← Back
DEEN

Privacy Notice

Last updated: 07.05.2026| Version 1.0

1.Controller and Contact Details

The controller responsible for the processing of your personal data within the meaning of the nFADP and the GDPR is:

Monte Rosa Investments AG

Seestrasse 93, 6052 Hergiswil

info@monterosa-invest.com

www.monterosa-invest.com

Phone:+41 41 210 20 00

Email for privacy enquiries:info@monterosa-invest.com

Website:www.monterosa-invest.com

If you have any questions about data protection, wish to exercise your rights as a data subject, or have any other privacy-related concerns, please contact us by email or post at the address above.

Data Protection Officer (DPO):The Company has not formally appointed a Data Protection Officer, as this is not mandatory under the Swiss nFADP based on current assessment. For privacy-related enquiries, please contact us directly at the privacy email address above. Should a DPO appointment become required following a GDPR assessment, this notice will be updated accordingly.

2.Scope and Applicable Legal Bases

2.1Material Scope

This Privacy Notice applies to all processing of personal data carried out in connection with the operation of this website and the provision of our services. It is addressed to:

  • Visitors to this website (regardless of their country of residence)
  • Individuals who contact us by email or via the contact form
  • Business partners, clients and their representatives

2.2Applicable Data Protection Laws

Depending on the data subject's place of residence, the following data protection laws may apply:

  • Switzerland: Federal Act on Data Protection (nFADP) of 25 September 2020, in force since 1 September 2023, together with the Data Protection Ordinance (DPO)
  • EU/EEA: Regulation (EU) 2016/679 (GDPR) for individuals habitually resident in the EU
  • UK: UK General Data Protection Regulation (UK GDPR) for individuals habitually resident in the United Kingdom
  • USA: We respect applicable US state-level privacy laws (e.g. CCPA/CPRA for California residents) to the extent reasonably practicable

Where this Notice does not expressly differentiate, Swiss and EU bases apply cumulatively.

3.Principles of Data Processing

We process personal data in accordance with the following principles (Art. 6 nFADP / Art. 5 GDPR):

  • Lawfulness, fairness and transparency: We process data on a clear legal basis and communicate openly about our practices.
  • Purpose limitation: Data is collected for specified, explicit and legitimate purposes and not processed incompatibly with those purposes.
  • Data minimisation: We collect and process only data that is actually necessary for the respective purpose.
  • Accuracy: We take reasonable steps to ensure that data is accurate and kept up to date.
  • Storage limitation: Data is retained only as long as necessary for the processing purpose or to fulfil statutory retention obligations.
  • Integrity and confidentiality: We protect data through appropriate technical and organisational measures.

4.Categories of Personal Data Processed, Purposes and Legal Bases

4.1Access Data and Server Log Files (Hosting)

When you access our website, our hosting provider IONOS SE (Germany) automatically records the following data in server log files:

  • IP address of the requesting device (anonymised or deleted after 7 days)
  • Date, time and duration of access
  • URL, path and file name accessed
  • Referrer URL (previously visited page, if transmitted)
  • Browser type, version and language setting
  • Operating system and device type
  • HTTP status code (e.g. 200, 404) and data volume transferred

Purpose:To ensure the technical functioning of the website, maintain system security and stability, detect and defend against attacks, and for error diagnostics.

Legal basis CH:Art. 31(1) nFADP (overriding legitimate interest in secure operation).

Legal basis EU/UK:Art. 6(1)(f) GDPR / UK GDPR (legitimate interest).

Retention:7 days, then automatic deletion or anonymisation.

Recipient:IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany. Server location: Germany (EU). DPA in place.

4.2Contact Form and Email Communication

When you contact us via the contact form or by email, we process:

  • First name and surname (required)
  • Email address (required)
  • Telephone number (optional, if provided)
  • Company / organisation (optional, if provided)
  • Subject and content of your message
  • Date and time of submission
  • IP address and technical metadata of the sender (for spam protection)

Purpose:Processing and responding to your enquiry, initiating, performing and managing business relationships, and client support.

Legal basis CH:Art. 31(1) nFADP (performance of contract or pre-contractual measures; legitimate interest).

Legal basis EU/UK:Art. 6(1)(b) and (f) GDPR.

Retention:10 years where statutory retention obligations under CO Art. 958f apply. Enquiries unrelated to a business relationship are deleted within 2 years of receipt.

Note:Standard emails (SMTP) are transmitted without encryption. For confidential information, we recommend encrypted communication or postal correspondence.

4.3Cookies

Our website uses cookies and similar tracking technologies. Cookies are small text files stored on your device that enable your browser to be recognised on subsequent visits.

a) Strictly necessary cookies (technically required)

These cookies are essential for the technical operation of the website and cannot be disabled. No consent is required.

