Privacy policy.

01 Controller and contact

The controller for the data processing is Aeberli Treuhand AG, unless otherwise indicated in a specific case.

Privacy enquiries can be sent — together with a copy of an ID or passport for identification — by letter or email to:

02 Collection and processing of personal data

We process personal data in particular in the following processing categories:

• Customer data of customers for whom we provide or have provided services
• Personal data we receive indirectly from our customers when delivering services
• When you visit our website
• When you use our newsletter
• When you participate in an event of ours
• When we communicate or a visit takes place
• In other contractual relationships, e.g. as a supplier, service provider or advisor
• In recruiting and applications
• When we are required to do so for legal or regulatory reasons
• When we exercise due-diligence duties or other legitimate interests, e.g. to avoid conflicts of interest, prevent money laundering or other risks, ensure data accuracy, perform credit checks, ensure security or enforce our rights

03 Categories of personal data

Which personal data we process depends on your relationship with us and the purpose for which we process it. In addition to your contact details we also process other information about you or about persons connected to you. This information may also include particularly sensitive personal data.

We collect the following categories of personal data, depending on the purpose:

• Contact information (e.g. name, address, phone number, email)
• Customer information (e.g. date of birth, nationality, marital status, profession, title, job description, ID number, AHV number)
• Risk-assessment data (e.g. credit information, commercial register data)
• Financial information (e.g. bank details)
• Engagement data, depending on the assignment (e.g. tax information, articles of association, minutes, projects, contracts, employee data such as wages and social insurance, accounting data, beneficial owners, ownership structure)
• Website data (e.g. IP address, device info, browser info, usage analytics — analysis and use of plugins, etc.)
• Application data (e.g. CV, work references)
• Marketing information (e.g. newsletter sign-up)
• Security and network data (e.g. visitor logs, access controls, network and mail scanners, phone-call logs)

Where permitted, we also obtain certain data from publicly accessible sources (e.g. debt-collection register, land register, commercial register, press, internet) or receive it from our clients and their staff, from authorities, (arbitration) courts and other third parties.

In addition to the data you give us directly, the categories of personal data we receive from third parties about you include in particular:

• Information from public registers
• Information we learn in the context of administrative and judicial proceedings
• Information related to your professional roles and activities
• Information about you in correspondence and meetings with third parties
• Credit information
• Information about you provided by people in your environment (family, advisors, legal representatives, etc.)
• Information for compliance with legal requirements such as anti-money-laundering and export restrictions
• Information from banks, insurers, distribution and other contract partners about services received from or rendered to you
• Information about you from media and the internet
• Your addresses and possibly interests and other socio-demographic data (for marketing)
• Data related to use of the website (e.g. IP address, MAC address of smartphone or computer, device info and settings, cookies, date and time of visit, pages and content accessed, features used, referring website, location)

04 Purposes of processing and legal basis

Due to its length, section 4 is preserved in the German original. Please refer to the German version for the legally binding wording.

4.1 Service delivery

We primarily process personal data we receive in the context of our engagement relationships with our clients and other contractual relationships with business partners and other involved persons.

The personal data of our clients includes in particular the following information:

• Contact information (e.g. name, address, phone number, email, other contact details)
• Personal information (e.g. date of birth, nationality, marital status, profession, title, ID number, AHV number, family circumstances, etc.)
• Risk-assessment data (e.g. credit information, commercial register data, sanctions lists, specialist databases, internet data)
• Financial information (e.g. bank details, investments or holdings)
• Engagement data, depending on the assignment, e.g. tax information, articles of association, minutes, employee data (e.g. wages, social insurance), accounting data, etc.
• Particularly sensitive personal data: this may include health data, religious views or social welfare measures, especially when we provide payroll or accounting services

We process these personal data for the described purposes on the following legal bases:

• Conclusion or execution of a contract with the data subject or in their favour, including pre-contractual measures and any enforcement (e.g. consulting, fiduciary services)
• Compliance with a legal obligation (e.g. when we exercise our duties as a statutory auditor or are required to disclose information)
• Safeguarding legitimate interests (e.g. for administrative purposes, to improve our quality, ensure security, perform risk management, enforce our rights, defend against claims, or check for potential conflicts of interest)
• Consent (e.g. to send you marketing information)

4.2 Indirect processing from service delivery

When we deliver services to our customers, we may also process personal data we did not collect directly from the data subjects, or personal data of third parties (typically employees, contacts, family members or other persons related to the customer).

4.3 Use of our website

You don't need to disclose personal data to use our website. The server records a number of user data points with each request, which are temporarily stored in server log files.

4.4 Direct communication and visits

When you contact us (e.g. by phone, email or contact form) or we contact you, we process the personal data necessary for this. For online meetings we use Zoom or Microsoft Teams; for support, TeamViewer.

