Privacy Policy

1. General Principles

Protecting your personal data is of great importance to us. In this Privacy Policy, we explain how CSF Management AG (“we” or “us”) collect, process, store and disclose personal data. Personal data means any information relating to an identified or identifiable natural person.

We comply with the provisions of the Swiss Federal Data Protection Act (FADP). Where we process data of individuals from the European Union or the European Economic Area, we also take into account the requirements of the EU General Data Protection Regulation (GDPR).

If you provide us with personal data relating to other individuals, you are obliged to ensure that such persons are informed about this Privacy Policy and that the information provided is accurate.

2. Controller

The controller responsible for data processing is CSF Management AG, Zugerstrasse 32, 6340 Baar, Switzerland. If you have any data protection related concerns, you can contact us using the following contact details: CSF Management AG, Data Protection Officer, Zugerstrasse 32, 6340 Baar, Switzerland, Phone : +41 41 711 78 00, E-mail: dataprotection@csfmanagement.ch, Website: www.csfmanagement.ch

 

3. Data Collected and Its Sources

We primarily process personal data that we receive in the course of our fiduciary and business relationships. This includes, in particular, information actively provided to us by clients, business partners, employees or other involved persons, for example at the start of a business relationship, during the performance of a mandate or in the course of ongoing communication.

We may also collect information from publicly available sources such as commercial registers, publications, media or the internet. In addition, we may receive data from authorities, courts, banks, insurance companies or other business partners where this is necessary to fulfil our duties.

When you use our website or electronic communication tools, technical data such as IP addresses, device information or access logs may also be collected.

 

4. Purpose of Data Processing

We process personal data exclusively for lawful purposes. Our primary objective is the provision of fiduciary, advisory and administrative services. This includes the initiation, conclusion and performance of mandates and contracts, as well as compliance with statutory and regulatory obligations, in particular with respect to tax law, accounting and anti-money laundering regulations.

Furthermore, data processing ensures efficient communication with our clients, business partners and authorities, the maintenance and further development of client relationships, as well as the fulfilment of internal administrative and compliance requirements. Personal data may also be processed for the establishment, exercise or defence of legal claims, for evidentiary and documentation purposes, and to safeguard IT and data security.

Where you have given us your consent – for example, to receive newsletters or information letters – we will process your data on that basis. You may withdraw your consent at any time with effect for the future.

 

5. Disclosure to Third Parties and International Transfers

In the course of our business activities, we may disclose personal data to third parties where necessary for the provision of our services or where required by law. Recipients may include, in particular, authorities, courts, banks, insurance companies, auditors, and external service providers supporting us in areas such as IT, compliance or accounting. Cooperation partners and professional advisers engaged in the performance of our services may also receive such data.

As we act for clients worldwide, it may be necessary to transfer personal data to countries outside Switzerland or the European Economic Area. In such cases, we ensure an adequate level of protection, in particular through the use of the European Commission’s Standard Contractual Clauses or other appropriate safeguards. Where this is not possible, we rely on statutory exemptions, for example where the transfer is necessary for the performance of a contract, for overriding public interests, or where you have expressly consented.

6. Retention Period

We retain personal data only for as long as necessary to fulfil the purposes described above or as required by law. Business records relevant for accounting and tax purposes are generally retained for ten years. In addition, we may retain data for as long as legal claims may be asserted against us or where legitimate interests, in particular with respect to documentation and evidence obligations, require such retention. Once these periods expire, the data will be deleted or anonymised.

7. Data Security

We implement appropriate technical and organisational measures to ensure the security of your personal data. These measures include, among others, access and permission controls, encryption, firewalls and physical security precautions. In addition, we maintain internal policies and processes and regularly train our employees. These measures are reviewed on an ongoing basis and adjusted to reflect the state of the art.

 

8. Rights of Data Subjects

Within the scope of applicable data protection law, you have various rights. You may request information about the personal data we hold about you, request the correction of inaccurate information or request the deletion of your data, provided no legal retention obligations apply. You also have the right to request restriction of processing, to object to certain processing activities, and – where applicable – to request the transfer of your data in a commonly used electronic format.

To exercise these rights, proof of identity is generally required. Requests should be addressed to the contact details listed in section 2. Furthermore, you have the right to lodge a complaint with the competent data protection authority. In Switzerland, this is the Federal Data Protection and Information Commissioner (FDPIC).

9. Obligation to Provide Data

In the context of a business relationship, we rely on certain personal data. Without such information, we are generally unable to accept a mandate or fulfil our contractual and legal obligations.

 

10. Automated Decision-Making

We do not use exclusively automated decision-making processes that produce legal effects concerning you or significantly affect you in a similar way. Should such processes be applied in exceptional cases, we will inform you separately and explain your rights in connection therewith.

11. Amendments

We reserve the right to amend this Privacy Policy at any time, in particular if legal requirements change or our services are expanded. The current version published on our website shall apply. Where this Privacy Policy forms part of an agreement with you, we will inform you appropriately of any material changes.