Privacy Policy

Privacy Policy

(Last updated: May 31, 2025)

Data Controller

Bretton Woods digital AG
Neugasse 29
6300 Zug
Switzerland

Email: info@brettonwoods.ch

Data Protection Officer:
Dr. Sebastian Block LL.M.
datenschutz@brettonwoods.ch

Authorized Representatives:

• Norbert M. Schmidt (Chairman/Co-Founder)
• Prof. Dr. Martin Uzik (Board Member/Co-Founder)

Applicable Law

This privacy policy applies to the processing of personal data by Bretton Woods digital AG. Different data protection laws apply depending on your place of residence:

• For persons in the EU/EEA: EU General Data Protection Regulation (GDPR)
• For persons in Switzerland: Swiss Data Protection Act (nDPA)
• Competent EU supervisory authority: Data protection authority of your EU country of residence

1. General Principles

We take the protection of your personal data very seriously and treat your personal data confidentially and in accordance with statutory data protection regulations.

Personal data means any information relating to an identified or identifiable person. Processing includes any handling of personal data, in particular storage, disclosure, acquisition, deletion, retention, alteration, destruction and use.

In cooperation with our hosting providers, we strive to protect databases as much as possible from unauthorized access, loss, misuse or falsification.

2. Data Processing Overview

Processing Purpose	Legal Basis	Retention Period	Data Categories
Website Operation	Legitimate interests (Art. 6(1)(f) GDPR)	12 months	Server logs, IP address, browser data
Contact Inquiries	Legitimate interests (Art. 6(1)(f) GDPR)	3 years	Name, email, message content
Newsletter	Consent (Art. 6(1)(a) GDPR)	Until withdrawal	Email address, delivery statistics
Contract Processing	Contract performance (Art. 6(1)(b) GDPR)	10 years	Customer, contract, payment data
KYC Procedures	Legal obligation (Art. 6(1)(c) GDPR)	10 years	Identity documents, proof of address
Biometric Identification	Public interest + Consent (Art. 9(2)(g) + (a) GDPR)	30 days after verification	Facial recognition, liveness detection
Payment Processing	Contract performance (Art. 6(1)(b) GDPR)	Until contract termination	Payment data (processed externally)
Marketing/Advertising	Legitimate interests (Art. 6(1)(f) GDPR)	3 years	Usage behavior, preferences

3. Website Usage

3.1 Server Log Files

Each time you visit our website, we automatically collect the following data for statistical purposes and to ensure system security:

• Technical data: Browser type and version, operating system
• Access data: Referrer URL, pages accessed, date and time
• Network data: IP address (anonymized after 24 hours)

Purpose: Technical operation of website, security monitoring, error analysis
Legal basis: Legitimate interests (Art. 6(1)(f) GDPR)
Retention: 12 months, then deletion or anonymization
Disclosure: None, except to technical service providers (hosting providers)

3.2 Cookies and Tracking Technologies

Our website uses different types of cookies:

Technically Necessary Cookies (always active)

• Session management: Maintaining connection
• Security functions: Protection against cross-site request forgery
• Basic website functions: Language settings, shopping cart

Analytical Cookies (optional, consent required)

• Google Analytics 4: Website analysis with IP anonymization
• Usage statistics: Visitor numbers, popular content
• Retention: 14 months

Marketing Cookies (optional, consent required)

• Google Ads conversion tracking: Measuring advertising effectiveness
• Remarketing: Personalized advertising based on website visits
• Social media plugins: Integration of social networks

Your choices:

• Adjust cookie settings via our cookie banner
• Use browser settings for cookie management
• Google Analytics opt-out: https://tools.google.com/dlpage/gaoptout

3.3 SSL/TLS Encryption

This website uses SSL/TLS encryption to protect confidential data transmissions. You can recognize an encrypted connection by “https://” in the address bar and the lock symbol in the browser.

Data transmitted without encryption can be viewed by third parties. We assume no responsibility for data transmitted unencrypted.