  • Session cookies (deleted when the browser is closed)
  • Security cookies (CSRF protection, login status)

b) Analytics cookies (Google Analytics 4)

With your consent (EU/UK) or subject to your right to object (CH), we use Google Analytics 4. Please see section 4.4 for details.

Cookie durations:Essential session cookies: until the end of the browser session. Persistent cookies (Google Analytics): up to 13 months.

Cookie consent:Upon your first visit, your cookie choices are presented via a consent banner. For EU/UK visitors, analytics cookies are only set after explicit consent. You may withdraw consent or adjust preferences at any time via the cookie settings menu or your browser settings.

4.4Google Analytics 4 (GA4)

We use Google Analytics 4 (GA4), a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

GA4 uses cookies and similar technologies to collect and transmit usage data. The following data is processed:

  • Pseudonymised client ID (randomly generated identifier, no direct personal reference)
  • IP address (anonymised on our instruction prior to storage — the last octet is deleted)
  • Device information: browser type and version, operating system, screen resolution
  • Geolocation at city/region level (based on the anonymised IP)
  • Pages visited and their sequence (navigation path)
  • Time spent on individual pages and on the website as a whole
  • Referrer URL and acquisition channel (e.g. organic search, direct, social media)
  • Events and conversions (e.g. clicks on specific elements, form completions)
  • Session and user counts

Purpose:Analysis of user behaviour to optimise our web presence and improve usability.

Legal basis CH:Art. 31(1) nFADP (legitimate interest) or consent via cookie banner.

Legal basis EU/UK:Art. 6(1)(a) GDPR / UK GDPR (consent). GA4 is only activated for EU/UK visitors after explicit consent.

Data transfer to the USA:On the basis of EU Standard Contractual Clauses (SCCs) pursuant to Art. 46 GDPR and the Swiss-US Data Privacy Framework (for Swiss data subjects).

Data processing agreement:We have concluded a DPA with Google pursuant to Art. 28 GDPR / Art. 9 nFADP.

Retention:Usage data is stored at GA4 level for a maximum of 14 months, then automatically deleted.

4.5Business Contact Persons (B2B)

In the course of our business activities, we process personal data of representatives of our business partners and clients, including:

  • First and last name and function / title
  • Business contact details (telephone, email, address)
  • Communication history and contractual documents
  • Information arising in the course of projects and mandates

Purpose:Initiation, performance and management of service contracts, client relationship management, accounting and invoicing.

Legal basis CH:Art. 31(1) nFADP (performance of contract; legitimate interest).

Legal basis EU/UK:Art. 6(1)(b) and (f) GDPR.

Retention:10 years from the end of the business relationship (CO Art. 958f).

5.Disclosure of Personal Data to Third Parties

We do not share your personal data with third parties as a matter of principle. Disclosure only takes place where:

  • There is a legal obligation (e.g. tax authorities, law enforcement),
  • Disclosure is necessary for the performance of a contract,
  • You have expressly consented to the disclosure,
  • There is an overriding legitimate interest of the Company and your interests do not outweigh those interests, or
  • We engage processors who handle data exclusively on our documented instructions under a binding DPA.
  • IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany — web hosting. Server location: Germany (EU). DPA in place.
  • Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland — Google Analytics 4. DPA in place. Data transfers to the USA on the basis of SCCs.

Disclosure to tax authorities, auditors, lawyers or advisers may be required to comply with legal obligations or to protect our legitimate interests.

Eine Weitergabe an Steuerbehörden, Wirtschaftsprüfer, Anwälte oder Berater kann im Rahmen gesetzlicher Pflichten oder zur Interessenwahrnehmung erforderlich sein.

6.International Data Transfers

Some of our service providers (notably Google) process data partly in third countries outside Switzerland, the EU and the EEA — in particular in the USA. Third countries may not offer a level of data protection comparable to Switzerland or the EU.

We ensure that transfers are made only on the basis of appropriate safeguards:

  • EU Standard Contractual Clauses (SCCs) pursuant to Commission Implementing Decision (EU) 2021/914 (Art. 46(2)(c) GDPR)
  • Swiss-US Data Privacy Framework (for transfers from Switzerland to the USA, where the recipient is certified)
  • Adequacy decision by the European Commission (where available for the recipient country)

Further information on the safeguards applicable to Google: https://privacy.google.com/businesses/processorterms/

7.Data Security

We implement comprehensive technical and organisational security measures (TOMs) to protect your personal data against accidental or intentional manipulation, loss, destruction and unauthorised access (Art. 8 nFADP / Art. 32 GDPR). Our security measures are continuously reviewed and updated.

