1. Introduction
OLZ AG (hereinafter "OLZ", "we", "us"), with locations in Bern and Zurich, respects your privacy. We are committed to handling information and data collected or received about you at all times with the greatest care and sense of responsibility, in compliance with the applicable data protection laws and on the basis of this privacy policy. Our data protection practice is in particular consistent with the Swiss Federal Act on Data Protection (FADP) and, where applicable, the EU General Data Protection Regulation (GDPR). Below you will find information on how we process your personal data when you use our services, communicate with us, use our website, or otherwise interact with us. Across our various locations, we process your personal data within the scope of this privacy policy and therefore, in particular, for the same purposes.
2. Data Controller / EU Representative
2a. EU Representative
For cases under Article 3(2) of Regulation (EU) 2016/679 (General Data Protection Regulation; GDPR), the following has been designated as EU representative for controllers not established in the Union, pursuant to Article 27 GDPR: Dr. Klaus Philipp Seif Sausenheimer Str. 6 67271 Neuleiningen Germany You can also reach our EU representative here: info(at)olz.ch
2b. Data Controller
The controller responsible for the processing of personal data is: OLZ AG Marktgasse 24 CH-3011 Bern Tel.: +41 31 326 80 00 Email: info(at)olz.ch For any requests relating to the protection of your personal data, please contact our Data Protection Officer: Roger Scheidegger +41 31 326 80 24 roger.scheidegger(at)olz.ch
3. Personal Data / Data Sources
The terms used in this privacy policy are to be understood in line with their definitions under the EU General Data Protection Regulation (GDPR) and the Swiss Federal Act on Data Protection (FADP). Accordingly, the term "personal data" corresponds to the Swiss law term "personal data" ("Personendaten"), and the term "processing" corresponds to "processing" ("Bearbeiten"). "Personal data" means any information relating to an identified or identifiable natural person. This includes various categories of information you provide to us: for example, master and customer data such as name, address, date of birth, social security (AHV) number, telephone number, email address or IP address; customer history, such as powers of attorney, signature authorizations, declarations of consent; or, in particular, contractual data arising in connection with the conclusion or execution of a contract. Statistical or anonymized data that cannot be directly linked to you are not covered by this term. A "data subject" is a natural person whose personal data is processed; "processing" means any handling of personal data (collecting, storing, retaining, using, altering, disclosing, archiving, deleting, destroying), such as, for example, linking data to an identifier such as a name, an identification number or location data. We obtain this data either directly from you as the data subject, or from third parties who may be involved, such as authorities, banks, insurers or contracting parties. To the extent permitted, we also process data about you that we have collected ourselves, for example from public registers (commercial registries), databases, networks, media reports or websites. This may include, in particular, master data, data on administrative or criminal proceedings or sanctions, or data on ideological, religious or political views or activities (regarding the purpose of processing, see item 4 below). If you disclose data about other persons to us, we assume that you are authorized to do so, that such data is correct, and that you have ensured that those persons have been informed of such disclosure to the extent necessary and have consented to it.
4. Legal Bases and Purposes of Data Processing
We process your personal data primarily in connection with our contractual relationship with you and any third parties involved, and therefore primarily for the purposes of initiating, concluding, administering and executing contracts with you, for example in connection with asset management. In addition, we process your personal data and that of other persons, to the extent permissible and appropriate, in particular for the following purposes, in which we have a corresponding legitimate interest (Art. 6(1)(f) GDPR): - to ensure and improve our operations, in particular our IT systems and our website; - to prevent fraud; - for security purposes (IT, building and facility security, and the protection of our employees and other persons), i.e. for example for access controls; - for the purposes of our risk management within the scope of corporate governance; - to evaluate IP addresses and countries; this is, however, only carried out in the event of attacks on the website's network infrastructure and for statistical purposes. We further process your data on the basis of your consent (Art. 6(1)(a) GDPR), for example: - for marketing purposes, to maintain relationships, and to improve our services and operations (e.g. organizing events, newsletters, contact forms), in any case provided you have not objected to the use of your data. For information on data processing relating to the online domain, see item 8 below; - for communication with you and with the recipient categories referred to in item 7 below (e.g. for conducting online meetings). To the extent that we process your personal data on the basis of your consent, you may generally withdraw that consent at any time; this does not, however, affect data processing already carried out. Further processing of your personal data takes place on the basis of legal, regulatory or official obligations imposed on us (e.g. retention obligations; Art. 6(1)(c) GDPR). If you use, or intend to use, our asset management services as a prospect or client, we are legally or regulatory required, for the purposes of preventing money laundering and combating the financing of terrorism (Art. 6(1)(c) GDPR), to carry out independent due diligence on you. In this context, we may process your name(s), contact details, information on family circumstances, age, nationality, tax information, marital status, education, account connections, financial data (assets and liabilities, income and expenses), retirement provision data, experience with financial instruments, investment objectives, or correspondence instructions. In the context of portfolio management, we collect personal data such as name, contact details, information on relatives, date of birth, place of residence, nationality/nationalities, account and custody account connections, or securities holdings, in order to fulfil our contractual obligations (Art. 6(1)(b) GDPR).