4. Contact and Communication

4.1 Platform: Support Button

Processed data:

• Required information: Name, email address
• Optional information: Phone number, message content
• Automatically collected: IP address, timestamp

Purpose: Processing and responding to your inquiry
Legal basis: Legitimate interests (Art. 6(1)(f) GDPR)
Retention: 3 years after last contact or until deletion request
Disclosure: None, except for proper inquiry processing to internal departments

4.2 Email Communication

Privacy notice: Emails are transmitted unencrypted and can be viewed by third parties. For confidential information, please use alternative communication channels.

4.3 Newsletter

Processed data:

• Registration data: Email address, registration time, IP address
• Delivery statistics: Open rates, clicks, unsubscriptions

Registration procedure: Double opt-in (confirmation via email required)
Purpose: Sending product information, company news, marketing
Legal basis: Consent (Art. 6(1)(a) GDPR)
Retention: Until unsubscription

Service provider: Customer.io (Peaberry Software, Inc., USA)
Guarantees: EU Standard Contractual Clauses, technical security measures

Unsubscription possible at any time:

• Link in every newsletter email
• Email to: datenschutz@brettonwoods.ch

5. Business Operations and Services

5.1 Contract Processing and Customer Management

Processed data:

• Master data: Name, address, phone, email
• Contract data: Service description, terms, prices
• Payment data: Payment method, billing data (no card numbers)
• Communication data: Emails, calls, support tickets

Purpose:

• Contract fulfillment and service provision
• Invoicing and payment processing
• Customer service and support
• Legal documentation

Legal basis: Contract performance (Art. 6(1)(b) GDPR)
Retention: 10 years (commercial and tax retention obligations)
Deletion: After expiry of retention periods, provided no other legal obligations exist

5.2 Know-Your-Customer (KYC) and Compliance

Legal background: As a financial service provider, we are obligated to verify the identity of our customers and conduct certain compliance procedures.

Processed data:

• Identity documents: National ID, passport, driver’s license
• Proof of address: Utility bills, bank statements, official documents
• Beneficial ownership: Information about beneficial ownership
• Risk assessment: Country risk, PEP status, sanctions lists
• Biometric data: Facial recognition, liveness detection, document authenticity verification

Processing of Biometric Data (Art. 9 GDPR)

Special categories: Biometric data for identification are special categories of personal data and are subject to enhanced protection requirements.

Processed biometric data:

• Facial recognition: Comparison between ID photo and live selfie
• Liveness detection: Detection of live persons vs. photos/videos
• Document analysis: Biometric features for fraud detection
• Facial geometry: Temporary analysis for comparison purposes

Purpose of biometric processing:

• Identity verification and fraud protection
• Document authenticity verification
• Compliance with regulatory requirements
• Protection against identity theft

Legal basis for biometric data:

• Primary: Substantial public interest (Art. 9(2)(g) GDPR in conjunction with national anti-money laundering laws)
• Secondary: Explicit consent (Art. 9(2)(a) GDPR) – obtained during KYC process

Purpose:

• Anti-money laundering
• Counter-terrorism financing prevention
• Sanctions list screening
• Regulatory compliance

Legal basis (general): Legal obligation (Art. 6(1)(c) GDPR, Art. 7 AML Act)
Retention: 10 years after contract termination (legal obligation)
Service provider: Sum and Substance Ltd. (UK, GDPR-compliant)

Special security measures for biometric data:

• Encrypted transmission and storage with AES-256 standard
• Access restriction to authorized KYC personnel
• Short-term storage: Biometric templates are deleted after successful matching (max. 30 days)
• No permanent storage of biometric raw data
• Regular security audits of KYC provider
• Secure deletion after expiry of retention periods
• Data protection impact assessment conducted due to high risk

Your rights regarding biometric data:

• Explicit consent: Obtained before KYC process
• Right to withdraw: Consent can be withdrawn at any time (contract conclusion may then not be possible)
• Special access rights: Additional information about biometric processing
• Enhanced deletion rights: Priority treatment of deletion requests

