Privacy Notice

Swissgrams AG, Industriestrasse 7, 6300 Zug, Switzerland (the “Company”, “we”, “us”) is the controller responsible for the processing of personal data in connection with the operation of this website.

This privacy notice applies to the use of the Company’s website (swissgrams.com) and to personal data processed through the website, in particular via contact forms, file uploads and newsletter subscriptions. It also applies to personal data processed in connection with issuance and redemption requests and identification procedures under the Token Terms.

It does not apply to services, transactions or onboarding processes provided by third parties to which this website may refer or link.

Depending on the use of the website, we may process the following categories of personal data:

• Technical data (e.g. IP address, browser type, date and time of access)
• Contact data submitted via contact forms (e.g. name, email address, message content)
• Data contained in files voluntarily uploaded by users
• Newsletter subscription data (e.g. email address, confirmation and consent metadata)
• Usage and analytics data collected through our web analytics tool (see Section 6)
• Data provided in connection with issuance or redemption requests, self-collection or shipping and, where required by law, identification and sanctions screening (e.g. name, address, wallet address, identification and transaction data); wallet addresses and transaction data are also publicly visible on the Ethereum blockchain, which we do not control

Unless requested by us in connection with issuance or redemption requests or identification procedures, users are requested not to submit any sensitive personal data (such as identification documents, financial account data or health data) via the website.

Personal data is processed for the following purposes:

• Ensuring the technical operation, stability and security of the website
• Responding to inquiries and communications submitted via the contact form
• Processing and reviewing voluntarily submitted files
• Sending newsletters and project-related information, based on user consent
• Analysing website usage and newsletter performance (website usage based on our legitimate interests, newsletter performance based on user consent)
• Processing issuance and redemption requests under the Token Terms, including self-collection and shipping, and carrying out identification procedures and sanctions screening where required by law

Processing is based on our legitimate interests, on pre-contractual communication, on the performance of the Token Terms, on compliance with legal obligations, or on user consent, as applicable.

Newsletter subscriptions require explicit consent and are confirmed via a double opt-in procedure. Consent also covers newsletter performance analytics (such as open and click rates). Users may withdraw their consent at any time.

This website uses Matomo, a web analytics tool that we host ourselves on servers in Switzerland, to analyse website usage and improve user experience. Matomo sets first-party cookies and records usage data from the first page view (such as pages visited, time and duration of the visit, referring website, device and browser information). The data is not disclosed to third parties. The processing is based on our legitimate interest in analysing and improving the website. Users may object to it at any time by using the opt-out option below; the opt-out is stored in a cookie in the user’s browser.

This website may integrate or link to third-party services. In particular, purchase or onboarding processes facilitated via embedded or linked services are operated exclusively by the respective third-party providers under their own responsibility. The Company does not access or control the personal data processed in such third-party services.

For the technical delivery of newsletters and other email communications, we use an external email delivery service provider acting solely as a technical transmission service.

Personal data processed in connection with issuance and redemption requests is disclosed, to the extent necessary, to the custodian of the Gold Reserve, which also handles the shipping of redeemed coins, to approved redemption partners in case of self-collection, and to competent authorities where required by law.

In connection with email delivery and certain technical services, personal data (such as email addresses and delivery metadata) may be processed outside Switzerland and the European Union, in particular in the United States. Such processing is limited to what is technically necessary for the transmission of communications. Where personal data is transferred to a country without an adequate level of data protection, we rely on appropriate safeguards, in particular the standard contractual clauses approved by the European Commission and recognised by the Swiss Federal Data Protection and Information Commissioner (FDPIC), or on another lawful transfer mechanism. Where shipping of redeemed coins to an address outside Switzerland is requested, the personal data required for delivery is disclosed in the country of destination to the extent necessary for the performance of the Token Terms.

Personal data is retained only for as long as it is necessary for the purposes for which it was collected or as required by applicable legal or regulatory obligations. Data relating to inquiries is deleted once the inquiry has been dealt with and no follow-up is required; upon withdrawal of consent, the email address is marked as unsubscribed and retained, together with a record of the newsletters sent, so that no further newsletters are sent; technical log data is deleted after a short period, unless it is required for security purposes; raw analytics data recorded by Matomo is deleted after 12 months. In the absence of statutory retention requirements, personal data may be retained for an extended period where this is justified by legitimate organisational or documentation interests of Swissgrams AG.

Data subjects may request deletion of their personal data at any time, subject to overriding legal retention obligations.

Data subjects have the right to request access, rectification or deletion of their personal data, as well as to object to or restrict processing, and, where the GDPR applies, to data portability, subject to applicable law. Where processing is based on consent, consent may be withdrawn at any time. Data subjects also have the right to lodge a complaint with a competent supervisory authority, in Switzerland the Federal Data Protection and Information Commissioner (FDPIC) and, where the GDPR applies, the supervisory authority of their place of residence.

For data protection inquiries, please contact: legal@swissgrams.com.