Transparency and compliance
Privacy and
data protection policy
Foster Swiss processes personal data in accordance with Regulation (EU) 2016/679 (GDPR), Spanish Organic Law 3/2018 (LOPDGDD) and the Swiss Federal Act on Data Protection (FADP).
Last updated: 30 September 2026
01 Data controller
Foster Swiss Société Anonyme SA
Rue de Lausanne 37 · 1201 Geneva · Switzerland
Telephone: +41 22 518 10 98
Data Protection Officer: dpo@fosterswiss.com
General enquiries: info@fosterswiss.com
02 Processing principles
- Lawfulness, fairness and transparency — we collect data lawfully and with informed consent.
- Purpose limitation — we use data only for the purposes expressly stated.
- Data minimisation — we collect only the information that is necessary and relevant.
- Accuracy — we keep data accurate and up to date.
- Integrity and confidentiality — we protect data against unauthorised access, alteration or loss.
- Accountability — we are able to demonstrate compliance with these principles.
03 Data we collect
- Contact form — name, email, telephone (optional), country of residence, wealth range, service of interest and the description of your situation.
- Wealth assessment — information about assets, jurisdictions and family structure, always with explicit consent and within a professional engagement.
- Communications — emails, call records and meeting notes.
- Technical data from the form — when you submit the form we record your IP address, the country corresponding to that IP, the browser, operating system, device type, language, time zone and the page you arrived from. This serves to assess the request, prevent abuse of the form and respond to you in your language. It is collected only at the moment of submission, not while you browse.
- Browsing data — if you consent to statistics cookies, aggregated usage data is collected through Google Analytics.
04 Legal basis
| Data | Legal basis | Purpose |
|---|---|---|
| Contact form | Consent — art. 6.1.a GDPR | Responding to your review request |
| Wealth assessment | Performance of a contract — art. 6.1.b GDPR | Providing the consultancy services engaged |
| KYC / anti-money laundering | Legal obligation — art. 6.1.c GDPR | Regulatory compliance and fraud prevention |
| Technical and security logs | Legitimate interest — art. 6.1.f GDPR | Site security and abuse prevention |
| Statistics and marketing cookies | Consent — art. 6.1.a GDPR | Measuring site usage and campaign effectiveness |
05 Recipients of the data
Data submitted through the form on this site is delivered directly to a mailbox hosted on Foster Swiss's own infrastructure. It is not sent to third-party form platforms.
In addition to our internal team (advisers, compliance and audit), your data may be disclosed to:
- Service providers — hosting and email infrastructure, and our internal client management system (CRM).
- Financial institutions — Swiss banks and authorised entities, only where necessary for the service engaged and with your knowledge.
- Competent authorities — where required by applicable law (FINMA, AEPD, tax administrations).
We do not transfer data to third parties for commercial or advertising purposes.
International transfers
Where a provider is located outside the European Economic Area, the transfer is covered by Standard Contractual Clauses or by an adequacy decision of the European Commission. Switzerland benefits from an EU adequacy decision.
06 Your rights
You may exercise the following rights at any time (arts. 15 to 22 GDPR):
- Access — obtain a copy of the data we process about you.
- Rectification — correct inaccurate or incomplete data.
- Erasure — request deletion of your data, subject to any statutory retention obligations.
- Restriction — request that we suspend processing while a complaint is resolved.
- Portability — receive your data in a structured, commonly used format.
- Objection — object to processing based on legitimate interest or to commercial communications.
- Automated decisions — not to be subject to decisions based solely on automated processing.
How to exercise them
Send your request to dpo@fosterswiss.com stating the right you wish to exercise. We will respond within one month at the latest.
08 Retention periods
- Contacts who do not become clients — 2 years from the last interaction.
- Clients — for the duration of the relationship and, thereafter, 10 years, under anti-money laundering record-keeping obligations.
- Technical logs from the form — 12 months.
09 Security measures
- Encryption in transit — TLS on all connections to this site.
- Access control — only authorised personnel access the data, with multi-factor authentication on internal systems.
- Backups — automated and encrypted.
- Periodic review — compliance and infrastructure security audits.
- Incident response — data breach notification plan within 72 hours.
10 Changes to this policy
We may update this policy when our processing activities or the applicable regulation change. Updated versions are published at this same address with the corresponding date.
11 Complaints
If you believe the processing of your data does not comply with the applicable regulation, you may contact us first at dpo@fosterswiss.com. You may also lodge a complaint with the competent supervisory authority:
- Spain — Agencia Española de Protección de Datos, www.aepd.es
- Switzerland — Federal Data Protection and Information Commissioner (FDPIC), www.edoeb.admin.ch