Privacy Policy
1. Privacy policy
This privacy policy informs you about how we process your personal data. We process your personal data when you visit our website, enter into a client relationship or other contractual relationship with us, purchase services from us, apply to work for us, or otherwise deal with us.
We will inform you in good time about additional processing activities not mentioned in this declaration.
The processing of your personal data is subject to the Swiss Federal Act on Data Protection (FADP) and, where applicable, the EU General Data Protection Regulation ("GDPR").
2. Our company
The company listed below is responsible for the processing of your data, unless otherwise communicated:
Concept Capital Group AG
Gartenstrasse 17
8002 Zurich
Switzerland
If you have any concerns about data protection or wish to exercise your rights, please contact:
Concept Capital Group AG
Executive Board
Gartenstrasse 17
8002 Zurich
3. Processing of personal data
Personal data means all information relating to an identified or identifiable natural person. "Data processing" means any handling of personal data, in particular its collection, storage, use, modification, disclosure, archiving, deletion or destruction.
When processing personal data we observe the principles of data protection law. Where the law requires it, we process personal data only with your prior consent.
We process personal data that we receive from you or from third parties. Where permitted and appropriate we also obtain personal data ourselves, for example from publicly accessible sources.
If you provide us with personal data of other persons, you must be authorised to do so and the data must be accurate. Please also ensure that those persons have read and understood this privacy policy.
4. Legal basis
We process personal data where this is necessary to perform a contract with you or to take steps at your request before entering into a contract; where we are subject to a legal or supervisory obligation, in particular under the Financial Institutions Act (FinIA), the Financial Services Act (FinSA) and the Anti-Money Laundering Act (AMLA); where we have a legitimate interest in the processing and your interests do not override it; or, where none of these apply, on the basis of your consent. Where processing is based on consent, you may withdraw that consent at any time with effect for the future.
5. Categories of data
Visitors to our website. When you visit www.conceptcapital.world, technical data is processed: your IP address, the browser and operating system used, the requesting domain, the file retrieved, the time of retrieval, the volume of data transferred and whether the retrieval was successful. Further information is set out in section 11.
Clients. We process personal data received when a client relationship is initiated and while it is in place. We receive this data directly from you in the course of providing our asset and wealth management services, in part through third parties such as banks, other asset managers or auditors, or we obtain it ourselves. In particular we process master data (name, address, email address, telephone number, date of birth, gender, nationality, copies of identity documents); contract data (type of contract, services, financial data); data required to fulfil our due diligence obligations, for example for identification or background checks; data on your preferences, based on the services you request; financial information; and communication data.
Applicants. We process the data we receive from you or from third parties in the context of an application, or that we obtain ourselves: master data, communication data, data from your CV and references, information from referees, extracts from the criminal record or debt collection register and other official confirmations, and data obtained through further clarifications. Sensitive personal data may be processed; where your consent is required for this, we will inform you separately.
Business partners and other third parties. We process master data, contract data, communication data and data obtained through further clarifications in the context of a business relationship with you or with a business partner.
6. Purpose of processing
The purpose of processing depends on how you deal with us. We process your data in particular to establish, administer and perform client, contractual and employment relationships, including the provision of our services and the fulfilment of our contractual obligations; to fulfil our due diligence and documentation obligations, for example know-your-customer clarifications; to process job applications; to develop our services further; to communicate with you, respond to enquiries and manage the relationship; to comply with laws, regulations, orders and recommendations of authorities and with our internal rules; to operate our website; to assert legal claims and defend ourselves in legal disputes and official proceedings; to prevent and investigate criminal offences and other misconduct; and to safeguard our legitimate interests and ensure the functioning of our business, including accounting, risk management, operational security and training.
We do not send newsletters or advertising material and we do not use your data for customer acquisition.
