Document type: reference guide

Service policy: unavailable

1. Reading this guide

This is a guide to reading privacy documents. A DTCC Trading privacy policy and verified responsible entity are not published on this page.

Use the sections below to identify the information a privacy notice would need to explain for:

• People using a service; and

• People visiting a website, opening an application, contacting a service or following an external link. Establish which activity and interface a notice covers before applying its statements to a particular interaction.

Information can identify a person directly or become identifying when combined with other records. When reviewing a notice, consider names and contact details alongside device identifiers, account records and linkable transaction information.

Privacy requirements depend on the responsible entity, activity and jurisdiction. Read the applicability statement in the actual notice, then verify the relevant official sources for:

• The location and role of the organization responsible for processing;

• The place where the person or account is based;

• The specific collection, use or disclosure described by the service;

• Any stated regional supplement; and

• The version and effective date of the rules referenced by that supplement.

A person acting for a business can have a different relationship with a service from someone using it personally. A useful notice makes that distinction explicit, identifies whose information is involved and explains whether separate documents apply to the organization and its representatives.

2. Identifying the responsible parties

Start with the legal name in the applicable notice, then compare it with the service and jurisdiction it describes. A trading name, familiar logo or website domain alone does not establish which organization decides how personal information is processed.

A document should identify the role of each organization involved. Distinguish the party deciding the purposes of processing from a party carrying out specified tasks, and read how their responsibilities are described.

2.1 Entity details to establish

The following checks help identify an entity without treating a brand reference as authorization:

2.1.1. Exact legal name
Compare the name in the notice with the name in the relevant service terms and authoritative organization record.

2.1.2. Place of establishment
Check which jurisdiction the stated entity belongs to.

2.1.3. Service relationship
Identify the activity for which that entity is named.

2.1.4. Regional scope
Read the locations and users covered by the statement.

2.1.5. Local supplements
A regional supplement should explain how it relates to the main notice. Check its scope and date instead of assuming that a document for one location applies to every visitor.

When an interface is supplied by one organization and a service by another, read both roles in context. A notice should explain who provides instructions, who receives information and which document covers each stage. An embedded interface does not establish those relationships by itself.

2.2 Responsibility for each processing activity

Connect each purpose to the organization responsible for it. Account administration, payment processing and answering a privacy request can involve different functions. Record which party explains the activity, which contact channel it publishes and whether another notice governs part of the process.

A reference to a group of companies is not a complete description of information sharing. Look for the recipient or recipient category, the purpose of the transfer and the role performed by the receiving party. Keep those details separate from the organization that originally collected the information.

2.3 Data handling and control of an asset

Possessing transaction information and controlling an asset are different questions. A privacy document describes information handling; custody and wallet control require their own service terms. A public address or transaction identifier can appear in a record without showing who holds signing authority, how funds are held or what access an interface has to an account.

3. Data categories and collection sources

3.1 Identifying personal information

A category name can cover several kinds of information. Read the examples, the context in which they are used and any link to a person or account. The same technical identifier can have different significance when viewed alone or joined with account, communication or transaction records.

A clear notice connects each data category with the activity that produces it. Distinguish information entered into a form, records generated by an interaction and information obtained elsewhere. The examples below explain how to review those categories; they are not an inventory of DTCC data collection.

3.2 Reading a data-category inventory

3.2.1 Identity and contact details

For an identity or contact category, check the scope of each field:
(a) name format;
(b) address purpose;
(c) email use;
(d) phone use;
(e) nationality context;
(f) residence information; and
(g) age or birth-date purpose.

3.2.2 Verification-related information

A description of verification data should explain why each item is relevant:
(a) the document type and which details are read from it, rather than an undefined request for identification;
(b) the information needed to establish an address or residency statement;
(c) whether an image is reviewed directly or used to derive another identifier;
(d) why an employment or organization detail relates to the stated activity;
(e) the purpose of a residence-status field;
(f) the context for any tax identifier; and
(g) the source, date and use of information obtained from screening records.

