TCX Investment Management Company B.V.
Last updated: 1 September 2026
Introduction
TCX Investment Management Company B.V. (TIM), as the dedicated Fund Manager of The Currency Exchange Fund N.V. (TCX), qualifies as a controller (verantwoordelijke) for the purposes of the General Data Protection Regulation (GDPR). TIM, as agreed in the data processing agreement is controller of the data of both TIM and TCX.
This Privacy Notice explains how TIM collects, uses, stores and shares personal data in connection with the services provided by TIM/TCX. It applies to individuals who are professionally linked to TIM/TCX in any way.
The Notice describes which personal data TIM processes, the purposes and legal bases for processing, how long the data are retained, with whom they may be shared, and the rights of data subjects under the GDPR and applicable Dutch data protection legislation (AVG/UAVG).
Scope of this Privacy Statement
This statement applies to personal data processed in the context of
- Relationship management;
- To enter into and execute agreements;
- To send informative newsletters and offers;
- Recruitment;
- Employment and post-employment obligations;
- Regulatory reporting;
- Transactions performed to execute the investment policy of TCX.
Where this statement refers to ‘’you”, it means a natural person whose personal data are processed because of your role in relation to TIM/TCX as supplier, business relation, counterparty, (former/potential) employee.
What are personal data?
Personal data means any information relating to an identified or identifiable natural person. This may include a name, identification number, contact details, address, online identifiers, or information relating to a person’s economic, cultural, or social identity.
Personal data collected
· Full name, date and place of birth, and nationality.
· Copy of a valid identity document, such as a passport or national ID card.
Residential address and contact details, including telephone number and
e-mail address.
· Role, title and documentation showing representative authority, such as a
power of attorney, board resolution or delegation of authority.
- If required, UBO information, including name, date of birth, nationality, country of residence and ownership or control percentage.
- Source of wealth and source of funds information for UBOs where enhanced BRDD is required.
- If required, Politically Exposed Person (PEP) status.
- If required, Sanctions screening results against EU, UN, OFAC and other applicable lists.
- Tax identification number (TIN) and tax residency where relevant.
- During recruitment TIM processes: full name, contact details, resume/CV, cover letter, references, educational qualifications/scores and work history. Where required by regulation (e.g. AIFM fitness and proprietary requirements), TIM may carry out background checks and integrity screenings with the explicit consent of the candidate or as required by the AFM.
- Correspondence and supporting documentation provided during onboarding or periodic review.
Special category and criminal offence data
PEP screening may incidentally reveal political opinions or affiliations. This processing is based on Article 9(2)(g) GDPR, read with Article 22 UAVG and the Dutch Act on the prevention of money laundering and financing of terrorism (“Wwft’’). Sanctions screening may involve criminal offence data and is processed on the basis of Article 10 GDPR and Article 33 UAVG, as applicable.
Legal basis for the processing of personal data
The table below sets out the principal processing activities of TIM and the applicable lawful basis under Article 6 GDPR. Where processing is based on legitimate interests (Art. 6(1)(f)), a Legitimate Interests Assessment (LIA) must be documented and retained.
Cookies policy
TIM has a cookie policy available. Please consult the cookie policy published on its website, Cookie policy - TCX
Security of personal data
TIM implements appropriate technical and organizational measures to protect personal data against unauthorized or unlawful processing, accidental loss, destruction or damage, in accordance with Article 32 GDPR. Measures include:
- Encryption on the website, through this encryption, the data traffic between you and the webserver is inaccessible for unauthorized parties.
- Management of access rights to personal data processed by TIM.
- Written guidelines, code of conduct and regular staff data protection awareness training.
- Data processing agreements with relevant third-party service providers.
- Personal data breach notification procedures in accordance with Articles 33 and 34 GDPR.
The Data Subject also has an important role to play in securing your personal data, e.g. by keeping the devices they use up-to-date and keeping its login data confidential and secure.
Sharing of personal data and international transfers
TIM shares personal data only on a strict need-to-know basis. Recipients may include relevant TIM/TCX departments, the fund administrator, depositary, auditors and accountants, KYC/BRDD screening providers, legal advisers, portal hosting providers, regulators and competent authorities such as AFM, DNB, AP, Belastingdienst and FIU-Nederland.
Where personal data are transferred outside the European Economic Area, TIM and TCX ensure that an adequate level of protection is maintained through an adequacy decision, Standard Contractual Clauses approved by the European Commission or other appropriate safeguards under Article 46 GDPR. Details are available on request via privacy@tcxfund.com
Data retention
TIM retains personal data only for as long as necessary for the purpose for which the data was collected or as required by applicable law. The following retention periods apply to personal data relating to identified natural persons associated with investor entities:
Certain records containing personal data may be subject to mandatory retention obligations under EMIR, the Wft and the Dutch Civil Code for periods of up to 10 years or longer. Personal data will be deleted when no longer required, to the extent technically possible across systems, including backups.
Your rights as a data subject
Under the GDPR and the Dutch AVG/UAVG, you may have the following rights in relation to personal data processed by TIM:
- Right to be informed (Articles 13–14 GDPR).
- Right of access (Article 15 GDPR).
- Right to rectification (Article 16 GDPR).
- Right to erasure (Article 17 GDPR), subject to statutory retention obligations.
- Right to restriction of processing (Article 18 GDPR).
- Right to data portability (Article 20 GDPR), where applicable.
- Right to object to processing based on legitimate interests (Article 21 GDPR).
- Right to withdraw consent at any time where processing is based on consent (Article 7(3) GDPR).
- Right not to be subject to solely automated decision-making producing legal effects (Article 22 GDPR). TIM does not use solely automated decision-making for such purposes.
- Right to lodge a complaint with the Autoriteit Persoonsgegevens (Article 77 GDPR) and to seek a judicial remedy (Article 79 GDPR).
- Certain rights, in particular erasure and portability, may be limited where TIM is required by law to retain data, including Wwft KYC/CDD files, EMIR trade records, CRS/FATCA data and Wft regulatory records.
How to exercise your rights
Submit a data subject request to TIM Legal & Compliance by e-mail at privacy@tcxfund.com or by post to Mauritskade 64, 1092 AD Amsterdam, the Netherlands.
TIM will acknowledge receipt within 72 hours, may request identity verification where necessary, and will respond within one month of receipt. Complex or multiple requests may be extended by a further two months, in which case you will be informed within the initial one-month period.
Complaints
If you have a complaint about the processing of your personal data, please contact privacy@tcxfund.com
You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
The contact details for the Dutch Data protection authority are:
For a visit (with appointment):
Hoge Nieuwstraat 8
2514 EL The Hague
Postal address:
Autoriteit Persoonsgegevens
PO Box 93374
2509 AJ The Hague
Business contact
Telephone: (+31) - (0)70 - 8888 500
Fax number: 088-0712 140
For more information visit the webpages of Autoriteit Persoonsgegevens:
Een tip of klacht indienen bij de AP | Autoriteit Persoonsgegevens
Changes and contact
Amendments to this Privacy Statement will be published on www.tcxfund.com. For questions about this Privacy Statement, please contact privacy@tcxfund.com