Privacy Policy

1. Controller

The controller responsible for the processing of your personal data under this Privacy Policy is:

2. Scope of This Privacy Policy

This Privacy Policy explains how Flowstate Capital GmbH ("we", "us", "our") collects, uses, discloses, and protects personal data when you visit our website www.swissvirtualoffices.com (the "Website"), submit enquiries, engage our services, or otherwise interact with us.

This Privacy Policy covers website visitors, prospects, clients, representatives, beneficial owners, contact persons, newsletter subscribers (where applicable), and service users.

This Privacy Policy is issued in accordance with the Swiss Federal Act on Data Protection (FADP / nDSG) and, where applicable, the EU General Data Protection Regulation (GDPR). In the event of any conflict, Swiss data protection law shall take precedence for processing activities subject to Swiss jurisdiction.

3. Categories of Personal Data We Process

We may collect and process the following categories of personal data, depending on the nature of our interaction:

• Contact information: Name, company name, email address, phone number, and postal address.
• Identity and verification data: Passport or national ID copies, date of birth, nationality, proof of residential address, and beneficial ownership information — collected for KYC, AML, and commercial registry compliance purposes.
• Business data: Company registration details, articles of association, commercial register extracts, tax and VAT identification numbers, financial information, bank account details, and corporate structure information.
• Correspondence data: The content of messages, enquiries, and communications you send to us via contact forms, email, phone, or other channels.
• Service delivery data: Information related to mail handling, mail scanning, mail forwarding (including sender and recipient details), accounting and payroll administration, and compliance support.
• Technical data: IP address, browser type and version, operating system, referring URLs, pages visited, time and date of visit, and other standard web server log data.
• Cookie and analytics data: Information collected through cookies and similar technologies as described in Section 8.
• Payment data: Billing details, payment confirmations, and transaction information processed through our payment providers.

4. Purposes of Processing

We process your personal data for the following purposes:

• Responding to enquiries: To provide information about our services and respond to requests submitted through our contact form, email, or phone.
• Client onboarding and KYC/AML compliance: To verify your identity, conduct due diligence checks, screen against sanctions lists, and comply with Swiss legal and regulatory obligations.
• Invoicing and payment administration: To issue invoices, process payments, and manage billing relationships.
• Communication: To send service updates, compliance reminders, regulatory change notifications, and administrative communications relevant to your engagement with us.
• Website operation and improvement: To maintain, secure, and improve our Website, including analysis of usage patterns.
• Legal compliance: To comply with Swiss commercial, tax, anti-money laundering, and data protection laws, as well as any other applicable legal or regulatory obligations.
• Marketing (with consent): To send newsletters, promotional materials, or service announcements where you have provided your consent. You may withdraw consent at any time.
• We do not use your personal data for automated individual decision-making or profiling that produces legal effects concerning you.

5. Legal Basis for Processing

Our processing of your personal data is based on one or more of the following legal grounds:

(a) Contract performance and pre-contractual steps: Processing is necessary for the performance of a Service Agreement with you or to take steps at your request before entering into a contract.

(b) Legal obligation: Processing is necessary for compliance with Swiss legal obligations, including anti-money laundering legislation, commercial registry requirements, tax laws, and data protection laws.

(c) Legitimate interests: Processing is necessary for our legitimate business interests in operating and improving our services, maintaining the security of our Website, and managing our client relationships, provided those interests do not override your fundamental rights and freedoms.

(d) Consent: Where we rely on your consent (e.g., for certain marketing communications or non-essential cookies), you have the right to withdraw your consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.

6. Cookie and Similar Technologies

Our website uses cookies and similar technologies to operate securely, improve the user experience and understand how visitors use the website.

Cookies are small text files that are stored on your device when you visit a website. Similar technologies may include local storage, session storage, pixels, tags or server-side technical logs.

We may use the following categories of cookies and similar technologies:

Essential Cookies

Essential cookies are necessary for the website to function properly. They may be used for security, navigation, language preferences, session management, page loading, form protection and basic website functionality.

These cookies cannot usually be disabled through our website because they are necessary for the operation of the website.

Preference Cookies

Preference cookies may be used to remember choices you make, such as your selected language or cookie preferences, so that the website can provide a more convenient experience.

Analytics and Performance Cookies

Analytics and performance cookies may help us understand how visitors use the website, which pages are visited, whether errors occur and how the website can be improved.

Where required, these cookies are only used after you have given your consent.

Marketing or Tracking Cookies

Marketing or tracking cookies may be used to measure campaigns or show more relevant content. Swiss Virtual Offices does not use such cookies unless they are clearly disclosed and, where required, accepted by the visitor.

Managing Your Cookie Preferences

When you first visit the website, a small cookie notice may appear. You can accept cookies, reject non-essential cookies or manage your preferences where available.