3.2.3 Payment and transaction records

When a notice describes transaction information, distinguish:
(a) account details used by a payment provider;
(b) public addresses and the network to which each address belongs;
(c) amounts, currencies, timestamps and the status recorded at a particular stage;
(d) supporting information requested for a stated review purpose; and
(e) the merchant or service associated with the record.

3.2.4 Device and technical records

A technical-data description should clarify what each record represents:
(a) a network address and its context;
(b) browser family and version;
(c) device or operating-system characteristics;
(d) the role of a session or device identifier;
(e) the event time and referring page, if recorded; and
(f) a selected language or display preference.

3.2.5 Usage and communication records

For information about use of an interface, identify the relevant interaction:
(a) an access attempt and its recorded result;
(b) a setting chosen by the person using the interface;
(c) a request made through a page or application interface;
(d) a support conversation and the details attached to it; and
(e) feedback supplied for a stated research question or product review.

3.2.6 Information received from elsewhere

An external-source category should identify the source and the reason for obtaining the information:
(a) a public record and the date it was consulted;
(b) a verification result and the organization that produced it;
(c) a network-analysis result and the underlying observation;
(d) a payment or service record supplied by another participant;
(e) a referral or campaign record connected to an interaction; and
(f) information supplied through an official request or process.

3.2.7 Public network records

When blockchain records are relevant, distinguish the public observation from any additional account association:
(a) the address and the network being observed;
(b) the transaction identifier, amount and observation time;
(c) signature information visible in the relevant record; and
(d) the operation or contract interaction shown by that record.

A public transaction does not identify every person associated with it. A notice should separately explain any link it makes between a network record and information received through another channel.

3.3 Describing the collection process

3.3.1 Information supplied directly

For a direct collection point, establish whether information is entered during:
(a) an account or profile interaction;
(b) a documented verification request;
(c) a message to the responsible service;
(d) a voluntary research activity; or
(e) an instruction relating to an asset or payment.

3.3.2 Information generated by technology

For records generated by an interface, a notice should distinguish:
(a) storage or tracking technology used by a page;
(b) technical logs produced by a device or service; and
(c) measurements generated for a stated performance or analysis purpose.

Cookie and storage details belong in a matching technology notice.

3.3.3 Information supplied by another party

When information arrives from another organization, check:
(a) who performed the original collection or verification;
(b) which source record supports a screening result;
(c) which participant supplied a payment or transaction detail;
(d) the origin and scope of any campaign or audience record; and
(e) the official process associated with an authority request.

3.4 Aggregation and de-identification

A summary of many records is different from an individual record, but its label alone does not explain whether people remain identifiable. Read what detail is retained and what information can be combined with it.

The purpose of producing a summary should be stated alongside its contents. Distinguish measuring overall performance from analyzing a particular account, and check whether the output retains a link to the source records.

3.5 Sensitive information and context

A notice should identify any categories that need particular care in the relevant context. Read what information is involved, why it is needed and the safeguards described for it; do not infer a collection practice from a broad category heading.

Documents or attachments can contain details beyond the purpose of a request. Review whether the stated process explains unnecessary information, redaction options and the handling of material submitted by mistake.

3.6 Accuracy and correction

An accuracy statement should explain which records a person can review and how a correction would be requested.

When checking a correction process, identify the responsible recipient and use a verified route. The current contact information explains the availability of a DTCC channel.

4. Connecting information with its purpose

A useful processing description answers three questions together: what information is involved, why it is used and who performs the activity. Broad phrases such as service improvement or security are starting points for reading, not complete explanations. Look for the specific event, output and scope associated with each purpose.

4.1 Activities described by service documents

4.1.1 Account creation and administration

An account-related purpose should explain the records used to create access, maintain a profile and administer the stated service.
Details to distinguish:
(a) identity or contact fields;
(b) access and account records;
(c) records associated with the service activity.

4.1.2 Recording a transaction process

For a transaction-related purpose, follow the information from the request through the recorded outcome. Identify which participant creates each record.
Records to distinguish:
(a) payment-related details;
(b) the relevant network address;
(c) timing and transaction status.

4.1.3 Responding to a support inquiry

A support purpose should describe the issue being investigated and the information needed to understand it, rather than treating every available record as relevant.
Questions to ask:
(a) who submitted the inquiry;
(b) what communication is retained;
(c) which technical context is necessary.

