Privacy policy

This privacy policy explains what personal data arqo1 AG (“arqo1”, “we”, “us”) collects, why we use it, who we share it with and what rights you have. It covers our website arqo1.com, the contact form and call booking, email and other correspondence with us, and our dealings with clients, partners and their representatives.

We process personal data in line with the Swiss Federal Act on Data Protection (FADP). Where the EU General Data Protection Regulation (GDPR) applies, for example because you are in the European Union or deal with our Luxembourg office, we also comply with it, and we name the GDPR legal bases below.

Our client portal and the products we issue are governed by their own contractual and product documentation, which may contain further privacy information.

Who is responsible

The controller for the processing described here is:

arqo1 AG
[Street and number]
[Postcode] Zürich
Switzerland

For any privacy question or request, write to [privacy contact email] or to the postal address above, marked “Data protection”. Our affiliated companies in Luxembourg and Israel are responsible for the data they process for their own activities and can be reached through the same contact.

What we collect when you browse the website

When you open a page, your browser sends technical information to the servers that deliver the site: your IP address, the date and time, the page requested, the referring page, and your browser and operating system. Our hosting provider processes this data to deliver the pages, keep the site available and protect it against abuse and attacks. We do not use it to identify you or build a profile.

The website itself is kept lean:

• No cookies. The website does not set cookies or similar trackers, so we do not ask for cookie consent.
• No analytics or advertising. We do not use web analytics, advertising pixels, retargeting or social media plugins.
• No third-party requests on page load. Fonts and images are served from our own domain, so opening a page does not send your data to font or media providers.

If this changes, we will update this policy first and, where required, ask for your consent.

Contact form and call booking

When you use the “Talk to an expert” form, we collect what you enter: the asset classes you are interested in, whether you hold a licence, your first and last name, your company, your email address and the language of the form. We use this information to answer your request, understand whether and how we can help, and prepare a first conversation.

Your submission is delivered to our team by email through our email delivery provider. A hidden field filters out automated spam; it does not collect anything about you.

After you send the form, you can pick a time for a call in an embedded scheduling tool (Calendly). The tool loads only at that point. Your name and email are passed to it so you do not have to type them again, and it receives whatever else you enter there. The scheduling provider processes this data on our behalf to arrange the meeting and may use its own cookies inside the booking window; its privacy notice applies to that window.

Email and other correspondence

When you write to us, call us or meet us, we process your contact details, the content of the exchange and related notes to respond, follow up and keep a record of our business relationship.

Clients, partners and their representatives

When we prepare or carry out a mandate, or work with banks, custodians, paying agents, law firms and other partners, we process business contact data of the people involved: name, role, employer, contact details and the content of our communication.

Before and during a client relationship we may also need identification and background information, such as identity documents, information on beneficial owners and the results of sanctions and reputational checks, where anti-money laundering, sanctions or other laws require it.

Why we use personal data, and on what basis

We use personal data to:

• answer enquiries and arrange meetings;
• assess, prepare and perform contracts with clients and partners;
• structure, issue and administer financial products, together with the service providers involved;
• meet legal and regulatory obligations, including record keeping, anti-money laundering and sanctions checks, and requests from authorities;
• keep our website and systems secure and working;
• develop our business relationships, for example by staying in touch with contacts who have shown interest in our services;
• establish, exercise or defend legal claims.

Under the GDPR, we rely on the following legal bases: steps taken at your request before a contract and the performance of a contract (Art. 6(1)(b)); compliance with legal obligations (Art. 6(1)(c)); our legitimate interests in running, securing and developing our business, where those interests are not overridden by yours (Art. 6(1)(f)); and your consent where we ask for it (Art. 6(1)(a)), which you can withdraw at any time with effect for the future.

Who we share personal data with

We do not sell personal data. We share it only where needed for the purposes above:

• Service providers that process data on our behalf under contract, including our hosting and content delivery provider (Cloudflare), our email delivery provider (Resend), our scheduling provider (Calendly) and our IT, email and office software providers.
• Product and transaction partners, such as banks, custodians, paying agents, calculation agents, auditors and legal advisers, where a mandate or product requires it.
• Affiliated companies of arqo1, for example to coordinate a mandate across our offices.
• Authorities and courts, where we are legally required to disclose data or need to protect our rights.

Where your data is processed

We process personal data mainly in Switzerland and the European Union. Some of our service providers, including those named above, are based in the United States or operate global infrastructure, so data may be processed there or in other countries.

We transfer personal data abroad only where the destination ensures adequate protection, such as under the Swiss–US and EU–US Data Privacy Frameworks, or with appropriate safeguards, such as the standard contractual clauses approved by the European Commission and recognised in Switzerland, or where a legal exception applies.

How long we keep it

We keep personal data only as long as we need it for the purpose it was collected for or as the law requires:

• technical server data is kept only briefly, for security and troubleshooting;
• contact form submissions and related correspondence are kept for as long as needed to handle your request and any follow-up; if no business relationship results, we delete them within a reasonable period;
• business records and documents relating to clients and mandates are kept for the statutory retention periods, generally ten years under Swiss law, and longer if needed for legal claims.

How we protect it

We use technical and organisational measures appropriate to the risk, including encrypted connections (HTTPS), access restricted to the people who need it, careful selection of service providers and regular review of our safeguards. No system is completely secure, but we work to keep your data safe.

Your rights

Subject to the conditions and exceptions in the applicable law, you have the right to:

• ask whether we process your personal data and obtain a copy of it;
• have inaccurate data corrected;
• have your data deleted, or its processing restricted;
• object to processing based on our legitimate interests, including direct marketing;
• receive data you have provided to us in a common electronic format, or have it sent to another controller;
• withdraw your consent at any time, without affecting processing before the withdrawal.

To exercise these rights, contact us as described in “Who is responsible”. We may ask you to confirm your identity before we act on a request.

You can also lodge a complaint with a supervisory authority: in Switzerland, the Federal Data Protection and Information Commissioner (FDPIC); in the European Union, the authority of your country of residence or work, or the Luxembourg National Commission for Data Protection (CNPD).

Automated decisions

We do not take decisions that produce legal effects for you, or affect you similarly, based solely on automated processing.

Changes to this policy

We may update this privacy policy when our services, our providers or the law change. The version published on this page, with the date shown at the top, applies.