Privacy Policy

This text applies analogously to male and female persons and a plurality of persons.

Issue March 2025

1. Protection of personal data

The protection of personal data is a top priority for the asset manager. The personal data of clients is subject to professional secrecy. Personal data is treated as strictly confidential and is protected from access by unauthorised third parties. Persons who are not subject to a confidentiality obligation do not have access to the personal data collected. The asset manager also ensures that the recipients of the personal data comply with the applicable data protection provisions.  

2. Sources of personal data of the asset manager

In the context of business relationships with clients or potential clients ("client") and natural persons or legal entities associated with the client, the data that the asset manager receives from the data subject (e.g. the client) is processed. The asset manager may also obtain data from service providers, public registers (e.g. commercial register, Swiss Official Gazette of Commerce) or authorities that the asset manager requires for the provision of the service or for legal or regulatory reasons. 

Associated natural persons or legal entities include, in particular, any:

• Authorised representative or authorised signatory,
• Beneficial owner and controlling person,
• Payee of a specific payment transaction, or
• Any other natural person or legal entity who has a relationship with the client that is relevant to the business relationship between the client and the asset manager.

3. Types of personal data processed by the asset manager

The categories of personal data processed by the asset manager include personal information (e.g. name, date/place of birth, marital status, address, interests, family relationships, contact details (telephone number or email address), transaction data, financial circumstances, investment objectives, professional information, data relating to the use of the asset manager's website (e.g. IP address, cookies) and other information on powers of attorney, personal relationships, regulatory relationships, log files).

It is possible that data other than the aforementioned data is processed when a specific service or product offer is accepted. This may include, for example, order data, sales, documentation data, investment behaviour, investment strategy, balance sheets and other business data.

Insofar as the asset manager processes sensitive personal data, it does so in relation to:

• Processing for which the data subject has given their express consent.
• Processing relating to personal data that the data subject has made public or which has been made public.
• Compliance with legal or regulatory obligations.

4. Purposes of data processing

The asset manager collects and processes only the personal data that is necessary for the fulfilment of a specific purpose. Personal data is processed in particular for the following purposes:

• In connection with the client's business, i.e. in order to be able to provide the products and services offered by the asset manager, e.g. for the (possible) opening or management of a business relationship.
• In order to fulfil legal and regulatory obligations, e.g. the Anti-Money Laundering Act (AMLA), Financial Services Act (FinSA), disclosure obligations to authorities.

In connection with marketing, i.e. to improve the products and services offered or to offer new products and services, e.g. by means of direct marketing, sending newsletters, operating the website.

5. Compliance with data protection principles

The asset manager processes personal data in particular in compliance with the Federal Act on Data Protection (FADP) and the Ordinance on Data Protection (DPO). When processing personal data, the asset manager makes sure that the personal data is processed lawfully, in good faith and proportionately. The data is processed in the manner specified at the time of collection, as recognisable to the data subject or as provided for by law. The asset manager does not process the personal data covertly or secretly, unless this is required by law. Personal data is only collected by the asset manager for a specific purpose that is recognisable to the data subject. Taking into account the state of the art and the implementation costs, the asset manager implements appropriate technical and organisational measures to ensure that the processed personal data:

• Is only accessible to authorised persons,
• Is available when it is needed,
• Is not changed without authorisation and unintentionally, and
• Is processed in a comprehensible manner.

Should it transpire that personal data is incorrect or incomplete, the asset manager will correct, erase or destroy the personal data, unless this is prohibited by law or regulatory provisions.

6. Basics of the processing of personal data

If required, the asset manager processes personal data for the following reasons:

6.1 Overriding public or private interest

The asset manager processes personal data to initiate or conclude a contract, to fulfil the obligations arising from a contract (e.g. advisory/management services or the execution of orders and transactions), if necessary to analyse client behaviour (including profiling), for measures to improve products and services, or for direct marketing. 

