1. General

 This data protection declaration provides information about how ARROWA AG, acting on its own responsibility in its capacity as a financial institution, acquires and processes personal data.

ARROWA AG is committed to a transparent and customer-friendly approach to handling personal data, and the protection of this personal data is a top priority for ARROWA AG.

This data protection declaration provides you with an overview of how ARROWA AG handles personal data. At the same time, you will learn about the rights you are granted under data protection law.

“Personal data” refers to all information relating to an identified or identifiable natural person.

This includes, in particular, contact or master data such as names, telephone numbers, postal and email addresses.

“Processing” refers to any handling of personal data, regardless of the means and procedures used, in particular the acquisition, storage, retention, use, modification, disclosure, archiving, deletion, or destruction of personal data.

This privacy policy is directed at interested parties, customers, and persons associated with them (e.g., family members and authorized representatives).

If you provide ARROWA AG with personal data of other persons (e.g., family members, authorized representatives), ARROWA AG assumes that you are authorized to do so and that this personal data is correct. By transmitting personal data via third parties, you confirm this. Please ensure that these persons are familiar with this privacy policy.

  1. Controller and Contact

ARROWA AG is responsible for processing your personal data. To exercise your rights, you can contact ARROWA AG as follows:

ARROWA AG

Bahnhofstrasse 40

CH-8703 Erlenbach

T +41 44 925 11 90

F +41 78 721 08 77

E info@arrowa.ch

  1. Collection and Processing of Personal Data

ARROWA AG primarily collects and processes personal data that is communicated to it by the data subject, e.g., when establishing business relationships, in the context of processing contracts, using products and services, or on websites or other applications.

It also processes personal data that arises and is transmitted in the context of using products or services. ARROWA AG may, to the extent permitted, obtain personal data from publicly accessible sources, authorities, or other third parties.

  1. Origin and Categories of Personal Data

ARROWA AG processes personal data that you provide to it (e.g., during a visit, during a consultation, when ordering marketing materials, in the context of providing services) and that is publicly accessible (e.g., in address books, in the commercial register).

ARROWA AG processes various categories of personal data.

The most important categories are the following:

  • Communication data (e.g., data in written, telephone, or electronic communications)
  • Documentation data (e.g., consultation or conversation transcripts)
  • Master and inventory data (e.g., name, address, nationality, date of birth, information regarding accounts, securities accounts, concluded transactions and contracts, information about third parties affected by data processing, such as spouses, authorized representatives, and advisors)
  • Financial data (e.g., creditworthiness data, information on assets and their origin, liabilities, risk and investment profile)
  • Transaction or order and risk management data (e.g., information on the beneficiaries of transfers, beneficiary bank, amount of transfers, information on investment products)
  • Technical data (e.g., business numbers, IP addresses, internal and external identifiers, access records)
  • Visitor and prospect data (e.g., users of the partner’s websites)

Marketing data (e.g., preferences, needs)

  • Communication data (e.g., contact details such as email address, telephone number)
  • Other data (e.g., video or audio recordings, access data)

Much of this data is provided to ARROWA AG by the data subject themselves.

The categories of personal data that ARROWA AG receives from third parties may include, in particular, information from public registers, information related to official and judicial proceedings, credit reports, information regarding compliance with legal requirements such as those related to the fight against fraud, money laundering, terrorism, and export restrictions, information from banks and other contractual partners of ARROWA AG regarding the use or provision of services, and information from the media and the internet.

  1. Your Rights

You have the right to information, rectification, erasure, restriction, objection, and – where applicable – the right to data portability. You also have the right to lodge a complaint with a competent data protection supervisory authority.

ARROWA AG accepts requests for information in writing, along with a legible copy of a valid official ID (e.g., passport, identity card, driver’s license). Contact details can be found in Section 2.

The rights to erasure and objection are not unlimited rights. Depending on the individual case, overriding interests may require further processing. ARROWA AG will examine each individual case and inform you of the outcome.

  1. Purpose of Processing

ARROWA AG processes personal data primarily to provide its own services, to process contracts with customers and business partners, and to comply with legal obligations.

In addition, ARROWA AG processes personal data, where permitted and appropriate, for the following purposes:

  • Conclusion and fulfillment of contracts, implementation, processing, and administration of products and services (e.g., invoices, payments).
  • Monitoring and managing risks (e.g., investment profiles, anti-money laundering, limits, market risks).
  • Planning, business decisions (e.g., development of new or evaluation of existing services and products).
  • Marketing, communication, information about the service offering and its review (e.g., print and online advertising, customer, prospective customer, or other events, identification of future customer needs, assessment of customer, market, or product potential).
  • Fulfillment of legal or regulatory disclosure, information, or reporting obligations to courts and authorities, fulfillment of official orders (e.g., reporting obligations to FINMA and foreign supervisory authorities, orders from public prosecutors in connection with money laundering and terrorist financing).
  • Preventing and investigating criminal offenses or other misconduct (e.g., through internal investigations).
  • Protecting the interests and securing the claims of ARROWA AG, e.g., in the event of claims against ARROWA AG or claims against third parties.
  • Ensuring operations, particularly IT, the website, and other platforms.

