Privacy Policy

1. Company

Invico Capital Corporation AG, Kirchgasse 24, 8001 Zurich is a company that provides services in the financial sector. The services offered by Invico Capital Corporation AG include: Fiduciary, Consulting, HR Administration, Payroll, Finance, Accounting, Tax, and legal advice.

2. Data processing

This privacy policy describes how we process personal data, particularly which personal data we collect and for what purpose. It also regulates the transfer of data, the retention period and your rights. Personal data (hereinafter also referred to as data) means all information relating to an identified or identifiable natural person. The term "data processing" is to be understood situationally and includes any handling of personal data, regardless of the means and procedures used, in particular the acquisition, storage, use, modification, disclosure, archiving or destruction of data. We collect and process personal data to fulfill our business tasks, within the legally and contractually regulated framework. Personal data collection, processing and use are subject to Swiss legal provisions. We collect personal data transparently and in compliance with the principles of proportionality and purpose limitation. The data is only processed to the extent and for as long as necessary for our tasks and duties.

4. What personal data do we process?

4.1. General contact and basic data

Depending on the purpose of the data processing, customer segment and service areas, we collect various types of personal data, including, under certain circumstances, personal data requiring special protection.

We process at least the following personal data from all contact, dialogue and contractual partners as well as customers:

• Surname, first name, e-mail address and, if applicable, gender, address, telephone number, title, date of birth, nationality, occupation, information on employer or activity, title, AHV number, CV information, assets under management, breakdown of salary, assets and liabilities, spouse's activity, wife/husband's income, description of economic origin of the assets contributed, all bank data of banking relationships, identification documents such as passport, identity card, ID card, etc..., Extracts from the commercial register, details of the risk profile and the investment strategy (asset management contract) as well as other personal data required for the exercise, e.g. forms A - T

• E-mail and written correspondence (post)

In addition, depending on the purpose of the data processing, customer segment and service area, we collect and process additional data following the descriptions in the following sections:

4.2. Data for the processing of the mandate

We process the following personal data for the provision and administration of our mandates and communication with our clientele:

• General contact and basic data according to point 4.1

• For companies:

  - Legal form, share capital and paid-up capital, year of incorporation of the company, external auditors, domestic and foreign turnover, annual turnover achieved per area of activity, register no.

  - Branches: Place of branch, company name, address, telephone, internet, e-mail, language of correspondence

  - Information on staffing levels: departments, number of employees or persons in charge, full-time equivalents

• Financial information

• Risk assessment data:

  - Extracts from the debt collection register and criminal records

  - Management and control of the company

• Information on the natural persons/shareholders and members of the management participating in the company: surname, first name, year of birth, nationality, function, share of votes, information on activity in the company

• Information on the companies and foundations participating in the company: Company name, registered office, division, degree of participation

• Contact details: surname, first name, date of birth, e-mail and telephone number

• Information on the employment of responsible persons with third-party companies and, if applicable, surname, first name, company, sector, function and degree of employment

• Information on the shareholdings

• Payment information

• Mandate data such as:

  - Statutes, minutes, contracts

  - Employee data (salary, social security); - Accounting and tax information

• Customer lists incl. details such as entry dates, exit dates, assets under management, etc.

• Various contracts, e.g. asset management contracts, trust deed

• Multiple documents such as form A - T

• All bank documents: bank contracts, bank account statements, custody account statements, transaction journals, etc.

• Copies of IDs, passports, identity cards, etc.

This data is processed primarily in connection with consulting services. It mainly concerns data of our clients. However, it may also affect third parties, such as employees, contact persons, or persons with a (contractual) relationship with our clients. Our customers can therefore also refer to this data protection declaration, but must also take measures themselves to comply with data protection legislation. The data processing serves the execution and administration of the mandates, the credit assessment, the avoidance of conflicts of interest and the quality check. It also fulfils the legal and contractual requirements. - particularly sensitive personal data such as data on health, debt collection or bankruptcy, etc.

The data is usually communicated and provided directly by the clients. However, depending on the type and scope of the mandate, it may also come from authorities, courts, or third parties. Under certain circumstances, it may also be collected directly from the employer of the persons concerned.

4.3. Data for mailings and newsletters

We process the following personal data to send information about events, publications, etc. (marketing purposes) and for sending newsletters, we process the following personal data:

• General contact and basic data according to point 4.1.

This data is necessary for providing the service, communicating with our customers, or maintaining our customer base. Information related to marketing, mailings, and newsletters is also statistically analysed to improve our services. You can object to using your data for marketing purposes at any time or unsubscribe from receiving the newsletter.

4.4. Data for the organisation and implementation of events

The following personal data is processed for the organisation and implementation of events:

• General contact and basic data according to point 4.1

• Information about the employer (such as company, address, e-mail address), participants, and speakers

• Information about the participation in the further education

• Payment information

• Possibly pictures or videos

4.5. Data related to direct communication (telephone, email or chat, online meetings, video conferences and/or webinars etc.)

