Privacy Policy

Introduction

The European data protection legislation called EU's General Data Protection Regulation (GDPR) came into force on May 25, 2018 and replaces the Data Protection Directive from 1995. This represents a significant step forward toward transparent collection and use of personal data. Although SwissFirma operates in Switzerland under Swiss jurisdiction, we serve clients who are citizens of EU countries. Therefore, regulatory changes in this area are important, and full compliance with GDPR rules is a priority for us.

This Privacy Policy will clarify why and in which way we may collect personal data and where, how and for which purposes we may use it. The Privacy Policy applies to the SwissFirma website, subscriptions, communications and services.

This Privacy Policy takes effect immediately for every new user and is binding for all existing users.

Please read our Privacy Policy carefully. If you have any questions or concerns about our Privacy Policy, contact us at +41 44 51 52 591 or visit our office at Baarerstrasse 21, 6300 Zug, Switzerland.

SwissFirma acknowledges the Privacy Principles defined in Article 5 of the GDPR, in particular: Lawful, Fair and Transparent Data Processing; Limiting the Purpose; Minimizing Collection; Being Accurate; Limiting Storage Time; and ensuring Protection and Confidentiality.

Any information stored by SwissFirma is treated as confidential. All information is stored securely and is accessed by authorized personnel only. SwissFirma implements and maintains appropriate technical, security and organizational measures to protect Personal Data against unauthorized or unlawful processing and use, and against accidental loss, destruction, damage, theft or disclosure.

Definitions

For the purposes of this Privacy Policy the following terms will be used with the following meaning:

SwissFirma is a network of partner law firms incorporated in Switzerland, providing legal support services for business formation and corporate operations in Switzerland. SwissFirma can be both a data controller and data processor, depending on what data it has and what SwissFirma is doing with the data.

Client is any entity or individual with which SwissFirma has an established relationship.

Consent of the data subject means any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.

Controller means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.

Data Subject is any identified or identifiable natural person, whose personal data is processed by SwissFirma, including but not limited to Visitors/Users and Clients of SwissFirma.

Personal Data means any information relating to an identified or identifiable natural person ('data subject'); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

Processing is any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

Processor means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.

Visitor/User is any person who visits or uses the website of SwissFirma.

What Information Do We Collect?

We collect, use and save personal data according to the requirements of law and taking into account the existing legal limitations or upon your prior consent. In general, we collect the following information: name, email, IP address, postal address and postal code, means of payment, date of birth, telephone number, company name, intended business structure, nationality and residence status.

This information can be collected in different ways, including during:

• User registration
• Purchase of our services (company formation, tax consulting, accounting)
• Filling in a contact form
• Using our online tools (company name verification, tax calculator)
• Signing up for newsletters or updates
• Phone calls
• In-person consultations
• Participating in marketing offers or surveys

Collecting Personal Data of Visitors and Users

If you visit or use our Website, this section applies to you. SwissFirma may collect, record and analyze information of Visitors to its Website. We may record your IP address and use cookies (see Cookies Policy below). SwissFirma may collect and process any Personal Data that you voluntarily provide to us in our website's forms, such as when you:

• Request company name verification
• Use our tax calculator
• Sign up for information and newsletters
• Request a consultation
• Fill in contact forms

If you provide SwissFirma with your social media details, SwissFirma may retrieve publicly available information about you from social media. Such Personal Data may comprise your IP address, first and last name, your postal and email address, your telephone number, your professional title, data for social networks, your areas of interest and interest in SwissFirma's services.

SwissFirma gathers data about visits to the website, including numbers of Visitors and visits, geo-location data, length of time spent on the site, pages clicked on, and where Visitors have come from.

Collecting and Use of Personal Data of Clients

If you are a Client of SwissFirma, this section applies to you. SwissFirma may collect and process any Personal Data that you voluntarily provide to us through our Website, telephone calls, in-person meetings, or through our partner law firms.

