Privacy Policy - Onsa Advisor

Last updated: November 27^th, 2023

This privacy notice (the “Notice”) aims at informing you how ONSA ADVISORS SA, registered at Rue du Grand-Pont 12, 1003 Lausanne (the “Company”, “we”, “us”, “our”) Processes your Personal Data while browsing our website (https://onsa-advisors.ch/) (the “Website”) and/or by contacting us or requesting our services, and the rights to which you are entitled in accordance with the Swiss Federal Act on Data Protection (“FADP”) and, when applicable, the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (“GDPR”).

This Notice provides general information applicable in most situations and may be supplemented with more specific notices or regulations whenever applicable. This Notice aims to detail the procedures applicable to the Processing of your Personal Data used to provide and improve the Website and in our interactions with you. It explains which Personal Data we Collect and Process, how We use it, and for what purposes.

We recognize that Processing your Personal Data involves a high degree of trust on your part.

We take this mark of trust very seriously and prioritize providing you with the utmost privacy and security regarding your Personal Data.

We encourage you to review this Notice carefully and to contact us in case of any questions or remarks.

1. DEFINITIONS

Advised company(-ies)

means the start-up or scale-up company to which the Company provides its advisory Services. Advised companies are Clients of the Company.

Advisory (Services)

shall mean the Services provided by the Company to Advised companies, supporting them in the development and expansion of their operations.

Breach

means a breach of security leading to the accidental or unlawful destruction, loss or alteration of – or to the unauthorized Disclosure of, or access to – Personal Data transmitted, stored or otherwise Processed.

Client(s)

means a client, either a natural or legal person, to whom the Company provides Services.

Collect

means a systematic approach to gathering and measuring Personal Data from the Data Subject to achieve a given result. The term “Collection” shall be the nominative reference to the term Collect.

Consent

means the active, free, specific, informed, and unambiguous expression of will by which a Data Subject gives consent to the Processing of his/her Personal Data.

Controller

means a natural or legal person, which, alone or jointly with others, determines the purposes and means of the Processing of Personal Data.

For the purpose of this Notice, the Controller is the Company.

Cookies

are pieces of data that are placed automatically on your electronic device’s hard drive when you access the Website. The Cookies can be recalled by a web server in the domain that placed the Cookie.

The Cookies identify your browser to the server. Cookies also allow to store information on the server (for example language preferences, technical information, click or path information, etc.) to help make your experience of the Website better and to conduct Website analysis and Site performance review.

Cookies Policy

Data Subject(s)

shall mean all natural persons that may be concerned by the Collection or Processing of Personal Data, either directly or indirectly. The categories of Data Subjects are described in Articles 5 and 6 of the present Notice.

Device

means any devices (especially electronic devices) that can access the Website, such as a computer, a mobile phone or a digital tablet.

Disclosure

means making Personal Data accessible, for example, by permitting access to, transmitting, or disseminating it to any third party. The terms “Disclosed” and “Disclose” all refer to any of the above operations and is used generically in this Notice.

Family Office (Services)

shall mean the Services the Company provides to high-net-worth families, known as Private Clients. These Services include international wealth structuring, management of banking relationships, relocations services and administrative support.

Investment Prospect(s)

means a company, start-up, real-estate, art or project that the Company presents to its Clients as an investment opportunity, as part of its investment scouting Services.

Investment Scouting (Services)

shall mean the Services provided by the Company where it identifies investments opportunities to cater the needs of its Clients who are in search of alternative options beyond the conventional financial markets.

Personal Data

means any data which is deemed to be personal and consists of all the information relating to a person who is either identified or identifiable, including Sensitive Personal Data, as defined in the FADP and the GDPR.

Private Client(s)

means a Client of the Company, to whom Company provides family office Services and/or investment scouting Services, as described in Article 5 of the present Notice.

Processing

means any operation relating to Personal Data – regardless of the means and processes used – including the Collection, retention, use, modification, backup, Disclosure, archiving, storage, or destruction of Personal Data. The terms “Process“, “Processed” and “Processing” all refer to any of the above operations and is used generically in this Notice.

Processor

means a natural or legal person, which Processes Personal Data on behalf of the Controller.

Prospective Clients

means a potential Client of the Company, as described in Article 5 of the present Notice.

Sensitive Personal Data

shall refer to the definition at article 5 let. c FADP, specifically (1) data on religious, philosophical, political or trade-union opinions or activities; (2) data concerning health, intimacy or racial or ethnic origin; (3) genetic data; (4) biometric data uniquely identifying a natural person; (5) data relating to criminal or administrative proceedings or sanctions; and (6) data on social welfare measures.