4.2 Stated legal or reporting requirements

4.2.1 The reason for a verification request

When a notice cites a legal requirement for verification, locate the specific activity and responsible entity. A reference to a compliance framework alone does not establish the information required for every person or service.
The explanation should connect:
(a) the requested identity detail;
(b) any address evidence;
(c) the purpose of a screening result.

4.2.2 Reporting and recordkeeping purposes

A reporting purpose should identify the records involved and the obligation being described. Separate the act of recording a transaction from a later report.
Check the scope of:
(a) financial information;
(b) the relevant activity history;
(c) account or record identifiers.

4.2.3 Official requests and disclosures

An official-request section should explain the responsible recipient, the information sought and the context in which a disclosure is considered. Do not read a possible disclosure category as evidence that a request has occurred.
Relevant distinctions include:
(a) identification records;
(b) public and private transaction details;
(c) communications associated with the matter.

4.3 Other stated operational purposes

4.3.1 Access security and abuse review

A security purpose needs enough detail to connect an observation with the issue being assessed. Distinguish a technical event from a conclusion about a person or account.
Review the stated use of:
(a) transaction observations;
(b) device and session records;
(c) access and activity logs.

4.3.2 Understanding an interface

For interface research, check which interaction is measured and what the resulting analysis is meant to explain.
Keep these sources distinct:
(a) usage measurements;
(b) feedback supplied by a participant;
(c) technical performance observations.

4.3.3 Internal planning and reporting

An internal-reporting description should distinguish an operational total from a person-level record and explain the purpose of each.
Compare the treatment of:
(a) activity records;
(b) financial summaries;
(c) combined statistical measures.

4.3.4 Notices about a service

A notice about service operation has a different purpose from a promotional message. Read how the sender describes each category and which information it uses to address the message.
Check the connection between:
(a) the recipient detail;
(b) the message category;
(c) the event that prompted the notice.

4.4 Activities described as optional

Where a notice describes an activity as optional, look for a clear choice and an explanation of what that choice covers.

4.4.1 Promotional communications

For promotional messages, identify the sender, the subject of the communication and the method used to record a preference. The description should explain how that preference relates to each channel.
Distinguish:
(a) the destination address;
(b) the context used to select a message;
(c) feedback or interaction records.

4.4.2 Surveys and participant research

A research description should identify the question being studied, what participation involves and how responses are handled.
Consider separately:
(a) communication details;
(b) observed use of the interface;
(c) answers provided by a participant.

4.5 Explaining exceptional disclosures

A notice can describe situations outside routine service use. Each situation needs its own scope and reason:

4.5.1 A formal investigation or proceeding

Identify the type of process and the record being requested without assuming that every inquiry requires the same disclosure.

4.5.2 A specific security incident

An incident-related explanation should connect the information being reviewed with the event, affected system and purpose of the investigation.

4.5.3 A claim or disputed record

A dispute-related purpose should identify the record needed to examine the matter and distinguish that purpose from routine storage.

The explanation should remain specific enough to distinguish these cases from ordinary day-to-day processing.

4.6 Recording and changing a choice

When processing is described as based on a choice, read how that choice is captured, what it covers and how a later change is recorded. A preference control should have an understandable effect; its presence does not explain every activity described elsewhere in a notice.

4.6.1 Preferences for particular messages

A communication preference can be limited to a subject, sender or delivery channel. Check those boundaries before assuming that one setting covers all messages. A complete description should also distinguish a new preference from information already used for an earlier communication.

For a published preference process, look for an explanation beside the control or a verified contact route. See contact availability.

Useful preference details include:
(a) the contact destination concerned;
(b) the service or subject selected;
(c) any external sender involved;
(d) the record of the person’s choice.

4.6.2 Device permissions and settings

Device permissions and a service privacy notice answer different questions. A camera, file or microphone permission explains access at the device level; the service document should explain the purpose, information produced and handling of any resulting upload or recording.

A permission prompt alone does not establish how long information is retained or who receives it. Read those details alongside the requested access, and distinguish revoking future access from handling information already supplied.

