Privacy Policy

1. Controller

The controller responsible for processing your personal data on ASSET.CH is:

Alexander Baum, c/o RA Matutis
Rheinstrasse 71
CH-7012 Felsberg, Switzerland
E-mail: [email protected]

ASSET.CH is operated as a sole proprietorship under Swiss law. For questions about data protection and to exercise your rights, please contact us at this e-mail address.

2. EU representative

Our representative in the European Union under Art. 27 GDPR is:

Kanzlei Matutis
Berliner Strasse 57
D-14467 Potsdam, Germany
Phone: +49 331 813 284 70
E-mail: [email protected]
Website: matutis.de

Individuals in the EU may also contact this representative with questions about data protection.

3. Scope

This Privacy Policy applies to the website www.asset.ch in all language versions and to all functions we offer there: the directory, user accounts, firm profiles, verification of firms and private individuals, contact enquiries and messages, requests to several firms with offers, saved searches, bids, invoices and payments for top placement, and the help centre with its help assistant.

We process personal data in accordance with the Swiss Federal Act on Data Protection (FADP) and, where applicable, the EU General Data Protection Regulation (GDPR).

The websites of listed firms are not covered. If you follow a link to such a website, its own privacy policy applies.

4. Data we process

Visiting the website: The web server stores technical information such as your IP address, the date and time, the page accessed, your browser and operating system (server log files). We need this information to operate the website securely.

User account: Name, e-mail address, optional telephone number, preferred language, password (stored only as a hash) and the time and IP address of the last sign-in.

Sign-in and security: For two-factor sign-in we send codes by e-mail, or you use an authenticator app; we store the app’s key in encrypted form and recovery codes only as a hash. For each sign-in we store a sign-in event (time, IP address, approximate country, browser and a random device identifier) as well as the signed-in sessions. We use this to show you your devices and recent sign-ins, to warn you of a sign-in on a new device and to detect misuse. If you choose «Trust this browser», we store an entry with the name of the browser for this purpose.

Verification of firms: The firm’s UID, the role of the person registering and, if necessary, a power of attorney or other supporting document. The applicant also uploads photos of their official ID (front and back) and a selfie holding the ID. We query the public UID register.

Verification of private individuals: Anyone who wishes to contact firms or submit requests confirms their e-mail address and proves their identity with photos of an official ID (front and back) and a selfie with the ID; the ASSET.CH team checks these details. Where an SMS service is set up, the person also confirms their mobile number with a code sent by text message (SMS).

Uploaded documents and ID images: They are stored encrypted, opened only by the administration for review and deleted after the decision. On upload we read out technical characteristics of the file (e.g. editing software, labelling as AI-generated) and keep only these characteristics. For the review, the administration may use AI assistance (section 8); the check digits, name, expiry date and ID number are cross-checked in the process. We store the ID number only as an irreversible keyed hash, in order to detect multiple accounts using the same ID.

Saved firms and saved searches: Firms you save, and saved searches with your choice of e-mail alerts (daily or weekly).

Firm profiles: The information a firm enters, such as firm name, category, location, description, regulatory details, logo and contact details. Uploaded logos are re-encoded.

Team members: The accounts and invitations of team members whom the owner of a firm invites using their business e-mail address.

Contact enquiries and messages: Name, e-mail address, optional telephone number, preferred contact method, voluntary details on the approximate size of your assets, your residence, your status as a US person and your investor status, and the content of your messages. Clients with an account can save these details as an investor profile; they are then added to their enquiries.

Support, attachments, reporting and blocking: Questions sent through the contact form or «Contact support» are stored as a conversation with the ASSET.CH team (name, e-mail address, subject, messages, IP address). Without an account you receive a personal link by e-mail for this. Attachments to messages (PDF, JPG, PNG) are stored encrypted outside the public area of the website; only the participants can retrieve them, and they are not part of the database backups. The administration does not read conversations between you and a firm; it only sees who wrote to whom and when. If you report a conversation (e.g. because of spam or suspected fraud), the administration may read that conversation to review the report; every access is logged. If you block a conversation, we store who blocked it. E-mails about new messages contain only a link, not the content (except for replies to persons without an account).

Requests to several firms and offers: The title, description and key details of your request (e.g. category, canton, approximate size of assets) and the firms’ offers.

Reports and block list: Reports about firm profiles (reason, text, optional e-mail address) and blocked e-mail addresses, domains and IP addresses.

Risk assessment: To protect against fraud and multiple accounts, we automatically derive indicators on accounts and firm profiles from the information listed above, for example sign-ins via anonymisation services, shared devices, disposable addresses, copied profile texts or wording typical of investment fraud. For this purpose we query public information (reverse DNS of an IP address, age of a domain).

Top placement, invoices and payments: Bids by firms for top places (amount, place by category, canton and month, result of the auction) as well as firm name, reference, invoice amount and payment status. For online payments we receive only the payment status from Stripe, no card details.