Services

means the services provided by the Company, which are the Family Office, the Investment Scouting, and the Advisory. The Services provided are specific to each single Client.

Standard Contractual Clause

means the standard contractual clauses set out in the Annex of the Commission implementing decision (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council.

Usage Data

refers to data Collected automatically, either generated by using the Service or from the Service infrastructure (for example, the duration of a page visit).

Visitor

shall mean any natural person visiting the Website, without entering into contact with the Company.

Website

shall mean the website onsa-advisors.ch operated by the Company.

Y/you

refers to any individual accessing or using the Website and entering in contact with the Company, that may qualify as a Data Subject, as well as any other legal entity on behalf of which such individual is accessing or using the Website or contacting the Company, as applicable.

W/we

refers to the Company.

2. PERSONAL DATA PROCESSING PRINCIPLES

When Processing Personal Data, the Company is committed to the following general principles:

a. Loyalty and Legality

When Processing Personal Data, the individual rights of the Data Subjects will be protected by the Company. Personal Data will be Collected and Processed lawfully, fairly, in good faith and a manner proportionate to the purpose.

b. Restriction to a specific objective

Personal Data Processed by the Company must be adequate and relevant to the purpose for which they are Processed. This includes ensuring that the Personal Data Collected is not excessive in relation to the purpose for which it is Collected. Subsequent changes to the purpose of the Processing are only possible to a limited extent and must be justified.

c. Transparency

The Data Subject shall be informed of the manner in which their Personal Data is Processed by the Company. When Personal Data is Collected, the Data Subject must be informed:

of the existence of this Notice;

the identity of the Controller(s);

the purpose of the Collection and Processing of Personal Data;

how the Personal Data is Processed, where the Personal Data is Processed, and by whom the Personal Data is Processed; and

third Parties to whom Personal Data may be Disclosed.

d. Consent of the Data Subject

Personal Data must be Collected directly from the Data Subject concerned and the Consent of the Data Subject may be required before the Processing of Personal Data. The Consent must be obtained in writing or electronically for the purposes of documentation. The Consent is valid only if given voluntarily. If, for any reason, the Consent of the Data Subject is not given before the Processing of Personal Data, the Data Subject should be informed in writing as soon as possible after the beginning of the Processing.

Personal Data will only be Processed without Consent if it is necessary to assert a legitimate interest of the Company, for the execution of the contract between the Data Subject and the Company or if a national or international law or regulation requests, requires or permits it.

e. Accuracy

The Personal Data Processed must be correct and, if necessary, updated. Inaccurate or incomplete Personal Data should not be retained and should be deleted.

3. ACCEPTANCE

By using the Website, you acknowledge that you have read and understood this Notice and agree to be bound by it and to comply with all applicable laws and regulations.

Your Consent to the Processing of your Personal Data is given in accordance with this Notice.

4. CHANGES TO THE NOTICE

We may update and change this Notice from time to time to keep it up to date with legal requirements and the way We operate our business.

In the event of any modification, if applicable, you will be notified by e-mail or by notification (pop-up message) and your Consent with the changes in question will be required. If you do not agree with these changes, you may no longer access the Website and/or request the Company to delete your Personal Data and/or Sensitive Personal Data. In this case, We ensure the portability of your Personal Data.

5. TYPES OF DATA SUBJECTS

Data Subjects are all the natural persons that can be concerned by the Collection and Processing of their Personal Data by the Company, through the Website or the provision of its Services.

We can identify different categories of Data Subjects:

Visitors: Data Subjects that are simply browsing the Website without taking any action.

Prospective Clients: Data Subjects that are in contact with the Company but have not yet formally requested the Services of the Company.

Private Clients: Data Subjects that use the Family Office Services.

Investment Prospects’ employees or board members: Data Subjects that work for and/or sit on the board of a company that Company assesses as a potential investment opportunity in its Investment Scouting Services, and either interact with the Company to close deals and/or whose Personal Data are Collected and Processed as part of the due diligence process.

Advised companies’ employees or board members: Data Subjects that either interact with the Company, or whose Personal Data are Collected and Processed, as part the Advisory Services.

6. PERSONAL DATA COLLECTED

6.1 Per Data Subjects

6.1.1 Visitors

When you are simply browsing the Website without taking any action, We Collect Cookies as described in our Cookies Policy available at onsa-advisors.ch/cookies-policy.

6.1.2 Prospective Clients

When you are filling in the contact form on the Website, the following Personal Data are Collected:

email address;

first and last name;

phone number (optional)

the content of your sent messages;

the history of your sent messages;

Depending on the information that you provide in the contact form of the Website, or if you reach out to us by any other means, the following Personal Data may also be Collected:

any other Personal Data that you share with us.

6.1.3 Private Clients

The Company will Collect Personal Data, based on the Services provided to the Clients. In general, the Private Clients of the Company are also clients of Bonnard Lawson International Law Firm, in which case, the data that are processed within the framework of a mandate entrusted to a lawyer are subject to the rules relating to professional secrecy.

The following Personal Data will be Collected to initiate the business relationship with the Private Client:

First and last name;
Nationality;
Email address;
Phone number (optional);
Address;
Family members’ identity details if applicable (first and last name(s), date(s) of birth, address(es));
Any Personal Data that may be shared by the Data Subject to explain the nature of mandate;
The content of all the correspondence between the Company and the Private Client;
If applicable, their financial objectives and risk tolerance.

For providing the Services, the Company may Collect a range of categories of Personal Data belonging to Private Client. For instance, it may Collect the Personal Data contained in the following documents:

Identity documents;
Origin and family certificates;
Domicile and residence documents;
Banking and financial statements documentation, including portfolio reports;
Health certificates and documentations;
Travel documents (visa(s));
Criminal records and/or extract from the register of prosecutions;
School and universities diplomas and certificates;
Work experience documentation (curriculum vitae, work certificates);
Bills;
Property deeds (real-estate and chattel);
Contracts passed by Private Client
Any other documentation sent by Private Client or its representative.

6.1.4 Investment Prospects

When providing its Investment Scouting Services, the Company may Process the following Personal Data belonging to an Investment Prospect’s employees or board members:

First and last name of the board members of Investment Prospect and their educational and professional background (CV, past work experiences);

First and last name of employees of Investment Prospect that interact with Company;

Email address of employees of Investment Prospect that interact with Company;

First and last name of employees of Investment Prospect that are shared with Company as part of the due diligence;

Any Personal Data that is shared with Company, during its relationship with Investment Prospect.

6.1.5 Advised companies’ employees or board members

When providing its Advisory Services, the Company may Collect the following Personal Data belonging to Advised companies’ employees or board members:

First and last name of the board members of Advised company;

First and last name of employees of Advised company that interact with Company;

Email address of employees of Advised company that interact with Company;

Any other Personal Data that is shared with Company or Collected by Company whilst providing its Advisory Services.

7. PURPOSE AND LEGAL BASIS FOR THE PROCESSING OF YOUR PERSONAL DATA

7.1 Consent

You hereby Consent that the Company may use your Personal Data for the following purposes:

a. providing a better user experience when browsing the Website (article 6.1.1);

b. providing maintenance of our Website, including monitoring of its usage (article 6.1.1);

c. communicating with you, managing, and responding to your request(s) to us as a Prospective Client (article 6.1.2);

d. understanding and assessing the Services required by you as a Client (article 6.1.3);

e. providing you with our Family Office Services (article 6.1.3);

f. evaluating and undertaking any due diligence process to assess whether your company will be considered as an Investment Prospect and recommended to our Clients as part of our Investment Scouting Services;

g. for other purposes, with your prior Consent.

You therefore expressly Consent that the Company Collects and Processes your Personal Data for the above-mentioned purposes.

You therefore expressly Consent that the Company may Collect and Process some of your Sensitive Personal Data that may be contained in the documents sent, or that you may share directly with the Company, for the above-mentioned purposes.

7.2 LEGITIMATE INTEREST

The Company Processes Personal Data based on legitimate interests.

1. Contract

The Company Processes Personal Data relating to its Clients, in direct connection with the conclusion or the performance of the contract between Company and its Clients, for the following purposes:

a. Concluding the contract with its Clients;

b. Providing its Family Office Services to Private Clients;

c. Providing its Investment Scouting Service to its Clients;

d. Providing its Advisory Services to Advised companies;

2. Legitimate interests to improve its services;

The Company will Process Personal Data relating to Data Subjects, based on the legitimate interests to improve its services, for the following purposes:

a. relationship management;

b. undertaking satisfaction surveys;

c. keeping track of the Clients supported;

d. improvement of its services and offering.

7.3 LEGAL REQUIREMENTS

The Company will Process Personal Data relating to Data Subjects, based on legal requirements, for the following purposes:

a. management of its accounting;

b. management of the requests of Data Subjects to exercise their rights, namely the rights of access, portability, edit, erasure, opposability, and limitation.