For a device-based interaction, distinguish:
(a) the technical permission requested;
(b) the file, image or recording produced;
(c) the additional details attached to that item.

4.7 Urgent and exceptional circumstances

If a notice includes an emergency-related purpose, look for a precise description of the situation and the information involved. A broad reference to urgency does not explain the scope of access or disclosure.

The document should distinguish an urgent safety issue from a routine support request or ordinary security review. Keep the event, responsible party and action described in the notice together.

Useful questions about an exceptional process include:

• What circumstances trigger the review?

• Which information is relevant to that event and why?

• How is the decision recorded?

A clear explanation can distinguish:
(a) details used to identify the matter;
(b) any relevant transaction record;
(c) communications about the event;
(d) information supplied through an official channel.

5. Understanding recipients and disclosures

5.1 Sharing between related organizations

A group relationship does not by itself explain an information transfer. A notice should identify the receiving party or category and connect it to a specific purpose, such as:
(a) performing a stated part of a service;
(b) handling a particular inquiry;
(c) carrying out a documented review; or
(d) maintaining the systems used for an activity.

Read the receiving party’s role separately from its ownership or affiliation. A corporate connection does not describe the recipient’s access or permitted use.

5.2 Disclosures through official processes

For a section about public authorities or formal requests, distinguish the basis and scope of each disclosure described:
(a) the requirement or process cited by the notice;
(b) the request and the records it identifies;
(c) any reporting arrangement mentioned;
(d) the particular matter under investigation and the information relevant to it; or
(e) the event that explains an exceptional disclosure.

An official recipient should be identified through an appropriate source. Record the context rather than treating the category as an unrestricted access statement.

5.3 External service providers

A provider list is most useful when it explains the function performed and the information needed for that function. Different providers can have different roles, so compare the descriptions of:
(a) infrastructure and hosting of the relevant records;
(b) document or identity review for a specified purpose;
(c) performance measurement and the events it examines;
(d) screening or risk analysis based on identified sources;
(e) payment or settlement records exchanged during an instruction;
(f) support and case-management systems used for an inquiry; and
(g) delivery of a message or notification to its intended recipient.

A statement about provider safeguards should explain its scope. The name of a vendor or the existence of a contract alone does not describe the actual information flow.

5.4 Changes in ownership or organization

A corporate-event section should distinguish the event from the information transfer associated with it. Read which records are involved, who would receive them and how the notice describes the resulting responsibility. An acquisition, financing or restructuring reference does not establish that such an event has occurred.

If the document mentions a reduced-data form, check which details are removed and what links remain.

5.5 Sharing initiated by a person

When sharing follows an instruction, the description should identify the requested action and the receiving service. Compare the information required for that action with the scope of the choice or permission shown in the interface.

Two distinct situations to examine in a service description are:
(a) information passed to a merchant in connection with a particular service interaction;
(b) details supplied to a payment or wallet service to carry out a stated instruction.

Read the recipient’s notice where it governs a separate activity. A link or integration label does not replace an explanation of the recipient’s role.

6. Security and storage descriptions

6.1 Reading a safeguards statement

A safeguards statement should explain the scope and purpose of the controls it names. When reviewing a description, distinguish:
(a) protection while information is transmitted or stored;
(b) access to the systems holding it;
(c) observation of relevant security events;
(d) the way access is authenticated; and
(e) the procedures used by people handling the records.

A list of security measures is not a guarantee about every system or interaction. Look for the systems covered, the date of the description and the evidence supporting any assurance.

6.2 Information about an incident

An incident section should explain how an affected person would recognize an authentic notice and what information it would contain. Read the scope, responsible sender and communication route rather than inferring a notification deadline or method from a general security statement.

6.3 Describing a retention purpose

A retention explanation should connect a record to the reason it remains available, such as:
(a) completing a defined service activity;
(b) meeting a stated recordkeeping requirement that applies to the relevant entity and activity; or
(c) examining a specific unresolved matter.

Different categories can have different retention rules. Read how the starting event, duration and eventual handling are defined instead of treating a single period as a rule for every record.