5. Job Applications
We publish job advertisements from time to time (e.g. on our website, on relevant portals, etc.). You may submit your application to us either by mail or electronically. For such (digital) applications, as well as unsolicited applications, your applicant and application data is stored and processed (electronically) by us for the purpose of conducting the application process. If an employment contract is concluded following the application process, we store the data submitted with the application in your personnel file for the purposes of the usual organizational and administrative process, subject to further legal obligations. This processing is based on Art. 6(1)(b) GDPR. If an application is rejected, we delete the data submitted to us within 6 months after completion of the recruitment process. Deletion will not take place, as an exception, where the data must be retained for a longer period under mandatory legal provisions. If you expressly consent to a longer retention of your data, for example for inclusion in an applicant database, the data will continue to be processed on the basis of your consent. You may withdraw your consent at any time with future effect by notifying us. A corresponding notice to the office named in item 2 is sufficient for this purpose. Processing carried out up to that point will, however, not be affected by your withdrawal.
6. Newsletter
OLZ is pleased to inform you regularly, through its newsletter, about current topics, projects, and new additional offerings related to our field of activity. When you sign up for the newsletter, your email address may accordingly be used for our own advertising purposes until you unsubscribe from the newsletter. You will only receive a newsletter from us upon your express request. For sending the newsletter, we use the so-called "opt-in" procedure, meaning that you will only receive our newsletter by email if you have previously expressly signed up for newsletter delivery. You may unsubscribe from the newsletter at any time. In connection with the newsletter, we use an external service provider. It is contractually ensured that this provider processes personal data in compliance with the applicable data protection provisions and does not use it for its own purposes. Please do not hesitate to contact us if you have any questions.
7. Disclosure and Transfer of Data Abroad
Within the scope of the processing purposes mentioned above (items 4-6 and item 8 below), it may be necessary for us to disclose your personal data to the recipients listed below. These recipients process your data either on our behalf, jointly, or under their own responsibility. To the extent we are obliged to do so, we ensure that recipients treat your data confidentially and in accordance with applicable legal provisions, and that your data is used only for the purpose of the respective service. - Subsidiaries: in principle, our subsidiaries are independent legal entities; data is therefore only exchanged between them where the parent company provides contractually agreed services for the entire corporate group, i.e. outsourcing of IT and/or legal and compliance services. An overview of our company and our subsidiaries can be found here: https://olz.ch/ueber-uns/kontakt; - External service providers, including processors: providers in connection with our portfolio management, IT service providers, cloud providers, software providers, fiduciaries, auditors, shipping service providers (in particular Swiss Post and courier services), transport companies, providers in connection with the newsletter, hosting providers, web and advertising service providers who conduct analyses of our website activity on our behalf (see item 8 below); - Custodian banks; - Other financial service institutions, payment recipients, beneficiaries, account holders, and other persons involved in transactions domestically and abroad, to the extent this is provided for in the performance of the business relationship; - OLZ may, in certain cases, disclose personal data to government authorities or regulatory bodies in the financial market and tax law fields, domestically or abroad, based on legal obligations, legal justifications, or an order from an authority, or to safeguard OLZ's legitimate interests domestically and abroad; - Government offices and authorities, courts, domestically and abroad; - Counterparties or other parties in any legal proceedings, courts, other domestic and foreign authorities, such as commercial registry offices. Recipients may be located both domestically and abroad, i.e. worldwide, meaning that your data may also be processed outside Switzerland, in particular in Liechtenstein, Singapore (depending on the choice of custodian bank), and Hong Kong (subsidiary). Exceptionally, a data transfer in connection with the use of our website may also take place to the USA (see item 8 below). Should the recipient be located in a country without an adequate level of legal data protection, we ensure contractually that the recipient complies with applicable data protection standards, unless it is already subject to a legally recognized framework ensuring data protection or we can rely on an exception. Such an exception may apply where you have consented to the disclosure, or where the data concerned is data you have made generally accessible and to whose processing you have not objected. Disclosure is also permissible in connection with legal proceedings abroad, in cases of overriding public interest, or where the performance of a contract requires such disclosure.