Furthermore, by browsing the Website, contacting us, and requesting the provision of our Services, you expressly understand and agree that the Company Collects and Processes your Personal Data for the above-mentioned purposes, since the Company has a legitimate interest to provide you with a functional, up to date and user-friendly Website, as well as to provide maintenance if required. You also acknowledge and consent to the Company’s Collection and Processing of your Personal Data during the conclusion and fulfillment of the agreement that you have entered with the Company to receive the Services provided by the Company. You also understand that the Company must be able to fulfill all its legal and regulatory obligations, as well as to detect fraud and investigating any complaints.

8. DATA DISCLOSURE

The Company may Disclose your Personal Data under some circumstances specified in this Article.

In any case, the Company shall ensure that an adequate protection is guaranteed for your Personal Data, especially by using a data sharing agreement (if needed).

In some specific cases, when the level of protection is not guaranteed, the Company shall obtain your prior Consent or establish with the recipient of your Personal Data a contractual framework or sufficient safeguards that ensure an adequate level of protection abroad, especially by using Standard Contractual Clauses. You may request access to a copy of these safeguards by contacting the Company. You shall be informed of any cross-border transfer in the event that it occurs.

a. The Company’s employees and partners

The Company’s employees and partners (in Switzerland) may Process your Personal Data to ensure a consistently high service standard and in line with the internal regulations of the Company.

The contracts of the employees and partners contain a confidentiality clause which includes the standard of protection detailed in this Notice.

b. The Company’s affiliates

The Company may share your Personal Data with its affiliates. In which case the Company will require those affiliates to respect this Notice. The Company may share your Personal Data with Bonnard Lawson International SA and/or the trust company, depending on the Services provided.

c. The Company’s Clients

When providing its Advisory Services, and helping Clients raising funds, and/or when providing its Investment Scouting Services, the Company may share some of the Personal Data collected to its Clients, who are investors seeking investment opportunities.

d. Third Parties service providers

The Company can act on behalf of Clients to negotiate and finalize agreements, such as for relocation needs (with schools, landlords, real estate agents and utility companies). Your Personal Data may be shared with these external parties by the Company.

e. Local public authorities

The Company may Disclose some of your Personal Data with local public authorities when it is required to, in order to support your application or situation with the local authorities. This is typically the case in the application process for a residency permit.

f. Public or regulatory authorities

If required from time to time, the Company may Disclose your Personal Data to public authorities, regulators or governmental bodies, including when required by law or regulation, under a code of practice or conduct, or when these authorities or bodies require the Company to do so.

Generally, the Company may Disclose your Personal Data in the good faith belief that such action is necessary to comply with a legal obligation, protect and defend the rights or property of the Company, prevent or investigate possible wrongdoing in connection with the Company’s activities, protect the personal safety of Company’s employees, partners, clients, affiliates and other Users of the Website, as well as protect against legal liability.

You therefore expressly Consent that the Company Discloses your Personal Data to the above-mentioned third parties.

9. RETENTION OF YOUR PERSONAL DATA

We will retain your Personal Data only for as long as it is necessary for the purposes set out in this Notice.

We will retain and use your Personal Data to the extent necessary to comply with our legal obligations (for example, if We are required to retain your Personal Data to comply with any applicable laws), resolve disputes, and enforce our legal agreements and policies.

We will also retain some Personal Data for internal analysis purposes.

10. GEOGRAPHICAL PROCESSING OF YOUR PERSONAL DATA

Your personal information, encompassing Personal Data, is Processed and maintained on servers located in Switzerland.

The Company will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this Privacy Notice, and no transfer of your Personal Data will take place to an organization or a country unless there are adequate controls in place, including the security of your data and other personal information.

11. DELETION OF YOUR PERSONAL DATA

You have the right to delete or request that We assist in deleting the Personal Data that We have Collected about you.

You may update, amend, or delete your information at any time by contacting us to request access to, correct, or delete any Personal Data that you have provided to us.

Please note, however, that We may need to retain certain information when We have a legal obligation or lawful basis to do so.

12. DATA SECURITY

The security of your Personal Data is our priority, and therefore We have put in place appropriate physical, electronic, and managerial procedures to safeguard and secure the information We Collect.

However, please remember that no method of transmission over the Internet, or method of electronic storage is 100% secure, and it depends on various factors including the security of your Device, and the security provided by your internet access service provider.

The Company applies industry standards and will always apply adequate technical and organizational measures, in accordance with applicable laws to ensure that your Personal Data is kept secure.

