in order to accommodate a disability orillness. As explained below, we will only use such Sensitive Personal Data for those purposes and as permitted by law.
Collectively, the above categories of data constitute Personal Data. We may collect Personal Data in various ways, suchas where you enter into a transaction or contractual arrangement with us; participate in our programs or activities;
provide data at industry events and trade shows; or visit our facilities.
We may also collect Personal Data when we visit you at your offices or when you contact our customer services or our
personnel via email, instant messaging, and/or telephone; in connection with your inquiries and communications withus; or from other sources, including your employer, data companies, publicly accessible databases, and joint marketing
partners.
When asked to provide Personal Data, you may decline. If, however, you choose not to provide the data that arenecessary for us to operate the requested services, we may not be able to provide you with certain services.

2

IPN EU2511 (Rev 19/07/2024)

Who are we?
Wells Fargo Group is one of the largest financial institutions in the world. As described in Part 2, in order to carry out
our business operations, Wells Fargo and the Affiliated Entities need to process certain Personal Data of Individuals
and Customers. The financial product or service you or your organization is receiving or seeking to receive from theWells Fargo Group determines which Wells Fargo entity listed in Part 4 is providing the service and is the primarycontroller of your Personal Data. Part 4 also lists each of those entities and their jurisdictions. Contact information for
our EMEA Regional Privacy Officer is listed in Part 3.
Name of group parent: Wells Fargo & Company
Headquarters location: 420 Montgomery Street, San Francisco, CA 94104 USA

Part 2. Our handling of Personal Data
Why do we process Personal Data?
Wells Fargo needs to process Personal Data for a number of purposes. A primary purpose is to ensure that we canprovide Customers with our products and services, which they have requested. As described below, we also need to use
Personal Data for purposes of carrying out our business operations, including confirming a person's authority as arepresentative or agent of a Customer, maintaining our relationship with you, manage risk, ensuring security,
maintaining business continuity plans and processes, providing online services and platforms, improving or marketing
our products and services, research and development, training staff, carrying out system or product development,
prevent and detect crime including fraud and financial crime, undertaking internal investigations and audits, handlinglegal claims, responding to requests from regulatory authorities, and complying with applicable laws and regulations
on a global basis.
In particular, we process the following Personal Data for the following purposes:

3•

To provide and improve the performance of products and services requested by our Customers. We mayprocess general data, position or employment/work description, identification and authentication data,
customer access or system usage data, financial data and payment details, marketing and communications
data, market data, geographical data, investigation data, complaints data, regulatory data and background or
credit check data in order to: perform obligations under our agreements; carry out related business functions;process data and transactions; perform commercial banking services (including deposit taking and accountmanagement); conduct credit checks and due diligence; market products and services; provide investmentbanking and financial services; improve the performance of our products and services; and manage Customer
relationships, complaints and inquiries, including where we need to contact Customers or Individuals with
important information or for other administrative purposes. We process such data because you voluntarily
provide this information and give your consent for us to process it; because such data is necessary to carry out
an agreement we have with you; because we have a specific legitimate interest to process it; to comply with alegal obligation; or to establish, utilize and defend our legal rights.

•

To comply with legal or regulatory obligations and laws & regulations. We may process any of the abovementioned types of Personal Data for the purpose of meeting our monitoring, recordkeeping and reporting
obligations (for instance, telephone call recording for legal and regulatory purposes), conducting audits,
detecting, preventing and investigating fraud, preventing money-laundering and terrorism financing, including
carrying out background checks; fulfilment of tax control and notification obligations, carrying out due
diligence and know-your-customer (KYC) checks; identifying potential conflicts of interest; complying withsanction rules and anti-corruption, anti-bribery, and transparency obligations; responding to legal processes
such as subpoenas; pursuing legal rights and remedies; defending litigation; conducting internal investigations;managing internal complaints or claims; and complying with internal policies or procedures. We process suchdata because such data is necessary to carry out an agreement we have with you; because we have a specific