For the purposes of providing company formation and business services in Switzerland, we may collect:

• Personal identification documents (passport, ID)
• Proof of residence
• Business plans and financial projections
• Banking information
• Tax residency information
• Corporate structure details
• Beneficial ownership information
• Professional references

This information is necessary for compliance with Swiss legal requirements for company formation, including Swiss Anti-Money Laundering regulations and Know Your Customer (KYC) procedures.

Cookies Policy

Our website uses cookies to distinguish you from other visitors and users of our site. This helps us to provide you with a good experience when you browse our website and also allows us to improve our site.

What is a Cookie?

A cookie is a small file that can be placed on your device that allows us to recognize and remember you. It is sent to your browser and stored on your computer's hard drive, tablet or mobile device.

We use cookies to obtain information about your visits and about the device you use to access our website, including for:

• Understanding how you use our site
• Showing you information that is relevant to you
• Showing you SwissFirma's services that are relevant to you
• Marketing and analytical purposes

This includes, where available, your IP address and pseudonymous identifiers, operating system and browser type and, depending on the cookie, also includes the reporting of statistical data about our users' browsing actions and patterns.

Types of Cookies

'Essential' cookies are automatically placed on your computer or device when you access our website or take certain actions on our website.

'Non-essential' cookies and other technologies are only placed on your computer or device if you have consented to us doing so. You consent to us placing non-essential cookies on your computer or device by continuing to use our website with your browser settings set to accept cookies.

How You Can Control and Delete Cookies

If you are visiting our website, a pop-up window will give you an opportunity to agree to our Cookies Policy.

You can also set up your browser to delete or refuse some or all of them, or to notify you when you are sent a cookie and therefore choose whether or not to accept it. You may also delete or refuse some or all of the cookies at any time by contacting SwissFirma. If you choose not to receive our cookies, we cannot guarantee that your experience will be as fulfilling as it would otherwise be.

Information We Receive from Other Sources

We may receive information about the Data Subject if the Data Subject uses any of the other websites we operate or the other services we provide. We may also receive information about the Data Subject from any of our business partners (including partner law firms, notaries, banks, and Swiss government registers) to whom the Data Subject may have given details with permission for them to send it to us.

How Do We Use Personal Information?

We may use the personal information of the Data Subject:

• To provide company formation and business services in Switzerland
• To verify company names through Swiss commercial register (Zefix)
• To prepare and submit company registration documents
• To facilitate bank account opening with Swiss banks
• To provide tax calculation and consulting services
• To provide immigration and residence permit support
• To administer our website and for internal operations, including troubleshooting, data analysis, testing, research, statistical and survey purposes
• To improve our site to ensure that content is presented in the most effective manner for you and for your computer
• To allow you to participate in interactive features of our service (company name checker, tax calculator), when you choose to do so
• As part of our efforts to keep our site safe and secure
• To measure or understand the effectiveness of advertising we serve to you and others, and to deliver relevant advertising to you
• To make suggestions and recommendations to you and other users of our site about services that may interest you or them
• To carry out polls and surveys
• To deliver marketing and events communications
• To conform with our legal obligations, including Swiss Anti-Money Laundering regulations
• To provide ongoing accounting, bookkeeping and tax compliance services

What Legal Basis Do We Have for Processing Your Personal Data?

The primary condition for processing the personal data of the data subject is given consent to the processing of his or her personal data according to Art. 6 (1) lit. a GDPR. If no other legal basis for data processing applies, SwissFirma can only collect personal data upon prior consent of the Data Subject.

Each data subject shall have the right granted by the European legislator to withdraw his or her consent to processing of his or her personal data at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.

If the data subject wishes to exercise the right to withdraw consent, he or she may at any time directly contact SwissFirma at +41 44 51 52 591.

If the processing of personal data is necessary for the performance of a contract to which the data subject is party, as is the case when processing operations are necessary for company formation services, bank account setup, or to provide any other service, the processing is based on Article 6(1) lit. b GDPR. The same applies to processing operations which are necessary for carrying out pre-contractual measures, for example in the case of inquiries concerning our services.

If SwissFirma is subject to a legal obligation by which processing of personal data is required, such as for the fulfillment of Swiss Anti-Money Laundering obligations, tax obligations, or Swiss company registration requirements, the processing is based on Art. 6(1) lit. c GDPR.

