I. Content of this Privacy Policy

sensusplus AG (hereinafter also "we", "us", "sensusplus") obtains and processes personal data relating to you or to other persons (so-called "third parties"). The term "data" is used here synonymously with "personal data".

"sensusplus AG" refers to processing by sensusplus AG itself as well as by the companies of the CORUM Group, to which sensusplus AG belongs.

"Personal data" means data relating to an identified or identifiable person, i.e. the data subject can be identified from the data itself or by including corresponding additional data.

In this Privacy Policy, we describe what we do with your data when you use https://www.sensusplus.ch or other websites of ours (hereinafter collectively "website"), obtain our services, are otherwise connected with us within the framework of a contract, communicate with us or otherwise deal with us. Where appropriate, we will inform you by timely written notice of additional processing activities not mentioned in this Privacy Policy. In addition, we may inform you separately about the processing of your data, e.g. in declarations of consent, contractual terms, additional privacy notices, forms and other notices.

If you transmit or disclose data about other persons, such as family members, work colleagues etc., we assume that you are authorised to do so and that this data is correct. By transmitting data about third parties, you confirm this. Please also ensure that these third parties have been informed about this Privacy Policy.

This Privacy Policy is based on the Swiss Federal Act on Data Protection ("FADP") as amended with effect from 1 September 2023 and the Data Protection Ordinance ("DPO"). Where the EU General Data Protection Regulation ("GDPR") applies in individual cases, this Privacy Policy also takes its requirements into account.

II. Contact Details and Responsibility

The controller responsible for the processing is:

CORUM Vermögensverwaltung AG
Mainaustrasse 21
8008 Zurich
Switzerland
T: +41 (0) 44 213 20 20
F: +41 (0) 44 213 20 25
This email address is being protected from spambots. You need JavaScript enabled to view it.

III. Categories of Data Processed

We process various categories of data. The most important categories are the following:

Technical data: When you use our website or other electronic services (e.g. free Wi-Fi), we collect the IP address of your device and other technical data in order to ensure the functionality and security of these services. This data also includes logs recording the use of our systems. We generally retain technical data for 6 months. In order to ensure the functionality of these services, we may also assign an individual code to you or your device (e.g. in the form of a cookie, see section XI). Technical data as such generally does not allow any conclusions to be drawn about your identity. However, in connection with user accounts, registrations, access controls or the performance of contracts, it may be linked to other categories of data (and thus possibly to your person).

Communication data: When you are in contact with us via the contact form, by email, telephone or chat, by letter or by any other means of communication, we record the data exchanged between you and us, including your contact details and the metadata of the communication. If we record or listen in on telephone calls or video conferences, e.g. for training and quality assurance purposes, we will expressly inform you of this. Such recordings may only be made and used in accordance with our internal guidelines. You will be informed whether and when such recordings take place, e.g. by a notice during the video conference concerned. If you do not wish to be recorded, please let us know or end your participation. If you merely do not want your image to be recorded, please switch off your camera. If we want or need to establish your identity, e.g. in the case of a request for information submitted by you, a request for media access etc., we collect data to identify you (e.g. a copy of an identity document). We generally retain this data for 12 months from the last exchange with you. This period may be longer where this is necessary for evidentiary reasons, to comply with legal or contractual requirements, or for technical reasons. Emails in personal mailboxes and written correspondence are generally retained for at least 10 years. Recordings of (video) conferences are generally retained for 24 months. Chats are generally retained for 2 years.

Master data: Master data is the basic data that, in addition to contract data (see below), we need to conduct our contractual and other business relationships or for marketing and advertising purposes, such as name, contact details and information about, for example, your role and function, your bank details, your date of birth, customer history, powers of attorney, signatory authorisations and declarations of consent. We process your master data if you are a client or other business contact or work for one (e.g. as a contact person of a business partner), or because we wish to address you for our own purposes (e.g. for marketing and advertising, with invitations to events, with vouchers, with newsletters etc.). We receive master data from you, from the entities you work for, or from third parties such as our contractual partners, associations and address brokers, and from publicly accessible sources such as public registers or the internet (websites, social media). Within the scope of master data, we may also process information about third parties. We may also collect master data from our shareholders and investors. We generally retain this data for 10 years from the end of the contract. This period may be longer where this is necessary for evidentiary reasons, to comply with legal or contractual requirements, or for technical reasons. For pure marketing and advertising contacts, the period is usually considerably shorter, normally no more than 2 years from the last contact.

Contract data: This is data arising in connection with the conclusion or performance of a contract, e.g. information about contracts and the services to be provided or already provided, data from the period preceding the conclusion of a contract, information required or used for performance, and information about reactions (e.g. complaints or information on satisfaction etc.). We generally collect this data from you, from contractual partners and from third parties involved in the performance of the contract, but also from third-party sources (e.g. providers of credit information) and from publicly accessible sources. We generally retain this data for 10 years from the end of the contract. This period may be longer where this is necessary for evidentiary reasons, to comply with legal or contractual requirements, or for technical reasons.