IPN EU2511 (Rev 19/07/2024)

legitimate interest to process it; to comply with a legal obligation; or to establish, utilize and defend our legal
rights.
•To confirm a person’s authority as a representative or agent of a Customer. We process general data,
position or employment/work description, financial data and payment details, background or credit check data,
identification and authentication data, customer access or system usage data and geographical data to
confirm a person’s authority as a representative or agent of a Customer with which Wells Fargo or its AffiliatedEntities have entered or intend to enter into various arrangements, including deposit contracts, loan contracts,
contracts for foreign exchange transactions, contracts involving derivative transactions, letters of credit, loan
services, account management, commercial banking, commercial real estate, structured lending, corporate andinvestment banking services, credit card issuance and processing, financial services, and investment
management. We process such data because such data is necessary to carry out an agreement we have withyou; because we have a specific legitimate interest to process it; to comply with a legal obligation; or toestablish, utilize and defend our legal rights.

•

To conduct record-keeping. We process general data, position or employment/work description, financial
data and payment details, background or credit check data, identification and authentication data, customer
access or system usage data, market data, geographical data, complaints data, investigation data andregulatory data to facilitate the management of our records in a systematic manner so they can be retrieved
when required for legal, regulatory or operational reasons. To the extent permitted by applicable law andregulation, Wells Fargo may record telephone calls to support meeting our legal, regulatory or compliancerequirements We process such data because such data is necessary to carry out an agreement we have withyou; because we have a specific legitimate interest to process it; to comply with a legal obligation; or toestablish, utilize and defend our legal rights.

•

To protect Legal Rights and fulfil Legal obligations. We may process any of the above-mentioned types of
Personal Data when we believe it is necessary or appropriate to enforce our terms and conditions and toprotect our/your rights for privacy, safety or assets/property, and/or that of our Affiliates or others. We
process such data because such data is necessary to carry out an agreement we have with you; because wehave a specific legitimate interest to process it; to comply with a legal obligation; or to establish, utilize anddefend our legal rights.

•

For sale or business transaction. We may process any of the above-mentioned types of Personal Data inconnection with any reorganization, merger, sale, joint venture, assignment, transfer or other disposition of allor any portion of our business, assets or stock (including in connection with any bankruptcy or similar
proceedings). We process such data because we have a specific legitimate interest to process it; to comply witha legal obligation; or to establish, utilize and defend our legal rights.

Under which lawful bases do we rely on to process Personal Data?
Wells Fargo may process Personal Data:4•

because you voluntarily provide this information and give your consent for us to process it;•

because this information is necessary to carry out an agreement we have with you;••because we have a specific legitimate interest to process it;
to comply with a legal obligation;•

to establish, utilize and defend our legal rights;•

for insurance purposes;•

because this information is necessary for the performance of a task carried out in the public interest (e.g.
for the purpose of preventing or detecting crime); or•

because this information is necessary to protect the vital interests of any person.

IPN EU2511 (Rev 19/07/2024)

Do we transfer Personal Data to different countries?
The Wells Fargo Group operates across the globe, and we may transfer Personal Data to Affiliated Entities located incountries other than the country where a Customer opened its account or maintains its relationship with us. Transfers
can also take place where the Wells Fargo Group engages third parties to assist with certain operations and activities,
as they also may be established in different countries, including countries located outside the EU, UK or DIFC
respectively. The countries where the Wells Fargo Group has operations are shown on the map atwww.wellsfargo.com/com/international/locations.
Transferring your data cross-border: We may need to transfer your information in this way for a variety of purposessuch as to carry out our contract with you, to fulfil our legal obligation, to protect the public interest, and/or for ourlegitimate interests. The recipients of Personal Data identified herein may be located in the United States and otherjurisdictions. Some of these countries are recognized by the EU or the UK or the DIFC respectively as providing “anadequate level of protection” according to each of their respective standards (for instance, the full list of thesecountries recognized under EU law is available at https://commission.europa.eu/law/law-topic/dataprotection/international-dimension-data-protection/adequacy-decisions_en. With regard to transfers from the EU,
the UK or the DIFC to countries not considered adequate by the relevant Data Protection Authority, we have put inplace safeguards and adequate measures, such as standard contractual clauses as adopted by the EU, the UK or the
DIFC respectively to protect your Personal Data. Please contact our EMEA Regional Privacy Officer, using the contact
information in Part 3, to obtain a copy of these safeguards and measures.
To whom do we disclose Personal Data?
We may disclose Personal Data for the purposes described in Part 2 to the following recipients:

5•

Affiliated Entities. Wells Fargo has Affiliated Entities and subsidiaries operating in the United States andaround the world, including the group parent in the United States, Wells Fargo & Company, and Wells Fargo
Bank, N.A. Wells Fargo may disclose Personal Data to our Affiliated Entities on a worldwide basis and ourAffiliated Entities may use the data for the purposes described above and to the extent permitted byapplicable law. In certain circumstances, an Affiliated Entity may be acting as an independent controller ofprocessing of your Personal Data. If you have any questions, please contact our EMEA Regional Privacy
Officer, using the contact information in Part 3.

