Privacy policy.

01 Controller and contact

Unless otherwise stated in a particular case, Aeberli Treuhand AG is the controller responsible for the processing of personal data.

Enquiries regarding data protection may be addressed to us by letter or email, enclosing a copy of your ID or passport for identification:

02 Collection and processing of personal data

We process personal data in particular in the following categories of processing:

• Client data of clients for whom we provide or have provided services
• Personal data received indirectly from our clients in the course of providing services
• When visiting our website
• When using our newsletter
• When taking part in an event we organise
• When we communicate with you or a visit takes place
• In other contractual relationships, e.g. as a supplier, service provider or advisor
• When applying for a position
• When we are required to do so for legal or regulatory reasons
• When exercising our due-diligence duties or other legitimate interests, e.g. to avoid conflicts of interest, prevent money laundering or other risks, ensure data accuracy, check creditworthiness, ensure security or enforce our rights

03 Categories of personal data

Which personal data we process depends on your relationship with us and on the purpose for which we process it. In addition to your contact details, we also process further information about you or about persons connected to you. This information may in certain circumstances also include particularly sensitive personal data.

We collect the following categories of personal data, depending on the purpose of processing:

• Contact information (e.g. surname, first name, address, telephone number, email)
• Client information (e.g. date of birth, nationality, marital status, occupation, title, job title, passport / ID number, AHV number)
• Risk assessment data (e.g. credit information, commercial register data)
• Financial information (e.g. bank details)
• Mandate data, depending on the engagement (e.g. tax information, articles of association, minutes, projects, contracts, employee data (e.g. salary, social security), accounting data, beneficial owners, ownership structures)
• Website data (e.g. IP address, device information, browser information, website usage — analysis and use of plugins, etc.)
• Application data (e.g. CV, work references)
• Marketing information (e.g. newsletter subscription)
• Security and network data (e.g. visitor logs, access controls, network and mail scanners, telephone call lists)

Where permitted, we also obtain certain data from publicly accessible sources (e.g. debt-collection register, land register, commercial register, press, internet) or receive it from our clients and their employees, from authorities, (arbitration) courts and other third parties.

In addition to the data you provide to us directly, the categories of personal data we receive about you from third parties in particular include:

• Information from public registers
• Information we obtain in connection with administrative and court proceedings
• Information relating to your professional roles and activities
• Information about you in correspondence and meetings with third parties
• Credit information
• Information about you provided by people around you (family, advisors, legal representatives, etc.)
• Information for compliance with legal requirements such as anti-money-laundering rules and export restrictions
• Information from banks, insurers, sales partners and other contractual partners in connection with the provision or receipt of services by you
• Information from media and internet sources about you
• Your addresses and, where applicable, interests and other socio-demographic data (for marketing)
• Data in connection with the use of the website (e.g. IP address, MAC address of the smartphone or computer, information on your device and settings, cookies, date and time of visit, pages and content accessed, features used, referring website, location information)

04 Purposes of processing and legal basis

4.1 Provision of services

We primarily process the personal data we receive in the context of our mandate relationships with our clients and other contractual relationships with business partners, from them and from other persons involved.

Our clients' personal data comprises in particular the following information:

• Contact information (e.g. surname, first name, address, telephone number, email, other contact information)
• Personal information (e.g. date of birth, nationality, marital status, occupation, title, job title, passport / ID number, AHV number, family circumstances, etc.)
• Risk assessment data (e.g. credit information, commercial register data, sanctions lists, specialised databases, data from the internet)
• Financial information (e.g. bank details, investments or shareholdings)
• Mandate data, depending on the engagement, e.g. tax information, articles of association, minutes, employee data (e.g. salary, social security), accounting data, etc.
• Particularly sensitive personal data: these personal data may also include particularly sensitive personal data, such as data on health, religious views or social welfare measures, in particular when we provide payroll or accounting services

We process this personal data for the described purposes on the following legal bases:

