1. Scope
This privacy policy provides information on how and for what purposes companies belonging to the UMA Group process Your Personal Data (hereinafter “You”). The companies of the UMA Group to which this privacy policy applies, include UMA SWISS AG (CHE-383.539.031), UMA Wealth (Switzerland) AG (CHE-149.037.915), UMA Wealth (UK) Ltd. (Registration number: 11378402) and UMA Wealth Shared Support Services Ltd. (HE 433600) (hereinafter “we” or “UMA”).
This privacy policy does not apply to data processing by UMA Wealth (Luxembourg) Sàrl (hereinafter “UMA Lux”). If you correspond or do business with UMA Lux, please refer to the separate UMA Lux`s Data Protection notice at the following link: Data Protection Statement
“Personal Data” means all details and information relating to an identified or identifiable natural person.
We process Personal Data in accordance with the requirements of the Swiss Federal Data Protection Act (hereinafter “FDPA”) and, if and to the extent applicable, in accordance with the EU General Data Protection Regulation (hereinafter “GDPR”) and local data protection laws. Where we deem it appropriate, we may provide you with additional privacy policies.
Since UMA consists of different companies, the company which will be responsible for processing Your Personal Data may vary. The company of UMA with which you correspond or do business with or which has referred you to this privacy policy in the context of an enquiry, a contract or other correspondence is responsible for processing Your Personal Data under this privacy policy.
Depending on the data processing, the companies of UMA may each individually or jointly be the data controller or may also assume the role of data processor.
The contact person for any queries You may have regarding data protection is, irrespective of which UMA company is responsible for the processing of Your Personal Data in each individual case:
UMA SWISS AG
Talstrasse 82, 8001,
Zürich, Switzerland
Telephone: +41 44 500 33 50
E-Mail: compliance@umaswiss.com
Please contact us at the above address with any questions regarding data protection at UMA.
2. Data origin and data categories
We primarily process Personal Data that we receive or collect from our customers (including their employees, shareholders, directors, etc.), website visitors, service providers, banks and other business partners in the course of our business activities. In addition, we may also process Personal Data that we have obtained from publicly accessible sources (e.g. websites or public registers such as the commercial register, etc.). Finally, we may also have received Your Personal Data from family members of Yours, from business partners of ours, from official agencies and authorities or from other third parties.
The Personal Data we process includes, as the case may be, in particular name and contact details (e.g. address, telephone number and e-mail address), identification and background information (e.g. passport number, ID-number, language, date of birth, nationality, gender, religious denomination), political data, job title and business relationship, country of residence, geographic location, origin-
related data, family situation (e.g. marital status, number of children), data on criminal proceedings, financial information for payment purposes (e.g. bank account details), economic data (e.g. financial assets, origin of funds), investment related information (e.g. investment profile, risk profile, suitability test, asset allocation, investments), transaction data (e.g. payment instructions, investment instructions), information about the use of our website and information of any kind from correspondence, contacts and interactions (e.g. photographs, videos and voice recordings) with us.
2.1 Processing purpose and legal basis General in connection with our business activities
We process Your Personal Data primarily in order to provide our services in connection with our business activities. In particular, we process Your Personal Data for the following purposes:
- to communicate with You, in particular to provide You with information or to process Your requests. If You contact us by e-mail/contact form, You authorise us to reply to You via the same channel. Please note that unencrypted e-mails are transmitted via the open Internet, which is why it cannot be ruled out that they can be viewed, accessed and manipulated by third parties. Therefore, we ask You not to send us confidential information by e-mail. We exclude – as far as legally permissible – any liability which You may incur in particular as a result of faulty transmission, falsification of content or disruption of the network (interruptions, overloading, illegal interventions, blocking);
- to make our services and our website available to You and to evaluate and improve them;
- to be able to hold events and webinars and report them or make them available on our website;
- for the conclusion, administration and performance of our contractual or fiduciary relationships;
- to maintain and manage the business relationship with You (incl. issuing invoices);
- to inform You of recent updates or to provide You with other information about our services;
- for statistical purposes;
- for IT and building security measures (such as access controls, visitor lists, network and mail scanners, telephone recordings) and risk control reasons;
- for the assertion of legal claims and defence in connection with legal disputes as well as proceedings before the authorities;
- to comply with our legal obligations nationally and internationally.