8. Cookies / Tracking and Other Technologies Related to the Use of Our Website
When you use our website, data is automatically collected and sent from your browser to our server (in particular technical data). This serves to ensure smooth connectivity and a secure, comfortable use of the website. We also use various types of so-called "cookies" and comparable techniques on our website to recognize you when using our website, to analyze your behavior and/or to identify your preferences. A "cookie" is a small text file that is transferred to your computer when you browse our pages and that your browser stores. The data we collect, including cookies, generally does not contain any personal data. It is, however, possible that third-party providers we engage may link the collected information with other data about you, thereby establishing a connection to you personally. Through our consent banner on our website, you have the option of adjusting the use of cookies and comparable techniques (except for technically necessary cookies). Please note, however, that in this case you may not be able to use all functions of this website to their full extent. As mentioned, we use various types of cookies on our website: so-called session-related temporary cookies ("session cookies"), which are technically necessary for the operation of the website. They do not, however, remain on your computer; when you leave our website, the temporary cookie is also discarded. We also use permanent cookies. These remain stored on your computer and allow us to recognize your browser on your next visit. In addition, we use service providers who may also place cookies on your device on our behalf (so-called third-party cookies). These cookies help us tailor our site to the specific needs of our visitors. Through the use of these cookies, we obtain information about which offerings you have viewed or searched for, or which pages you have previously visited. These cookies are stored on your hard drive.
8.1. Use of Google Analytics
We use Google Analytics on our website, a web analytics service provided by our processor Google Ireland Ltd. ("Google"). Google Analytics allows us to measure and evaluate the use of the website (not on a personal basis). Permanent cookies set by the service provider are also used for this purpose. You may consent to the use of these cookies in the cookie banner (Art. 6(1)(a) GDPR) or decline them. The service provider may track your use of the website and combine this information with data from other websites you have visited that are also tracked by the service provider. The service provider may, where applicable, use these insights for its own purposes. In that case, the processing of your personal data by the service provider takes place under its own responsibility and in accordance with its own data protection provisions. We have configured the service such that visitors' IP addresses are shortened by Google within Europe before any transfer to the USA, and therefore generally cannot be traced. We have also disabled the "data sharing" and "signals" settings. Although we therefore assume that the information we share with Google does not constitute personal data for Google, it is possible that Google may, for its own purposes, draw conclusions about your identity from this data, create personal profiles, and link this data to any Google account you may have. Information on any transfer of data abroad can also be found in item 7. You can adjust the installation of cookies through our consent banner on our website. Please note, however, that in this case you may not be able to use all functions of this website to their full extent. More detailed information on Google Analytics' data protection practices can be found at https://support.google.com/analytics/answer/6004245.
8.2. Google AdWords
This website uses Google AdWords, an analytics service provided by Google Inc. ("Google"). Google AdWords places a cookie on your computer (a so-called "conversion cookie") if you reached our website via a Google advertisement. These cookies expire after 30 days and are not used for personal identification. If you visit certain of our pages and the cookie has not yet expired, we and Google can recognize that someone clicked on the advertisement and was thereby redirected to our page. Each AdWords customer receives a different cookie. Cookies therefore cannot be tracked across the websites of AdWords customers. The information obtained using the conversion cookie is used to generate conversion statistics for AdWords customers who have opted for conversion tracking. We do not receive any information that would allow users to be personally identified. Information on any transfer of data abroad can also be found in item 7. If you do not wish to participate in this tracking process, you may adjust this accordingly via our consent banner on our website. More detailed information on the data protection practices of Google AdWords can be found at https://policies.google.com/privacy?hl=en.
