Datenschutzerklärung
This Data Protection Statement informs you how Schweizer Finanzzentrum GmbH (hereinafter "SFZ", "we" or "us") processes personal data in connection with the operation of this website and the provision of our services. It is governed by the revised Swiss Federal Act on Data Protection (revDSG = Swiss Federal Act on Data Protection) together with the Data Protection Ordinance (DSV). To the extent that we process personal data of persons in the European Union and the General Data Protection Regulation (GDPR) is applicable, the notices in Section 14 apply in addition. Where [placeholder] markings appear below, the relevant information is to be completed or confirmed by the client prior to publication. This is a professionally founded DRAFT; a conclusive legal review prior to go-live is mandatory.
1. Controller and Contact (Data Protection Contact Point)
Responsible for the processing of personal data within the meaning of the revDSG is:
Schweizer Finanzzentrum GmbH
Moosstrasse 64, 3126 Kaufdorf, Canton of Bern, Switzerland
Business Identification Number (UID): [Placeholder: CHE-xxx.xxx.xxx, registered in the Commercial Register of the Canton of Bern - to be confirmed]
Authorised representatives: Christian Zwahlen and Stefan Jaggy
E-mail: info@schweizerfinanzzentrum.ch [Placeholder: currently possibly still a gmx address - the productive address to be confirmed by the client]
Telephone: +41 79 706 10 52 (Christian Zwahlen) / +41 78 730 49 34 (Stefan Jaggy)
Website: www.schweizerfinanzzentrum.ch
For all matters relating to data protection, in particular the exercise of your data subject rights (Section 13), please contact the above contact address with the reference "Data Protection".
There is no statutory obligation for SFZ under the revDSG to designate a data protection adviser; if such a function is voluntarily designated, it is to be inserted here [Placeholder: optional data protection adviser contact point].
Since SFZ has its registered office in Switzerland, the designation of a representative in the EU pursuant to Art. 14 revDSG or Art. 27 GDPR is required only under certain conditions. [Placeholder: assess whether, due to a regular nexus to EU clientele, a representative in the EU/EEA must be designated; insert contact details if applicable.]
2. Principles and Scope of Application
We process personal data in accordance with the principles of good faith, lawfulness, proportionality, purpose limitation as well as accuracy and data security (Art. 6 and Art. 8 revDSG). Personal data means any information relating to an identified or identifiable natural person.
This Data Protection Statement applies to the processing of personal data in connection with the visiting and use of this website as well as to contact made via the channels offered here. For the processing of client data within the scope of a specific mandate, the information in the individual agreement as well as the general terms and conditions apply in addition.
Where links to third-party websites are offered via this website, their data processing falls outside our area of responsibility; the data protection statements of the respective operators are decisive.
Unlike the GDPR, the revDSG does not generally require a special justification ("legal basis") for the processing of personal data by private persons. Where we nonetheless cite legal bases or grounds of justification below, this serves the purpose of transparency and the supplementary fulfilment of the GDPR for EU clientele (Section 14). For the processing of personal data necessary for the initiation, establishment and execution of a mandate, no separate consent is required under the revDSG; we obtain consent only where the law requires it (in particular for newsletters and non-strictly-necessary cookies/web analytics).
3. Categories of Data Processed, Purposes and Legal Bases (Overview)
Depending on your use of our website and our services, we process in particular the following categories of personal data: technical data and server log files (Section 4); data from the contact form as well as from contact by e-mail or telephone (Section 6); registration and dispatch data in connection with our newsletter (Section 7); where applicable, usage and analytics data where web analytics is activated and consent is present (Section 8); as well as - within the scope of a mandate and in particular in the protected client area (Section 10) - master, contract, financial, pension and insurance data.
We process these data in order to provide and ensure the technical operation of the website, to respond to enquiries, to initiate, establish and execute mandate relationships, to fulfil statutory and regulatory obligations (in particular under the OR (= Swiss Code of Obligations), FIDLEG/FinSA (= Financial Services Act) and VAG (= Insurance Supervision Act)), to safeguard our legitimate interests (e.g. security, abuse prevention, demonstrability) as well as - where applicable - on the basis of your consent (newsletter, optional web analytics).
To the extent that the GDPR is applicable, we base the processing in particular on Art. 6 para. 1 lit. b GDPR (contract/pre-contractual measures), lit. c (legal obligation), lit. f (legitimate interests) as well as lit. a (consent). For the newsletter and non-strictly-necessary cookies/analytics tools, consent is decisive.