We process Your Personal Data for the purposes specified above, depending on the situation, in particular on the following legal bases:
- the processing of Personal Data is necessary for the performance of an agreement with or other obligations owed to You;
- You have given Your consent to the processing of the Personal Data relating to You;
- the processing of Personal Data is necessary for the fulfilment of a legal obligation;
- the processing is necessary to protect the vital interests of the data subject or another natural person; or
- we have a legitimate interest in processing the Personal Data.
2.2 When visiting our website
Each time a user accesses our website, our server collects a set of user information which is stored in the server’s log files. The information collected includes, but is not limited to, the IP address, the date and time of access, the time zone difference relative to GMT, the name and URL of the downloaded file, the website from which the access takes place, the browser used and the operating system used.
The use of this general information does not involve identification of a specific person. The collection of this information or data is technically necessary in order to display our website to You and to guarantee its stability and security. The legal basis for the temporary storage of the information and log files is our legitimate interest in being able to offer You our website with maximum security and in sufficient quality.
2.3 Contact form and contact by e-mail and telephone
You can contact us by using the contact form or the e-mail addresses and telephone numbers provided on our website. The Personal Data You send us will be stored and processed by us for the purpose of processing Your request. The legal basis for this Personal Data processing is Your consent and our legitimate interest in processing your request.
2.4 Cookies
Our website uses so-called cookies or beacons. Cookies are text files that are stored in or by the internet browser on the computer system or a mobile device of the user. The cookie contains a characteristic string that allows the browser or mobile device to be identified unambiguously when the website or app is visited again.
The purpose of the use of cookies is, on the one hand, to enable and simplify the use of our website for users. Some functions of the website cannot be offered without the use of cookies (so-called technically necessary cookies). On the other hand, we also use cookies to analyse user behaviour on our websites, namely for range measurement and marketing purposes.
2.4.1 Technically necessary cookies
Technically necessary cookies are necessary for the functioning of our website. Therefore, these cookies cannot be deactivated in our systems. These cookies usually record important actions, such as the number of requests made, the editing of Your privacy settings or when You fill out forms. Although You can block these cookies in Your browser, some parts of our website may no longer function then.
The legal basis for the data processing when using technically necessary cookies is our legitimate interest, which lies primarily in ensuring the functionality and improvement of our website.
2.4.2 Analytical and marketing cookies
Analytical cookies allow us to analyse visitor behaviour and traffic sources so that we can measure the performance of our website and improve the user experience. They help us to identify how popular which pages are and indicate how visitors move around our website. The information collected is aggregated and anonymous.
If we use cookies for analysis and marketing purposes, we obtain Your consent to do so. Therefore, the processing of data for analysis and marketing purposes is based on Your consent. If You give us Your consent, You may withdraw it at any time with effect for the future. However, this does not affect the lawfulness of the processing carried out on the basis of Your consent before Your withdrawal of consent. You can express Your withdrawal at any time by adjusting the cookie settings.
You can object to the use of cookies, for example, (i) by selecting the appropriate settings in Your browser or (ii) by using appropriate cookie blocker software (e.g. ghostery etc.).
2.5 YouTube-Videos
We can embed videos from the YouTube platform on our websites so that they can be played directly from our websites. The YouTube videos are all embedded in “extended data protection mode”, which means that no data about You as a user is transmitted to YouTube if You do not play the videos. Only when You play the videos will data about You be transmitted.
The legal basis for the processing of Your data is Your consent. Further information on the processing of Personal Data by Google in connection with the playing of YouTube videos can be found at https://policies.google.com/privacy?hl=en&gl=de.
2.6 Applications
You can submit Your application for a position with us by post or via the e-mail addresses provided on our website. Your application documents and all Personal Data thereby disclosed to us will be treated in the strictest confidence, will not be disclosed to any third party and will only be processed for the purpose of processing Your application for employment with us. Unless You have given consent which provides otherwise, Your application file will either be returned to You after the conclusion of the application process or will be deleted/destroyed, unless it is subject to a statutory retention requirement. The legal basis for the processing of Your data is Your consent, the performance of the contract with You and our legitimate interests.