4.5 Applications

You can submit your application by post or via the email address on our website. Application documents and all personal data communicated with them are treated strictly confidentially.

4.6 Suppliers, service providers, other contract partners

When we conclude a contract with you so you provide a service to us, we process personal data of you or your employees.

05 Tracking technologies

We use cookies on our website. These are small files your browser creates automatically and stores on your device (laptop, tablet, smartphone, etc.) when you visit our site.

Cookies store information related to the specific device used. This does not mean we directly learn your identity. We use so-called session cookies to recognise that you have already visited individual pages of our website. These are deleted automatically when you leave our site.

We also use temporary cookies stored for a defined period to optimise usability.

The data processed via cookies is necessary for the stated purposes. Most browsers accept cookies automatically, but you can configure your browser to refuse them or to warn you before each new cookie. Disabling cookies entirely may prevent some site features from working.

06 Web and newsletter analytics

To gain insight into the use of our website and improve our online offering, we may use web analytics tools and re-targeting technologies.

These tools are provided by third parties. The information collected about website usage is typically transmitted via cookies or similar technologies to the third party's server. Depending on the provider, those servers are abroad.

Data is normally transmitted with truncated IP addresses, preventing identification of individual devices. Third parties only transmit this information based on legal requirements or in the context of contracted data processing.

07 Data disclosure and transfer

We only disclose your data to third parties when necessary to deliver our services, when those third parties provide services to us, when we are required to do so by law or authorities, or when we have an overriding interest in the disclosure. We will also disclose personal data to third parties if you have given consent or asked us to.

The following categories of recipients may receive personal data from us:

• Branches
• Service providers (e.g. IT providers, hosting providers, cloud-storage providers, AI providers, suppliers, advisors, lawyers, insurers)
• Third parties under our legal or contractual obligations, authorities, government bodies, courts

With service providers that process personal data on our behalf we conclude contracts obliging them to ensure data protection. Most of our service providers are based in Switzerland or in the EU/EEA. Some personal data may also be transmitted to the USA or, in exceptional cases, to other countries worldwide. Where data is transmitted to countries without an adequate level of data protection, this is based on the EU standard contractual clauses or other suitable instruments.

When we receive unencrypted emails, we assume we may also reply unencrypted and that the sender consents.

08 Artificial intelligence (AI)

We use artificial intelligence (AI) for efficient engagement processing, quality assurance, error detection and to improve our processes and services. AI may be used in drafting and formulating texts, in automated analysis in specialist applications (e.g. accounting, payroll, taxes, audit) and in creating and quality-assuring reports.

In the exceptional case of a fully automated individual decision with legal effects or similarly significant impact, we will inform you separately. In such cases you have the right to express your view and to have the decision reviewed by a natural person.

09 Retention period for personal data

We process and store your personal data for as long as it is necessary to fulfil our contractual and legal obligations, or otherwise to fulfil the purposes pursued — e.g. for the duration of the entire business relationship (from inception through execution to termination of a contract) and beyond, in line with statutory retention and documentation obligations. Personal data may be retained for the period in which claims may be asserted against our company (in particular during the statutory limitation period) and as long as we are otherwise legally obliged or have legitimate business interests (e.g. evidence and documentation, possible future audit proceedings).

Once your personal data is no longer required for the above purposes, it is in principle deleted or anonymised where possible. Operational data (e.g. system logs) generally has a shorter retention period of twelve months or less.

10 Data security

We take appropriate technical and organisational security measures to protect your personal data against unauthorised access and misuse, e.g. issuing instructions, training, IT and network security solutions, access controls and restrictions, encryption of media and transmissions, pseudonymisation and controls.

11 Obligation to provide personal data

In the context of our business relationship you must provide the personal data necessary to enter into and execute a business relationship and to fulfil the related contractual obligations (you generally have no statutory obligation to provide us with data). Without this data we will not be able to enter into or execute a contract with you (or the entity or person you represent). The website also cannot be used if certain information needed to ensure data traffic (e.g. IP address) is not disclosed.

12 Your rights

In connection with our processing of personal data you have the following rights:

• Right to information about personal data stored about you with us, the purpose of processing, the origin and the recipients or categories of recipients to whom personal data is disclosed
• Right to rectification if your data is incorrect or incomplete
• Right to restriction of processing of your personal data
• Right to request erasure of the processed personal data
• Right to data portability
• Right to object to data processing or to withdraw a consent to processing of personal data at any time without giving reasons
• Right to lodge a complaint with a competent supervisory authority where legally provided

To exercise these rights, please contact the address listed in section 1.

Please note that we reserve the right to invoke the legal restrictions provided, e.g. when we are required to retain or process certain data, have an overriding interest in it (where we may invoke this) or need it to assert claims. If costs apply, we will inform you in advance.

13 Changes to the privacy policy

We expressly reserve the right to change this privacy policy at any time.

Last update: November 2025