• Conclusion or performance of a contract with the data subject or for the benefit of the data subject, including contract initiation and any enforcement (e.g. advisory, fiduciary services)
• Fulfilment of a legal obligation (e.g. when acting as statutory auditor or when required to disclose information)
• Safeguarding legitimate interests (e.g. for administrative purposes, to improve our quality, to ensure security, for risk management, to enforce our rights, to defend against claims or to review potential conflicts of interest)
• Consent (e.g. to send you marketing information)

4.2 Indirect data processing in the course of providing services

When we provide services to our clients, we may also process personal data that we have not collected directly from the data subjects or personal data of third parties. These third parties are typically employees, contact persons, family members or persons who otherwise have a relationship with our clients or the data subjects. We need this personal data in order to perform contracts with our clients. We receive this personal data from our clients or from third parties instructed by our clients. Third parties whose information we process for this purpose are informed by our clients that we process their data. Our clients may refer to this privacy policy for that purpose.

4.3 Use of our website

You do not need to disclose any personal data in order to use our website. The server, however, records a range of user information with every access, which is temporarily stored in the server log files.

The use of this general information is not linked to a specific person. Collecting this information is technically necessary in order to display our website and to ensure its stability and security. This information is also collected in order to improve the website and analyse its use.

4.4 Use of the newsletter

If you subscribe to our newsletter, we use your email address and other contact details to send you the newsletter. You can subscribe to our newsletter with your consent. Your full name and email address are required in order to send the newsletter and are stored after your subscription. The legal basis for processing your data in connection with our newsletter is your consent to receive the newsletter. You can withdraw this consent and unsubscribe at any time.

4.5 Participation in events

If you attend an event organised by us, we collect personal data in order to organise and conduct the event and, where appropriate, to send you additional information afterwards.

4.6 Direct communication and visits

If you contact us (e.g. by telephone, email or chat) or we contact you, we process the personal data necessary for that purpose. For online meetings we use in particular the services "Zoom" or "Microsoft Teams". For support services we use TeamViewer.

4.7 Applications

You can submit your application for a position with us by post or by email to the address provided on our website. Application documents and all personal data disclosed to us in this context are treated strictly confidentially.

4.8 Suppliers, service providers and other contractual partners

When we enter into a contract with you for the provision of a service to us, we process personal data relating to you or your employees.

05 Tracking technologies

We use cookies on our website. Cookies are small files that your browser automatically creates and that are stored on your device (laptop, tablet, smartphone or similar) when you visit our site.

The cookie stores information that arises in connection with the specific device used. This does not mean, however, that we obtain direct knowledge of your identity. The use of cookies serves, on the one hand, to make your use of our offering more comfortable. For example, we use so-called session cookies to recognise that you have already visited individual pages of our website. These are deleted automatically after you leave our site.

In addition, we also use temporary cookies to optimise ease of use, which are stored on your device for a defined period.

The data processed via cookies is required for the purposes mentioned. Most browsers accept cookies automatically. You can configure your browser, however, so that no cookies are stored on your computer or so that a notice always appears before a new cookie is created. Disabling cookies entirely may mean that you cannot use all the functions of our website.

06 Website and newsletter analysis

To gain insights into the use of our website, to improve our online offering and to reach you with advertising on third-party websites or on social media, we use the following web-analysis tools and re-targeting technologies: Google Analytics, Google reCAPTCHA, Google Tag Manager and Mailchimp (newsletter).

These tools are provided by third parties. Typically the information collected about the use of a website for this purpose is transmitted via cookies or similar technologies to the third party's server. Depending on the third party, these servers may be located abroad.

Data is normally transmitted with truncated IP addresses, preventing the identification of individual devices. Any onward transmission of this information by third parties takes place only on the basis of statutory requirements or in the context of data processing on our behalf.

The full details on Google Analytics, Google Maps, other Google services, social-media plugins and Mailchimp newsletter tracking can be found in the German original.