3. Disclosure of Personal Data to recipients and abroad
3.1 Disclosure of Personal Data to recipients
In addition to the transfers of data to recipients expressly mentioned in this privacy policy, we may – to the extent permitted – disclose Personal Data to the following categories of recipients:
- Other companies belonging to UMA;
- Providers to whom we have outsourced certain services (e.g. IT and hosting providers, payment service providers, banks, insurance companies, risk management and compliance providers etc.);
- Issuers of the securities or products, collective investment vehicles and their agents;
- National or foreign transaction registers, central trade repositories;
- National and foreign brokers, stock exchanges;
- Service providers, subcontractors and other business partners;
- Tax advisors, auditors, lawyers and other external professional advisors of UMA;
- Counterparties;
- National and foreign authorities, agencies and courts.
3.2 Disclosure of Personal Data abroad
Your Personal Data may be processed within Switzerland, the European Union or the European Economic Area (hereinafter “EU/EEA”) but may also be processed in and transferred to a country outside of Switzerland, EU or EEA, primarily the UK and the US.
If we transfer data to a country without adequate legal data protection, we ensure an adequate level of protection as provided for by law by using appropriate contracts (namely on the basis of the so-called standard contractual clauses of the European Commission) or we rely on the legal exceptions of consent, the performance of a contract, the establishment, exercise or enforcement of legal claims, overriding public interests, published Personal Data or because it is necessary to protect the integrity of the data subjects. We would like to point out that data transmitted abroad is no longer protected by Swiss law and foreign laws as well as official orders may require the disclosure of this data to authorities and other third parties.
4. Duration of storage
We process and store Your Personal Data only for as long as is necessary in accordance with the relevant purpose of processing or if there is another legal basis for doing so (e.g. statutory retention periods). We retain Personal Data that we hold on the basis of a contractual relationship with You for at least the duration of that contractual relationship and the limitation periods for potential claims or based on contractual retention obligations. As soon as Your Personal Data are no longer required for the above-referenced purposes, they will be set inactive, deleted or anonymised as far as possible.
5. Your rights
Under the data protection law applicable to You and to the extent provided for, You have the right to information, rectification, erasure, the right to restrict data processing and otherwise to object to our data processing as well as to the handover of certain Personal Data for transfer to another location (so- called data portability). Please note, however, that we reserve the right to assert the statutory restrictions on our part, for example if we are obliged to retain or process certain data, if we have an overriding interest in this (to the extent we are entitled to rely on such interest) or if we need the data in order to assert claims. If this results in costs for You, we will inform You in advance.
If data processing is based on Your consent, after giving Your consent You may withdraw it at any time with future effect. However, this does not affect the lawfulness of the processing carried out on the basis of Your consent prior to Your withdrawal of consent.
The exercise of such rights generally requires that You clearly prove Your identity (e.g. by means of a copy of an identification document, where Your identity is otherwise unclear or cannot be verified). In order to assert Your rights,
You may contact us at the address specified in Section 2 of this privacy policy.
In addition, every data subject has the right to enforce his/her rights in court or to lodge a complaint with the competent data protection authority. The competent data protection authority may vary depending on Your place of residence or the place where the alleged infringement of the applicable data protection law takes place.
6. Data security
We take appropriate security measures in order to maintain the required security of your Personal Data and ensure its confidentiality, integrity and availability, and to protect it against unauthorized or unlawful processing, and to mitigate the risk of loss, accidental alteration, unauthorized disclosure or access. In particular, we use encryption for certain data and have implemented additional protective measures in order to ensure that the Personal Data is protected as comprehensively as possible.
7. Amendments to this Privacy Policy
We expressly reserve the right to amend this privacy policy at any time. If such amendments are made, we will immediately publish the amended privacy policy on our website. The privacy policy published on our website, as from time to time amended, shall apply.
January 2023