Financial and investment data: Information about your assets, accounts and custody accounts, transactions and account statements, your financial circumstances (e.g. income, assets, liabilities) as well as your knowledge and experience, investment objectives and risk profile, which we require for the suitability assessment under the Swiss Financial Services Act (FinSA). We receive this data from you and from your custodian bank.

Compliance and KYC data: Information that we are required to collect under the Swiss Anti-Money Laundering Act (AMLA), such as copies of identity documents, information on the beneficial owner, on the origin of the assets and on the economic background of transactions, as well as the results of checks regarding sanctions, politically exposed persons and adverse media reports. This may include sensitive personal data, in particular data on administrative or criminal proceedings and sanctions. We retain this data for 10 years after the end of the business relationship (Art. 7 para. 3 AMLA).

Tax data: Information about your tax residence, your tax identification number and your status under the automatic exchange of information (AEOI) and FATCA.

Other data: We also collect data from you in other situations. In connection with official or judicial proceedings, for example, data may arise (such as files, evidence etc.) that may also relate to you. We may receive or produce photos, videos and audio recordings in which you may be identifiable (e.g. at events, through security cameras etc.). We may also collect data about who enters certain buildings and when, or who has corresponding access rights (including in the case of access controls, based on registration data or visitor lists etc.), who participates in events or campaigns (e.g. competitions) and when, or who uses our infrastructure and systems and when. Finally, we collect and process data about our shareholders and other investors; in addition to master data, this includes information for the relevant registers, regarding the exercise of their rights and the holding of events (e.g. general meetings). The retention period for this data depends on the purpose and is limited to what is necessary. This ranges from a few days for many security cameras, to visitor data, which is generally retained for 3 months, to reports on events with images, which may be retained for several years or longer. Data about you as a shareholder or other investor is retained in accordance with the requirements of company law, but in any case for as long as you are invested.

IV. Collection of Data

From the data subject
You provide us with much of the data mentioned in section III yourself (e.g. via forms, in the course of communication with us, in connection with contracts, when using the website etc.). Subject to certain individual cases, you are not obliged to disclose data. However, if you wish to enter into contracts with us or use our services, you must provide us with data as part of your contractual obligations under the relevant contract, in particular master data, contract data, financial data and compliance data. When using our website, the processing of technical data is unavoidable. For the provision of our financial services, we are legally obliged to collect certain information, in particular under the Anti-Money Laundering Act and the Financial Services Act. Without this information, we cannot enter into or continue a business relationship.

From third parties or from publicly accessible sources
Where permitted, we also obtain data from publicly accessible sources (e.g. debt enforcement registers, land registers, commercial registers, the media or the internet including social media) or receive data from other companies within our group, from custodian banks where you hold accounts and custody accounts, from providers of compliance databases (e.g. for screening against sanctions lists and politically exposed persons), from authorities and/or from other third parties (such as credit agencies, address brokers, associations, contractual partners etc.).

V. Purpose of Data Processing

We process your data for the purposes explained below:

Communication
We may process your data for purposes related to communication with you, in particular to respond to enquiries or to enable you to exercise your rights. For this purpose, we use in particular communication data and, in connection with offers and services used by you, also your master data. We retain this data in order to document our communication with you, for training purposes, for quality assurance and for follow-up enquiries.

Contractual relationships
We process your data for the initiation, administration and performance of contractual relationships. This includes in particular the provision of our financial service of asset management, the suitability assessment under FinSA, cooperation with your custodian bank, documentation and reporting, and the invoicing of our fees.

Advertising purposes
We process data for marketing purposes and relationship management, e.g. to send our clients and other contractual partners personalised advertising for our services. This may take the form of newsletters and other regular contacts (electronically, by post, by telephone), via other channels for which we have your contact details, but also as part of individual marketing campaigns (e.g. events), and may include free services (e.g. invitations, vouchers etc.). You may object to such contacts at any time or refuse or withdraw your consent to being contacted for advertising purposes. Please note that withdrawing consent does not affect the lawfulness of the processing carried out before the withdrawal.

