Privacy Policy

This privacy notice and access policy (“Privacy Policy”) explains how we collect, share, use, and protect your personal information when you visit or use our website, app and/or services, as offered by SolideFinance SA through its platform (“Platform”), APIs, or third parties. This Policy does not apply to the practices of companies not owned or controlled by SolideFinance SA or to people whom SolideFinance SA does not manage or employ.

We are committed to protecting our customer’s personal information in compliance with applicable data protection laws, including the Swiss Federal Act on Data Protection (“FADP”) and the Regulation EU 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (“GDPR”).

As part of our day-to-day business, we need to collect personal information from our customers, potential customers, and their respective users, to ensure that we can meet their needs for a range of services and provide them with information about our services.

Your privacy is important to us and it is our policy to respect the confidentiality of information and the privacy of individuals. This notice outlines how we manage your personal information supplied to us by you or a third party in connection with our provision of services to you, or which we collect from your use of our services, Platform or website. It also details your rights in respect of our processing of your personal information, and sets out which measures are taken to protect your privacy when using our services or products, and your respective rights in connection therewith.

Our Privacy Policy will be reviewed from time to time to take account of changes to our services, operations and/or practices and to make sure it remains compliant with applicable law. Any personal information we hold will be governed by the terms of our most current Privacy Policy, as published on our website. We will not notify you of any changes to this policy.

Please note that if you are an employee, a contractor or a third party service provider of SolideFinance, your personal information will be used in connection with your employment contract, your contractual relationship with us or in accordance with our separate policies which are available by contacting us.

Any reference to ‘you’, ‘your’, ‘yours’ or ‘yourself’ in this Privacy Policy is a reference to any of our customers and potential customers as the context requires unless otherwise stated.

WHO ARE WE?

This Privacy Policy applies to the processing activities of SolideFinance SA a Swiss limited company with registered address at c/o EUREX GE SA, Rue de Genève 18, 1225 Chêne-Bourg, Switzerland, and registered under number CHE-140.601.494. SolideFinance SA is a processor of your personal information. Personal information can be defined as any information relating to an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as, but not limited to, a name, an identification number, location data, etc.

WHY DO WE COLLECT PERSONAL DATA?

We collect, use and disclose personal information to meet the needs of our customers and users to better our business purposes for their benefit, we may rely on contractual obligations, legal obligations, your consent or our legitimate interests to process your data. These may include:

• to provide the products and services you request;
• the day-to-day operation and maintenance of accounts and services;
• collection of any amounts outstanding from you;
• to tell you about services or other related products and services offered by us;
• to manage our Platform, APIs and other services;
• to understand the needs of our customers and users;
• to learn about our markets and design and improve our services and related products;
• to administer and process any request for information or job application;
• to comply with our regulatory and legal obligations, including but not limited to KYC/AML obligations, warrants, and court orders or to meet government tax reporting requirements;
• to manage customer and user accounts generally, including billing, customer correspondence and customer relationship management to send you marketing information, product recommendations and other non-transactional communications about us, our affiliates and partners where you have consented;
• to the extent you voluntarily consent to provide it to meet our broader community goals related to diversity and equality of opportunity;
• to investigate suspicious activities; and
• to contact you (including by way of e-mail), including, but not limited to:
  • in response to your inquiries and comments, and to safeguard your interests;
  • to investigate suspicious activities; and
  • to protect our rights and property.

We may transfer your personal information to public authorities where this is required by the applicable law. A transfer of your personal information is also permitted if there is a suspicion of a criminal offence or the abuse of the services offered on our Platform. In this event, we shall be entitled to transfer your personal information to the criminal prosecution authority.

We take reasonable steps to ensure that the personal information we process is limited to what we require in connection with the purposes set out in this Privacy Policy. We will retain copies in a form that permits identification for as long as we deem necessary in connection with the purposes set out in this Privacy Policy, unless applicable law requires a longer retention period. In particular, we will retain personal information for as long as it is needed to establish, exercise or defend any legal rights.