In the event of a Breach, the Company shall without undue delay, and where feasible, notify the Breach to the competent supervisory authority, unless said Breach is unlikely to result in a risk to your rights and freedoms. If the Breach is likely to result in a high risk to your rights and freedoms, the Company shall communicate this Breach to you, if it is feasible, and required by the supervisory authority.

13. CHILDREN AND PERSONAL DATA

The Company takes all possible steps to limit the Processing of Personal Data belonging to children. When it does, in the context of the Family Office Services for example, it will do so with the consent of their parents or legal representatives.

14. ACCESS TO PERSONAL DATA AND INFORMATION RIGHTS

You have the right to request access to or information about your Personal Data which are Processed by the Company. Where provided by applicable law, you, your successors, your representatives and/or your proxies may (i) request deletion, correction or revision of your Personal Data; (ii) oppose the Personal Data Processing; (iii) limit the use and Disclosure of your Personal Data; and (iv) revoke Consent to any of the Personal Data Processing activities, if the Company is relying on your Consent and does not have another legal basis or legitimate interest to continue Processing your Personal Data.

These rights can be exercised by contacting the Company in writing at the address provided in Article 19 of the present Notice attaching a copy of your ID. If the request is submitted by a person other than the Data Subject, without providing evidence that the request is legitimately made on behalf of such Data Subject, the request will be rejected.

The request is free of charge unless your request is unfounded or excessive (e.g. if you already have requested such requests multiple times in the last twelve months or if the request generates an extremely high workload). In such a case, the Company may charge you a reasonable request fee according to applicable laws. The Company may refuse, restrict or defer the provision of Personal Data where it has the right to do so, for example if fulfilling the request will adversely affect the rights and freedoms of others.

Please note that if you require the deletion, correction or revision of your Personal Data, it may prevent you from accessing the Website, as well as from beneficiating from the Company’s services.

15. PORTABILITY OF THE PERSONAL DATA

You also have the right to receive your Personal Data, which you have provided the Company with, in a structured, commonly used and machine-readable format and has the right to transmit those Personal Data to another data controller without hindrance from the Company.

These rights can be exercised by contacting the Company enclosing a copy of your ID to the address provided in Article 19 of the present Notice. If the request is submitted by a person other than the Data Subject, without providing evidence that the request is legitimately made on behalf of such Data Subject, the request will be rejected.

16. PRIVACY BY DESIGN AND BY DEFAULT

The Company will, both at the time of the determination of the means for Processing and at the time of the Processing itself, implement appropriate technical and organizational measures, such as pseudonymization, which are designed to implement data-protection principles, such as data minimization, in an effective manner and to integrate the necessary safeguards into the Processing in order to meet the requirements of the applicable laws and protect your rights.

The Company will implement appropriate technical and organizational measures, in order to ensure that by default, only Personal Data which are necessary for each specific purpose of the Processing are Processed.

This obligation applies to the amount of your Personal Data the Company Collects, the extent of their Processing, the period of storage and their accessibility. These measures will ensure that by default your Personal Data is not made accessible without your intervention to an indefinite number of third parties.

17. DATA CONTROLLER

The Company is the Controller of your Personal Data.

18. LINKS TO OTHER WEBSITES

The Website may contain links to other websites that are not operated by us. If you click on a third-party link, you will be directed to that third party’s website.

We strongly advise you to review the privacy policy/privacy notice of every website you visit and to get information about the third parties’ websites you decide to browse before browsing them. We have no control over and assume no responsibility for the content, privacy policies/privacy notices or practices of any third-party websites or services (whether the links are hypertext links or deep links).

Furthermore, you expressly acknowledge and agree that using the Website could imply downloading or using third party applications. Under no circumstances the Company shall be liable for the utilization of these other applications, especially regarding the Personal Data protection rules.

19. CONTACT

The Company will endeavor to answer any questions or concerns you may have in relation to the Processing of your Personal Data. You may contact the Company by mail to the address:

Rue du Grand-Pont 12, 1003 Lausanne

If you believe that your Personal Data has been unlawfully Processed or that the Company has failed to meet your expectations in this regard, you may complain to the appropriate authority. However, We encourage you to contact us first.

20. JURISDICTION AND GOVERNING LAW

This Notice and any questions/issues relating thereto shall be governed by the laws of Switzerland, to the exclusion of any rules of conflict resulting from private international law.

Any dispute relating to this Notice must exclusively be brought before the courts of Lausanne, Switzerland, subject to possible recourse to the Swiss Supreme Court (Tribunal fédéral).

PRIVACY NOTICE