5.3 Online Shop and E-Commerce

Processed data:

• Order data: Shopping cart content, order history
• Delivery data: Delivery address, shipping preferences
• Session data: Login status, temporary shopping cart contents

Cookies in online shop:

• Session cookies: Shopping cart management (technically necessary)
• Persistent cookies: Login status, language settings

User account (optional):

• Creation on voluntary basis
• Overview of orders and invoices
• Not public, not indexable by search engines
• Deletion upon request (except for legal retention obligations)

6. External Service Providers and Third Parties

6.1 Google Services

We use various Google services with specific privacy guarantees:

Google Analytics 4

• Purpose: Website analysis, user behavior, performance measurement
• Configuration: IP anonymization activated, enhanced privacy settings
• Data retention: 14 months
• Transfer basis: EU-US Data Privacy Framework (Google is certified)
• Opt-out: Google Analytics Browser Add-on

Google Ads and Conversion Tracking

• Purpose: Measure advertising effectiveness, conversion tracking
• Cookie duration: 30 days
• Personalization: No combination with other Google data without consent
• Objection: Google Ads settings or browser cookie settings

Google reCAPTCHA

• Purpose: Protection against spam and bots
• Processed data: IP address, browser information, mouse movements
• Privacy: IP address is shortened in EU/EEA

Other Google Services

• Google Fonts: Local hosting to avoid data transfers
• Google Maps: Only loaded upon explicit user activation
• YouTube: Enhanced privacy settings activated

6.2 Social Media Integration

Facebook/Meta

• Integration: Like button, pixel for conversion tracking
• Data transmission: Only upon active use of plugins
• Protection measure: Two-click solution implemented

LinkedIn

• Purpose: Business networking, B2B marketing
• Usage: Analytics, conversion tracking
• Privacy: Pseudonymized processing

Twitter/X

• Integration: Tweet button, content embedding
• Activation: Only after user activation

General protection measures:

• Two-click solution for social media buttons
• Prior information about data transmission
• Opt-out options in respective platform settings

6.3 Payment Service Providers

Used services:

• Stripe: Credit cards, SEPA, various local payment methods
• PayPal: PayPal account, Express Checkout
• Klarna: Buy now, pay later services
• Apple Pay / Google Pay: Mobile payments
• Others: Region-specific local providers

Data processing:

• No storage of payment data on our servers
• Tokenization: Secure tokens instead of card data
• PCI-DSS compliance: All payment providers are certified

Transmitted data:

• Transaction amount and details
• Buyer information (name, email, address)
• Order information

Legal basis: Contract performance (Art. 6(1)(b) GDPR)
Guarantees: EU Standard Contractual Clauses for US providers

7. International Data Transfers

7.1 Principles

Your data is generally processed within the EU/EEA. In certain cases, transfer to third countries is necessary:

7.2 USA Transfers

Affected services:

• Google services (Analytics, Ads, etc.)
• Customer.io (newsletter dispatch)
• Certain payment service providers
• Cloud services (partially)

Guarantees and protection measures:

EU-US Data Privacy Framework (DPF)

• For certified US companies (e.g., Google)
• Adequacy decision of the EU Commission from July 10, 2023
• Annual recertification required

EU Standard Contractual Clauses (SCCs)

• For non-DPF certified providers
• Version 2021/914 of the EU Commission
• Additional technical and organizational measures (TOMs)

Additional protection measures

• Encryption: End-to-end for data transmission
• Pseudonymization: Where technically possible
• Minimization: Only necessary data is transmitted
• Monitoring: Regular review of protection measures

7.3 Risk Assessment

General risks with USA transfers:

• US authorities may access data under certain circumstances
• Weaker data protection rights for non-US citizens
• Possible surveillance programs

Our assessment:

• Risk assessed as low with implemented protection measures
• Regular reassessment upon legal changes
• Alternative EU providers are reviewed and preferred when available