•

Beneficiaries, counterparties, and other parties related to a transaction; credit reference agencies. The
Wells Fargo Group may disclose Personal Data to beneficiaries, counterparties, or other parties related to atransaction on a worldwide basis to provide the services requested by our Customers and to comply with legal
obligations and regulations. We may provide Personal Data to credit reference agencies where permitted byapplicable law.

•

Service providers. The Wells Fargo Group may disclose Personal Data to information technology providers orother service providers around the world that act on our behalf and under our instructions regarding theprocessing of such data ("Data Processors"). Data Processors will be subject to contractual obligations to
implement appropriate technical and organizational security measures to safeguard Personal Data and toprocess Personal Data only as instructed.

•

Regulators, Public and Governmental Authorities, and other Legally Authorized Recipients. The Wells
Fargo Group may disclose Personal Data if required or permitted by applicable law or regulation, including laws
and regulations of the United States and other countries, or in the good faith belief that such action isnecessary to: (a) comply with a legal obligation or in response to a request from law enforcement or otherpublic authorities wherever the Wells Fargo Group may do business; (b) protect and defend the rights orproperty of any Wells Fargo Group entity; (c) act in urgent circumstances to protect the personal safety ofIndividuals, Customers, and contingent resources/employees of any Wells Fargo Group entity or other persons;or (d) protect against any legal liability. In addition, the Wells Fargo Group may share Personal Data with U.S.
regulators and other self-regulatory bodies that are competent to oversee our operations, wherever the Wells
Fargo Group may do business.

IPN EU2511 (Rev 19/07/2024)

•Acquiring Entities. The Wells Fargo Group might sell, buy, restructure or reorganize businesses or assets. In
the event of any actual or proposed sale, merger, reorganization, restructuring, dissolution or any similar event
involving our business or assets, Personal Data may be shared with the relevant entity or may be part of thetransferred assets and will be subject to the legal obligations to ensure their protection.

•

Professional Advisors. This category includes accountants, auditors, lawyers, insurers, bankers and otheroutside professional advisors in all of the countries where we operate. As necessary and in connection with the
purposes described in Part 2, Personal Data may be shared with one or more professional advisors.

How do we keep your Personal Data safe?
We have implemented appropriate technical, physical and organizational security measures to safeguard Personal Datain accordance with the Wells Fargo’s Information Security Policy and Standards. When we retain a non-Affiliated Entity
or Data Processor to perform a function, that entity will be required to protect Personal Data in accordance with ourstandards. Unfortunately, no data transmission or storage system can be guaranteed to be 100% secure. If you havereason to believe that your interaction with us is no longer secure, please immediately notify our EMEA Regional
Privacy Officer using the contact information in Part 3.
How long do we keep your Personal Data?
We retain Personal Data for as long as needed or permitted in light of the purpose(s) for which the data were obtained
and consistent with applicable law. The criteria used to determine our retention periods include but are not limited to
the following:•

The length of time we have an ongoing relationship with you and provide the services to you (for example, foras long as your organization has an account with us or keeps using the services);•

Whether there is a legal obligation to which we are subject (for example, certain laws require us to keep recordsof your transactions for a certain period of time after your organization no longer has an account with us);•

Whether retention is advisable in light of our legal position (such as in regard to applicable statutes oflimitations, litigation or regulatory investigations); and/or•

Whether our operational needs require maintaining your personal data (for example, for the internal audit ofbank operations, maintaining solicitation preferences (including for former customers and non-customers),
systems administration, or for fraud prevention).

