Privacy Policy

Last updated: September 2025

1. Overview and scope

Qovera Capital AG (hereinafter “Qovera”, “we”, or “us”) collects and processes your personal data as part of our business activities. Protecting this data is very important to us.
This Privacy Policy explains how and for what purposes we process your personal data (“you”), whether you provide it to us yourself or we obtain it from other sources.

This Privacy Policy is not exhaustive. Additional Qovera Capital documents may govern specific data protection matters (e.g., engagement contracts, General Terms and Conditions (GTC), Terms of Use, etc.).

“Personal data” means all information that relates to an identified or identifiable natural person. A “data subject” is any person whose personal data we process.

2. Controller and contact for data protection matters

Controller:
Qovera Capital AG
Stockerstrasse 12
8002 Zurich

Phone: +41 44 377 30 20
Email: service@qovera.ch

If you have any questions regarding data protection, please contact us at the address above.

3. Data sources and data categories

We generally process only the personal data that we receive or collect from clients (“customers”), prospective clients, event participants and website visitors in the course of our business activities. Where permitted, we may also obtain certain data from publicly accessible sources (e.g., debt collection registers, commercial registers, media, the Internet) or receive such data from other companies, authorities or third parties.

If you provide us with personal data of other individuals, please ensure that these individuals have been informed about this Privacy Policy. Share their personal data with us only if you are authorised to do so and if the data is accurate.

Depending on the case, the personal data we process may include:

  • Personal details and contact information (e.g., name, address, gender, date of birth, phone number, email address)
  • Identification and background information (e.g., AHV number, signature samples, language)
  • Contract data related to the initiation, execution or termination of contracts
  • Transaction and financial data (e.g., payment information, assets, liabilities, income, turnover)
  • Employment information (e.g., job title, employment relationship)
  • Pension data (e.g., pension assets, capital withdrawals)
  • Tax data (all relevant documents and information, including religious affiliation)
  • Data related to pension cases (e.g., information regarding disability, health, retirement, death, home ownership)
  • Property data (e.g., address, type of property, purchase price, market value, size, condition, renovations)
  • Communication data (e.g., email content, written correspondence, chats, social media posts, phone calls, video conferences)
  • Documentation data (e.g., notes from consultations, references)
  • Preference and marketing data (e.g., website usage data, newsletter interaction, interests)
  • Public data (e.g., land registry and commercial register entries, media reports)
  • Data related to proceedings with authorities or courts
  • Compliance-related data, including anti-money laundering requirements
  • Image and audio data (e.g., photos, videos, call recordings, CCTV footage)
  • Technical data (e.g., IP addresses, device IDs, cookies)

4. Purposes of processing and legal bases

We process personal data where necessary to operate our business in a secure, user-friendly and reliable way. Categories may include contact data, device data, log data, usage data, location data, transaction data and contract data.

We may outsource data processing to third parties, process data jointly with them, or transfer data to them — particularly when using specialised service providers.

We generally process personal data with your consent. However, we may process data without consent if another legal basis applies, such as:

  • Performance of a contract
  • Compliance with legal obligations
  • Protection of legitimate interests, such as:
    • Secure and reliable operation of our services
    • Prevention of misuse
    • Enforcement of legal claims
    • Compliance with Swiss law

We handle personal data in compliance with the Swiss Federal Act on Data Protection (FADP) and its Ordinance. Where applicable, the EU GDPR forms the basis of processing (Art. 6 para. 1 lit. a–f).

5. When you visit our website

5.1 Cookies

We may use cookies (first-party and third-party). Cookies may be temporary (“session cookies”) or stored for a set duration (“permanent cookies”).
They help recognise your browser, measure reach and may be used for marketing purposes.

You can disable cookies in your browser settings at any time, but doing so may limit website functionality.

Where required, we ask for your consent to use cookies.

5.2 Server log files

When you access our website, the following data may be recorded:
date/time, IP address, access status, operating system, browser type, subpages accessed, data volume, referrer URL.

These data help ensure security, stability and proper functioning of the website.

5.3 Tracking pixels

We may use tracking pixels (web beacons), including from third parties, to collect similar information as server log files.

6. Email, phone calls and video conferences

When you contact us by email or phone, we store your personal data to process your inquiry.
Communication by unencrypted email may be intercepted by third parties. We disclaim liability for damages arising from such risks.

Calls and video meetings may be recorded (we will inform you beforehand). If you do not consent, you may end the call and contact us by another method.

We use specialised service providers for online meetings. Please review their privacy policies.

7. Social media

We maintain profiles on several social media platforms. Personal data may be processed outside Switzerland and the EEA. The respective platform providers’ terms and privacy policies apply.

8. Third-party services

We use third-party services to ensure secure, user-friendly and reliable operation of our activities, including website integrations. These providers may temporarily collect IP addresses or other technical data.

Examples include services from Google LLC / Google Ireland Ltd.

9. Digital infrastructure

We use specialised providers for hosting, storage and other infrastructure services.

10. Job applications

Applications can be submitted by post or email. Applicant data is processed confidentially and only for recruitment purposes, and will be deleted or returned after the process unless retention is required by law.

11. Disclosure of personal data

11.1 Disclosure to recipients

We may disclose data to:

  • Service providers (e.g., IT providers, external accounting, debt collection, banks, photographers)
  • Third parties collecting data on websites
  • Authorised representatives
  • Insurers and social insurance funds
  • Credit agencies
  • Buyers or investors in M&A transactions
  • Auditors
  • Parties in legal proceedings
  • Swiss and foreign authorities or courts

11.2 Transfer abroad

Data is generally processed in Switzerland but may be transferred abroad, mainly to the EU/EEA and occasionally other countries.
Where necessary, we ensure adequate protection through standard contractual clauses or rely on legal exceptions.

12. Data retention

We retain personal data only as long as necessary to fulfil contractual or legal obligations or for the purposes for which they were collected. Data may be retained for statute-of-limitations periods. Afterwards, data is deleted or anonymised whenever possible.

13. Your rights

You may request:

  • Access
  • Correction
  • Deletion
  • Restriction of processing
  • Data portability
  • Objection to processing

If processing is based on consent, you may withdraw your consent at any time.

We may require proof of identity for such requests.

You also have the right to lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC).

14. Data security

We implement appropriate technical and organisational measures — including firewalls, logging, encryption and access controls — to protect your data against loss, misuse or unauthorised access.
However, no system is fully secure, and residual risks remain.

15. Changes to this Privacy Policy

We may amend this Privacy Policy at any time. The current version published on our website is the one that applies.