7. Disclosure of data and transfer abroad
We may disclose your data to third parties where this is necessary to fulfil our contractual and legal obligations, where those third parties need it to perform their tasks, on the basis of your consent, or to protect our legitimate interests. Recipients may include service providers who process data on our behalf, in particular our website host and IT service providers; banks, other asset managers, insurers, auditors and comparable bodies; our contractual partners; public bodies and authorities, for example FINMA, our supervisory organisation AOOS, the ombudsman OFS and the tax authorities, where a legal or supervisory obligation applies; and other third parties such as lawyers, recipients of payments and services, and third parties in the context of mergers and acquisitions.
Recipients may be located in Switzerland or abroad. Where a recipient is in a country whose data protection legislation the Federal Council does not regard as adequate, and where no recognised set of rules already ensures an adequate level of protection, we take additional safeguards, in particular by agreeing the standard contractual clauses. Exceptions may apply, for example where the transfer is directly connected with the conclusion or performance of a contract, is necessary for legal proceedings abroad, serves an overriding public or private interest, or where you have consented.
8. Profiling and automated individual decisions
We do not carry out automated individual decision-making and we do not carry out profiling within the meaning of data protection law. Should we intend to do so in future, we will inform you and, where required, obtain your consent.
9. Your rights
You have the right to request information about the personal data we process about you. You may also request that your data be corrected, deleted or that its processing be restricted, and you may object to processing.
Where technically feasible, you may receive personal data you have provided to us in a structured, commonly used and machine-readable format, or have it transferred to another controller.
Where our processing is based on your consent, you may withdraw that consent at any time with effect for the future.
You may enforce your rights through the courts and you may lodge a complaint with the competent supervisory authority. In Switzerland this is the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern.
To exercise your rights, please contact the office listed in section 2 in writing. Please note that your rights may be restricted in certain circumstances, in particular where statutory retention or confidentiality obligations apply. We will inform you if this is the case.
10. Retention of personal data
As a rule, personal data is retained only until the purpose of the processing has been achieved. Data is retained beyond that point where a legal or regulatory requirement, an order of an authority or a contractual agreement obliges us to do so, where claims may still be asserted against us, or where we have an overriding interest in retention, for example for evidentiary and documentation purposes. Records subject to the Anti-Money Laundering Act are retained for ten years after the end of the business relationship or the conclusion of the transaction.
11. Data security
To ensure the confidentiality, integrity, availability and traceability of the data we store and process, we take technical and organisational security measures within our area of responsibility and review them regularly. These include access restrictions and access controls; encryption of data storage, email correspondence, calendars and backups; network and IT security solutions; and encryption of data carriers and of data in transit.
12. Use of our website
Hosting. Our website is operated on the platform of Wix.com Ltd. and its group companies, which process the technical data described below on our behalf as our processor. Data may be processed in the European Economic Area, in Israel and in the United States on the basis of the safeguards referred to in section 7.
Log files. When you visit the website, log files are stored containing the name of the file retrieved, the date and time of retrieval, the volume of data transferred, a message about successful retrieval, your browser, operating system and requesting domain, and your IP address. This data is used solely to operate and secure the website and generally does not allow conclusions to be drawn about you as a person.
Cookies. Cookies are small text files stored on your device by your browser. Our website uses cookies that are technically necessary to operate the site and to keep it secure; these are set without your consent, as the site cannot be provided without them. We do not use web analytics, we do not use cookies for advertising, and we do not track visitors across websites. You can configure your browser to refuse cookies or to notify you before they are stored; if you do, some functions of the website may not work fully.
User profiles. We do not create personal user profiles.
Contact form. If you use the contact form on our contact page, we ask for your first name, last name and email address, and you can enter a message. Providing this data is voluntary; we use it solely to process your enquiry and to communicate with you about it. Transmission is encrypted.
Google Maps. Our contact page embeds Google Maps, a map service of Google Ireland Limited. When the map loads, a connection to a Google server is established and Google receives your IP address. If you are logged into a Google account at the time, Google may associate the visit with that account. We have no knowledge of the content of the data transmitted or of its further use by Google. Details can be found in Google's privacy policy.
13. Changes
We may amend this privacy policy at any time. The version published on our website applies. Unless otherwise agreed, this privacy policy does not form part of any contract concluded with you.
Version: 4 September 2026 (previous version: 1 September 2023)