Invitations to firms: If we invite a firm to the directory, we store the firm name and the name and business e-mail address of the contact person. These details come from public registers (such as the commercial register or the FINMA register) or from the firm’s website; the invitation states the source. We send one invitation and at most one reminder. If the firm replies “Unsubscribe”, we delete the invitation and keep only a checksum of the address (or, on request, the firm’s domain) so that no further invitation is sent.

Statistics for firms: Profile views, clicks to the firm’s website and enquiries. We count them without personal reference and at most once per visitor and day.

Help assistant: Your questions and the assistant’s answers, only for the duration of your session.

Security and audit log: Records of security-relevant events on the platform, secured against subsequent alteration by a hash chain. Browsers may also send us technical reports about blocked scripts (page and blocked address, without personal reference).

Backups: Our data is backed up in encrypted form; an encrypted copy may be held off-site with a storage provider.

Providing data is voluntary. Without the necessary information, however, we cannot process an account, a profile, a verification or an enquiry.

5. Purposes

We process personal data for the following purposes:

operating the directory and displaying firm profiles
verifying firms (register entry, authority to represent, domain) and checking regulatory details
verifying private individuals so that firms receive genuine enquiries
monitoring changes to the name, website, e-mail address or telephone number of listed firms
managing user accounts and team access, including two-factor sign-in, session management and warnings about new devices
forwarding your enquiry to the firm you have chosen, delivering requests to matching firms and exchanging messages and offers
sending e-mail alerts for saved searches, if you set them up
handling bids, invoices and payments for top placement
providing firms with statistics on their own profile
translating profile texts and messages, providing text suggestions for firms and reply suggestions in the messaging system, and answering questions about using the platform
inviting firms to the directory
protecting the platform and its users against attacks, fraud, identity misuse and multiple accounts
complying with legal obligations, in particular the retention of accounting records

6. Legal bases

Under the FADP we process personal data lawfully, in good faith, proportionately, for recognisable purposes and for no longer than necessary (Art. 6 FADP). Where a justification is required, we rely on the performance of a contract, your consent, an overriding interest or the law (Art. 31 FADP).

Where the GDPR applies, the following legal bases under Art. 6(1) GDPR apply:

Contract (point b): user account, sign-in, firm profile, team access, verification, enquiries, offers and messages, saved searches, bids and payments for top placement, and help assistant.
Legal obligation (point c): retention of accounting records.
Legitimate interest (point f): secure operation, sign-in events, protection against fraud and misuse including the risk assessment, review of profiles, statistics without personal reference and invitations to firms.
Consent (point a): voluntary information, such as the approximate size of your assets. You may withdraw your consent at any time with effect for the future.

No automated individual decisions: The risk assessment and the AI assistance provide indicators only. Whether a profile is approved, a verification is confirmed or an account is blocked is always decided by a human.

7. Profiles and enquiries

Firm profiles: Profiles are public and visible to all visitors of the website. ASSET.CH reviews every profile before it goes live. The firm’s phone number and e-mail address are only shown publicly if the firm allows this in its privacy settings. Each firm is responsible for the accuracy of its information.

Your enquiry: Your enquiry goes directly to the firm you have chosen. The firm receives your name, your e-mail address, your message and any further information you provide. If the firm has invited team members, they also have access to the firm account. From receipt, the firm is itself responsible for any further processing of your data.

Request to several firms: Matching verified firms see your request without your name or contact details and can send you an offer. Only when you reply to an offer does that one firm receive your name and your message. Firms can store a processing status and an internal note for a request they received; the note is encrypted and deleted together with the request.

Enquiry with a client account: You contact firms with a free, verified client account (section 4). Your messages remain stored in your account. The firm replies via the message system. If a message contains typical signs of investment fraud, we show you a warning.

Enquiry without an account: Where ASSET.CH allows enquiries without an account, you confirm your enquiry as a guest via a link we send you by e-mail, which is valid for 48 hours. Without confirmation the enquiry is deleted after 3 days. You receive the firm’s replies by e-mail.

Statistics: Firms see only figures on profile views, website clicks and enquiries. These figures contain no information about individual visitors.

8. Recipients

The following recipients receive personal data to the extent necessary for their task:

