Your privacy is very important to us, and we are committed to protecting your personal data.

We respect and protect your right to privacy and will process your personal data in accordance with the provisions of the Swiss Federal Act on Data Protection (FADP) and the European General Data Protection Regulation (GDPR) and other applicable privacy laws, in each case to the extent that the relevant regulations are applicable. Since the GDPR requires us to list these individually, those legal bases on which we base our processing, insofar as the GDPR applies, are listed below. In the case of processing of personal data according to the FADP, we rely in each case on the comparable legal bases in this law. The GDPR and any other applicable privacy laws apply to this Privacy Policy and anything not specifically mentioned in this notice shall be governed by the GDPR and any other applicable privacy laws.

This Privacy Policy explains how we may use, process and store your personal data.

What kind of personal data do we collect?

Personal data means any information relating to an identified or identifiable natural person.

Tsugu may collect information about your computer, including where available your IP address, date and time of your visit, operating system, browser type, the URLs of websites that referred you to the website and the path that you take through the website. This is statistical data about users’ browsing actions and patterns, and does not identify any individual.

Tsugu may also process the following types of personal data:

- name, address, email address, telephone number and other contact information
- date and place of birth
- nationality
- gender
- employment details
- marital status
- copies of identity documents (passport, national ID card, driver's license, employee identification numbers)
- source of wealth
- utility bill, bank statement
- tax residency and domicile
- details of structures, investments and other arrangements to which you and/or your family are connected
- personal data connected to businesses which we are being asked to review for investment purposes, or with which our clients have an investment relationship

Please note that the list is not exhaustive and that Tsugu may also collect and process personal data to extent this is useful or necessary for the provision of our services and the conduct of our business.

How does Tsugu collect personal data?

Tsugu obtains and processes personal data in different ways.

> Personal data provided to Tsugu directly

We collect personal data directly from (prospective) clients, partners (investment related or otherwise), intermediaries, advisers, consultants and employees for the purposes of entering into a contract or a service agreement, to further our legitimate business interests and/or to meet certain legal requirements.

> Personal data obtained from third parties

We also collect and process personal data from publicly accessible sources such as internet, social networks, risk assessment databases or commercial registers. Furthermore we may receive personal data from third parties as part of the service we provide to you (if any) or in connection with legal requirements that are applicable to us.

How does Tsugu use personal data?

The majority of the personal data processed by Tsugu is necessary for the performance of a contract to which the data subject is a party or to comply with the request of the data subject prior to entering into a contract. Tsugu also processes personal data in order to comply with our legal and regulatory obligations. We may furthermore process personal data for the purposes of the legitimate business interests pursued by Tsugu. Such legitimate interests include general research and development (including statistical research or as a basis to analyze our current security measures) or to carry out, develop and improve our services or to strengthen our relationship with you.

Tsugu may use and/or process personal information held about you for any reasonable purpose including but not limited to the following:

- to provide you with information on products and services that may be of interest to you
- complying with anti money laundering and counter-terrorist financing legislation
- discharging internal conflict of interest checks
- responding to any request that you make
- discharging services to the entities or arrangements (whether companies, partnerships, foundations or trusts) which Tsugu has been contracted to provide and to which you and/or your family are connected.

We may provide you with communications or information regarding our services which we think will be interesting for you. When we process your personal data for our legitimate business interests, we will consider and balance any potential impact on you and your rights under the relevant data protection and any other relevant law. Whenever we process personal data for these purposes you have the right to object to this way of processing.

The legal basis for the processing of personal data is Art. 6 | sentence 1 lit. a GDPR if the processing is based on consent, Art. 6 |  sentence 1 lit. b DSGVO if the basis of the processing is a contractual (or possibly pre-contractual) relationship and Art. 6 | sentence 1 lit. f GDPR. if the basis is our legitimate interest. If the processing of personal data is necessary for the fulfilment of a legal obligation to which we are subject, Art. 6 | sentence 1 lit. c GDPR serves as the legal basis.