To the extent that we process sensitive personal data (Art. 5 lit. c revDSG, e.g. health or social welfare data within the scope of insurance or pension clarifications), this is done only insofar as it is necessary for the agreed service, and under heightened protective measures.
4. Hosting and Server Log Files
Our website is hosted and operated by a specialised provider (see Section 9: Vercel Inc.). Each time the website is accessed, data are automatically collected by the server and temporarily stored in so-called server log files.
The following are collected in particular: the IP address of the accessing device, the date and time of access, the file or page retrieved, the HTTP status code, the volume of data transferred, the previously visited page (referrer) as well as information on the browser and operating system.
The purpose of this processing is the technical provision and stability of the website, the safeguarding of data security, the detection and prevention of abuse and attacks, as well as error analysis. The legal basis is our overriding legitimate interest in the secure and trouble-free operation of the website (for EU clientele: Art. 6 para. 1 lit. f GDPR).
The log files are retained only for as long as is necessary for the stated purposes and are subsequently deleted. [Placeholder: insert the specific retention period for the server log files, e.g. 30 to 90 days - to be definitively determined prior to publication.]
5. Cookies and Consent
Cookies are small text files that are stored on your end device. We distinguish between technically necessary cookies, which are required for the operation and security of the website (e.g. to ensure the functionality of the contact form and spam protection), and non-strictly-necessary cookies or comparable technologies (e.g. for web analytics).
We use technically necessary cookies on the basis of our legitimate interest in the secure operation of the website without separate consent. You can restrict or prevent the setting of cookies in your browser settings; this may impair the functionality of the website.
We use non-strictly-necessary cookies and technologies (in particular for analytics/statistical purposes, Section 8) only if and to the extent that you have previously consented. As long as no consent mechanism (consent management) is in use, no non-strictly-necessary cookies are set and no web analytics takes place. [Placeholder: If a cookie/consent banner (consent management) is used, describe it here - the tool used, the categories, the possibility of withdrawal - and ensure that non-necessary cookies are set only after consent.]
You may withdraw consent once given at any time with effect for the future, in particular via the settings of the consent tool or by adjusting your browser settings. The lawfulness of the processing carried out up to the withdrawal remains unaffected.
6. Contact Form and Contact by E-mail and Telephone
When you use our contact form or contact us by e-mail or telephone, we process the information you submit (in particular name, contact data such as e-mail address and, where applicable, telephone number, as well as the content of your enquiry) in order to handle your enquiry and to get in contact with you.
To prevent spam and abusive submissions, the contact form is protected by the Cloudflare Turnstile service (see Section 9). In doing so, technical information (e.g. IP address, browser details, interaction data) is transmitted to Cloudflare and evaluated in order to distinguish between human users and automated access. The legal basis is our legitimate interest in the security and functionality of the form (for EU clientele: Art. 6 para. 1 lit. f GDPR).
The processing of the data submitted via the form or by e-mail/telephone is carried out in order to respond to your matter and, where applicable, to initiate a contractual relationship (for EU clientele: Art. 6 para. 1 lit. b GDPR or lit. f GDPR).
We retain these data for as long as is necessary to handle your matter and any subsequent correspondence, and subsequently delete them, unless statutory retention obligations preclude this. [Placeholder: insert the specific retention period for contact enquiries - to be definitively determined prior to publication.]
7. Newsletter (Double Opt-In)
If you subscribe to our newsletter, we process the data provided for this purpose (in particular your e-mail address and, where applicable, your name) in order to send the newsletter with information about our services.
Registration takes place by means of the double opt-in procedure: after your registration, we send you an e-mail with a confirmation link. Only after confirmation via this link do we add you to the distribution list. In this way we ensure that the registration actually originates from the holder of the specified e-mail address. For the purposes of evidence, we log the registration, confirmation and dispatch (including time and IP address).
The legal basis for sending the newsletter is your consent (for EU clientele: Art. 6 para. 1 lit. a GDPR). You may withdraw this consent at any time with effect for the future, in particular via the unsubscribe link in each newsletter or by notification to the address stated in Section 1. After unsubscribing, your data are removed from the distribution list; we may continue to retain the evidence data relating to the consent given within the scope of the statutory obligations.
For sending the newsletter as well as for transactional and contact e-mails, we use the Brevo service (Sendinblue SAS, France) as a processor (see Section 9). In doing so, the data required for dispatch are processed on the provider's servers in the EU.
8. Web Analytics and Tag Manager (only with Consent)
In order to design our website in a manner suited to needs and to continuously improve it, we may use web analytics tools and a tag management service. Any such use takes place - insofar as it is activated at all - exclusively on the basis of your prior consent.