8.3. Microsoft Clarity
This website uses the "Microsoft Clarity" service provided by Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA (hereinafter "Microsoft") to collect and store various user information for the purposes of statistical analysis of user behavior and for optimization and marketing purposes. This information, for which any connection to a specific person is always excluded, includes, among other things, time zone settings, operating system and platform, the geographic origin of the page view, the origin of any redirection to our site, the duration of visits to particular pages, and information on website interaction (e.g. scrolling, clicks, and mouse-overs). Pseudonymized usage profiles may be created and evaluated from this data for the same purpose. Cookies are used for collection and evaluation and are deleted after 3 months at the latest. Data collected using Microsoft technologies is not used, without the separately obtained consent of the data subject, to personally identify visitors to this website, and is not merged with personal data relating to the holder of the pseudonym. Information collected may be transmitted to and stored on Microsoft servers in the USA. All processing described above, in particular the placement of cookies to read information on the device used, is only carried out if you have given us your express consent to do so in accordance with Art. 6(1)(a) GDPR. Without such consent, Microsoft Clarity will not be used during your visit to the site. You may withdraw your consent at any time with future effect. To exercise your withdrawal, please disable this service in the "cookie consent tool" provided on the website. Further information on Microsoft Clarity's data protection provisions can be found at https://clarity.microsoft.com/terms.
8.4. Social Media Plugins
We use a social media plugin from the social network LinkedIn on our website. This is indicated to you in each case (typically via corresponding icons). We have configured our website so that this "social media plugin" is deactivated by default. If you activate the plugin (by clicking on it) (Art. 6(1)(a) GDPR), a connection is established to LinkedIn's server, and LinkedIn can see that you are on our website. The processing of your personal data is LinkedIn's responsibility; we do not receive any information about you from LinkedIn. More detailed information on LinkedIn's data protection practices can be found here: https://www.linkedin.com/legal/privacy-policy
8.5. Social Networks / Platforms
We maintain a presence on the social network LinkedIn and process data about you in this context. We receive data from you directly, but the platform may also analyze your usage and use data for its own purposes. More detailed information on LinkedIn's data protection practices can be found here: https://www.linkedin.com/legal/privacy-policy LinkedIn Inc. is a social network headquartered in Sunnyvale, California, USA. The company is therefore located outside Switzerland. Information on the disclosure of data abroad can be found in item 7.
8.6. Cloudflare Turnstile
On this website, we use the "Cloudflare Turnstile" service provided by Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA (hereinafter "Cloudflare") for the newsletter sign-up form. This service is used to protect against spam and automated access (bots) and ensures that form requests originate from human users. For this purpose, various pieces of information are collected and evaluated, including the IP address, browser and device information, and characteristics of interaction behavior (e.g. mouse movements, keystroke patterns, timing and duration of the page visit). This data is used exclusively to distinguish between human users and automated access and is not used for marketing or tracking purposes. Unlike traditional captcha services, Cloudflare Turnstile largely avoids the use of third-party cookies. Information collected may be transmitted to and stored on Cloudflare servers in the USA. This processing is based on our legitimate interest under Art. 6(1)(f) GDPR, respectively Art. 31 of the revised FADP, in protecting our website and forms against misuse, spam, and automated attacks, as well as in ensuring the functionality of the newsletter sign-up form. Without the use of Cloudflare Turnstile, use of the newsletter sign-up form is not possible. You have the right to object to this processing, for reasons arising from your particular situation, pursuant to Art. 21 GDPR. Further information on Cloudflare's data protection provisions can be found at https://www.cloudflare.com/privacypolicy/ and, specifically regarding Turnstile, at https://developers.cloudflare.com/turnstile/.
9. Automated Data Processing Procedures
We collect data about you for the purpose of creating your investment profile. This data is evaluated using an automated procedure. The logic of the program is relatively simple: it evaluates your answers to certain questions and assigns them to various categories corresponding to gradations ranging from "defensive" to "dynamic". This procedure enables us to serve you according to your needs and to offer you suitable and appropriate products. The evaluation thus forms the basis for the decision on the composition of the portfolio suitable for you. At your request, we can also have this baseline assessment carried out "by hand", i.e. by a person rather than through the automated procedure. In the vast majority of cases, the result will be the same.