6.4 Recognizing an authentic information request

Before responding to a message about personal information, verify the sender, destination and purpose independently. An unexpected message or familiar logo is not proof of authority. DTCC channel status is described in contact information.

6.5 Storage context and access

A storage description should identify the environment or location at the level stated by the notice and explain who can access the records. Distinguish a technical measure from an organizational process, and check whether a security statement concerns the entire service or only a named component.

When a recipient stores a copy, its role and handling conditions need to be understood separately. Similar wording in two notices does not establish identical access, controls or retention.

A storage location and a retention period answer different questions. Record the location being described, the category of information and the event that starts any period. Do not assume that closing an account changes every associated record at the same time or under the same rule.

Deletion, anonymization and archival are different outcomes. Read which outcome applies to a category and how it is described in the relevant document.

7. Reading retention periods

7.1 The record and its starting event

For each retention statement, identify the category and the activity to which the period relates:
(a) an ongoing or completed service interaction;
(b) a specified reporting or recordkeeping purpose; and
(c) a particular review, claim or unresolved instruction.

A period is easier to assess when the notice explains:
(i) the records included in the category;
(ii) the event from which time is measured;
(iii) the condition that changes or extends the period; and
(iv) what happens when that condition no longer applies.

7.2 Requirements cited for retention

Where a notice cites a legal or regulatory reason for retaining information, identify the entity, activity and record category concerned. A general reference to financial regulation does not establish a period that applies to every record.

A numerical period should have a source and a defined starting event. Compare those details before applying an example duration to a different service, jurisdiction or type of information.

7.3 Closure and deletion as separate events

An account closure and a data request can concern different records. Look for an explanation of:
(a) information needed for a remaining purpose;
(b) records linked to an unresolved matter; or
(c) information covered by a stated retention requirement.

The stated end of a purpose should be connected to a defined handling outcome for the affected records.

A policy should distinguish a minimum period from a maximum period and explain any event that changes the calculation. Record the source of a stated requirement; a period copied from another service is not evidence of a DTCC retention practice.

When a request and a retention requirement overlap, the document should explain the relevant categories and the reason for a different outcome. Keep the request date, affected records and stated response together rather than assuming that every copy is handled identically.

8. Age-related privacy information

8.1 An age-related section should identify the service and audience it describes. Read the stated scope separately from any general reference to children or young people in a privacy document.

8.2 If the document describes how an unexpected submission is handled, look for the responsible recipient, information involved and review process. The description should distinguish restricting access from deciding what happens to information already received.

8.3 A concern about information relating to a young person requires an independently verified recipient. This page lists contact availability without asking you to submit personal records.

9. Locations and cross-border access

9.1 A cross-border section should identify the information flow, not merely list office locations. Distinguish where information is initially collected, where it is stored and where a recipient can access it. A company’s place of establishment does not describe every location involved in processing.

9.2 Read the stated source and destination context together. A notice should explain the role of the receiving party and the basis it gives for the transfer. Do not infer that two locations have the same requirements or safeguards because they appear in the same document.

9.3 When a notice describes a transfer mechanism, record the specific explanation and source, including:
(a) the official decision or record being referenced;
(b) the agreement or clauses described and the parties to which they apply;
(c) the scope of any choice requested from the person;
(d) the service activity connected with the transfer;
(e) any particular claim or proceeding mentioned; or
(f) another stated basis and the context needed to assess it.

9.4 A request for transfer details needs an authentic recipient. Consult contact availability and the relevant published notice to identify where such a request would go and what information the recipient provides about the arrangement.

10. Cookies and local storage

10.1 A technology notice should explain which browser or device records are involved in a particular interaction. A general privacy section does not by itself establish an inventory of deployed technologies.

10.2 A description of a cookie or similar item is useful when it identifies the name, source, purpose and relevant lifetime. Distinguish information stored on a device from information transmitted to a service. A preference stored locally and a record sent elsewhere can require different explanations.

10.3 Functional, measurement and promotional purposes should be described separately. Read what each item does, when it is used and whether a setting affects that item, rather than relying only on its category label.

10.4 If a third-party technology is described, identify the party and the activity covered by its notice. An external library, embedded frame and network request are different observations; none should be treated as a complete account of information handling on its own.