If consent has been given to process personal data for specific purposes (e.g., when registering for a newsletter), the personal data will be processed within the scope of and based on this consent, unless another legal basis exists and is necessary.

Consent can be revoked at any time; however, this will not affect data processing that has already taken place.

  1. Data Security

ARROWA AG is committed to ensuring that all data processing activities under its responsibility comply with applicable laws on the protection of personal data.

The protection of personal data includes appropriate technical and organizational security measures (e.g., access restrictions, firewalls, personalized passwords, encryption and authentication technologies, employee training, etc.).

  1. Disclosure to third parties and data transfer abroad

ARROWA AG discloses personal data to the following third parties (recipients) in the following cases:

  • For outsourcing purposes in accordance with Section 9 and for the purpose of customer support to other service providers.
  • For order execution, i.e., when using products or services.
  • Due to legal obligations, legal justifications, or official orders, e.g., to courts, supervisory authorities, tax authorities, or other third parties.
  • Where necessary to protect legitimate interests, e.g., in the event of legal action threatened or initiated by customers against ARROWA AG, in the event of public statements, to secure ARROWA AG’s claims against customers or third parties, in the collection of debts, etc.
  • With the consent of the data subject, to other third parties.

Recipients of personal data are usually within Germany.

In particular, when using certain products or services, personal data may also be disclosed to third parties outside Switzerland (e.g., Europe).

If a recipient is located in a country without an adequate level of data protection, ARROWA AG contractually obligates the recipient to comply with applicable data protection regulations (e.g., with standard contractual clauses), unless the recipient is already subject to a legally recognized set of rules to ensure data protection or ARROWA AG cannot rely on an exception.

  1. Outsourcing of business areas or services (outsourcing)

ARROWA AG outsources certain business areas and services, in whole or in part, to third parties.

The service providers who process personal data on behalf of ARROWA AG for this purpose (so-called processors) are carefully selected.

Whenever possible, ARROWA AG uses processors domiciled in Switzerland. The processors may be entitled to have certain services provided by third parties.

The processors may only process received personal data in the same way as ARROWA AG itself, as the sole controller, and are contractually obliged to ensure the confidentiality and security of the data.

   10. Website Use and Cookie Policy

When a person visits the ARROWA AG website, the web server automatically records details of their visit (e.g., the website from which the visit originates, the visitor’s IP address, the content of the ARROWA AG website accessed, including the date and duration of the visit).

Such tracking data is used to optimize the ARROWA AG website and provides information about how the visitor learns about and uses ARROWA AG’s products, services, and offers. However, they generally do not allow any conclusions to be drawn about the visitor’s identity. Therefore, no personal data is processed.

Furthermore, by using the ARROWA AG website, a visitor consents to the use of cookies.

Cookies are small files stored on the visitor’s computer to track the respective website visit and navigation between different pages and/or to save settings (e.g., selected language). Cookies are used to collect statistical data on the frequency and time of visits to individual website areas and help to create customized, useful, and user-friendly websites. Visitors can opt out of the use of cookies at any time by deleting the cookies set by the ARROWA AG website. Deletion is possible via the visitor’s internet browser settings.

11. Duration of Retention

The duration of retention of personal data depends on the purpose of the respective data processing and/or statutory retention and documentation obligations, which may be five, ten, or more years, depending on the applicable legal basis.

As soon as the personal data is no longer required for the above-mentioned purposes, it is generally deleted or anonymized wherever possible.

 12. Rights of Data Subjects

Anyone can request information from ARROWA AG about whether personal data concerning them is being processed.

They have the right to object, to restriction of processing, and, where applicable, to data portability. Incorrect data can be corrected. Furthermore, the deletion of personal data can be requested, unless legal or regulatory provisions (e.g., statutory retention periods for business-relevant data) or technical hurdles prevent this. The deletion of data may result in certain services no longer being provided. Furthermore, there is a right of appeal to a competent authority, where applicable. If ARROWA AG processes personal data based on consent, this consent can be revoked at any time. Please note that ARROWA AG reserves the right to assert the legally stipulated restrictions, for example, if it is obliged to retain or process certain data, has an overriding interest in doing so (to the extent that it is entitled to rely on this), or requires it to assert claims.

 13. Changes

This Privacy Policy does not form part of a contract between ARROWA AG and you.

ARROWA AG may amend this Privacy Policy at any time without prior notice. The current version published on the ARROWA AG website applies.