  • Encryption of data transmission via SSL/TLS (HTTPS) across the entire website
  • Password protection and multi-factor authentication for access to systems containing personal data
  • Access restrictions based on the need-to-know principle
  • Regular data backups and recovery procedures
  • Physical security measures for servers and infrastructure (via hosting provider IONOS SE)
  • Training and awareness of staff on data protection matters
  • Data Processing Agreements (DPAs) with all external service providers having access to personal data
  • Regular review and updating of security measures

In the event of a personal data breach likely to result in a risk to the rights and freedoms of natural persons, we will notify the competent supervisory authority and — where required — the affected individuals within the timeframes prescribed by law (Art. 24 nFADP / Arts. 33, 34 GDPR).

Im Falle einer Datenschutzverletzung, die voraussichtlich zu einem Risiko für die Rechte und Freiheiten natürlicher Personen führt, werden wir die zuständige Aufsichtsbehörde und — soweit erforderlich — die betroffenen Personen im gesetzlich vorgeschriebenen Rahmen informieren (Art. 24 DSG / Art. 33, 34 DSGVO).

8.Data Retention and Deletion

We store personal data only as long as necessary for the processing purpose or as required by statutory retention obligations. After the retention period expires, data is routinely deleted or irreversibly anonymised.

  • Server log files and access data: 7 days, then deletion / anonymisation
  • Contact enquiries unrelated to a business relationship: 2 years from receipt
  • Business correspondence and contractual documents: 10 years from end of financial year (CO Art. 958f)
  • Accounting records and invoices: 10 years (CO Art. 958f)
  • Google Analytics 4 usage data: 14 months at GA4 level, then automatic deletion
  • Cookies: depending on type (session: until browser is closed; persistent: up to 13 months)

9.Your Rights as a Data Subject

You have the following rights regarding your personal data. Please direct requests in writing (by email or post) to the contact address under section 1. We will respond within 30 days (nFADP) or one month (GDPR).

9.1Right of Access

You have the right to request information at any time about whether and which personal data we process about you, for what purpose, from which sources and to whom it is disclosed (Art. 25 nFADP / Art. 15 GDPR). We will provide you with a copy of the personal data stored about you upon request.

9.2Right to Rectification

You have the right to request the correction of inaccurate or incomplete personal data (Art. 32 nFADP / Art. 16 GDPR). We will correct inaccurate data without undue delay.

9.3Right to Erasure

You may request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you withdraw consent, or where the processing is unlawful (Art. 32 nFADP / Art. 17 GDPR). The right to erasure does not apply where statutory retention obligations or the assertion of legal claims preclude deletion.

9.4Right to Restriction of Processing

Under certain circumstances you may request restriction of the processing of your data, e.g. where you contest the accuracy of the data or where the processing is unlawful but you oppose erasure (Art. 18 GDPR; corresponding nFADP provisions).

9.5Right to Data Portability

For individuals resident in the EU or UK: You have the right to receive your personal data in a structured, commonly used and machine-readable format and to transmit it to another controller (Art. 20 GDPR / UK GDPR).

9.6Right to Object

You have the right to object to the processing of your personal data where it is based on our legitimate interest (Art. 21 GDPR / Art. 32 nFADP). Objections to processing for direct marketing purposes will always be upheld.

9.7Right to Withdraw Consent

Where processing is based on your consent, you have the right to withdraw it at any time with effect for the future. The lawfulness of processing carried out prior to withdrawal remains unaffected.

10.Right to Lodge a Complaint

Without prejudice to any other legal remedy, you have the right to lodge a complaint with the competent data protection authority:

Switzerland:Federal Data Protection and Information Commissioner (FDPIC)

Feldeggweg 1, CH-3003 Bern | Tel.: +41 58 462 43 95

Email:contact@edoeb.admin.ch | Website: www.edoeb.admin.ch

EU:The national data protection authority of your country of residence. List of all national DPAs: https://edpb.europa.eu/about-edpb/about-edpb/members_en

United Kingdom:Information Commissioner's Office (ICO)

Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF | Website: www.ico.org.uk

We recommend contacting us directly in the first instance. We are committed to resolving any concerns promptly and straightforwardly.

11.Automated Decision-Making and Profiling

We do not make automated decisions — including profiling — that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR / Art. 19(c) nFADP). Usage data collected via Google Analytics is used exclusively for aggregated analytical purposes and does not result in any individualised automated decision.

12.Amendments to this Privacy Notice

We reserve the right to update this Privacy Notice at any time to reflect changes in legal requirements or data processing practices. The current version is accessible on our website at all times.

In the event of material changes affecting your rights or obligations, we will notify you in advance — where possible and legally required — by a prominent notice on our website or by email.