07 Data disclosure and transfer

We only disclose your data to third parties where necessary in order to provide our services, where such third parties provide services for us, where we are legally or by authority obliged to do so, or where we have an overriding interest in the disclosure. We will also share personal data with third parties where you have given your consent or requested it.

The following categories of recipients may receive personal data from us:

• Branch offices
• Service providers (e.g. IT service providers, hosting providers, cloud-storage providers, AI service providers, suppliers, advisors, lawyers, insurers)
• Third parties in the context of our legal or contractual obligations, authorities, government agencies, courts

With service providers who process personal data on our behalf we conclude contracts obliging them to safeguard data protection. Our service providers are mostly located in Switzerland or in the EU / EEA. Certain personal data may also be transferred to the USA (e.g. Google Analytics data or AI input data) or, in exceptional cases, to other countries worldwide. Where a data transfer to countries without an adequate level of data protection is necessary, it takes place on the basis of the EU standard contractual clauses (e.g. in the case of Google) or other suitable instruments.

Where we receive unencrypted emails, we assume that we may also reply to that email unencrypted and that the sender consents to this.

08 Artificial intelligence (AI)

For the efficient handling of mandates, for quality assurance, error detection and the improvement of our processes and services, we use artificial intelligence (AI). AI may be used in the preparation and drafting of texts, in automated analysis within specialist applications (e.g. accounting, payroll, tax, audit) and in the preparation and quality assurance of reports.

Should, exceptionally, a decision be taken exclusively on an automated basis that has legal effects or significantly affects a data subject in a similar way, we will inform separately about this. In such cases there is a right to express one's position and to have the decision reviewed by a natural person.

09 Retention period of personal data

We process and store your personal data for as long as it is necessary to fulfil our contractual and statutory obligations or otherwise to serve the purposes pursued by the processing, i.e. for example for the duration of the entire business relationship (from initiation through performance to termination of a contract) and beyond that in accordance with statutory retention and documentation duties. It is possible that personal data will be retained for the period in which claims can be asserted against our company (i.e. in particular during the statutory limitation period) and where we are otherwise legally obliged or where legitimate business interests require it (e.g. for evidence and documentation purposes and on account of possible future audit proceedings).

Once your personal data is no longer needed for the above-mentioned purposes, it is, as a rule and where possible, deleted or anonymised. Shorter retention periods of twelve months or less generally apply to operational data (e.g. system logs).

10 Data security

We take appropriate technical and organisational security measures to protect your personal data against unauthorised access and misuse, such as issuing directives, providing training, applying IT and network-security solutions, access controls and restrictions, encrypting data carriers and transmissions, pseudonymisation and controls.

11 Obligation to provide personal data

In the context of our business relationship you must provide the personal data required to establish and perform a business relationship and to fulfil the associated contractual duties (as a rule, you are not legally obliged to provide data to us). Without this data we will not be able to conclude or perform a contract with you (or with the entity or person you represent). The website cannot be used either if certain information required to ensure data traffic (e.g. IP address) is not disclosed.

12 Your rights

In connection with our processing of personal data, you have the following rights:

• Right of access to the personal data stored with us about you, the purpose of processing, the origin and the recipients or categories of recipients to whom personal data is disclosed
• Right to rectification if your data is inaccurate or incomplete
• Right to restriction of processing of your personal data
• Right to request the erasure of the processed personal data
• Right to data portability
• Right to object to processing or to withdraw consent to the processing of personal data at any time without giving reasons
• Right to lodge a complaint with a competent supervisory authority, where legally provided for

To exercise these rights, please contact the address given in section 1.

Please note, however, that we reserve the right to invoke the restrictions provided for by law, for instance where we are required to retain or process certain data, have an overriding interest in doing so (to the extent we may rely on it) or need the data to assert claims. If costs arise for you, we will inform you in advance.

13 Amendments to this privacy policy

We expressly reserve the right to amend this privacy policy at any time.

Last updated: November 2025