If and as long as you do not give consent, no corresponding analytics takes place and no cookies that are not necessary for this purpose are set. The legal basis is your consent (for EU clientele: Art. 6 para. 1 lit. a GDPR), which you may withdraw at any time with effect for the future.
As at the present version, no web analytics and no tag management service are used on this website; accordingly, no analytics cookies are set. [Placeholder: This section is conditional. If Google Tag Manager and/or an analytics service (e.g. Google Analytics) are actually used, the specific service, the provider (Google), the processing purpose, the data collected, any profiling/reach measurement, the storage period as well as the disclosure abroad (USA) with the appropriate safeguards are to be described here - prior to activation and only together with a functioning consent management tool. If no analytics service is used, this paragraph remains decisive.]
We do not use analytics tools in order to make automated individual decisions with legal effects concerning you. Any profiling for statistical purposes takes place only within the scope of the consent given.
9. Processors and Services Used (with Location and Disclosure Abroad)
In order to provide our services, we engage carefully selected service providers as processors (Art. 9 revDSG). These process personal data exclusively in accordance with our instructions and on the basis of corresponding data processing agreements that provide for adequate technical and organisational security measures. To the extent that personal data are disclosed abroad, we ensure adequate protection pursuant to Art. 16 et seq. revDSG - either because the state concerned has data protection recognised as adequate by the Federal Council, or by means of appropriate safeguards (in particular standard contractual clauses, supplemented where applicable by additional protective measures).
Vercel Inc. (registered office USA): hosting and operation of the public website. Delivery takes place, according to our configuration, via a region in the EU (Frankfurt, "fra1"). A disclosure to the USA can nonetheless not be excluded; it takes place on the basis of appropriate safeguards (standard contractual clauses) or on the basis of an applicable adequacy decision. [Placeholder: definitively confirm the current status of the Swiss or EU-US data protection framework (Swiss-US/EU-US Data Privacy Framework) and the agreed safeguards.]
Brevo / Sendinblue SAS (registered office France, EU): sending of the newsletter (double opt-in) as well as transactional and contact e-mails. Processing on servers in the EU; France has data protection recognised as adequate.
Cloudflare, Inc. (registered office USA): spam and abuse protection in the contact form (Turnstile). A disclosure to the USA takes place on the basis of appropriate safeguards (standard contractual clauses) or on the basis of an applicable adequacy decision. [Placeholder: definitively confirm the status of the Data Privacy Framework and the agreed safeguards.]
Akenes SA / Exoscale (registered office Switzerland, data centre zone Zurich; operated with Aiven): database and object storage for the internal client area (Phase 2, client data). The data location is in Switzerland; no disclosure abroad of the client data stored in the client area takes place under this data hosting.
Google (Tag Manager / web analytics): only if activated and exclusively subject to your consent (see Section 8). Not used as at the present version. In the event of any later use, a disclosure to the USA may take place, on the basis of appropriate safeguards. [Placeholder: confirm use, provider entity and safeguards, or leave the section as 'not used'.]
In addition, personal data are disclosed to third parties to the extent that this is necessary for the provision of the agreed services (e.g. to product and insurance providers within the scope of the intermediation) or to the extent that we are obliged to do so by law, by supervisory law, or by an authority/court.
[Placeholder: review the list of processors and services for completeness and currency prior to go-live; in particular confirm any further services, a consent management tool, as well as the respective current safeguards/contractual bases.]
10. Protected Client Area (CH Data Location, Encryption)
For existing clients, a protected, access-restricted client area is envisaged - within the scope of Phase 2. Client data processed there (in particular master, contract, financial, pension and insurance data) are stored on an infrastructure with a data location in Switzerland (Akenes SA / Exoscale, Zurich zone; see Section 9).
Access is protected by appropriate authentication mechanisms; transmission is encrypted (transport encryption), and the stored data are protected by appropriate technical and organisational measures (see Section 11). [Placeholder: confirm the specific protective measures of the client area - e.g. encryption at rest, access and role concept, logging - prior to commissioning.]
The data processed in the client area serve the administration and execution of the respective mandate. Details of the processing follow from the individual agreement. This client area is in preparation; until its commissioning, no corresponding data processing takes place here. [Placeholder: confirm the status/availability of the client area.]
11. Data Security (Art. 8 revDSG)
We take appropriate technical and organisational measures to protect the personal data we process against unauthorised access, loss, alteration, destruction as well as unauthorised disclosure, and to ensure data security appropriate to the risk (Art. 8 revDSG, Art. 1 et seq. DSV).