10.5 Browser controls can help inspect storage and manage preferences. The effect of a control depends on the browser and the item concerned. Distinguish deleting an existing item from preventing a future one, and consult documentation for the control being used. For general background, the reference links point to AboutCookies.org and AllAboutCookies.org.

10.6 A tool intended for a particular provider should be read in that provider’s documentation. Its presence as a reference does not confirm that the provider operates on this site.

10.7 For a separate explanation of technology categories and preference controls, read the cookie information. Compare any eventual service inventory with the exact browser or device item it describes.

11. External pages and interfaces

11.1 An external link can lead to a different organization, purpose and information flow. Before interacting with the destination, identify its domain and the service it describes. A linked explanation, identity service and payment interface should each be read in their own context.

11.2 The privacy notice of the destination should identify the activity covered there. Compare it with the originating page to understand whether information is simply being viewed, entered into a form or passed between services.

11.3 Keep the source page and destination notice together when reviewing an interaction. The terms or privacy statement of one provider cannot be assumed to describe a separate organization’s systems.

11.4 A link provides a route to information; it does not by itself establish endorsement, affiliation or a data-sharing arrangement.

12. Reading rights and preference procedures

12.1 A rights section should identify the people, records and jurisdictions covered by its statements. Read the procedure alongside the scope of the notice rather than assuming that every described request has the same conditions or outcome. Access, correction, deletion and changing a preference are distinct requests that need their own explanation and stated scope.

12.2 Where a document describes obtaining or transferring a copy, check the categories included, the format and the recipient. Distinguish receiving a record from transferring an account or moving an asset; those are separate activities.

12.3 If a request concerns limiting or objecting to processing, identify the activity in question and the explanation given for its continued or changed handling.

12.4 A complaint route should identify the relevant organization or authority and explain how its remit relates to the matter being raised.

12.5 A preference concerning advertising should state the activity and scope it covers. A control for one purpose should not be assumed to cover every use of information.

12.6 A request process needs an authentic recipient and a clear description of the information needed to identify the relevant record. Review how the process explains verification, the requested action and the resulting response without supplying additional personal material through an unverified channel.

12.7 If a representative can act for someone else, the procedure should explain the role and evidence of authority. Distinguish confirming the representative’s permission from identifying the person or records concerned, and review the specific instructions published for that process.

12.8 Browser signals and service controls are not interchangeable. Read how a notice describes a particular signal before assuming it changes an activity.

12.9 The scope of a message preference should be explained where the choice is made. For DTCC channel status, see contact information. A published procedure should distinguish promotional messages from notices about a specific service event.

A preference record should identify the channel, subject and date of the choice. Read any stated exceptions in the actual service notice instead of inferring them from a general example.

12.10 Request records and response information

A published request process should identify its recipient through an authentic channel. See contact availability. It should also explain the relevant record categories, the information needed to locate them and the way an outcome is communicated. A response period needs its own applicable source and starting event; this reference does not set a deadline for a DTCC request.

Verification for a request should be explained in relation to the information involved. Read why a particular detail is needed, which recipient handles it and whether the procedure offers another way to identify the relevant record. Do not assume that an unspecified request requires a full identity document.

The description of an outcome should make clear which parts of a request were addressed and which remain unresolved. If a document mentions a charge, exception or refusal, read the stated conditions and source rather than applying a general phrase to every request.

12.11 Automated analysis and review

If a notice describes automated analysis, look for the purpose, inputs and kind of result produced. A score, flag or classification is different from a final decision. The explanation should distinguish the role of a technical system from any review performed by a person or another service.

An explanation of the system’s purpose does not establish its accuracy, suitability or legal effect in a particular case.

A meaningful review description identifies how a person can ask about an outcome and what context the recipient provides. Read whether the process explains the information used, the role of any human reviewer and how a disputed record or conclusion is considered.

13. Contacts and authority references

13.1 A privacy contact should identify the responsible organization and the purpose of the channel. The present contact information describes DTCC channel availability.

A notice that names a specialist privacy role should explain its scope and how to reach the correct recipient. Refer to contact availability before treating any channel as an appointed DTCC privacy office.

