Data Protection Declaration

1. Scope of Data Protection Declaration

This Data Protection Declaration applies to the users of the services of our website www.truewealth.ch in accordance with the terms of use and for you as a client if you have concluded an asset management agreement with us.

Depending on the processing of personal data, European data protection law (Regulation (EU) 2016/679 (General Data Protection Regulation, GDPR)) may also apply in addition to the applicable Swiss law (Federal Act on Data Protection (FADP) of 19 June 1992, SR 235.1); namely, in particular regarding services with points of contact within the EU (Art. 3 para. 2 lit. a GDPR).

The use of the services of this website as well as our asset management offer is aimed at persons domiciled in Switzerland.

This Data Protection Declaration does not apply in relation to our employees. The data protection regarding these persons is regulated by the respective employment contract and in accordance with the applicable local laws.

2. Contact Details of the Data Controller and the Data Protection Advisor

See Imprint.

3. Processing of your Personal Data

We process your personal data:

As a (possible) customer (cf. section 4):

Refer a friend
When opening an online test account and customer accounts
For the fulfilment of the contract
For advertising purposes

As a user of the website (cf. section 5):

To optimise our website
To contact us (e-mail)
To subscribe to a newsletter

4. Processing for Customers

4.1. Refer a Friend

Our customers have the possibility to refer a friend through our website. Our customer enters the following information:

Salutation, first name, last name
E-mail address

We will send the referred friend a message with the most important information about our services and an invitation link.

When using our services as a referred friend, you can decide when you open an account whether the previous customer should be informed about your contract conclusion.

In case a recommended friend does not choose our services, his personal data will be irrevocably deleted after 90 days at the latest.

The customer can view the recommended friends in his profile for 90 days. If the friend decides to inform the customer about the conclusion of the contract, it will be displayed to the customer in his profile for a maximum of one year. In all other cases, the personal data of the referred friends will be irrevocably deleted after 90 days.

4.2. When Opening a Test Account and Registering for a Customer Account

You can register for our services or set up a password-protected test account to create a virtual portfolio for the purpose of visualising our services and gaining insight into asset management. The personal data you enter will be stored and processed. This serves the purpose of providing you with the service you have requested.

To create a password-protected test account, please provide us with the following information:

Salutation, first name, last name
Valid e-mail-address
Telephone number (voluntarily)

To create a password-protected customer account, you provide us with the following information:

Salutation, first name, last name
Address
Valid e-mail address
Telephone number
Citizenship, date of birth and country of birth
Information of personal and financial nature
Risk propensity and risk tolerance
Bank details
Records of you and your identification document

You will also need to enter a password of your choice to set up an account. Together with your e-mail address, this will give you access to your account. To create your (virtual) portfolio, you will need to answer questions about your risk tolerance and investment preferences. The information you provide is stored and processed. Based on the evaluation, an investment proposal is made, which is the basis for further personalisation. In your test account, you can view and change the personal data kept about you at any time.

The test account can also be set up without specifying the telephone number. This information is voluntary and would only be beneficial for quicker clarification of any queries or for updates to your virtual test account.

We store and process your personal data and personal information on the basis of Art. 13 para. 1 FADP and Art. 6 para. 1 sentence 1 lit. b GDPR and Art. 6 para. 1 sentence 1 lit. a GDPR. Our legitimate interest derives from the purpose of fulfilling the contract, managing your asset portfolio and servicing customer accounts and potential customers. Personal data that is evaluated for statistics is anonymised and serves to optimise customer service, product improvement and adaptation, market research, etc.

After deletion of your test account, your personal data will be automatically deleted for further use unless you become a customer.