If the legal basis is your consent, you are entitled to revoke your consent at any time without affecting the lawfulness of the processing of your personal data carried out based on the consent until revocation. If the legal basis is the legitimate interest, you are also generally entitled to object to the processing of personal data relating to you at any time for reasons arising from your particular situation. In this respect, Art. 21 GDPR applies.

To whom does Tsugu provide personal data?

Tsugu may disclose or transfer personal data collected by Tsugu for bona fide compliance purposes as well as on the legal basis as set out in this Privacy Policy.

Except as described in this paragraph, Tsugu will not disclose, transfer or sell your personal data to any third party unless you have consented to this.

Tsugu may disclose or transfer personal data to subcontractors for the purpose of the proper performance of the services we provide or for our legitimate business interests. It may, for example, disclose or transfer such personal data to third party service providers who provide administrative, computer, payment, data processing, debt collecting or other services. We enter into data processing agreements with such subcontractors to ensure that they process your data, on our behalf, with the same level of security and confidentiality as applied by Tsugu. Tsugu may furthermore disclose or transfer personal data when we received your consent to do so.

In addition Tsugu may disclose or transfer personal data to protect our rights or those of our clients and/or to prevent fraud. Tsugu can also be obliged to disclose or transfer personal data to competent authorities in order to comply with our legal and/or regulatory obligations.

International transfers and data storage

The personal data Tsugu processes is stored by Tsugu on our servers, and/or on the servers of the cloud-based database management services Tsugu engages. If disclosure or transfer of personal data is being done in a country that does not ensure an adequate level of protection of your personal data, Tsugu will make sure additional safeguards will be put in place.

Retention

Tsugu will process and store the relevant personal data for the duration of our services or for the duration of the business relationship. Tsugu may also store the data for as long as it is necessary or required in order to fulfill legal, contractual or statutory obligations and, or for the establishment, exercise or defence of legal claims, and in general where it has a legitimate interest for doing so.

Your rights

You have the following rights:

> Access to your information
You have the right to access the personal information that Tsugu holds about you at any time.

> Data portability
You may ask Tsugu to provide you with a copy of the personal information that Tsugu holds about you.

> Correction of your personal information
You have the right to ask Tsugu to update and correct any out-of-date or incorrect personal information that we would hold about you.

> Deletion of your personal information (the right to be forgotten)
You have the right to ask Tsugu to delete your personal information, to the extent that Tsugu has no legal and/or regulatory obligations to keep such personal information.

> Restriction of processing of your personal information
You have the right to ask Tsugu to restrict the processing of your personal information in case:
‍
i) You contested the accuracy of the personal information held by Tsugu
ii) The processing is unlawful but you objected to the deletion of the personal data and request the restriction of the use instead
iii) Tsugu no longer needs the personal data for the purposes of the processing, but you require them for legal reasons
iv) You objected to processing and Tsugu is investigating whether there are legitimate grounds to override your objection

> Automatic decision making
Tsugu generally does not make decisions by purely automatic means, but if we do, you have the right to object.

> Object
You have the right to object at any time to the processing of your personal data for any direct marketing (and related profiling) by Tsugu.

If you wish to exercise any of the above rights, you can contact Tsugu using the “Get in Touch” button on our website. In addition you have the right to make a complaint with the local supervisory authority with respect to the way Tsugu is processing your personal data or the way Tsugu is handling your rights. You acknowledge and agree that Tsugu may discharge its obligation without providing copies of all or any personal data.

How we protect personal data?

Tsugu is committed to ensuring the security of your personal data. Tsugu takes appropriate commercially reasonable technical, physical and organisational measures to prevent unauthorised or unlawful processing of your personal data or accidental loss or destruction of your personal data. Tsugu will ensure a level of security suitable to the identified risks and pursuant to applicable Data Protection Laws and, where the Processing concerns personal data of EU residents, shall take measures required pursuant to article 32 GDPR.

The Tsugu team are trained to handle personal data securely and with utmost respect and they will treat your personal data strictly confidential. The team shall be authorized to access personal data only to the extent necessary to serve the applicable legitimate purposes for which the data are processed by Tsugu and to perform their job.

Tsugu will not divulge client information to a third party unless we have received explicit client authorisation or we are required to do so by law.

Changes to this notice