Compliance with legal requirements
We process personal data to comply with laws, directives and recommendations of authorities and internal regulations ("compliance"). This includes in particular our obligations under the Anti-Money Laundering Act (AMLA), the Financial Services Act (FinSA), the Financial Institutions Act (FinIA) and the regulations on the automatic exchange of information (AEOI) and FATCA. In certain cases, we may be obliged to carry out certain checks on clients ("Know Your Customer") or to file reports with authorities. The fulfilment of obligations to provide information, notify or report, for example in connection with supervisory and tax law obligations, also requires or entails data processing, e.g. the fulfilment of archiving obligations and the prevention, detection and investigation of criminal offences and other violations. This also includes the receipt and processing of complaints and other reports, the monitoring of communications, internal investigations or the disclosure of documents to an authority if we have sufficient reason to do so or are legally obliged to do so. Your personal data may also be processed in the course of external investigations, e.g. by a law enforcement or supervisory authority or an appointed private body. We also process data in order to look after our shareholders and other investors and to fulfil our related obligations. For all these purposes, we process in particular your master data, contract data and communication data, but under certain circumstances also financial, compliance and tax data and data from the category of other data. The legal obligations may be Swiss law, but also foreign provisions to which we are subject, as well as self-regulation, industry standards, our own corporate governance and official instructions and requests.

Risk management and corporate governance
We also process data for the purposes of our risk management and as part of prudent corporate governance, including business organisation and corporate development. For example, as part of our financial management we must monitor our debtors and creditors, and we must avoid becoming the victim of offences and abuse, which may require the analysis of data for corresponding patterns. For these purposes and for your and our protection against criminal or abusive activities, we may also carry out profiling and create and process profiles. As part of planning our resources and organising our operations, we must analyse and process data on the use of our services and other offerings or exchange information about them with others (e.g. outsourcing partners), which may also include your data. The same applies to services provided to us by third parties. As part of corporate development, we may sell businesses, parts of businesses or companies to others or acquire them from others, or enter into partnerships, which may also lead to the exchange and processing of data.

Administration and other purposes
We may process your data for other purposes, e.g. as part of our internal processes and administration or for training and quality assurance purposes. These other purposes include, for example, training and education, administrative purposes (such as the management of master data, accounting and data archiving, and the review, management and ongoing improvement of IT infrastructure), the protection of our rights (e.g. to enforce claims in or out of court and before authorities in Switzerland and abroad, or to defend ourselves against claims, for example by preserving evidence, conducting legal assessments and participating in judicial or official proceedings) and the evaluation and improvement of internal processes. We may use recordings of (video) conferences for training and quality assurance purposes. The protection of other legitimate interests is also among these other purposes, which cannot be listed exhaustively.

VI. Legal Basis for Data Processing

Consent of the data subject
We may process data on the basis of your consent. Where we ask for your consent for certain processing, we will inform you separately about the corresponding purposes of the processing. You may withdraw your consent at any time with effect for the future by written notice, by post or by email, to us; our contact details can be found in section II. As soon as we have received notice of the withdrawal of your consent, we will no longer process your data for the purposes to which you originally consented, unless we have another legal basis for doing so. The withdrawal of your consent does not affect the lawfulness of the processing carried out on the basis of your consent before the withdrawal.

Fulfilment or performance of contractual obligations
We may process your data in order to fulfil our obligations arising from a contract with you. In this case, the processing of the data does not go beyond what is provided for in the relevant underlying contract.

Compliance with legal requirements
We may process your data in order to comply with the legal obligations imposed on us, insofar as these are not already recognised as a legal basis by the applicable data protection law.

Where we process sensitive personal data in this context, such as data on administrative or criminal proceedings or sanctions as part of the checks under the Anti-Money Laundering Act, we rely on the corresponding legal obligation.

Legitimate interest
We may process your data if we can demonstrate that we have a legitimate interest in the processing, in particular in order to pursue the purposes described above in section V and the related objectives and to be able to implement corresponding measures.

VII. Profiling and Automated Individual Decisions

We partly process your data automatically in order to evaluate certain personal aspects (profiling), in particular to determine your risk profile under FinSA, to assess the risk level of the business relationship, to screen against sanctions and PEP lists under AMLA, and to prevent abuse and criminal offences. We do not make automated individual decisions within the meaning of Art. 21 FADP or Art. 22 GDPR, i.e. decisions without human review that have legal effects for you.

VIII. Disclosure of Personal Data

In connection with our contracts, the website, our services, our legal obligations or otherwise to protect our legitimate interests and for the other purposes listed in section V, we may also transfer your personal data to third parties, in particular to the following categories of recipients:

Companies of the CORUM Group: For the purpose of performing contracts or fulfilling our obligations (contractual or statutory), your data may be passed on to other companies within the CORUM Group. In this case, the same requirements and conditions apply to data processing by another company of the CORUM Group as to sensusplus AG itself. In particular, CORUM Wealth Management Platform AG performs compliance tasks as well as administrative and operational tasks (e.g. back office, onboarding, monitoring, accounting) for us on the basis of an outsourcing agreement.

Custodian banks and other financial institutions: Banks and other financial institutions where your accounts and custody accounts are held or through which orders are executed, as well as issuers and fund management companies, insofar as this is necessary for the provision of our services.