In rare cases, the processing of personal data may be necessary to protect the vital interests of the data subject or of another natural person. This would be the case, for example, if a visitor were injured in our office and his name, age, health insurance data or other vital information would have to be passed on to a doctor, hospital or other third party. Then the processing would be based on Art. 6(1) lit. d GDPR.

Finally, processing operations could be based on Article 6(1) lit. f GDPR. This legal basis is used for processing operations which are not covered by any of the abovementioned legal grounds, if processing is necessary for the purposes of the legitimate interests pursued by SwissFirma or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data.

When Do We Share Personal Data?

We may share information about the Data Subject with selected third parties including:

• Partner law firms that provide legal services for company formation
• Swiss notaries for notarization of company documents
• Swiss banks for bank account opening procedures
• Swiss commercial register (Zefix) for company name verification and registration
• Swiss immigration authorities for residence permit applications
• Swiss tax authorities as required by law
• Accounting and audit firms for bookkeeping and compliance services
• Business partners, suppliers and subcontractors for the performance of any contract we enter into with them
• Analytics providers that assist us in the improvement and optimization of our site

We May Disclose Your Personal Information to Third Parties:

• In the event that we sell or buy any business or assets, in which case we may disclose your personal data to the prospective seller or buyer of such business or assets
• If we or substantially all of our assets are acquired by a third party, in which case personal data held by us about our clients will be one of the transferred assets
• If we are under a duty to disclose or share your personal data in order to comply with any legal obligation (including Swiss Anti-Money Laundering laws), or in order to enforce or apply our terms of use and other agreements, or to protect our rights, property, or safety or that of our clients or others

Where Do We Store and Process Personal Data?

The personal information of the Data Subject is stored on secure servers in Switzerland. Switzerland has been recognized by the European Commission as providing adequate protection for personal data, which allows for the transfer of data from the EU to Switzerland.

How Long Do We Keep Your Personal Data?

The criteria used to determine the period of storage of personal data is the respective statutory retention period. Under Swiss law, certain business documents must be retained for 10 years. After expiration of the applicable retention period, the corresponding data is routinely deleted, as long as it is no longer necessary for the fulfillment of the contract or the initiation of a contract.

For company formation clients, we retain personal data for:

• Company formation documents: 10 years (Swiss legal requirement)
• Financial and tax documents: 10 years (Swiss legal requirement)
• Marketing communications: Until consent is withdrawn
• Website analytics: 26 months maximum

Rights of the Data Subject

SwissFirma respects the rights of the Data Subject protected by the GDPR:

The Right to Be Informed

Each data subject shall have the right granted by the European legislator to obtain from the controller information as to whether or not personal data concerning him or her are being processed. If a data subject wishes to avail himself of this right of confirmation, he or she may, at any time, contact SwissFirma at +41 44 51 52 591.

The Right of Access

Each data subject shall have the right granted by the European legislator to obtain from the controller free information about his or her personal data stored at any time and a copy of this information. Furthermore, the European directives and regulations grant the data subject access to the following information:

• The purposes of the processing
• The categories of personal data concerned
• The recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organizations
• Where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period
• The existence of the right to request from the controller rectification or erasure of personal data, or restriction of processing of personal data concerning the data subject, or to object to such processing
• The existence of the right to lodge a complaint with a supervisory authority
• Where the personal data are not collected from the data subject, any available information as to their source
• The existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) of the GDPR and, at least in those cases, meaningful information about the logic involved, as well as the significance and envisaged consequences of such processing for the data subject

Furthermore, the data subject shall have a right to obtain information as to whether personal data are transferred to a third country or to an international organization. Where this is the case, the data subject shall have the right to be informed of the appropriate safeguards relating to the transfer.

If a data subject wishes to avail himself of this right of access, he or she may at any time contact SwissFirma.

The Right of Rectification

Each data subject shall have the right granted by the European legislator to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement.

If a data subject wishes to exercise this right to rectification, he or she may, at any time, contact SwissFirma.