4.3. For the Fulfilment of the Contract

In order to comply with our contractual obligations under the asset management agreement, you must provide us with the following personal data, which go beyond the opening of the account in accordance with 4.1, e.g.:

Information on the beneficial owners
Information on the origin of the asset values to be deposited
Information on your tax status
Information on external bank relationships
Information on your investment preferences

The above-mentioned personal data will be processed by the data controller for the following purposes:

To fulfil the asset management mandate

Insofar as this is permitted by law pursuant to Art. 13 para. 2 lit. a FADP or Art. 6 para. 1 sentence 1 lit. b GDPR and is necessary for the execution of contractual relationships with you, your personal data will be passed on to third parties. This includes, in particular, transmission to the hosting provider of our website software, payment data to payment service providers and to the account-holding bank, Schweizerische Post AG, PXL Vision AG, and info4c AG.

The personal data disclosed may be used by the aforementioned third party exclusively for the purposes stated.

4.4. For Advertising Purposes

We send our newsletters and print advertising to specific customer groups. You can unsubscribe from our newsletters and print products at any time. Necessary information from you in this connection are:

First name, last name
Address
E-mail address

The above-mentioned personal data will be processed by the data controller for the following purposes:

Marketing
Customer information

Personal data processing is carried out based on an overriding legitimate interest (Art. 13 para. 1 FADP and Art. 6 para. 1 sentence 1 lit. b GDPR).

5. Processing for Internet Users

5.1. When using the Information of the Website

When you visit our website, information is temporarily stored in so-called log files on our server. This is information that the browser of your terminal device automatically sends. Namely:

IP address of the contacting device
Date and time of the visit
URL of the requested page
Referrer URL
Browser and other device information

The personal data mentioned will be processed by us for the following purposes:

Smooth connection setup of the website
Comfortable use of our websites
Ensuring system security and stability
Evaluations for statistical purposes for the marketing of the products
For optimal answering and processing of your enquiries and requested services
To improve professional competence and services

The legal basis for data processing is based on Art. 13 para. 1 FADP Art. 6 para. 1 sentence 1 lit. f GDPR. Our legitimate interest derives from the intention to guarantee functionality regarding our services, to operate our website in a user-friendly manner, to keep information constantly updated and to meet the needs of our customers and website visitors.

Under no circumstances do we use the collected personal data for the purpose of drawing conclusions about your person.

5.2. Job Application Process

Our website gives you the opportunity to apply for a job. For this purpose, you submit your application dossier and the following personal data:

Salutation, first name, last name
E-mail address
Telephone number
Your preferred job or position
Work permit, salary presentation, availability

We process this personal data exclusively for the purpose of assessing your suitability for the advertised position or for handling the application process. If an employee is hired, his or her personal data is transferred to the HR department and stored in his or her personal file. Personal data processing is regulated in this respect within the framework of the respective employment relationship.

If there is no employment, the transmitted personal data will automatically be deleted irrevocably after 6 months after the announcement of the deletion. Should another applicant cancel in the meantime, we reserve the right to contact you again. If you expressly agree to retention in our database, we will delete the personal data later at an agreed time.

This processing is necessary to carry out the application process and is based on pre-contractual measures pursuant to Art. 13 para. 1 FADP and Art. 6 para. 1 sentence 1 letter b GDPR.

5.3. E-mail Communication

If you contact us by email, we will only use your voluntarily provided contact information such as name and e-mail address to respond to your inquiry. Please refer to our Terms of Use for e-mail communication.

The provision of this information and the establishment of contact by e-mail is always voluntary.

This processing is carried out to communicate with you and is based on Art. 13 para. 1 FADP and Art. 6 para. 1 sentence 1 letter b GDPR.

For the provision of our newsletter, we use the so-called Double-Opt-In procedure, i.e. we only send you a newsletter by e-mail if you have expressly confirmed this to us beforehand. You will receive a notification e-mail asking you to confirm the link contained in the e-mail. Only then you have given us your consent to send the newsletter.

First name, last name
Address
E-mail address

The above-mentioned personal data will be processed by the data controller for the following purposes:

Marketing

The personal data will be processed based on your consent in accordance with Art. 13 para. 1 FADP and Art. 6 para. 1 sentence 1 lit. a GDPR.