Service providers: We work with service providers in Switzerland and abroad who process data about you on our behalf or under joint responsibility with us, or who receive data about you from us under their own responsibility (e.g. IT providers, shipping companies, advertising service providers, login service providers, providers of compliance databases, insurance companies or debt collection agencies). Before disclosing your personal data, sensusplus ensures that the service providers concerned have an adequate level of protection. This may be done by verifying relevant certificates or by means of appropriate contracts (e.g. Standard Contractual Clauses, Binding Corporate Rules etc.).

Authorities: We may disclose personal data to offices, courts and other authorities in Switzerland and abroad if we are legally obliged or entitled to do so or if this appears necessary to protect our interests. The authorities process data about you that they receive from us under their own responsibility.

Audit and supervisory bodies: our audit firm, the supervisory organisation AOOS and the ombudsman OFS Ombud Finance Suisse, if you contact them.

Other persons: This refers to other cases where the involvement of third parties results from the purposes set out in section V, e.g. persons authorised by you, legal representatives, advisors or heirs.

All of these categories of recipients may in turn involve third parties, so that your data may also become accessible to them. We can restrict processing by certain third parties (e.g. IT providers), but not by others (e.g. authorities, banks etc.).

As an asset manager, we are subject to professional secrecy under Art. 69 of the Financial Institutions Act (FinIA). We only disclose client data to third parties insofar as this is necessary for the provision of our services, you have consented, or we are legally obliged or entitled to do so.

IX. Disclosure of Data Abroad

The recipients mentioned in section VIII may also be located abroad. Personal data may in particular be disclosed in member states of the European Union and the European Economic Area (e.g. Germany, Liechtenstein, Luxembourg), in the United Kingdom, in the USA, in Singapore or in Hong Kong, and also in your country of residence when we communicate with you. If a recipient is located in a country without an adequate level of data protection, we contractually oblige the recipient to comply with an adequate level of data protection, usually by means of the European Commission's Standard Contractual Clauses recognised by the Federal Data Protection and Information Commissioner (FDPIC), unless the recipient is subject to a framework recognised by the Federal Council (e.g. the Swiss-U.S. Data Privacy Framework). In exceptional cases, disclosure may also take place without such safeguards, for example if it is necessary for the conclusion or performance of a contract with you, if you have given your express consent, or if it is necessary for the enforcement of legal claims (Art. 17 FADP).

X. Duration of Processing

We process your data for as long as our processing purposes, the statutory retention periods and our legitimate interests in processing for documentation and evidentiary purposes require, or as long as storage is technically necessary. For client data, the retention obligations under the Anti-Money Laundering Act (10 years after the end of the business relationship) and the Swiss Code of Obligations (10 years) apply in particular. Thereafter, the data is deleted or anonymised.

XI. Use of Cookies

Our website only uses cookies that are technically necessary for its operation; they are deleted at the end of your visit or after a short time. We do not use analytics, tracking or marketing cookies. Our website does not integrate any content or services from third-party providers that transmit data to third parties when the website is accessed.

XII. Rights of Data Subjects

Under certain circumstances, the applicable data protection law grants you the right to object to the processing of your data, in particular processing for marketing purposes. In order to make it easier for you to control the processing of your personal data, you also have the following rights in connection with our data processing, depending on the applicable data protection law:

the right to request information from us as to whether and which data we process about you;
the right to have us correct data if it is inaccurate;
the right to request the erasure of data;
the right to request that we hand over certain personal data in a commonly used electronic format or transfer it to another controller;
the right to withdraw consent, insofar as our processing is based on your consent;
the right to receive, on request, further information required to exercise these rights;
the right to lodge a complaint with a data protection supervisory authority; in Switzerland, this is the Federal Data Protection and Information Commissioner (FDPIC), www.edoeb.admin.ch.

If you wish to exercise the above rights against us (or against one of our group companies), please contact us in writing, in person at our premises or, unless otherwise stated or agreed, by email; our contact details can be found in section II. In order to rule out misuse, we must identify you (e.g. with a copy of your identity document, unless this is not possible otherwise). We generally respond to your request within 30 days and in principle free of charge.

Please note that these rights are subject to conditions, exceptions or restrictions under the applicable data protection law (e.g. to protect third parties or business secrets). We will inform you accordingly where applicable. This includes in particular our statutory retention obligations and the prohibition on informing you of a report to the Money Laundering Reporting Office Switzerland (Art. 10a AMLA).

XIII. Data Security

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, misuse and alteration (Art. 8 FADP), and we oblige our employees and service providers to maintain confidentiality. However, the transmission of data over the internet, in particular by unencrypted email, is never completely secure.

XIV. Changes to this Privacy Policy

sensusplus reserves the right to amend this Privacy Policy at any time. The version published on this website is the current version.

Last updated: 26 October 2026