1. Who we are
Helvetica Credit Investment AG, Bahnhofstrasse 64, 8001 Zürich, Switzerland, VAT CHE-383.300.010 MWST, is the controller responsible for the processing of personal data described in this policy. Our data protection contact can be reached at compliance@hcwmgroups.com. For clients in the European Union and the European Economic Area, this policy also fulfils our obligations under the General Data Protection Regulation (GDPR). For all clients it reflects the revised Swiss Federal Act on Data Protection (nFADP) in force since 1 September 2023.
2. Personal data we collect
We collect identification data such as your name, date of birth, nationality, residential address and identity document details. We collect contact data such as your email address and telephone number. We collect financial data such as wallet balances, investments, deposits, withdrawals, bank account details and digital asset addresses. We collect verification data such as copies of identity documents, proof of address, selfies and source of funds evidence. We collect technical data such as IP addresses, device identifiers, browser information, login times and session identifiers. We collect communication data such as support tickets, advisor call requests, contact messages and email correspondence. We also collect preference data such as your chosen display currency, time zone, notification settings and risk profile.
3. Why we process your data and on what legal basis
We process your data to open and administer your account and to execute investments, deposits and withdrawals, which is necessary for the performance of our contract with you. We process identification and verification data to comply with anti money laundering legislation, which is a legal obligation. We process technical and security data to protect your account and our systems, which is in our legitimate interest and in yours. We process communication data to answer your questions and resolve complaints, which is necessary for the performance of the contract and in our legitimate interest. We send marketing communications only where you have given consent, which you may withdraw at any time in your settings. We retain records to meet statutory retention obligations under Swiss commercial and anti money laundering law.
4. Automated decision making
We use automated rules to screen transactions for unusual patterns and to apply tiered limits based on verification status. These rules may delay a transaction pending human review. No decision with legal or similarly significant effect is taken solely by automated means. Every identity verification is reviewed by a member of our compliance team, and you may request human intervention regarding any automated outcome.
5. Recipients of your data
We share personal data with our payment processor to the extent necessary to create and confirm digital asset payments, with our banking partners to execute bank transfers, with our email delivery provider to send transactional messages, and with hosting and infrastructure providers who process data on our behalf under written agreements. We may disclose data to supervisory authorities, financial intelligence units, courts and law enforcement where required by law. We do not sell personal data and we do not share it with third parties for their own marketing purposes.
6. International transfers
Our systems and primary data storage are located in Switzerland. Some service providers may process data in the European Union or in the United States. Where data is transferred to a country without an adequate level of data protection recognised by the Swiss Federal Council or the European Commission, we rely on standard contractual clauses supplemented by appropriate safeguards. Copies of the relevant safeguards are available from our data protection contact.
7. How long we keep your data
Account, transaction and verification data is retained for ten years after the end of the client relationship in accordance with Swiss anti money laundering and commercial record keeping obligations. Technical logs are retained for twelve months unless required for an ongoing investigation. Marketing preferences are retained until you withdraw consent. Support communications are retained for five years after resolution. After the applicable period, data is securely deleted or irreversibly anonymised.
8. How we protect your data
We apply technical and organisational measures appropriate to the risk, including encryption in transit using transport layer security, Argon2id password hashing, storage of identity documents outside the public web root with access limited to authorised compliance staff, role based access control, an immutable audit trail of administrative actions, regular backups and security monitoring. Our staff are bound by confidentiality obligations and receive data protection training.
9. Your rights
You have the right to obtain information about the personal data we hold about you and to receive a copy of it. You have the right to have inaccurate data corrected and, subject to our retention obligations, to have data erased. You have the right to restrict processing and to object to processing based on legitimate interests. You have the right to receive the data you provided in a structured, commonly used and machine readable format. You have the right to withdraw consent at any time without affecting the lawfulness of processing before withdrawal. You may exercise these rights by writing to our data protection contact. We respond within thirty days. You also have the right to lodge a complaint with the Swiss Federal Data Protection and Information Commissioner or, if you are located in the European Union, with the supervisory authority of your member state.
10. Cookies
We use a strictly necessary session cookie to keep you signed in and to protect forms against cross site request forgery. We use a local storage entry to remember that you have acknowledged our cookie notice. We do not use third party advertising cookies. Details are set out in our Cookie Policy.
11. Children
Our services are not directed at persons under eighteen years of age and we do not knowingly collect data from them. If you believe a minor has provided us with personal data, please contact us so that we can delete it.
12. Changes to this policy
We may update this policy to reflect changes in law or in our processing activities. The date of the latest revision appears at the top of this page. Material changes will be notified to registered clients by email.
Helvetica Credit Investment AG, Bahnhofstrasse 64, 8001 Zürich, Switzerland. Registered in the Commercial Register of the Canton of Zurich. VAT CHE-383.300.010 MWST.