You can also control or delete cookies through your browser settings. Please note that disabling certain cookies may affect the functionality of the website.

No Separate Cookie Policy

Swiss Virtual Offices does not maintain a separate cookie policy. Cookie information is included in this Privacy Policy.

Changes to Cookie Use

We may update our use of cookies and similar technologies from time to time. If our use of cookies changes materially, we will update this Privacy Policy and, where required, request renewed consent.

7. Recipients and Data Processors

We may share your personal data with the following categories of recipients, only to the extent necessary for the purposes described in this Privacy Policy:

• Public authorities: Swiss commercial registries, tax administrations (ESTV), social insurance authorities, courts, and migration authorities, where required by law or necessary for the services we provide.
• Notaries, banks, and financial institutions: For company formation, capital deposit, bank account opening, and related services.
• Professional advisors: Lawyers, tax advisors, accountants, and auditors engaged in connection with your company or our services.
• Resident directors: Where a resident director mandate has been agreed.
• Postal and courier services: For mail forwarding and parcel delivery.
• IT and cloud service providers: For hosting, email, CRM, document management, and data storage. These providers act as data processors under contractual data processing agreements.
• Payment service providers: For processing payments and invoicing.
• Analytics providers: [INSERT NAMES OF ANALYTICS PROVIDERS, if any].
• We do not sell, rent, or trade your personal data to third parties for their own marketing purposes.

8. International Data Transfers

Your personal data may be processed in Switzerland, the European Union / European Economic Area, and other countries where our service providers are located. Where data is transferred to a country that does not provide an adequate level of data protection under Swiss or EU law, we ensure appropriate safeguards are in place, including:

(a) EU Standard Contractual Clauses (SCCs) or Swiss equivalent recognised transfer instruments;

(b) Data processing agreements that reflect the requirements of applicable data protection legislation;

(c) Transfer to jurisdictions recognised by the Swiss Federal Data Protection and Information Commissioner (FDPIC) or the European Commission as providing adequate protection.

We will inform you upon request about the specific safeguards implemented for international data transfers.

9. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable Swiss law.

Specifically:

(a) Enquiries from non-clients: Retained for up to [INSERT PERIOD, e.g. 12 months] after the last contact, unless you become a client.

(b) Client data and service records: Retained for the duration of the client relationship plus the statutory retention period under Swiss commercial and tax law (typically 10 years after the end of the business relationship or financial year to which the records relate).

(c) KYC and AML documentation: Retained in accordance with Swiss anti-money laundering retention obligations [INSERT REFERENCE, e.g., typically 10 years after the end of the business relationship].

(d) Website server logs: Retained for up to [INSERT PERIOD, e.g. 30 days] unless required for security incident investigation.

(e) Marketing communications data: Retained until you withdraw consent or unsubscribe.

After the applicable retention period, your personal data will be securely deleted or anonymised.

10. Data Subject Rights

Under Swiss data protection law (FADP) and, where applicable, the GDPR, you have the following rights regarding your personal data:

• Right of access: You have the right to obtain confirmation of whether we process your personal data and to receive a copy of the data processed.
• Right to rectification: You have the right to request the correction of inaccurate or incomplete personal data.
• Right to erasure: You have the right to request the deletion of your personal data where the processing is no longer necessary or where other legal grounds for deletion apply.
• Right to restriction of processing: You have the right to request the restriction of processing under certain circumstances.
• Right to data portability: You have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to have it transmitted to another controller where technically feasible.
• Right to object: You have the right to object to processing based on legitimate interests or for direct marketing purposes.
• Right to withdraw consent: Where processing is based on consent, you have the right to withdraw your consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.
• Right to lodge a complaint: You have the right to lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC) if you consider that the processing of your personal data infringes applicable data protection law. Contact details: FDPIC, Feldeggweg 1, CH-3003 Bern, Switzerland, www.edoeb.admin.ch.

To exercise any of these rights, please contact us using the details in Section 13. We will respond to your request within the statutory timeframe (generally 30 days). We may request proof of identity before processing your request.

11. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, accidental loss, or destruction. These measures include:

(a) Encrypted data transmission using TLS/SSL protocols;

(b) Access controls and authentication measures for systems processing personal data;

(c) Secure data storage and processing environments;

(d) Data processing agreements with our service providers;

(e) Regular review of our security practices.

Please note that no method of transmission over the internet or electronic storage is completely secure. While we strive to protect your personal data, we cannot guarantee its absolute security.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or operational needs. Changes will be posted on this page with an updated "Last updated" date.

For material changes that affect your rights or our processing activities, we will notify you by email or through our Website. We encourage you to review this Privacy Policy periodically.

13. Contact

If you have any questions about this Privacy Policy, wish to exercise your data subject rights, or have concerns about our data processing practices, please contact us: