Privacy policy

In this Privacy Policy, we, BSP Treuhand Ltd, Zurich (hereinafter referred to as BSP Treuhand Ltd, we or us), describe how we collect and process personal data. This Privacy Policy is not an exhaustive description; other statements relating to data protection may govern specific circumstances. For the purposes of this Privacy Policy, personal data means all information relating to an identified or identifiable person.

1) Controller and contact information

Unless specified otherwise under the specific individual circumstances, the controller for the purposes of the data processing described herein is BSP Treuhand Ltd. Any queries concerning data protection may be sent to us by letter or email, enclosing a copy of the user’s identity card or passport in order to identify him/her, as follows:

BSP Treuhand Ltd, Andreas Stadler, Lindenstrasse 38, 8008 Zurich, Switzerland, info@bsp.do.

2) Collection and processing of personal data

We process personal data in particular from the following categories:

Client data from clients to which we provide or have provided services.
Personal data that we have obtained directly or indirectly from our clients when providing services.
Whenever our website is visited.
During participation in an event held by us.
In the event of any communication or visit between us.
Within the ambit of any other contractual relationship, e.g. as a supplier, service provider or advisor.
In relation to job applications.
If we are obliged to do so due to legal or regulatory requirements.
In order to comply with our due diligence obligations or to uphold our legitimate interests, e.g. in order to avoid conflicts of interest, money laundering or other risks, to ensure the accuracy of any data held, to review creditworthiness, to guarantee security or to enforce our rights.

Further detailed information can be found in the descriptions of the respective categories of processing in section 4.

3) Categories of personal data

The particular personal data that we process depend upon your relationship with us as well as the purpose for which we process them. Alongside your contact data, we also process other information concerning you or any persons who are associated with you. Under certain circumstances, this information may also contain sensitive personal data.

We collect the following categories of personal data, depending upon the purpose for which we process them:

Contact information (e.g. last name, first name, address, telephone number, email).
Client information (e.g. date of birth, nationality, marital status, profession, title, job title, passport / ID card number, OASI number).
Risk assessment data (e.g. information concerning creditworthiness, commercial register data).
Financial information (e.g. data relating to bank accounts).
Data relating to the mandate, depending upon the respective instructions (e.g. tax information, articles of association, minutes, projects, contracts, employee data (e.g. salary, social insurance), accounting data, beneficial owners, ownership arrangements).
Website data (e.g. IP address, device information (UDI), information concerning the browser, website usage (analysis and usage of plugins, etc.).
Data relating to job applications (e.g. CV, employment references).
Marketing information (e.g. signing up for newsletter).
Security and network data (e.g. visitor lists, access controls, network and email scanners, telephone call lists).

Where permitted, we also collect some data from publicly accessible sources (e.g. the debt enforcement register, land registers, the commercial register, press, Internet) or receive such data from our clients and their employees, public authorities, courts (or arbitral tribunals) and other third parties. In addition to data concerning you that you provide directly to us, the categories of personal data concerning you that we receive from third parties include in particular information from public registers, information that we obtain concerning administrative or judicial proceedings, information concerning your professional functions and duties (so that we can for instance, with your assistance, conclude and implement transactions with your employer), information concerning you obtained from correspondence and discussions with third parties, credit checks, information concerning you provided to us by persons closely associated with you (family, advisors, legal representatives, etc.) so that we can conclude or implement contracts with you or with your involvement (e.g. references, your address fo deliveries, powers of attorney), information concerning compliance with legalrequirements such as for instance anti-money laundering rules or export restrictions, information obtained from our banks, insurers, distribution partners and other contractual partners for the purpose of receiving services from you or providing services to you (e.g. payments made, purchases concluded), information concerning you obtained from the media and online (where appropriate under the specific individual circumstances, e.g. within the ambit of a job application etc.), your addresses and where applicable your interests and other socio-demographic data (for marketing), data relating to website usage (e.g. IP address, MAC address of your smartphone or computer, information concerning your device and settings, cookies, date and time of the visit, pages and content viewed, functions used, referring website and location data).

4) Purpose of data processing and legal basis

4.1) Provision of services

We process primarily the personal data that we receive within the context of advisor-client relationships with our clients as well as other contractual relationships with their business partners and other parties involved.

The personal data of our clients include in particular the following information:

Contact information (e.g. last name, first name, address, telephone number, email, other contact information).
Personal information (e.g. date of birth, nationality, marital status, profession, title, job title, passport / ID card number, OASI number, family circumstances, etc.).
Risk assessment data (e.g. information concerning creditworthiness, commercial register data, sanctions lists, specialist databases, data obtained online).
Financial information (e.g. data relating to bank accounts, investments or equity interests).
Data relating to the mandate, depending upon the respective instructions, e.g. tax information, articles of association, minutes, employee data (e.g. salary, social insurance), accounting data etc.
Sensitive personal data: personal data may also contain sensitive personal data, such as e.g. data concerning health, religious beliefs or social welfare, especially if we provide services involving payroll processing or accounting.

We process these personal data for the purposes described in accordance the following legal bases:

Conclusion or performance of a contract with or for the benefit of the data subject, including steps taken prior to entering into a contract and any enforcement (e.g. advice, fiduciary services) Page 4 | 12
Compliance with a legal obligation (e.g. if we are obliged to disclose information)
Upholding legitimate interests (e.g. for administrative purposes in order to improve our quality, to guarantee security, to conduct risk management, to enforce our rights, to defend against claims or to examine potential conflicts of interest)
Consent (e.g. in order to send marketing information to you). .

4.2) Indirect data processing in relation to the provision of a service

If we provide services for our clients, it is possible that we may also process personal data that we have not collected directly from data subjects or personal data concerning third parties. Any such third parties are general employees, contact persons, family members or persons who are otherwise closely associated with the client or the data subject. We need these personal data in order to perform contracts with our clients. We receive these personal data from our clients or from third parties instructed by our clients. Any third parties whose information we process for this purpose will be informed by our clients that we process their data. Our clients may refer to this Privacy Policy in this regard.

Personal data relating to people who are closely associated with our clients include
in particular the following information:

Contact information (e.g. last name, first name, address, telephone number, email, other contact information, marketing data).
Personal information (e.g. date of birth, nationality, marital status, profession, title, job title, passport / ID card number, OASI number, family circumstances, etc.).
Financial information (e.g. data relating to bank accounts, investments or equity interests).
Data relating to the mandate, depending upon the respective instructions, e.g. tax information, articles of association, minutes, employee data (e.g. salary, social insurance), accounting data.
Sensitive personal data: personal data may also contain sensitive personal data, such as e.g. data concerning health, religious beliefs or social welfare, especially if we provide services involving payroll processing or accounting. .

We process these personal data for the purposes described in accordance the following legal bases:

Conclusion or performance of a contract with or for the benefit of the data subject (e.g. if we comply with our contractual obligations).
Compliance with a legal obligation or if we are obliged to disclose information. Page 5 | 12
Upholding legitimate interests, including in particular our interest in
providing optimal service to our clients.

4.3) Usage of our website

It is not necessary to disclose any personal data in order to use our website. However, whenever it is accessed the server records various user information, which is stored temporarily in the server’s log files.

Where this general information is used it is not imputed to a particular person. The recording of this information and data is technically necessary in order to display our website and to guarantee its stability and security. This information is also collected for the purpose of improving the website and analysing how it is used.

It includes in particular the following information:

Contact information (e.g. last name, first name, address, telephone number, email).
Any other information that you transmit to us via the website.
Any technical information transmitted automatically to us or our service providers, information concerning user conduct or website settings (e.g. IP address, UDI, device type, browser, number of clicks on the page, opening of the newsletter, clicks on links, etc.)

We process these personal data for the purposes described in accordance the following legal bases:

Upholding legitimate interests (e.g. for administrative purposes, in order to improve our quality, to analyse data or to provide information concerning our services).
Consent (e.g. to the usage of cookies).

4.4) Participation in events

If you participate in an event organised by us, we collect personal data for the purpose of organising and holding the event as well as sending you any subsequent additional information. We also use your information to inform you concerning further events. It is possible that you may be photographed or filmed by us at these events and that we may publish the related images either internally or externally.

It includes in particular the following information:

Contact information (e.g. last name, first name, address, telephone number, email). Page 6 | 12
Personal information (e.g. profession, function, title, employer firm, dietary preferences).
Pictures or videos.
Payment information (e.g. bank details)

We process these personal data for the purposes described in accordance the following legal bases:

Compliance with a contractual obligation towards or for the benefit of the data subject, including steps taken prior to entering into a contract and any enforcement (enabling participation in the event).
Upholding legitimate interests (e.g. holding of events, provision of information concerning our event, provision of services, efficient organisation).
Consent (e.g. in order to send marketing information or images to you)..

4.5) Direct communication and visits

If you contact us (e.g. by telephone, email or chat) or if we contact you, we process the personal data that are necessary for this purpose. We also process these personal data if you visit us. In such cases it is possible that you may have to provide your contact data before your visit or at the reception. These will be stored by us for a particular period of time in order to protect our infrastructure and our information.