The personal data stored for the purpose of the newsletter subscription will be stored by us until you unsubscribe from the newsletter. After you have unsubscribed from the newsletter, your personal data will be deleted from our systems. Personal data stored by us for other purposes (e.g., e-mail addresses for events or course registrations, etc.) remain unaffected by this.

5.5. Cookies

We use cookies defined below on our website. These are small files that your browser automatically creates and that are stored on your end device (laptop, tablet, smartphone, etc.) when you visit our site. A cookie does not always mean that we can identify you.

Functional Cookies

Name: connect.sid
Issuer: www.truewealth.ch
Purpose: Session cookie
Duration: 1 Hour

Name: SESSION_ID
Issuer: app.truewealth.ch
Purpose: Session cookie
Duration: Session

Name: __Host-XSRF-Token
Issuer: app.truewealth.ch
Purpose: Security cookie
Duration: 1 Day

Personalised Cookies

These cookies enable the provision of enhanced functionality and personalisation, such as videos and live chat. They may be set by us or by third parties whose services we use on our sites.

Name: tw_cookie_consent
Issuer: www.truewealth.ch
Purpose: To document your consent to the cookie statement
Duration: 3650 Days

Name: _twfeatures
Issuer: app.truewealth.ch
Purpose: For switching on individual features
Duration: Session

Name: disable_demo_tour
Issuer: www.truewealth.ch
Purpose: To determine whether to play a demo
Duration: Unlimited

Name: tour_current_step
Issuer: www.truewealth.ch
Purpose: To determine the time of the demo tour
Duration: Unlimited

Name: tour_end
Issuer: www.truewealth.ch
Purpose: To determine if the demo tour is finished
Duration: Unlimited

Name: referral
Issuer: app.truewealth.ch
Purpose: To store a referral invite
Duration: 1 Day

Analysing Cookies

These cookies are used for analysis purposes.

Name: _gat
Issuer: truewealth.ch
Purpose: Google Analytics
Duration: 1 Minute

Name: _ga
Issuer: truewealth.ch
Purpose: Google Analytics
Duration: 2 Years

Name: _gid
Issuer: truewealth.ch
Purpose: Google Analytics
Duration: 1 Day

The legal basis for personal data processing is predominant legitimate interest pursuant to Art. 13 para. 1 FADP and Art. 6 para. 1 S. 1 lit. f GDPR. Our legitimate interest is to optimise and ensure the security of the use of our website and to make our services more attractive, effective and user-friendly.

By continuing to use our website and/or by agreeing to this Data Protection Declaration, you consent to our use of cookies and to the collection, storage and use of personal data even after your browser session has ended. You can revoke this consent at any time by activating the standard browser setting to reject third party cookies.

Most Internet browsers are set to accept cookies automatically. If you do not want our website to store cookies on your device, you can set your browser to warn you before certain cookies are stored. You can also adjust your settings so that your browser rejects most of our cookies or only rejects certain cookies or deactivates them completely. You can also revoke your consent to cookies by deleting the cookies that have already been saved. See the instructions of the search engine operator:

Internet Explorer: https://support.microsoft.com/en-us/help/17442/windows-internet-explorer-delete-manage-cookies

Mozilla Firefox: https://support.mozilla.org/en-US/kb/delete-cookies-remove-info-websites-stored

Google Chrome: https://support.google.com/chrome/answer/95647?co=GENIE.Platform%3DDesktop&hl=en

Safari: https://support.apple.com/en-gb/guide/safari/manage-cookies-and-website-data-sfri11471/mac

Opera: https://help.opera.com/en/latest/web-preferences/#cookies

Please note that if you limit or disable cookies, certain features of the website may no longer be available to you. If you disable cookies completely, you may not be able to use all the features of our website.

