Privacy policy

Who is responsible

For questions about data protection and to exercise your rights, write to us at this address.

Visiting this website

Each time you open a page, your browser sends technical data to the server. Our hosting provider stores it in log files:

• the IP address of your device
• date and time of the request
• the page or file requested and the amount of data transferred
• the website you came from, if your browser sends it
• browser type and version, and operating system
• whether the request succeeded

We use this data to deliver the website, to keep it stable and secure, and to detect and investigate attacks. We do not combine it with other data and do not use it to identify you, unless an attack requires it and we need the data to pursue legal claims. Log files are deleted or anonymised once they are no longer needed for these purposes. Entries needed to investigate an incident are kept until the incident is resolved.

Without this data we cannot deliver the website.

Legal basis under the GDPR: our legitimate interest in a secure, working website (Art. 6(1)(f)).

Cookies and tracking

We do not use cookies, tracking pixels, analytics, advertising tools or social media plugins. Fonts and code are delivered with the page itself, so your browser does not contact any third-party servers when you visit hai.ag.

Contacting us

When you write to us by email, we process your name, your email address, the content of your message and any other details you share, such as your company, role or phone number. We use them to answer your enquiry and, where relevant, to prepare a mandate, a project or an investment. Without your contact details we cannot reply.

Regular email is not encrypted end to end. Please do not send confidential information by email unless we have agreed on a secure channel.

Legal basis under the GDPR: steps prior to entering into a contract (Art. 6(1)(b)) and our legitimate interest in answering enquiries (Art. 6(1)(f)).

Working with us

When we work with you or your company, for example on a mandate, a platform, an investment or a transaction, we process the contact details of the people involved, our correspondence, contract and billing data, and the information we need to assess and carry out the business. This can include publicly available information, for example from the commercial register, and, where the law requires it, identification documents.

We use this data to perform our contracts, to manage the business relationship, to keep our accounts and to meet our legal obligations.

When we process personal data on behalf of a client, for example while automating the client’s processes, we act as the client’s processor. We then process the data only on the client’s instructions, and the client’s privacy policy applies.

Legal bases under the GDPR: performance of a contract (Art. 6(1)(b)), legal obligations (Art. 6(1)(c)) and our legitimate interests (Art. 6(1)(f)).

Who receives data

We disclose personal data only where it is needed for the purposes above:

• to IT service providers that host our website and email and store our data, as processors bound by our instructions
• to our accountants, auditors, lawyers and other advisers, who are bound by confidentiality
• to companies we hold interests in, co-investors and partners, if they are involved in the same project or transaction
• to banks, insurers, authorities and courts, where the law requires it or where we need it to establish or defend legal claims

We do not sell personal data.

Data abroad

Our service providers may process personal data in Switzerland, in the EU and EEA, and in the USA. The countries of the EU and EEA provide an adequate level of data protection under Swiss law.

We disclose personal data to the USA only to providers certified under the Swiss-US Data Privacy Framework, or on the basis of standard contractual clauses recognised by the Federal Data Protection and Information Commissioner (FDPIC) and the European Commission. In individual cases we rely on a statutory exception, for example where the disclosure is necessary to perform a contract with you.

How long we keep data

We keep personal data as long as we need it for the purpose for which we collected it, or as long as the law requires. Business records, including correspondence that documents business transactions, generally have to be kept for ten years (Art. 958f of the Swiss Code of Obligations). Enquiries that do not lead to a business relationship are deleted once they are no longer needed.

Security

We protect personal data with appropriate technical and organisational measures, including encrypted transmission of this website (HTTPS), access controls and the careful selection of our service providers.

Your rights

Under the FADP and, where it applies, the GDPR, you can:

• ask whether we process personal data about you, and which data
• have incorrect data corrected
• have data deleted, or its processing restricted
• object to processing based on our legitimate interests
• receive data you gave us in a common electronic format, or have it transferred to someone else
• withdraw your consent at any time with effect for the future, where we process data based on consent

To exercise these rights, write to info@hai.ag. We may ask you to confirm your identity. Statutory retention duties can limit deletion.

You can lodge a complaint with a supervisory authority: in Switzerland with the Federal Data Protection and Information Commissioner (FDPIC, www.edoeb.admin.ch), in the EU with the data protection authority in the country where you live or work.

We do not make decisions based solely on automated processing that have legal effects on you or affect you significantly.

Changes to this policy

We update this policy when our processing or the law changes. The version published on this page applies.