We use and disclose personal information only for the purposes that we disclose to you. We will request your consent before we use or disclose your personal information for any materially different purpose.

PURPOSE FOR WHICH WE PROCESS PERSONAL INFORMATION AND USAGE DATA AND ITS LEGAL BASIS

We collect and process your personal information for the following purposes, and rely on the following legal bases:

Purpose	Description	Legal basis
Providing our website, Platform, app and services	We process your personal information to operate and administer our website and services to provide you with the content you access and request	Our legitimate interest in providing online content to our customers and prospective customers regarding our service offering and related information
Improving our website, platform, APIs	We process your personal information to analyze overall trends and help us improve the user experience on our website, Platform, APIs	Our legitimate interest in providing a relevant and well-functioning website, Platform, APIs for the benefit of our visitors/users
Promoting the security of our website, Platform, APIs	We process your personal information by tracking use of our website and verifying and investigating activity	Our legitimate interest in promoting the safety and security of our website, Platform, APIs and in protecting our rights and the rights of others
Displaying personalized advertisements and content	We process your personal information to conduct market research, advertise to you, provide personalized information about us on and off our website and to provide other personalized content based upon your activities and interests	Our legitimate interest in advertising our products and services or, where necessary, to the extent you have provided your prior consent
Registering visitors	We process your personal information, including registration information and associated non-disclosure information, for security reasons	Our legitimate interest in protecting our offices, staff, visitors and our confidential information against unauthorized access
Managing event registrations and attendance	We process your personal information to plan and host events or webinars for which you have registered or that you attend, including sending related communications to you.	Performance of a contract or where we receive your explicit consent
Ensuring the safety and security of our employees, events and premises	We process your personal information where necessary based on a credible threat to our employees, events or premises	Our legitimate interest in protecting our employees, events and premises
Sending communications	We process your personal information to send you marketing information, product recommendations and other non-transactional communications (e.g., marketing newsletters, push notifications, information about our products, news or events) about us, our affiliates and partners	Our legitimate interest in conducting direct marketing or where you have provided your prior consent
Handling contact and user support requests	We process your personal information, if you fill out a “Contact Us” web form or if you contact us by other means such as sending us an email at: [email protected] or writing us at: c/o EUREX GE SA, Rue de Genève 18, 1225 Chêne-Bourg, Switzerland	Necessary for the performance of our contractual obligations or our legitimate interest in fulfilling your requests and communicating with you
Providing our services	We process your personal information to perform our contract with you for the provision of our services and to satisfy our obligations under the applicable terms and conditions	Necessary for the performance of our contractual obligations or our legitimate interest to provide and administer our services
Developing and optimizing the performance of the services	We process your personal information to develop, optimize, and improve the performance of the services	Legitimate interest to develop services and ensure that the services are performing in line with customer expectations; if special categories of personal information are processed, where the personal information is manifestly made public by the data subject
Providing personalized interactions	We process your personal information to customize our interactions with you	Legitimate interest to offer services to our customers and their users
Managing our customer and user accounts	We process your personal information (including usage data) to manage customer and user accounts generally, such as billing, customer correspondence and customer relationship management	Necessary for the performance of a contract or our legitimate interest in the management of customer and user accounts
Managing usage and licensing compliance	We process your personal information (including usage data) to assess and manage usage and licensing compliance with the applicable terms of use of our services	Necessary for the performance of our contractual obligations or our legitimate interest in managing the provision of our services to customers
Preparing internal reports and business modeling	We process your personal information (including usage data) for internal reporting and business modeling purposes (e.g., forecasting, revenue, capacity planning, product strategy)	Our legitimate interest in the management of our business operations
Maintaining our security	We process your personal information (including your usage data) for the purposes of maintaining our own security, including investigating, detecting and preventing suspicious activity, fraud and cybercrime that may affect SolideFinance or its services	Our legitimate interest in promoting our own safety and security generally and to protect our rights and the rights of others
Managing compensation for employees	We process your personal information (including your usage data) for the purposes of determining compensation for our own employees, such as commission	Necessary for the performance of our contractual obligations with an employee or our legitimate interest in fairly compensating our employees
Undertaking financial reporting	We process your personal information (including your personal information) for the purposes of financial reporting	Our legitimate interest in meeting our obligations associated with the reporting of our finances
Aggregating data	We process your personal information (including your usage data) for the purposes of aggregating this information to ensure that it is no longer identifying	Our legitimate interest in minimizing the amount of personal information processed as part of the noted processing activity
Managing, and participating in, webinars, contests, programs, training, certifications or promotions	We process your personal information if you register for a webinar, training, certification or a program. In some cases where the training or certification is through your employer, we will share your personal information with your employer.	Consent, necessary for the performance of our contractual obligations or our legitimate interest in providing the webinar, contest, promotion, training, certification or promotion
Managing payments	If you have provided financial information to us, we process your personal information to verify that information and to collect payments to the extent that doing so is necessary to complete a transaction and perform our contract with you	Necessary for the performance of our contractual obligations as per the applicable terms and conditions
Administering surveys and conducting research	We process your personal information (including, where legally permitted, special categories of personal information) in order to meet the goals set out in surveys or research as well as to analyze our compliance with internal policies	Consent or explicit consent (if required under applicable law) or our legitimate interest in conducting the survey or research based on its stated goals (where no special categories of personal information are in scope)
Collecting diversity information	We process your personal information (including special categories of personal information) to the extent you voluntarily consent to provide it to meet our broader community goals related to diversity and equality of opportunity	Consent or explicit consent (if required under applicable law)
Complying with legal obligations	We process your personal information (including usage data) when cooperating with public and government authorities, courts or regulators in accordance with our legal obligations under applicable laws to the extent this requires the processing or disclosure of personal information to protect our rights	Legal obligation, compliance with KYC/AML requirements, or our legitimate interest in protecting against misuse or abuse of our website or services, protecting personal property or safety, pursuing remedies available to us and limiting our damages, complying with judicial proceedings, court orders or legal processes, responding to lawful requests, or for auditing purposes