6. Analysis Tools

6.1. Google Analytics

Our website uses the web analysis service Google Analytics from Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Google Analytics uses cookies (see Cookies). These enable Google to analyse the use of our website offer including IP addresses in the USA. We would like to point out that on this website Google Analytics was extended by the code "gat._anonymizeIp();" in order to guarantee an anonymous recording of IP addresses (so-called IP masking). If anonymisation is active, Google shortens IP addresses within Switzerland and member states of the European Union or other states party to the Agreement on the European Economic Area, which means that no conclusions can be drawn about your identity. Only in exceptional cases is the full IP address transmitted to a Google server in the USA and shortened there. Google uses the collected information to evaluate the use of our websites for us, to write reports for us in this regard and to provide us with other relevant services. You can find out more at https://support.google.com/analytics/answer/6004245?hl=en, in particular, about the possibility of deactivating Google Analytics at http://tools.google.com/dlpage/gaoptout?hl=en.

The legal basis for personal data processing is predominant legitimate interest pursuant to Art. 13 para. 1 FADP and Art. 6 para. 1 S. 1 lit. f GDPR. Our legitimate interest lies in the fact that our websites are designed and constantly updated to meet the needs of our customers and website visitors and that the use of our website is statistically recorded and evaluated to optimise our services.

For more information about Google Analytics, please see the provider's Data Protection Declaration.

https://www.google.com/ (opt-out)

https://analytics.google.com/

We can use the following social plug-ins on our website to make our company better known. The underlying advertising purpose is to be regarded as a legitimate interest within the meaning of Art. 13 para. 1 FADP or Art. 6 para. 1 lit. f GDPR. In addition, we would like to offer the user of our website a user-friendly version in which the connection with friends and colleagues is simple.

The responsibility for data protection-compliant operation is to be guaranteed by their respective providers. Personal data processing in connection with these plug-ins takes place with your consent when you use these plug-ins in accordance with Art. 13 para. 1 FADP and Art. 6 para. 1 sentence 1 lit. a GDPR.

If you use the services of these social networks independently or in connection with our website, the social networks will evaluate your use of the plug-in. In this case, information about the plug-in is forwarded to the social networks.

You control the privacy settings of each social network and the permissions, for which personal data we may access, you provide to us when granting access to your personal data stored on that social network.

7.1. Facebook

Plug-ins of the social network Facebook, which is offered by Facebook Inc., can be used on our website. The Facebook plug-ins are marked with a Facebook logo or the addition "Like" or "Share". An overview of the Facebook plug-ins and their appearance can be found at https://developers.facebook.com/docs/plugins.

When you access a page on our website that contains such a plug-in, your browser establishes a direct connection to Facebook's servers. The content of the plug-in is transmitted directly from Facebook to your browser and integrated into the page.

This integration provides Facebook with the information that your browser has accessed the corresponding page of our website, even if you do not have a Facebook profile or are not logged on to Facebook. This information (including your IP address) is transmitted directly from your browser to a Facebook server in the USA and stored there.

If you are logged in to Facebook, Facebook can assign your visit to our website directly to your Facebook profile. If you interact with the plug-ins, for example by pressing the "Like" button, this information is also transmitted directly to a Facebook server and stored there. The information is also published on your Facebook profile and displayed to your Facebook friends.

The purpose and scope of the personal data collection and the further processing and use of the personal data by Facebook as well as your rights in this regard and setting options to protect your privacy can be found in Facebook's personal data protection information:

https://www.facebook.com/about/privacy.

7.2. Twitter

Plug-ins from the short message network Twitter Inc, 1355 Market Street, Suite 900, San Francisco, CA 94103, USA can be integrated on our website. By using Twitter and the "Re-Tweet" function, the websites you visit are linked to your Twitter account and made known to other users. Data is also transmitted to Twitter. This enables Twitter to assign visits to our pages to your user account. Further information on this can be found in Twitter's Data Protection Declaration at https://twitter.com/en/privacy.

You can change your privacy settings on Twitter in your account settings at http://twitter.com/account/settings.

General information about privacy on Twitter can be found at https://help.twitter.com/en/twitter-for-websites-ads-info-and-privacy.

We would like to point out that, as the provider of the pages, we do not have any knowledge of the content of the data transmitted or its use by Twitter.

