Data Protection Statement

Version effective as of 1 September 2023

With this Data Protection Statement we, VQF Financial Services Standards Association (hereinafter VQF, we or us), describe how we collect and further process personal data. This Data Protection Statement is not necessarily a comprehensive description of our data processing. It is possible that other Data Protection Statements or other documents are applicable to specific circumstances.

We take the protection of your personal data very seriously and treat your personal data confidentially and in accordance with the legal requirements and this Data Protection Statement.

Personal data refers to all information relating to a specific or identifiable person. Processing refers to any handling of personal data, regardless of the means and procedures used, in particular the creation, storage, retention, use, modification, disclosure, archiving, deletion or destruction of data.

If you provide us with personal data of other persons (such as employees, business partners etc.), we assume that you are authorized to do so and that this data is correct. With the transmission of data concerning third parties you confirm this. Please also ensure that these third parties have been informed about this Data Protection Statement.

This Data Protection Statement is designed to meet the requirements of the revised Swiss Data Protection Act ("DPA"), which came into force on 1 September 2023.

1. Controller

The data controller within the meaning of the Data Protection Act is the VQF Financial Services Standards Association, General-Guisan-Strasse 6, 6300 Zug.

If you have any data protection concerns, you can send them to us at the following contact address: VQF, Data Protection, General-Guisan-Strasse 6, 6300 Zug or info@vqf.ch with the reference "Data Protection".

2. Collection and Processing of Personal Data

We primarily process personal data that we receive from our members and business partners in the course of our supervisory activities or that we collect from the users in the course of accessing our websites and other applications.

Insofar as this is permitted, we also take certain data from publicly accessible sources (e.g. debt enforcement register, commercial register, press, internet) or receive such data from other companies, authorities and other third parties (such as FINMA, members, etc.).

Personal data is processed in accordance with data protection law.

Data processing takes place in Switzerland.

3. Purpose of Data Processing and Legal Grounds

We use the personal data we collect primarily to supervise our members in accordance with Art. 12 Para. 1 lit. c of the Anti-Money Laundering Act (AMLA) and thus to comply with laws, directives and recommendations from authorities and internal regulations.

In addition, in line with applicable law and where appropriate, we may process your personal data and personal data of third parties for the following purposes, which are in our (or, as the case may be, any third parties') legitimate interest, such as:

  • providing and developing our products, services and websites and other platforms, on which we are active;

  • communication with you and third parties and processing of their enquiries (e.g., job applications, media inquiries);

  • advertising and marketing (including organising events);

  • market and opinion research, media monitoring;

  • assertion of legal claims and defense in connection with legal disputes and official proceedings;

  • prevention and investigation of criminal offences and other misconduct (e.g. conducting internal investigations, data analysis to combat fraud);

  • ensuring our operations, including our IT, our websites, apps and other appliances;

  • measures for IT, building and facility security and protection of our employees and other persons and assets belonging to or entrusted to us (such as access control, visitor lists, network and mail scanners, telephone records);

  • for the purposes of our risk management and prudent corporate governance, including business organisation and development;

  • We may process your data for other purposes, e.g. as part of our internal processes and administration or for training and quality assurance purposes.

If you have given us consent to process your personal data for certain purposes (for example, when you register to receive newsletters or for seminars and training courses), we process your personal data within the scope of and based on this consent, insofar as we have no other legal basis and we require such a basis or the processing can be attributed to a legitimate interest. Our legitimate interests also include compliance with legal regulations, insofar as these are not already recognised as a legal basis by the applicable data protection law. Consent given can be revoked at any time, but this has no effect on data processing that has already taken place.

4. Retention Periods for your Personal Data

We process and retain your personal data as long as required for the performance of our contractual obligation and compliance with legal obligations or other purposes pursued with the processing, i.e. for the duration of the entire business relationship (from the initiation, during the performance of the contract or the membership until it is terminated) as well as beyond this duration in accordance with legal retention and documentation obligations. Personal data may be retained for the period during which claims can be asserted against our company or insofar as we are otherwise legally obliged to do so or if legitimate business interests require further retention (e.g., for evidence and documentation purposes).

5. Disclosure to Third Parties

In connection with our contracts, the website, our services and products, our legal obligations or otherwise to protect our legitimate interests and in connection with the other purposes listed in section 3, we also disclose your personal data to third parties, in particular to the following categories of recipients:

  • Service providers: In order to provide our products and services efficiently and to enable us to focus on our core competencies, we procure services from third parties in numerous areas. These services include, for example, IT services, the dispatch of information, marketing, sales, communication or printing services, facility management, security and cleaning, the organisation and implementation of events, services from consultancy firms, lawyers, banks, insurers and telecom companies. We disclose to these service providers the data required for their services, which may also concern you.

  • Authorities: We may disclose personal data to FINMA, other authorities and courts if we are legally obliged or entitled to do so.

  • Other persons: This refers to other cases in which the involvement of third parties arises from the purposes set out in section 3.

6. Data Security

We take appropriate technical and organizational security measures to protect the confidentiality, integrity and availability of your personal data, to protect it against unauthorised or unlawful processing and to protect it against the risks of loss, accidental loss or alteration, unauthorised disclosure or access.

For security reasons and to protect the transmission of confidential content, our website uses SSL/TLS encryption. You can recognise an encrypted connection by the fact that the address line of the browser changes from "http://" to "https://" and by the lock symbol in the address line.

7. Obligation to Provide Personal Data To Us

In the context of your membership or our business relationship you must provide us with any personal data that is necessary for the conclusion and performance of a membership or business relationship and the performance of our contractual obligations. In addition, the website cannot be used unless certain information is disclosed to enable data traffic (e.g. IP address).

8. Your Rights

In accordance with and as far as provided by the applicable data protection law you have the right to information, correction, deletion, the right to restrict data processing and the right to object to our data processing.

Please note, however, that we reserve the right to enforce legal restrictions on our part, for example if we are obliged to retain or process certain data, have an overriding interest or need the data for asserting claims.

In order to avoid abuse the exercise of such rights generally requires that you clearly prove your identity (e.g. by means of a copy of your identification document, where your identity is otherwise not clear or cannot be verified). To exercise your rights you can contact us at the address given in section 1.

In addition, any person concerned has the right to enforce his/her rights in court or to lodge a complaint with the competent data protection authority. The competent data protection authority of Switzerland is the Federal Data Protection and Information Commissioner (http://www.edoeb.admin.ch).

9. Amendments of this Data Protection Statement

We may amend this Data Protection Statement at any time without prior notice. The current version published on our website shall apply.