Do we use any Cookies and similar technologies?
Our websites, apps and other digital products may also track and record your interactions with them to help:• Provide or improve services and features;• Keep you safe;• Keep our services secure;• Make your visit more personal; or• Support our marketing.
Some tracking is essential but other tracking is optional. For more details, please refer to: Wells Fargo Privacy Security
Cookies panel

Part 3. Your rights in relation to Personal Data
What are your rights?
You have the right to request to access, rectify, erase, or restrict processing of Personal Data, or request to receive a
copy of your Personal Data for purposes of transmitting it to another company (to the extent these rights are provided
to you by applicable law). To exercise these rights, contact our EMEA Regional Privacy Officer using the information
below. We will respond to your request consistent with applicable law.
You also may lodge a complaint with a Data Protection Authority for your country or region or in the place of thealleged misconduct. Contact information for the relevant Data Protection Authority may be found by clicking on thefollowing link(s):6

IPN EU2511 (Rev 19/07/2024)

United Kingdom

Information Commissioner's Office (ICO)

European Union

Our Members | European Data Protection Board (europa.eu)

DIFC

Data Protection | DIFC

How can you revoke consent to our processing of your Personal Data?
To the extent that consent is required by applicable law, we will seek your consent.
You may revoke your consent at any time by notifying the EMEA Regional Privacy Officer using the contact details
below. Prior uses and disclosures of Personal Data, however, will not be affected by the withdrawal of consent (unlessrequired by applicable law), and we may continue to process Personal Data as permitted or required by law.
How can you object to the automated decision-making and/or profiling?
You may object to the use of your personal data for the purposes of automated decision-making and/or profiling, by
contacting the EMEA Regional Privacy Officer using the contact information below.
How can you stop Wells Fargo from sending you marketing materials?
We will only send you marketing and sales materials where, and to the extent required by applicable law, you haveconsented to receive such materials. If you do not want to receive our marketing and sales materials by direct mail,telephone or email, please follow the unsubscribe or opt-out instructions provided in those communications or submit
a written request to the EMEA Regional Privacy Officer using the address shown below. You can also contact our EMEA
Regional Privacy Officer to exercise your right to object to the receipt of these communications. We will comply withany such request within a reasonable period after receipt.
How can you exercise your rights?
At Wells Fargo, we have team members who are dedicated to responding to requests in relation to your Personal Data,and to helping you with any other questions. For the Wells Fargo entities listed in Part 4, please contact our EMEA
Regional Privacy Officer using the contact information below:
Europe, Middle East, and Africa:
EMEA Regional Privacy Officer
Address: 33 King William Street
London, United Kingdom
EC4R 9AT
Telephone: +44 (0) 203-942-8000
Email: privacy.emea@wellsfargo.com
Can we modify this Notice?
We may change or update parts of this Notice to reflect changes in our practices and/or applicable law and regulation.
Please check this Notice from time to time so that you are aware of any changes or updates to it, which may be
indicated by a change in the effective date noted at the beginning of the Notice. If and when required under applicablelaw, we will notify you of any change or update in relation to this Notice by either individual message or disclosing thechanges to the data processing on an available medium.

Part 4. Wells Fargo entities operating in EMEAOne of these EMEA entities listed below will be the controller of your Personal Data, based upon your or yourorganization’s relationship with the Wells Fargo Group. You should consult your organization or contact at the Wells
Fargo Group to determine the name of the entity or entities with which you or your organization have a relationship.
A list of entities in the Wells Fargo Group operating in EMEA is set out below:
Name of Wells Fargo Legal Entity

7

IPN EU2511 (Rev 19/07/2024)

Jurisdiction

Wells Fargo Bank, National Association, London Branch

United Kingdom

Wells Fargo Securities International Limited

United Kingdom

Wells Capital Finance (UK) Limited

United Kingdom

Wells Fargo Bank International Unlimited Company

IrelandWells Fargo Bank International Unlimited Company, Frankfurt Branch, theDusseldorf Office

Germany

Wells Fargo International Finance (France) S.A.S.

FranceWells Fargo Securities Europe S.A.

FranceWells Fargo Capital Finance, Amsterdam Branch

The Netherlands

Wells Fargo Capital Finance, Stockholm Branch

SwedenWells Fargo Bank, National Association, DIFC Branch

Dubai, United Arab Emirates

8

IPN EU2511 (Rev 19/07/2024)