7.3. LinkedIn

Plug-ins from the social network LinkedIn Inc, offered by LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland, can be used on our website. These plug-ins are a quick way to integrate the LinkedIn functionality into your website.

Please note that when you visit our website, the plug-in establishes a connection between your browser and the LinkedIn server. LinkedIn is thus informed that our website has been visited with your IP address. If you click on the "Recommend" button of LinkedIn and are logged into your account at LinkedIn, you have the possibility to link content from our website to your profile page at LinkedIn-Profile. In doing so, you enable LinkedIn to assign your visit to our website to your user account.

You can find more information about this in LinkedIn's Data Protection Declaration at: https://www.linkedin.com/legal/privacy-policy.

You can find an overview of the LinkedIn plug-ins and their appearance here: https://developer.linkedin.com/plugins.

If you visit a page on our website that contains such a plug-in, your browser establishes a direct connection to the LinkedIn servers. LinkedIn sends the content of the plug-in directly to your browser and integrates it into the page.

We would like to point out that as the provider of the pages, we are not aware of the content of the data transmitted to LinkedIn and its use by LinkedIn.

7.4. Google Ad Manager

Google Ad Manager is used on our website. In order to increase the success of advertising measures, Google collects information about the surfing behaviour of internet users. Google uses cookies to optimise advertising. Cookies are often used to deliver ads relevant to users, to improve campaign performance reports, or to prevent a user from seeing the same ads more than once.

Cookies do not contain any personal data. Depending on the Publisher's and User's preferences, the User's Google Account may store personal data from cookies that are used for advertising purposes.

For more information: https://support.google.com/dfp_premium/answer/2839090?hl=en

Opt-out: https://adssettings.google.com/anonymous?sig=ACi0TCiPXXaTyyjg_3V-gtghLjWDEX9qhXhGO23H5-pZcWRKbKKN9izLHVUaEPRgXwbY-bzdICt3Xxmg116iWgcMjWwh0HNazkFdn61wld7eLVIQGudldTQ&hl=en

7.5. Microsoft Advertising

We use the Microsoft Advertising service of the provider Microsoft Ireland Operations Limited on our website. Microsoft Advertising is an online marketing service that uses the Universal Event Tracking (UET) tool to help us display targeted advertisements via the search engines Microsoft Bing and Consortium Search Partners. Microsoft Advertising uses cookies for this purpose. This involves processing personal data in the form of online identifiers (including cookie identifiers), IP addresses, device identifiers and information about device and browser settings.

For more information: https://privacy.microsoft.com/en-us/privacystatement

Opt-out: https://about.ads.microsoft.com/en-us/resources/policies/personalized-ads

8. Disclosure of Personal Data to Third Parties

Your personal data will not be passed on to third parties for purposes other than those listed.

Your personal data will be passed on to the following categories of third parties:

Custodian Bank
Search engine operators
Hosting service provider
Financial accounting
Service providers in connection with the Federal Act on Combating Money Laundering and Terrorist Financing
Analytical tools
Other service providers (such as: postal services, providers of automated identity verification solutions, website developers, support operators, marketing providers, financial service providers, etc.)
Third parties due to legal obligations pursuant to the Anti-Money Laundering Act, supervisory authorities, official audits, etc.

The personal data will only be passed on for the purposes mentioned in this Data Protection Declaration and for reasons of justification stated herein.

The legal basis for personal data processing through access to your personal data by these third parties is based on our legitimate interest pursuant to Art. 13 para. 1 FADP and Art. 6 para. 1 sentence 1 lit. f GDPR, as well as your consent pursuant to Art. 6 para. 1 sentence 1 lit. a GDPR. The legitimacy is given, since legal obligations exist, as well as your personal data and information are used and, if necessary, passed on in order to optimally support you in asset management, to answer your questions satisfactorily and to process your requested service in time and in your interest. This also helps us to continually optimise our service and customer care.

9. Cross-Border Disclosure in Third Countries without an Adequate Level of Data Protection

No processing in or from a third country without an adequate level of data protection takes place in connection with the processing activities relating to the website.