WHAT KIND OF PERSONAL INFORMATION DO WE COLLECT?

We may ask for other personal information voluntarily from time to time (for example, through market research, surveys or special offers). If you choose not to provide the information, we need to fulfil your request for a specific product or service, we may not be able to provide you with the requested product or service.

We may record any communications, electronic, by telephone, in person or otherwise, that we have with you in relation to the services we provide to you and our relationship with you. These recordings will be our sole property and will constitute evidence of the communications between us. Such telephone conversations may be recorded without the use of a warning tone or any other further notice.

We also collect aggregate and anonymised data that does not identify you specifically, including data collected automatically when you enter our website. This may include cookies, pixel tags, web beacons, browser analysis tools and web server logs. This also includes information from the devices you use to access our website or Platform, your operating system type or mobile device model, browser type, domain, and other system settings, as well as the language your system uses and the country and time zone of your device, among other information.

If you have any concerns regarding how we process your Personal Information, please contact us at [email protected].

WHO MAY WE DISCLOSE PERSONAL INFORMATION TO?

As part of using your personal information for the purposes set out above, we may disclose your information to:

• service providers and specialist advisers who have been contracted to provide us with administrative, IT, financial, regulatory, compliance, insurance, research or other services;
• introducing brokers with whom we have a mutual relationship;
• credit providers, courts, tribunals and applicable regulatory authorities as agreed or authorised by law or our agreement with you;
• credit reporting or reference agencies; or
• anyone authorised by you.

Generally, we require any contracted party that handles or obtains personal information to acknowledge the confidentiality of this information, undertake to respect any individual’s right to privacy and comply with the all relevant data protection laws and this Privacy Policy.

Third party service providers may keep a record of any searches performed on our behalf and may use the search details to assist other companies in performing their searches.

Please note that the use of your personal information by external third parties who act as data controllers of your personal information is not covered by this Privacy Policy and is not subject to our privacy standards and procedures.