The Right to Erasure

Each data subject shall have the right granted by the European legislator to obtain from the controller the erasure of personal data concerning him or her without undue delay, where one of the following grounds applies and as long as the processing is not necessary:

• The personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed
• The data subject withdraws consent on which the processing is based and where there is no other legal ground for the processing
• The data subject objects to the processing and there are no overriding legitimate grounds for the processing
• The personal data have been unlawfully processed
• The personal data must be erased for compliance with a legal obligation

Please note that under Swiss law, certain documents must be retained for 10 years and cannot be deleted during this period.

The Right to Restrict Processing

Each data subject shall have the right granted by the European legislator to obtain from the controller restriction of processing where one of the following applies:

• The accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data
• The processing is unlawful and the data subject opposes the erasure of the personal data and requests instead the restriction of their use
• The controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defense of legal claims
• The data subject has objected to processing pursuant to Article 21(1) of the GDPR pending the verification whether the legitimate grounds of the controller override those of the data subject

If one of the aforementioned conditions is met, and a data subject wishes to request the restriction of the processing of personal data stored by SwissFirma, he or she may at any time contact SwissFirma.

The Right to Data Portability

Each data subject shall have the right granted by the European legislator, to receive the personal data concerning him or her, which was provided to a controller, in a structured, commonly used and machine-readable format. He or she shall have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, as long as the processing is based on consent pursuant to point (a) of Article 6(1) of the GDPR or point (a) of Article 9(2) of the GDPR, or on a contract pursuant to point (b) of Article 6(1) of the GDPR, and the processing is carried out by automated means.

Furthermore, in exercising his or her right to data portability pursuant to Article 20(1) of the GDPR, the data subject shall have the right to have personal data transmitted directly from one controller to another, where technically feasible and when doing so does not adversely affect the rights and freedoms of others.

In order to assert the right to data portability, the data subject may at any time contact SwissFirma.

The Right to Object

Each data subject shall have the right granted by the European legislator to object, on grounds relating to his or her particular situation, at any time, to processing of personal data concerning him or her, which is based on point (e) or (f) of Article 6(1) of the GDPR. This also applies to profiling based on these provisions.

SwissFirma shall no longer process the personal data in the event of the objection, unless we can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or for the establishment, exercise or defense of legal claims.

The Right in Relation to Automated Decision Making

Each data subject shall have the right granted by the European legislator not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her, or similarly significantly affects him or her, as long as the decision is not necessary for entering into, or the performance of, a contract between the data subject and SwissFirma.

Third Party Sites

Our site may, from time to time, contain links to and from the websites of our partner networks, partner law firms, Swiss government websites (Zefix, Swiss Federal Tax Administration), banks, and affiliates. If you follow a link to any of these websites, please note that these websites have their own privacy policies and that we do not accept any responsibility or liability for these policies. Please check these policies before you submit any personal data to these websites.

Changes to Our Privacy Policy

Any changes we may make to our privacy policy in the future will be posted on this page and, where appropriate, notified to you by telephone or through our website. The effective date at the top of this document will be updated accordingly. Please check back frequently to see any updates or changes to our privacy policy.

Contact

Questions, comments and requests regarding this Privacy Policy are welcomed and should be addressed to:

SwissFirma
Baarerstrasse 21
6300 Zug
Switzerland

Phone: +41 44 51 52 591

Office Hours: Monday - Friday, 9:00 AM - 6:00 PM (CET)

Additional Information for Swiss Residents

Under the Swiss Federal Act on Data Protection (FADP), which came into force on September 1, 2023, Swiss residents have additional rights regarding their personal data. SwissFirma is committed to compliance with both GDPR and FADP requirements.

The FADP provides Swiss residents with rights similar to those outlined above under GDPR, including:

• The right to information about data processing
• The right of access to personal data
• The right to rectification of inaccurate data
• The right to erasure of data (subject to legal retention requirements)
• The right to data portability
• The right to object to processing

For questions specifically related to FADP compliance, please contact us at +41 44 51 52 591.