The asset manager also has legitimate private interests in processing personal data: 

• To secure or enforce the asset manager's claims against the client,
• When collecting claims of the asset manager against the client,
• In the event of legal disputes between the asset manager and the client,

For enquiries about eligible persons in the event of a lack of contact or dormancy.

6.2 Lawful basis

The asset manager is obliged to process personal data on the basis of various legal and regulatory provisions. In particular, this includes legal obligations, e.g. the Financial Market Supervision Act, Financial Institutions Act, Anti-Money Laundering Act, Financial Services Act, etc.

6.3 Consent

If consent is required for the processing of personal data, the asset manager will obtain this from the data subject. The consent given can be revoked at any time. A corresponding revocation only takes effect upon receipt by the asset manager and does not affect the lawfulness of the processing of personal data before the revocation. There may be reasons (e.g. due to a law) that make it necessary to process the personal data despite the revocation. Revocation of consent may result in the restriction of certain services or the termination of the business relationship. 

7. Duration of storage of personal data

The asset manager processes and stores the personal data for as long as is necessary to fulfil the purpose for which the personal data was collected or to comply with contractual or legal obligations. As a rule, this is ten years after the service was provided or the business relationship ended. 

If personal data cannot be erased, technical and organisational measures are taken to ensure that:

• Procedures are implemented to ensure the integrity of the data, in particular to guarantee the authenticity and integrity of the data or documents (e.g. digital signature or time stamp). These also ensure that the data cannot subsequently be changed without this being detected;
• The contents of the data are traceable at all times; 
• Access and logins are logged and documented by means of "log files".

8. Rights arising from data protection

In principle, the data subject has the following rights, provided there is no legal obligation to the contrary:

• Information about personal data,
• Correction of personal data,
• Release of personal data,
• Transfer of personal data,
• Prohibition of the processing of certain personal data,
• Restriction of the processing of personal data,
• Prohibition of the disclosure of personal data to third parties,
• Revocation of consent to the processing of personal data,
• Erasure and objection to the personal data collected.
• 
  

The modalities concerning the exercise of the above-mentioned rights of the data subject and the duties of the asset manager, such as oral or written form, must be clarified between the data subject and the asset manager by mutual agreement. If the provision of information, the issuing or transfer of data involves a disproportionate effort, the asset manager may insist on a contribution to the costs of up to CHF 300.

9. Recipients of personal data

Personal data is only processed by those persons who need it to fulfil contractual or legal obligations. If necessary, service providers and third parties (e.g. outsourcing partners) are given access to the data. Professional secrecy and other statutory provisions are observed.

Service providers and third parties as recipients of personal data can be, for example:

• Other Group companies,
• Order processors and other service providers (e.g. suppliers),
• Public bodies (e.g. authorities), insofar as a legal or official obligation provides for this.

10. Data transmission abroad

In principle, data is not transmitted abroad. If personal data is transmitted abroad, this takes place in compliance with the statutory provisions and where this is required to perform the contract (e.g. to process international transactions or execute orders at foreign trading venues). If order processors are deployed abroad, they are obliged to comply with professional secrecy obligations and the Data Protection Act.

11. Profiling and automated decision in individual cases

In certain cases, the asset manager processes personal data automatically in order to assess personal aspects. This can happen in the following cases, for example:

• In the context of the legal obligation to combat money laundering and terrorist financing, by way of monitoring and analysing transactions.
• To inform the client about tailored services and products.

The asset manager reserves the right to process personal data in an automated manner in the future in order to create client profiles, to predict developments and to identify characteristic and personal features in connection with the data subject. The asset manager can use the client profiles created, for example, to make offers and information available to the client.

12. Logging of certain personal data processing operations

If the asset manager processes sensitive personal data automatically on a large scale or carries out higher-risk profiling of data subjects, it must log such processing as a technical and organisational measure and regulate it internally by way of regulations so that it can subsequently be checked, e.g. for conformity with the purpose.