We use the service “Microsoft Teams” or any other service provider preferred by you in order to hold telephone conferences, online meetings, video conferences and/or webinars (“online meetings”).

In this context we process in particular the following information:

Contact information (e.g. last name, first name, address, telephone number, email).
Metadata relating to the communication (e.g. IP address, duration of communication, communication channel).
Recordings of conversations, e.g. of video conferences.
Other information uploaded, provided or generated by the user whilst using the video conference service as well as any metadata used for the purpose of maintaining the service provided. Additional information concerning the processing of personal data by Microsoft Teams in its privacy statements.
Personal information (e.g. profession, function, title, employer firm).
Time of and reason for the visit.

We process these personal data for the purposes described in accordance the following legal bases:

Compliance with a contractual obligation towards or for the benefit of the data subject, including steps taken prior to entering into a contract and any enforcement (provision of a service).
Upholding legitimate interests (e.g. security, traceability as well as the handing and administration of client relationships).

4.6) Job applications

You can apply for a job with us by post or by writing to the email address indicated on our website. The job application documents and all personal data disclosed to us in them will be treated in the strictest confidence, will not be disclosed to any third party and will only be processed by us for the purpose of assessing your application for a job. Unless you consent to further usage, your application file will either be returned to you or erased/destroyed after the job application process has been concluded, unless it is subject to a legal retention requirement. The legal bases for the processing of your data are your consent, the performance of a contract with you and our legitimate interests. .

In this context we process in particular the following information:

Contact information (e.g. last name, first name, address, telephone number, email).
Personal information (e.g. profession, function, title, employer firm).
Job application documents (e.g. covering letter, certificates, diplomas, CV).
Information needed for assessments (e.g. evaluation of HR consultant, references, assessments).

We process these personal data for the purposes described in accordance the following legal bases:

Upholding legitimate interests (e.g. appointment of new staff).
Consent.

4.7) Suppliers, service providers, other contractual partners

If we conclude a contract with you so that you can provide a service to us, we process personal data concerning you or your employees. We need these in order to communicate with you and to receive your services. Under certain circumstances, we also process these personal data in order to examine whether there may be any conflict of interest in relation to our activities and to ensure that we do not take on any undesired risks as a result of cooperation, e.g. in relation to money laundering or sanctions.

In this context we process in particular the following information:

Contact information (e.g. last name, first name, address, telephone number, email).
Personal information (e.g. profession, function, title, employer firm).
Financial information (e.g. data relating to bank accounts).

We process these personal data for the purposes described in accordance the following legal bases:

Conclusion or performance of a contract with or for the benefit of the data subject, including steps taken prior to entering into a contract and any enforcement.
Upholding legitimate interests (e.g. avoiding conflicts of interest, protecting the company, enforcement of legal claims).

5) Tracking technologies

We use cookies on our website. These are small files generated automatically by your browser, which are stored on your end device (laptop, tablet, smartphone etc.) whenever you visit our site.

Cookies store information generated in relation to the specific end device used. However, this does not mean that we are able to establish your identity directly as a result. First of all, cookies are used to make using our content a more pleasant experience for you. For example, we use session cookies to detect if you have already visited individual pages on our website. Those are automatically deleted when you leave our website.

In addition, in order to optimise user friendliness we also store temporary cookies which are stored on your end device for a particular period of time. If you visit our site again in order to use our services, these cookies automatically establish that you have previously visited our site and provide the information entered and settings used by you so that you do not have to enter the respective information again. We also use cookies to record statistics on and assess the use of our website with a view to optimising our offer for you. If you visit our website again, these cookies enable us to detect that you have already visited it before. These cookies are automatically erased after a particular period of time.

The data processed by cookies are required for the purposes indicated. Most browsers accept cookies automatically. However, you can configure your browser in such a way that no cookies are stored on your computer or you are always notified before a new cookie is stored. However, disabling cookies entirely may mean that you cannot use all of our website’s functions.

6) Web analysis

We also use the following web analysis tools and retargeting technologies in order to obtain information concerning usage of our website, to improve our online content or so that we can display advertising to you, including on third-party websites or social media: Google Analytics.

These tools are furnished by third-party providers. The information collected for this purpose on the use of a website by using cookies or similar technologies is usually transmitted to a third-party server. Depending on the third-party provider, such servers may be located abroad.

Data are usually transmitted after truncating the IP address, which prevents individual end devices from being identified. This information is only transmitted by third-party providers if they are required to do so by law or within the context of outsourced data processing.