Compare a stated legal name with its authoritative organization record.

Verify a published address in the context of the entity it identifies.

13.2 If a document is offered in another format, the request route and available format should be clearly described. This reference does not establish a delivery process.

13.3 A privacy inquiry and a request about an account can have different recipients. Use the channel named for the specific purpose.

13.4 The references below point to official authority websites for general research. They do not designate a DTCC lead authority or determine which authority is relevant to a particular person, organization or activity.

• Denmark — authority reference
  Danish Data Protection Agency
  Consult its official pages for its remit
  Check current contact instructions
  Use the channel named for your inquiry
  Official website: Datatilsynet (Denmark)

• Norway
  Norwegian Data Protection Authority
  Read its published remit and guidance
  Check the current inquiry process
  Official website: Datatilsynet (Norway)

• Australia
  Office of the Australian Information Commissioner
  Read the scope of its published information
  Check the relevant inquiry instructions
  Official website: OAIC

• Canada
  Office of the Privacy Commissioner of Canada
  Check its official guidance and remit
  Use its current contact instructions
  Official authority website

• United States
  Privacy information can depend on the relevant state and activity. Read the official source applicable to the question. DTCC contact availability is separate from any public authority’s complaint or inquiry process.

14. Reading a regional supplement

A regional supplement should explain the location, people and activities to which it applies and how it relates to the main notice. Check defined terms within that context; a familiar phrase can have a specific meaning in a particular document. The scope of a supplement must be established for the actual service and activity before its statements are applied to a particular interaction.

14.1 Categories and disclosure descriptions

Compare the categories in a regional supplement with the main inventory rather than assuming that their names are interchangeable. Record what each category includes, the stated purpose and the recipient or recipient category. If one section discusses collection and another discusses disclosure, keep those actions distinct. A list of possible recipients is not evidence of a particular transfer, and an example of a data type is not confirmation that it is collected here.

14.2 Information needing particular care

A supplement may describe a narrower category of information that needs a more specific explanation. Read the definition, the purpose and any conditions attached to its use. Distinguish an identity number from an image of a document, an account name from an access credential, and a photograph from information derived from it. Those differences help identify what a statement actually covers. A broad assertion about security or compliance does not replace a description of the relevant information and processing activity.

14.3 Requests described in a supplement

Read each request type separately: obtaining information, correcting a record, asking about deletion, changing a preference and challenging an outcome can involve different records or procedures. A useful supplement identifies the scope of the request, the recipient and the explanation given for its outcome. Keep any conditions, exceptions and applicable sources with that description. Do not infer that a request transfers an asset, closes an account or changes a network record unless the relevant service documentation explains that separate action.

Where a supplement describes a request process, compare it with the main contact and verification sections. The destination should be authentic and the requested information should relate to the records concerned. If a representative is involved, the explanation should identify the authority needed for that role. Retain the wording and date of the actual request instructions when reviewing the process.

14.4 Sale, sharing and advertising terminology

Read the definition attached to each term in the relevant notice and jurisdiction. Commercial use, disclosure to a provider and a choice about advertising can refer to different activities. A label alone does not establish whether a particular information flow falls within it.

14.5 Treatment after a request

A statement about treatment following a privacy request should be read with the activity it describes. Identify the service condition, the reason given for any difference and the applicable source. This guide does not establish pricing, access or other service consequences for making a request.

Additional regional disclosure references

Some documents contain a separate disclosure section tied to a particular location or subject. Check the exact reference, the information it covers and the official source before relying on it. Keep that section distinct from the service’s general marketing preferences and provider disclosures. The existence of a regional heading does not confirm that its procedure applies to a DTCC interaction.

15. Versions and changes to a notice

A published privacy notice should make its version and scope clear. When comparing versions, identify the passages that changed and the activities affected. A new publication date alone does not explain whether a purpose, recipient, retention statement or request process has changed.

If a notice describes how changes are communicated, read the stated channel and the circumstances covered. Distinguish a publication update from a separate choice or agreement requested by a service.

Use the version and date shown on the actual notice being reviewed.