13. Data in relation to the website

13.1 Data collection when visiting our website

This website uses SSL or TLS encryption for security reasons and to protect the transmission of personal data and other confidential contents (e.g. orders or enquiries to the controller). You can recognise an encrypted connection by the character string "https://" and the lock symbol in your browser line.

When you use our website for information purposes, i.e. if you do not register or otherwise provide us with information, we only collect the data that your browser transmits to our server (so-called "server log files"). When you visit our website, we collect the following data that is technically required for us to display the website to you:

• Our visited website
• Date and time of access
• Amount of data sent in bytes
• Source/reference from which you reached the page
• Browser used
• Operating system used
• IP address used

Processing is carried out in accordance with Art. 6 para. 1 f) GDPR on the basis of our legitimate interest in improving the stability and functionality of our website. The data will not be passed on or used in any other way. However, we reserve the right to review the server log files at a later date if there should be any specific reason to suspect unlawful use.

13.2 Cookies

To make visits to our website attractive and allow the use of specific functions, we use cookies on various pages. These are small text files that are saved on your end device. Some of the cookies used by us are erased again at the end of the browser session, i.e. when you close your browser (session cookies). Other cookies remain stored on your end device and allow us or our partner companies (third-party cookies) to recognise your browser when you visit us again (persistent cookies). If cookies are set, they collect and process certain user information such as browser and location data and IP address values to an individual extent. Persistent cookies are automatically deleted after a specified period, which may vary depending on the cookie. Some cookies are used to simplify the ordering process by saving settings (e.g. remembering the contents of a virtual shopping basket for a next visit to the website). If personal data is also processed by individual cookies implemented by us, the processing is carried out in accordance with Art. 6 para. 1 b) GDPR either for the performance of the contract or in accordance with Art. 6 para. 1 f) GDPR to safeguard our legitimate interests in the best possible functionality of the website and a client-friendly and effective visit to the site.
We may work together with advertising partners who help us to make our website more interesting for you. For this purpose, cookies from partner companies are also stored on your hard drive when you visit our website (third-party cookies). Please note that you can change your browser settings to notify you about the setting of cookies so that you can decide individually whether to accept them or to reject cookies on an ad hoc basis or generally. Each browser differs in the way it manages cookie settings. This is described in the help menu of each browser, which explains how you can change your cookie settings. These can be found for the respective browsers under the following links: Internet Explorer, Edge, Firefox, Chrome, Safari or Opera.

Please note that if you reject cookies, the functionality of our website may be limited.

13.3 AWStats

We use the AWStats program to evaluate our website statistically. The program is a free web analysis software. It is used to analyse log files that web servers create on the basis of visitor requests. The program does not use cookie files for the evaluation. The statistical analysis is carried out via the log files, which also contain IP addresses. As a rule, this data cannot be assigned to specific persons. This data is not combined with data from other sources and the data is deleted after a statistical analysis. In contrast to other statistics programs, AWStats does not transmit any data to a third-party server. The program is installed on our own server. This also means that the transfer of data abroad is avoided as our servers are located in Switzerland (CH). 