Otherwise, no personal data will be transferred to third countries without an adequate level of personal data protection or corresponding contractual guarantees or equivalent protection mechanisms or legal requirements.

10. Your Rights

The rights of the data subjects shall be governed by the applicable national and international law.

Depending on the applicable law, you may assert the following rights:

To request information about your personal data processed by us. In particular, a request pursuant to Art. 8 FADP or Art. 15 GDPR may contain information regarding:
the purposes of the processing,
the category of personal data,
the categories of recipients to whom your information has been or will be disclosed,
the planned storage period,
the existence of a right of rectification, erasure, limitation, or opposition,
the existence of a right of complaint,
the origin of your personal data, if it has not been collected by us,
and the existence of automated decision making, including profiling and, where appropriate, meaningful information on its details.

In the event of a disproportionately high expense, we reserve the right to request proof of identity from you and payment of the actual costs in advance.

Immediately request the correction of incorrect or incomplete personal data retained by us (Art. 5 para. 2 FADP and Art. 16 GDPR).
To request the deletion of your personal data retained by us, unless processing is necessary for the exercise of the right to freedom of expression and information, to fulfil a legal obligation, for reasons of public interest or to assert, exercise or defend legal claims (Art. 15 FADP and Art. 17 GDPR)
To demand the restriction of the processing of your personal data if the accuracy of the personal data is disputed by you, the processing is unlawful, but you refuse its deletion and we no longer need the personal data, but you need it to assert, exercise or defend legal claims or you have lodged an objection against the processing pursuant to Art. 21 GDPR (Art. 15 FADP and Art. 18 GDPR).
To receive your personal data, which you have provided to us, in a structured, common, and machine-readable format or to request the transfer to another responsible person (Art. 20 GDPR).
To revoke your consent once given to us at any time. As a result, we may no longer continue the personal data processing based on this consent in the future (Art. 7 para. 3 GDPR).
To complain to a supervisory authority (see above) (Art. 77 GDPR)
Parents (or legal guardians) of persons under the age of 16 can request cancellation or deregistration at any time.

11. Right to Object

If your personal data is processed based of legitimate interests pursuant to Art. 6 para. 1 sentence 1 lit. f GDPR, you have the right to object to the processing of your personal data pursuant to Art. 21 GDPR if there are reasons for doing so which arise from your particular situation or if the objection is directed against direct advertising. In the latter case, you have a general right of objection, which is implemented by us without stating a particular situation.

12. Data Security

We have technical and organisational security procedures in place to safeguard the security of your personal data and to protect your session and personal data against unauthorised or unlawful processing and/or accidental loss, alteration, disclosure, or access.

However, you should always be aware that the transmission of personal data via the Internet and other electronic means involves certain security risks and that we cannot guarantee the security of information transmitted in this way.

Your personal data in connection with our website will be transmitted from this website to us with SSL encryption. We take technical and organisational measures to protect our website from unauthorised access.

If you notice any incidents in connection with our website that appear unusual to you, we would be very grateful if you would notify us immediately.

13. Data Retention Periods

We keep your personal data for as long as the following period:

Personal data that we process by law is retained for the statutory period of retention, for example if required by labour, social security or tax law or the Ordinance on Account Books.
Personal data that we need to fulfil a contract will be retained for at least the duration of the contract and for a maximum of 10 years thereafter unless we need the personal data to assert our rights.
Personal data that we process to protect our prevailing legitimate interests will be retained for a maximum of 10 years after the end of the contractual relationship unless we need the personal data to assert our rights.
Personal data that we no longer need, will be deleted, or destroyed if the purpose of the processing and the processing basis become invalid, unless there is a legal obligation to retain.
Parents (or legal guardians) of persons under the age of 16 can request cancellation or deregistration at any time.

14. Timeliness and Change of this Data Protection Declaration

We reserve the right to change this Data Protection Declaration at any time or to adapt it to new processing methods. The current Data Protection Declaration can be accessed at any time on the aforementioned websites. Older versions of the Data Protection Declaration are also available here.