These measures include in particular transport encryption for data traffic with the website (TLS/HTTPS), access restrictions based on the principle of least privilege, the careful selection and contractual commitment of processors, as well as organisational measures to ensure confidentiality. [Placeholder: add further specific measures (e.g. backups, logging, authorisation concept) if required.]
Despite these measures, absolute security cannot be guaranteed in the transmission of data over the internet. We recommend that you do not transmit confidential information unencrypted by e-mail.
In the event of a breach of data security that is likely to result in a high risk to the personality or the fundamental rights of the data subjects, we report this as quickly as possible to the Swiss Federal Data Protection and Information Commissioner (EDOEB = Swiss Federal Data Protection and Information Commissioner (FDPIC)) and - to the extent necessary - to the data subjects (Art. 24 revDSG).
12. Retention and Deletion
We process and store personal data only for as long as is necessary for the respective processing purposes, as long as a statutory or regulatory retention obligation exists, or as long as legitimate interests (e.g. for the preservation of evidence and the enforcement or defence of legal claims) justify retention.
In particular, business-relevant records are subject to the statutory retention obligation of ten years (Art. 958f OR). Regulatory documentation obligations (FIDLEG/VAG) remain reserved.
If the data are no longer necessary for the stated purposes and no retention obligations preclude this, they are deleted or anonymised. [Placeholder: determine and insert the specific retention and deletion periods per data category (log files, contact enquiries, newsletter data, mandate/client data) - definitively prior to publication, since mere placeholders do not satisfy the principle of transparency and proportionality under Art. 6 revDSG.]
13. Your Rights as a Data Subject
Within the scope of the applicable data protection law, you as a data subject have in particular the following rights:
Right of access (Art. 25 revDSG): You may request information as to whether, and which, personal data we process about you.
Right to rectification: You may request the rectification of inaccurate personal data.
Right to deletion or destruction: You may request that we delete or destroy your personal data, unless a statutory obligation or an overriding interest precludes further retention.
Right to the surrender and portability of data (Art. 28 revDSG): You may request the surrender of the personal data you have disclosed in a common electronic format or their transfer to a third party, insofar as the statutory requirements are met.
Withdrawal of consent: To the extent that processing is based on your consent (e.g. newsletter, optional web analytics), you may withdraw it at any time with effect for the future.
Objection: You may object to a processing that is based on a legitimate interest, on grounds relating to your particular situation.
To exercise your rights, please contact the contact address stated in Section 1. For identification purposes, we may request suitable proof. Access is in principle free of charge; the statutory exceptions and limitations remain reserved (Art. 26 et seq. revDSG).
Right to lodge a complaint: You have the right to contact the Swiss Federal Data Protection and Information Commissioner (EDOEB), Feldeggweg 1, 3003 Bern, www.edoeb.admin.ch. For EU clientele, there is in addition the right to lodge a complaint with a data protection supervisory authority in the respective member state.
14. Supplementary Notices for Clients in the EU (GDPR)
To the extent that the GDPR is applicable to the processing of your personal data (in particular where services are offered to persons in the EU or where behaviour is monitored in the EU), the following notices apply in addition.
Legal bases: Depending on the constellation, we process your data on the basis of Art. 6 para. 1 lit. a (consent), lit. b (contract/pre-contractual measures), lit. c (legal obligation) or lit. f GDPR (legitimate interests). The respective decisive basis is stated above in relation to the individual processing operations.
Additional data subject rights: Under the GDPR you have in particular the rights to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) as well as the right to object (Art. 21). You may withdraw consent once given at any time with effect for the future (Art. 7 para. 3 GDPR).
Third-country transfer: To the extent that we transfer personal data to states outside the EU/the EEA (in particular to the USA, cf. Section 9), we rely on an adequacy decision or on appropriate safeguards pursuant to Art. 46 GDPR (in particular standard contractual clauses). [Placeholder: confirm the current status of the relevant adequacy decisions/safeguards.]
Representative in the EU: [Placeholder: assess whether a representative in the EU is to be designated pursuant to Art. 27 GDPR; insert contact details if applicable.]
15. Amendments to this Data Protection Statement
We may amend this Data Protection Statement at any time, in particular in order to adapt it to changed legal requirements or to changes in our data processing. The respective current version published on this website is decisive.
Version date of this Data Protection Statement: [Placeholder: insert date].
This Data Protection Statement exists in the German language; in the case of translations, the German version is decisive in cases of doubt.