7.4 Your Rights Regarding Third Country Transfers

• Right to object: You can object to the transfer
• Right to information: Information about specific transfers
• Complaint: To the competent supervisory authority

8. Your Data Protection Rights

8.1 Right of Access (Art. 15 GDPR)

You have the right to information about:

• Which personal data we process about you
• Purpose and legal basis of processing
• Categories of processed data
• Recipients or categories of recipients
• Planned storage duration or criteria for determination
• Existence of other data subject rights
• Origin of data (if not obtained directly from you)
• Existence of automated decision-making

8.2 Right to Rectification (Art. 16 GDPR)

Right to correction of inaccurate or incomplete data without undue delay.

8.3 Right to Erasure (Art. 17 GDPR)

Right to deletion under the following conditions:

• Data no longer necessary for original purpose
• Withdrawal of consent without other legal basis
• Objection without overriding legitimate grounds
• Unlawful processing
• Deletion to fulfill legal obligations

Limitations: Retention obligations, freedom of expression, legal claims

8.4 Right to Restriction (Art. 18 GDPR)

Right to restriction of processing when:

• Contesting accuracy (during verification)
• Unlawful processing (instead of deletion)
• Need for legal enforcement (although we no longer need data)
• Objection (during balancing of interests)

8.5 Data Portability (Art. 20 GDPR)

Right to receive your data:

• In structured, commonly used, machine-readable format
• Direct transmission to another controller (technically possible)
• Only for processing based on consent or contract
• Only for automated processing

8.6 Right to Object (Art. 21 GDPR)

General right to object

• For legitimate interests: Objection for reasons of your particular situation
• Review: Whether overriding legitimate grounds for processing exist

Direct marketing

• Absolute right to object to processing for direct marketing
• Including profiling for advertising purposes
• Immediate cessation after objection

8.7 Withdrawal of Consent

• Possible at any time without giving reasons
• Effective for the future (previous processing remains lawful)
• Same procedure as granting consent

8.8 Right to Complain

Right to lodge complaint with supervisory authority:

• EU citizens: Supervisory authority of your habitual residence
• Swiss citizens: Federal Data Protection and Information Commissioner (FDPIC)
• Alternative: Supervisory authority at the place of alleged data protection violation

8.9 Exercising Your Rights

Contact:

• Email: datenschutz@brettonwoods.ch
• Mail: Bretton Woods digital AG, Attn: Data Protection Officer, Neugasse 29, 6300 Zug

Processing procedure:

• Identity verification: Proof required to prevent abuse
• Processing time: Generally 1 month, extension by 2 months for complex requests
• Free of charge: Generally free, except for unfounded or excessive requests
• Information obligation: We inform you about measures taken

9. Data Security

9.1 Technical Protection Measures

Encryption

• Transport: TLS 1.3 for all data transmissions
• Storage: AES-256 encryption for sensitive data
• Backups: Fully encrypted backup copies
• End devices: Disk encryption on all workstations

Network Security

• Firewalls: Multi-layer firewall systems
• Intrusion detection: Automatic attack detection
• VPN: Secure remote access via encrypted connections
• Segmentation: Network isolation of critical systems

System Security

• Updates: Automatic security updates
• Antivirus: Enterprise virus protection on all systems
• Monitoring: 24/7 system monitoring
• Patch management: Regular security patches

9.2 Organizational Protection Measures

Access Controls

• Principle of least privilege: Only necessary access
• Two-factor authentication: For all administrative access
• Regular reviews: Review of permissions
• Logging: Complete access logs

Personnel and Training

• Commitment: All employees committed to data confidentiality
• Training: Regular data protection and security training
• Background checks: Screening of new employees
• Awareness: Ongoing awareness programs

Processes and Procedures

• Incident response: Defined procedures for security incidents
• Business continuity: Emergency plans and recovery procedures
• Change management: Controlled changes to critical systems
• Documentation: Complete documentation of all security measures

9.3 Data Protection Impact Assessment

Procedure: For new processing with high risk, we conduct systematic data protection impact assessments.