The online meetings, video conferences and/or webinars we organise are conducted using Microsoft Teams. For direct communication via telephone, email, collaboration solution or chat, we and our corresponding service providers may process the following personal data to the extent necessary:

• General contact and basic data according to point 4.1

• Other personal data contained in the email communication

• Communication data such as IP address, time and duration of communication

• Videoconference recordings, if necessary

We process this personal data to provide and improve our services to our customers and other interested third parties.

4.6. Suppliers and other contractual partners

We process the following personal data of business partners who provide services or deliveries for us:

• General contact and basic data according to point 4.1

• Financial information such as bank details; § Information available in the contract (such as data on the responsible staff, consultants, information on the service provided, etc.)

We process this data in fulfilment of a contract and in application of the statutory retention periods of commercial and tax law. If our contractual partners have access to our personal data in fulfilment of their order, e.g. IT companies, programmers etc., we conclude a corresponding order processing contract with them.

4.7. Operation, control and improvement of the website and other electronic channels

4.7.1. Server log files

You can use our website without having to disclose extensive personal data. However, the server collects user information with each call. This information is temporarily stored in the server's log files. However, an assignment to a specific person does not take place. Log files contain the following information:

• Date, time of access, and amount of data

• the browser used and the operating system; § the domain name of the provider

• the page from which you came to our site (Referred URL)

• the search query

• the IP address

The collection of this data is technically necessary. The data collected serves to maintain the stability and security of the website, analyse its use, and improve it. It also enables a precise check in the event of suspicion of unlawful use of our website.

4.7.2. Cookies

Our websites use cookies and similar technologies. If your device's settings allow it, we use cookies and similar tools to provide you with an optimal browsing experience on our websites.

Cookies are text files stored on your computer and allow an analysis of your website use. In this way, they support our website's presentation and help you move around it. Cookies collect data such as:

• the IP address

• the website from which you are visiting us

• the type of device you are using

• how you use our search function (so-called search log)

• what actions you take when you receive the newsletter

It is also possible to visit our website without cookies. You can prevent cookies from being stored in the browser settings. However, this may affect your ability to use the website. Under no circumstances will we use cookies to install malware or spyware on your computer.

4.8. Ensuring safety, fulfilling legal obligations, enforcing claims

We may process the personal data mentioned above to ensure security and to enforce your rights, if necessary. We may also pass it on to third parties, such as courts or authorities, for this purpose.

5. Data collection, retention period, security measures

5.1. Data collection

As a rule, we receive the personal data mentioned in section 4 directly from you when you use one of the services. In the case of mandates, the data may also originate from authorities, courts or third parties, depending on the type and scope of the mandate. However, data may also originate directly from third parties, e.g. collection of debtor or creditor confirmations, bank confirmations, etc. We also take publicly available information from the media and the Internet, insofar as this is appropriate in the specific case (e.g. in the context of an application, in the selection of lecturers and speakers), as well as data in connection with the use of the website (see section 4.8).

5.2. Retention period

We retain personal data for as long as it is needed for the purpose for which it was collected, for some time that we are obliged to keep it under applicable laws, regulations, or contractual agreements, or for as long as we have an overriding interest in maintaining it. After that, the data will be deleted.

5.3. Data security

We take appropriate technical and organisational security measures to protect personal data from unauthorised access and misuse. These include IT and network security solutions, access restrictions, encryption of data carriers and transmissions, instructions, training and controls. The data is stored in the applications and software applications we use. The data is stored on servers in Switzerland.

6. Data sharing and data transmission

We may disclose personal data to third parties if you have given your consent, if this is necessary for the provision of the respective service, the fulfilment of the purpose of the contract, the protection of our legitimate interest, or if we are legally obliged to do so.

The following categories of recipients may receive personal data from us:

• Service providers (e.g. IT service providers, hosting providers, suppliers, consultants, lawyers, insurance companies)

7. Your rights

Any person may request information about the data processed about them, as well as about the origin, the recipient and the purpose of the data collection and processing. In addition, you have the right to request the correction, blocking, deletion or transfer of your data. Data retained due to legal regulations or required for business processing cannot or must not be deleted. If data is not covered by a legal archiving obligation or our overriding interest in preserving it, we will delete your data at your request. If the archiving obligation applies, we will block your data. In addition, you can assert your claims in court or file a complaint with the competent data protection authority.

8. Final provisions

8.1. Responsible body and contact

Unless otherwise stated, we are responsible for processing data per this privacy policy. General enquiries about data protection can be sent to us by post or email, at Invico Capital Corporation AG, Kirchgasse 24, 8001 Zurich, or info@invico.ch.

For questions regarding a specific person, correction requests, or deletion requests, a copy of the user's ID or passport must also be enclosed to identify the user.

8.2. Adjustments to the privacy policy

We may change our privacy policy by posting it on the website or sending you a letter or email notice.