6.1) Google Analytics

We use Google Analytics on our website, the web analysis service provided by Google LLC, Mountain View, California, USA; Google Limited Ireland is the company responsible for Europe (“Google”). Google provides a browser plug-in at https://tools.google.com/dlpage/gaoptout?hl=en for deactivating Google Analytics. Google Analytics uses cookies. These are small text files that enable specific userrelated information to be stored on the user’s device. These facilitate an analysis of the use of our website by Google. The information collected by the cookie concerning use of our website (including your IP address) is normally transferred to a Google server in the US where it is saved. Please note that Google Analytics has been extended on this website by the code “gat._anonymizeIp();” in order to ensure the anonymised recording of IP addresses (known as IP masking). If anonymisation is activated, Google truncates IP addresses within the member states of the European Union or other signatory states to the Agreement on the European Economic Area so that no conclusions about your identity can be drawn. Only in exceptional cases will the full IP address be transmitted to a Google server in the US and truncated there. Under certain circumstances, Google may crossreference your IP address with other data held by Google. For data transferred to the US, Google has undertaken to sign and comply with the EU standard contractual clauses.

7) Disclosure and transmission of data

We only disclose your data to third parties if this is necessary in order to provide our service, if the respective third party provides services to us, if we are obliged to do so by law or under the terms of an administrative direction or if we have an overriding interest in disclosing the personal data. We also disclose personal data to third parties if you have consented to this or if you have requested us to do so. .

Not all personal data are transmitted in encrypted form by default. Unless explicitly agreed otherwise with the client, accounting data, payroll administration data, payslips and salary statements, tax returns and calculations and other documents will be transmitted in unencrypted form.

The following categories of recipient may receive personal data from us:

Subsidiaries.
Service providers (e.g. IT service providers, hosting providers, suppliers, advisors, lawyers, insurers).
Third parties, within the ambit of our legal or contractual obligations, authorities, state bodies, courts. .

We conclude contracts with service providers that process personal data on our behalf that oblige them to guarantee data protection. Most of our service providers are located in Switzerland or the EU / EEA. Some personal data may also be transmitted to the US (e.g. Google Analytics data) or under exceptional circumstances to other countries around the world. Should it be necessary to transmit data to other countries that do not have an adequate level of data protection, this will occur on the basis of the EU standard contractual clauses (e.g. in relation to Google) or other suitable instruments.

8) Duration of the retention of personal data

We process and store your personal data for as long as this is necessary for the fulfilment of our contractual and legal obligations or as is otherwise necessary for the purposes pursued through its processing, i.e. for the duration of the entire business relationship (from its initiation and execution through to contract termination) and furthermore in accordance with statutory retention and documentation obligations. Within this context, it is possible that your personal data may be stored for the period during which claims can be asserted against our company (i.e. in particular during the statutory limitation period) and insofar as we are otherwise legally obliged to do so or this is required for legitimate business interests (e.g. for the purposes of providing evidence and documentation). As soon as your personal data are no longer needed for the above purposes, they will always be deleted or anonymised as far as possible. As a basic principle, the shorter retention periods of twelve months or less apply to operational data (e.g. system protocols, logs).

9) Data security

We implement appropriate technical and organisational security precautions to protect your personal data against unauthorised access and misuse, such as for instance the issue of instructions, training, IT and network security solutions, access controls and restrictions, data carrier encryption, encrypted transmission, pseudonymisation and controls.

10) Obligation to provide personal data

As part of our business relationship, you must provide the personal data required to enter into and conduct a business relationship and to fulfil associated contractual obligations (as a rule, you do not have a statutory obligation to provide us with
data). Without these data, we will not be able to conclude or perform a contract with you (or the body or person that you represent). What is more, the website cannot be used if certain information required to safeguard data traffic (such as the
IP address) is not disclosed.

11) Your rights

You have the following rights in relation to the processing of personal data by us:

The right to access the personal data stored by us concerning you, along with information concerning the purpose of processing, the origin of the data as well as the recipients or categories of recipient to which personal data are transmitted.
The right to rectification in the event that your data are not correct or complete.
The right to restrict the processing of your personal data.
The right to obtain the erasure of your personal data.
The right to data portability.
The right to object to data processing or to withdraw consent to the processing of personal data at any time without stating reasons.
The right to lodge a complain.

Please contact the address indicated in section 1 in order to exercise any of these rights.

Please note, however, that we reserve the right to invoke the restrictions provided for by law, for example if we are obliged to store or process certain data, if we have an overriding interest in doing so (insofar as we are entitled to refer to this) or if we need these data in order to exercise claims. We shall inform you in advance if this will be associated with any costs for you.

12) Amending the Privacy Policy

We expressly reserve the right to amend this Privacy Policy at any time. .

Last amendment: August 2023