Criteria for high risks:

• Automated decision-making with legal effect
• Systematic monitoring of public areas
• Processing special categories on a large scale
• Biometric data for identification

9.4 Data Breach Notification

Internal procedures:

• Immediate escalation to data protection officer
• Documentation and assessment of incident
• Implementation of immediate measures

External notifications:

• To supervisory authority: Within 72 hours if risk to data subjects
• To data subjects: Without undue delay if high risk
• Content: Nature of breach, affected categories, number of affected, consequences and measures

10. Automated Decision-Making and Profiling

10.1 General Position

No automated decision-making with legal effect: We do not make decisions based solely on automated processing that have legal effect or significantly affect you.

10.2 Marketing Automation

Scope: Newsletter and advertising

Processed data:

• Email open rates
• Click behavior in newsletters
• Website visiting behavior
• Interest profiles based on actions

Purpose:

• Content personalization
• Optimization of sending times
• Segmentation for relevant offers

Legal effects: None – only leads to personalized content without legal or significant consequences

10.3 Website Analytics

Google Analytics:

• Automated evaluation of user behavior
• Creation of audience segments
• No decisions with individual legal effect

10.4 Your Rights

• Right to object: Against any form of automated processing
• Human intervention: For all business-relevant decisions, you can request human review
• Information: About the logic of automated procedures
• Correction: Possibility to correct automatically created profiles

11. Special Situations

11.1 Minors

Principle: Our services are not specifically directed at persons under 18 years of age.

11.2 Biometric Recognition

High data protection risks: The processing of biometric data for identification poses special risks to the rights and freedoms of data subjects.

Special protection measures:

• Data protection impact assessment conducted for all biometric procedures
• Minimal storage duration: Biometric templates only 30 days
• No reuse: Biometric data is not used for other purposes
• Enhanced security standards: AES-256 encryption, strict access controls
• Regular review: Quarterly assessment of necessity

Your enhanced rights:

• Explicit consent required before any biometric processing
• Immediate withdrawal of consent possible at any time
• Priority information about biometric data processing
• Accelerated deletion upon request within 48 hours

12. Changes to this Privacy Policy

12.1 Reason for Changes

We reserve the right to change this privacy policy in case of:

• Changes in legal situation
• New or changed services
• Technical developments
• Changes in business processes

12.2 Notification Procedure

Significant changes:

• Email notification to registered users
• Prominent notice on website
• Possibility to object before taking effect

Minor changes:

• Update of date
• Notice on website

12.3 Archiving

• Previous versions are archived
• Access to previous versions upon request
• Documentation of change history

13. Contact and Support

13.1 Data Protection Officer

Dr. Sebastian Block LL.M.
Data Protection Officer
Bretton Woods digital AG

Contact:

• Email: datenschutz@brettonwoods.ch
• Postal address: Neugasse 29, 6300 Zug, Switzerland

13.2 Service and Support

General inquiries:

• Email: info@brettonwoods.ch
• Business hours: Monday to Friday, 9:00 AM – 5:00 PM (CET)
• Platform: Support button

13.3 Response Times and Service Levels

• Privacy inquiries: Response within 5 business days
• Data subject rights: Processing within one month
• Complaints: Priority processing within 3 business days

14. Final Provisions

14.1 Choice of Law and Jurisdiction

• Applicable law: Swiss law or EU GDPR depending on applicability
• Jurisdiction: Zug, Switzerland (for Swiss matters)
• EU disputes: Competent courts of the EU member state of the affected person

14.2 Severability Clause

Should individual provisions of this privacy policy be invalid, the validity of the remaining provisions remains unaffected.

14.3 Language Versions

This privacy policy is available in German and English. In case of contradictions, the German version shall prevail.

Version of this privacy policy: May 31, 2025

This privacy policy has been prepared with the utmost care. However, no guarantee can be given for completeness and timeliness. If you have any questions, please contact our data protection officer.