KYC/AML VERIFICATIONS

In order to use our services, you will have to provide Personal Information to pass Know Your Customer (KYC) and Anti-Money Laundering (AML) verifications as required by law. SolideFinance may provide this data to third-parties acting as agents to process and verify all KYC/AML information provided.

HOW DO WE OBTAIN YOUR CONSENT?

Where our use of your personal information requires your consent, such consent will be provided using consent form or any other contract we may have entered into with you or as set out in our communication with you from time to time.

If we rely on your consent as our legal basis for processing your personal information, you have the right to withdraw that consent at any time by contacting us using the contact details set out in this Privacy Policy.

HOW DO WE PROTECT THE CONFIDENTIALITY AND SECURITY OF PERSONAL INFORMATION

We will provide an adequate level of protection for Personal Information and make sure that appropriate technical and organisational security measures are in place to protect the Professional Information against accidental or unlawful destruction, accidental loss or alteration, unauthorised disclosure or access, and against all other unlawful forms of processing. We track and maintain strict records for all of our data processing activities. We place your account information on the secure portion of our website, using security technology to protect our network and systems from external attacks. In addition, if you access information online, we use digital certificate services to authenticate that you are transacting with the Platform and not an impostor.

We always take appropriate technical and organisational measures to ensure that your information is secure. In particular, we train our employees who handle personal information to respect the confidentiality of customer and user information and the privacy of individuals. We regard breaches of your privacy very seriously and will impose appropriate measures, including dismissal where appropriate and necessary.

HOW DO WE STORE PERSONAL INFORMATION AND FOR HOW LONG?

Safeguarding the privacy of your personal information is important to us, whether you interact with us personally, by phone, by mail, over the internet or any other electronic medium. We hold personal information in secure computer storage facilities, cloud servers and paper-based files and other records and take steps to protect the personal information we hold from misuse, loss, unauthorised access, modification or disclosure.

Regarding the use of cloud servers, we currently use Amazon Web Services (AWS). AWS offers customers a number of compliance measures they can rely on to comply with Swiss and European data protection laws including the FADP. For example, customers are able to rely on the AWS Data Processing Addendum, which includes the European Standard Contractual Clauses (the “SCCs”) recognized by the Swiss Federal Data Protection and Information Commissioner (the “FDPIC”) . The AWS Data Processing Addendum is available to all AWS customers transferring data from the EU, Switzerland, or other regions to any of AWS’ infrastructure regions around the world, whether in the US or otherwise. The Data Processing Addendum gives customers the assurance that AWS applies stringent security, privacy and data protection safeguards aligned with the FADP and the GDPR requirements, including provisions for data transfer, data subject rights and breach notifications.

AWS customers have granular control over their data they store in the AWS cloud. AWS also enables a high level of security and maintains certification with robust security standards, such as ISO 27001, SOC 1/2/3and PCI DSS Level 1.

When we consider that personal information is no longer needed, we will remove any details that will identify you or we will securely destroy the records. However, we may need to maintain records for a significant period of time. For example, we are subject to certain anti-money laundering laws which require us to retain:

• a copy of the documents we used to comply with our customer due diligence obligations; and
• supporting evidence and records of transactions with you and your relationship with us,

for a period of ten years after our business relationship with you has ended.

If we hold any personal information in the form of a contract, we will retain this contract deed in its complete form for a period of 10 years after our business relationship with you has ended.

If we hold any personal information in the form of a recorded communication, by telephone, electronic, in person or otherwise, the retention period of this information will be compliant with local regulatory requirements which will either be 5 years or 10 years, subject always to statutory requirements, after our business relationship with you has ended.

Where you have opted out of receiving marketing communications we will hold your details on a separate designated list of persons so that we know you do not want to receive these communications.

TRANSFERS OUTSIDE OF SWITZERLAND

We may transfer your personal information outside of Switzerland to the processors who are engaged on our behalf (“Transferees”). The Transferees are located in the following countries: France. To the extent we transfer your information outside Switzerland, we will ensure that the transfer is lawful and that there are appropriate and adequate security arrangements to protect your Personal Information in accordance with applicable legal requirements. The Transferees are permitted to use the personal data only for the purposes which we have identified, and not for their own purposes, and they are not permitted to further share the data without our express permission.