13.4 Google Analytics

This website uses Google Analytics, a web analysis service offered by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA ("Google"). Google Analytics uses "cookies", which are text files placed on your computer, to help the website analyse how users use the site. The information generated by the cookie about your use of this website (including the abbreviated IP address) is usually transmitted to and stored on a Google server in the USA. This website uses Google Analytics exclusively with the extension "_anonymizeIp()", which ensures anonymisation of the IP address by shortening it and excludes direct personal references. Due to the extension, your IP address is abbreviated by Google in the member states of the European Union or in other contracting states to the Agreement on the European Economic Area. Only in exceptional cases is the full IP address transmitted to a Google server in the USA and truncated there. In these exceptional cases, this processing is carried out in accordance with Art. 6 para. 1 f) GDPR on the basis of our legitimate interest in the statistical analysis of user behaviour for optimisation and marketing purposes. Google uses this information on our behalf to analyse your use of the website, to prepare reports on website activities and to provide us with other services related to the use of the website and the internet. The IP address transmitted by your browser through Google Analytics is not merged with other data held by Google. You may refuse the filing of cookies by selecting the appropriate settings in your browser software; please note, however, that in this case you may not be able to use the full functionality of this website. You can also prevent the capture of the data referring to your usage  (including your IP address) that is generated by the cookie by Google and the processing of this data by Google by downloading and installing the browser plugin offered under the following link. As an alternative to the browser plugin or within browsers on mobile devices, please click on the following link to set an opt-out cookie that will prevent Google Analytics from collecting data within this website in the future (this opt-out cookie only works in this browser and only for this domain; if you delete your cookies in this browser, you must click this link again): deactivate Google Analytics. Google LLC with its registered office in the USA is certified for the US-European data protection agreement "Privacy Shield", which guarantees compliance with the data protection level applicable in the EU. This website also uses Google Analytics for a cross-device analysis of visitor flows, which is carried out via a user ID. You can deactivate the cross-device analysis of your usage in your client account under "My data", "Personal data". You can find more information on how Google Analytics handles user data in the data privacy policy of Google. 

14. Tools and miscellaneous

14.1 Google Maps

We use Google Maps (API) on our website offered by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA ("Google"). Google Maps is a web service for displaying interactive (country) maps in order to visually present geographical information. Using this service will show you our location and make it easier for you to find us. Information about your use of our website (such as your IP address) is transmitted to Google servers in the USA and stored there as soon as you access the sub-pages in which Google Maps is integrated. This takes place regardless of whether Google provides a user account through which you are logged in or whether no user account exists. If you are logged in to Google, your data will be assigned directly to your account. If you do not wish to be associated with your Google profile, you must log out before activating the button. Google stores your data (even for users who are not logged in) as usage profiles and analyses them. Such an evaluation is carried out in particular in accordance with Art. 6 para. 1 f) GDPR on the basis of Google's legitimate interests in the display of personalised advertising, market research and/or the needs-based design of its website. You have the right to object to the creation of these user profiles, whereby you must contact Google to exercise this right. Google LLC with its registered office in the USA is certified for the US-European data protection agreement "Privacy Shield", which guarantees compliance with the data protection level applicable in the EU. If you do not agree to the future transmission of your data to Google when using Google Maps, you also have the option of completely deactivating the Google Maps web service by switching off the JavaScript application in your browser. In this case, Google Maps and therefore also the map display on this website cannot be used. You can read Google's terms of use here and the additional terms of use for Google Maps can be found here. Detailed information on data protection in connection with the use of Google Maps can be found on the Google website or here.

14.2 Google Web Fonts

Our website uses web fonts provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA ("Google") for the standardised display of fonts. When you call up a site, your browser loads the required web fonts into your browser cache in order to display texts and fonts correctly. For this purpose, the browser you are using must connect to Google's servers. This informs Google that our website has been accessed from your IP address. Google Web Fonts is used to ensure a uniform and appealing presentation of our online offers. This constitutes a legitimate interest as defined by Art. 6 para. 1 f) GDPR. If your browser does not support web fonts, a standard font will be used by your computer. Google LLC with its registered office in the USA is certified for the US-European data protection agreement "Privacy Shield", which guarantees compliance with the data protection level applicable in the EU.

You can find more information about Google Web Fonts here and in Google's privacy policy here.

15. Subject to change

The asset manager reserves the right to amend the privacy policy at any time in compliance with data protection regulations. The current version of this privacy policy is available on the asset manager's website.

16. Contact details 

The asset manager is the data controller when it comes to the processing of personal data. 

The data controller as defined by the General Data Protection Regulation (GDPR) is

Name: Christoph Schlauri
Address: Lindenhofweg 4, CH-8806 Bäch SZ
Email: infos@ssi-wm.ch
Telephone: +41 44 787 67 00