The firm you contact: your enquiry and contact details, as described in section 7.
Hosting: Novatrend Services GmbH, Switzerland. The servers are located in Switzerland. We send our e-mails via this provider’s mail server.
Cloudflare: Cloudflare, Inc., USA, protects the website against attacks, ensures fast delivery, provides the approximate country of an IP address and, where necessary, uses Cloudflare Turnstile to check forms for automated access.
Stripe: Stripe Payments Europe Ltd., Ireland, processes online payments (card, Apple Pay, Google Pay, TWINT). You enter your card details directly with Stripe. Stripe processes this data under its own privacy policy.
SMS service: For the code confirming your mobile number, the SMS service we use receives your mobile number and the text of the message (depending on the configuration, ASPSMS, Switzerland, or Twilio Inc., USA).
Anthropic: Anthropic, PBC, USA, provides the AI functions where we enable them: translation of public profile texts, text suggestions for firm profiles based on the public profile information, suggestions for profile details from the text of a firm’s website (only when the firm starts this itself), the help assistant’s answers (your question and the conversation so far, no account data) and – only if the administration so decides – assistance in checking the authenticity of documents and IDs (front and back of the ID or the documents, without the selfie and without file metadata). Under its commercial terms, Anthropic does not use this data to train its models. In the messaging system the AI translates a message only when you click or when you have switched on automatic translation yourself, and suggests texts only at the push of a button (reply suggestion, rewording, translating a draft); for this it receives the message concerned or your draft and the course of the conversation. We store translations encrypted for as long as the message exists.
Public registers and services: the UID register of the Federal Statistical Office (the firm’s UID), RDAP registry services (domain name only) and the “Have I Been Pwned” service to check whether a new password is known from data breaches. Only the first 5 characters of a hash leave our server in the process, neither the password nor your e-mail address.
Backup storage: If set up, a copy of our backups is held off-site with a storage provider (e.g. Infomaniak Network SA, Switzerland). The files are encrypted beforehand; the provider cannot read them.

Novatrend, Cloudflare, the SMS service, Anthropic and the storage provider process data as processors on our behalf. We do not sell personal data.

9. Transfers abroad

Our website and our data are stored on servers in Switzerland. Data may be transferred abroad in the following cases:

Cloudflare: to the USA. The transfer is based on the Swiss-U.S. Data Privacy Framework or on standard contractual clauses.
Stripe: to Ireland and possibly to the USA. As a member of the EU, Ireland ensures an adequate level of data protection. For the USA, the Swiss-U.S. Data Privacy Framework or standard contractual clauses apply.
Anthropic and, depending on the configuration, the SMS service Twilio: to the USA, based on standard contractual clauses or the Swiss-U.S. Data Privacy Framework respectively.
Firms in Liechtenstein: If you contact a firm in Liechtenstein, your enquiry is sent there. As a member of the EEA, Liechtenstein ensures an adequate level of data protection.

10. Cookies and tracking

We use only technically necessary cookies:

Session cookie: set only when you sign in or use a form, and deleted when you close your browser, or after 12 hours at the latest.
Device identifier: a random number set when you sign in or register. It serves only to recognise known devices (warning about new devices, list of your sessions) and is valid for 1 year.
Trusted browser: only if you choose «Trust this browser»; valid for 30 days.

We do not use any advertising or analytics trackers.

11. Retention

We keep personal data only for as long as the purpose requires or the law prescribes:

User accounts, firm profiles, messages, enquiries and offers: until deleted by you or by us. You can delete your account yourself under «Settings». Firms can see a request to several firms for no more than 30 days.
Support conversations: 24 months after the last message, with an account until it is deleted if earlier. Attachments and translations are deleted together with the message. Reports on conversations: as long as the conversation exists.
ID images and documents: until the decision on the verification, after which the files are deleted. We keep the result of the check until the account is deleted.
SMS codes: no more than 1 day.
Unconfirmed enquiries without an account (where ASSET.CH allows them): 3 days; the confirmation link is valid for 48 hours.
Unconfirmed registrations: 14 days.
Invitations for team members: 14 days.
Invitations to firms: up to 30 days after the invitation link expires (90 days); opt-outs from invitations: as a checksum or domain for as long as we send invitations.
Sessions: up to 1 day after the last activity; trusted browsers: 30 days.
Sign-in events: 180 days.
Help assistant history: until the end of your session.
Risk assessment: until the account is deleted; cached public queries: no more than 31 days.
Security logs: 12 months; resolved reports: 24 months.
Statistics for firms: about 2 years.
Backups: the most recent backups on the server; an off-site copy for no more than about 3 months.
Accounting records: 10 years (statutory obligation).

12. Data security

We protect your data with appropriate technical measures, including:

encrypted transmission (TLS)
two-factor sign-in with a code sent by e-mail or an authenticator app, display of signed-in devices and warnings about new devices
passwords stored only as a hash, and rejection of passwords from known data breaches
personal data, messages and IP addresses stored encrypted in the database (AES-256)
documents and ID images stored encrypted and deleted after the decision
encrypted backups, optionally with an off-site copy
tamper-protected security log and integrity monitoring of our systems
rate limits and checks on uploaded files to protect against misuse
re-encoding of uploaded logos

13. Your rights

Within the scope of applicable law, you have the following rights:

Access to the data we process about you. You can download your data yourself as a file under «Settings».
Rectification of inaccurate data.
Erasure of your data, unless a statutory retention obligation applies.
Disclosure and portability of your data in a common electronic format.
Objection to certain processing.
Withdrawal of consent with effect for the future.

You can delete your account yourself under «Settings». You can stop e-mail alerts for saved searches via the unsubscribe link in every e-mail. For all other requests, please write to [email protected].

You may also lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC). Individuals in the EU may also contact the competent data protection supervisory authority in the EU.

14. Changes

We may amend this Privacy Policy, for example if our services or the legal situation change. The version published on this page at any given time applies.

Last updated: October 2026