In order to transfer personal information to third parties in territories that do not have a finding of adequacy by the applicable authority and regulations, we enter into agreements with the Transferees ensuring appropriate and suitable safeguards based on the SCCs. Where we make transfers to Transferees in the US, we only transfer personal data to entities certified under Swiss-US Data Privacy Framework between Switzerland and the USA. If transfers are made to US entities that are not certified under this framework, we ensure that appropriate safeguards such as SCCs and binding corporate rules as required by the FADP. If you would like a copy of such arrangements, please contact us using the contact details below.

HOW CAN YOU MODIFY AND/OR DELETE THE PERSONAL DATA WE HOLD ABOUT YOU?

To modify and/or delete the information that we hold about you, you can contact us at [email protected].

In accordance with the FADP, you have the right to:

• request access to your personal information (commonly known as a "data subject access request"). This enables you to receive a copy of the personal information we hold about you;
• request correction of the personal information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected;
• request the erasure of your personal information. This enables you to ask us to remove/delete personal information where there is no good reason for us continuing to process it;
• object to processing of your personal information where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your personal information for direct marketing purposes;
• request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it;
• withdraw your prior consent to processing of your personal information at any time;
• the right to object to a decision based solely on automated processing, including profiling.
• request the transfer of your data to another controller, provided the data processing is automated, is based on your consent or a contract with you, and does not require a disproportionate effort;

To exercise your rights, you can contact us at [email protected] or write us at the following address: c/o EUREX GE SA, Rue de Genève 18, 1225 Chêne-Bourg, Switzerland.

We will respond to your request without undue delay and at the latest within 1 calendar month upon receiving your email or the letter sent to our registered office address.

COOKIES

WHAT IS A COOKIE AND HOW DO WE USE COOKIES?

We may collect certain information through cookies or other automated means. A cookie is a small text file that will be stored in your device via your browser primarily to enhance the convenience of using the website or to enable certain functions. A cookie allows its sender to identify the device on which it is stored during the period of validity of consent which does not exceed 12 months.

Some cookies are essential in order to enable you to use our website, others are functional cookies or may be performance cookies or advertising cookies.

TECHNOLOGY IMPROVEMENTS

We are constantly striving to improve functionality on the Platform through technology changes. This may mean a change to the way in which personal information is collected or used. The impact of any technology changes which may affect your privacy will be notified in this Privacy Policy at the time of the change.

LINKS TO THIRD PARTY WEBSITES

Our website and the use of our services may have links to external third-party websites. Please note, however, that third party websites are not covered by this Privacy Policy and those sites are not subject to our privacy standards and procedures. Please check with each third party as to their privacy practices and procedures.

WHAT IF YOU HAVE A COMPLAINT?

If you have a concern about any aspect of our privacy practices, you can make a complaint. This will be acted upon promptly. To make a complaint, please contact us via one of the methods set below.

If you are not satisfied with our response to your complaint, you have the right to lodge a complaint with our supervisory authority, the Swiss Federal Data Protection and Information Commissioner (FDPIC).

HOW TO CONTACT US

If you have any questions about this Privacy Policy or want to exercise your rights, please contact us by:

• email at [email protected]; or
• writing at the following address: SolideFinance, c/o EUREX GE SA, Rue de Genève 18, 1225 Chêne-Bourg, Switzerland.

GOVERNING LAW

This policy and all our dealings with you are in all respects governed by and construed and interpreted in accordance with the laws of Switzerland, and the competent courts of Switzerland will have exclusive jurisdiction to settle any legal action or proceedings arising out of or in connection with this policy, including any non-contractual disputes and claims. Nothing in this term will prevent us from bringing proceedings against you in any other jurisdiction. No one other than a party to this policy, their successors and permitted assignees shall have any right to enforce any of its terms.