10. Retention Period
We retain your personal data for as long as necessary to comply with applicable laws, or for as long as we consider it appropriate, or for as long as it is necessary for the purposes for which it was collected. We block or delete your personal data as soon as it is no longer required, and in any case after the expiry of the maximum retention period prescribed by law. You may at any time request the deletion of your personal data yourself by submitting a corresponding request to compliance(at)olz.ch (see item 2 above). We will comply with your request promptly, unless we are obliged to retain the data further for other reasons, or require it, for example, to enforce claims.
11. Rights of Users
11.1. Right of Withdrawal (Art. 21 GDPR; Art. 32 FADP)
To the extent that you have given us consent, in connection with the use of the website or the use of our services, to the collection, storage and use of personal data, you may withdraw that consent at any time. Withdrawal may be sent by email or in writing to the contacts named in item 2. The effects of the withdrawal are limited to the storage and use of personal data that may not already be stored and used without your consent under applicable legal provisions. The withdrawal also has no effect on processing already carried out on the basis of the consent.
11.2. Other Rights
a) Right of Access (Art. 15 GDPR; Art. 25 FADP)
Upon written request, we will inform you at any time as to what personal data concerning you is stored with us. The request for information must be made in writing and accompanied by proof of identity (copy of ID card, passport, or other official identification document).
b) Rectification (Art. 16 GDPR; Art. 32 FADP), Erasure (Art. 17 GDPR; Art. 32 FADP), Restriction (Art. 18 GDPR; Art. 32 FADP), Objection to Disclosure (Art. 21 GDPR; Art. 32 FADP)
You further have the option at any time to have your personal data corrected, blocked, or deleted by us. Please contact the office named in item 2 for this purpose. Excluded from deletion are only data that we require to complete outstanding tasks or to enforce existing rights and claims, as well as data that we are required to retain under legal provisions. Such data will, however, be blocked. You may further object to the disclosure of certain personal data.
c) Right to Lodge a Complaint (Art. 77 GDPR; Art. 49 et seq. FADP) We attach the greatest importance to upholding the rights of our clients, and thus also to protecting your personal data. Should you nevertheless be of the opinion that we are processing your data unlawfully, you may contact us at any time on +41 31 326 80 00 or by email at compliance(at)olz.ch and describe your concern. We will address your concern conscientiously and to the best of our knowledge. Should our customer service, contrary to expectation, be unable to resolve your concern satisfactorily, you may at any time submit your concern to the competent Data Protection Officer in the form of a formal complaint, which will then be reviewed.
d) Data Portability (Art. 20 GDPR; Art. 28 et seq. FADP) Upon written request, you also have the right to receive the personal data concerning you in a structured, commonly used, machine-readable format (PDF file) for transmission to a third party. We reserve the right to charge a fee to cover the associated costs.
12. Liability for Links
OLZ hereby expressly declares that, at the time the links were set, no illegal content was identifiable on the linked pages. We have no influence whatsoever on the current or future design, content, or authorship of the linked pages. We therefore expressly dissociate ourselves from all content of all linked pages that was modified after the link was set. This statement applies to all links and references placed within our own internet offering. Sole liability for illegal, incorrect, or incomplete content, and in particular for damages arising from the use or non-use of information presented in this manner, rests with the provider of the page to which reference is made, not with the party merely referring to that publication via a link.
13. Security Measures
Please note that communication with us via the public, freely accessible internet involves certain security risks over which we have no influence or control. Please contact us if you wish to communicate via a secure connection. We apply technical and organizational security measures to appropriately protect your personal data against unauthorized access, misuse, accidental or intentional manipulation, loss, or destruction. To protect your data, we use a secure connection for our website, which you can recognize by the "https" (https stands for "Hypertext Transfer Protocol Secure") at the very beginning of the address bar in your browser. This encrypts the connection using SSL or TLS, and your data cannot be intercepted by third parties. Technical security measures to protect your personal data are regularly reviewed and, where necessary, adapted to the state of the art. These principles also apply to companies that process and use personal data on our behalf and in accordance with our instructions.
14. Changes
We reserve the right to amend this privacy policy at any time. The version currently published on our website, or any version we may otherwise have provided to you, shall apply. If you are affected by a change to the privacy policy (for example, if you use a newsletter service), we will inform you of such a change in an appropriate manner. This privacy policy does not establish any contractual or other formal legal relationship with, or on behalf of, any party.
Bern, July 2026
--- In the event of any discrepancy or ambiguity between the different language versions of this privacy policy, the German version shall prevail.