Where we rely on legitimate interests as the legal basis, you have the right to object to processing at any time (see Section 8). We have assessed that our legitimate interests are not overridden by your interests or fundamental rights in these contexts, given the nature of the investor relationship and the limited sensitivity of the data involved.
 
5. Recipients of Your Personal Data
We may share your personal data with the following categories of recipients:
Banks and payment service providers — for payment processing, AML compliance and wire transfer execution;
External legal advisors and auditors — acting under duties of confidentiality;
Swiss commercial register authorities — where disclosure is required by law;
Tax authorities — for FATCA, CRS and Swiss withholding tax reporting obligations;
Technology service providers — including e-signature platforms, CRM systems and investor register software, acting as data processors under data processing agreements;
Regulatory and supervisory authorities — where required by applicable law or regulatory request.
We do not sell personal data to third parties or share it for commercial marketing purposes.
 
6. International Transfers
Switzerland is recognised by the European Commission as providing an adequate level of data protection. As a result, transfers of personal data from the EEA to Switzerland may take place without additional transfer safeguards.
Some of our service providers (including technology sub-processors) may process personal data outside Switzerland and the EEA. Where this occurs, we ensure that appropriate safeguards are in place in accordance with Chapter V GDPR and Art. 16 nDSG, including by use of Standard Contractual Clauses (SCCs) or equivalent mechanisms. A list of sub-processors and applicable transfer mechanisms is available upon written request.
 
7. Retention
We retain personal data for as long as necessary to fulfil the purposes set out in Section 4. In particular:
Investment records and Investor Register entries: for the duration of the investment relationship and a minimum of ten (10) years thereafter, in accordance with Swiss financial record-keeping obligations (CO Art. 958f; GwG Art. 7);
AML/KYC documentation: ten (10) years from the end of the business relationship (GwG Art. 7);
Tax records: ten (10) years from the relevant tax year;
Correspondence and legal records: until final resolution of any dispute or regulatory matter plus five (5) years.
After expiry of the applicable retention period, personal data is securely deleted or anonymised.
 
8. Your Rights
Subject to applicable law and any overriding legal obligations, you have the following rights in respect of your personal data:
Access — to obtain confirmation of whether we process your data and a copy of it (Art. 15 GDPR / Art. 25 nDSG);
Rectification — to have inaccurate data corrected (Art. 16 GDPR / Art. 32 nDSG);
Erasure — to request deletion where processing is no longer necessary, subject to our legal retention obligations (Art. 17 GDPR);
Restriction — to request that we limit processing in certain circumstances (Art. 18 GDPR);
Portability — to receive your data in a structured, machine-readable format where processing is based on contract or consent (Art. 20 GDPR);
Objection — to object to processing based on legitimate interests (Art. 21 GDPR). We will cease processing unless we can demonstrate compelling legitimate grounds;
Withdrawal of consent — where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
To exercise any of these rights, please contact us at privacy@iisolutions.ch. We will respond within thirty (30) days. Where requests are complex or numerous, we may extend this period by a further sixty (60) days with prior notice.
 
9. Right to Lodge a Complaint
If you consider that our processing of your personal data infringes applicable data protection law, you have the right to lodge a complaint with the competent supervisory authority:
EU residents: the data protection authority (DPA) of your Member State of habitual residence or place of work, or the DPA of the place where the alleged infringement occurred;
Swiss residents and others: the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, Switzerland (www.edoeb.admin.ch).
We would, however, appreciate the opportunity to address your concerns before you approach a supervisory authority and invite you to contact us in the first instance.
 
10. Automated Decision-Making
We do not make decisions about you solely by automated means that produce legal or similarly significant effects, within the meaning of Art. 22 GDPR.
 
11. Changes to This Notice
We may update this notice from time to time to reflect changes in our processing activities or applicable law. The current version is always available upon written request to legal@iisolutions.ch and will be published at www.iisolutions.ch/privacy once that page is live. Material changes will be communicated to investors directly.