Privacy Policy

Last updated: 3 October 2026 · Translation of the German version, which prevails in case of discrepancy.

1. What is this privacy policy about?

This privacy policy describes how we process personal data in connection with UBOscope. It covers the website uboscope.com, the client area (Client login) and the UBOscope application, enquiries and walkthroughs, and our page on LinkedIn.

It does not cover data we process in the course of legal mandates; those are governed by the terms of the mandate and by professional secrecy. Nor does it cover client data that an institution processes in UBOscope: the institution itself is responsible for that data (see section 3.4).

If you provide us with data about other people, such as colleagues at your institution, we assume that you are entitled to do so and have informed them of this privacy policy.

2. Who is responsible for the processing?

We have not appointed a representative in the EU/EEA.

3. What data do we process, and for what purposes?

3.1 Visiting the website

When you visit uboscope.com, technically necessary data is processed: IP address, date and time, page requested, referrer, browser and operating system. We need this data to deliver the website, to keep it secure and to detect and fend off attacks.

We use no analytics or tracking services, no advertising cookies, no social media plug-ins and no embedded third-party content. Fonts are served from our own server, not from Google or any other provider.

3.2 Contact, enquiries and walkthroughs

When you write to us or request a walkthrough, we process the details you give us – typically name, business email address, institution, role and your message. We use them to answer your enquiry, arrange the session and keep the correspondence. Walkthroughs use synthetic data only; we neither need nor receive any of your institution's client data for them.

3.3 Client area (Client login)

The client area is accessible only to individually approved persons. When you sign in, we process your email address, the one-time code sent to it, the access password and details of the sign-in (time, IP address, browser). We also keep a list of approved persons and their permissions within the application. The purpose is access control and the protection of non-public content.

3.4 Use of the UBOscope application

UBOscope is in an evaluation phase. The application runs in demonstration mode with synthetic data, and no institution's client data is processed. Every document generated in demonstration mode is marked as such.

Information you enter in the application is held in your browser's storage on your device and in export files you save yourself. Our server-side components process the information needed for a determination only transiently and store no case data.

If an institution later uses UBOscope in production, the institution is the controller of the client data processed in it. Where we process such data on its behalf, we do so as a processor under a data-processing agreement concluded before any production use.

3.5 Our page on LinkedIn

We operate a company page on LinkedIn. When you interact with us there – visiting the page, following it, commenting on posts or sending us a message – we receive the information you share there and aggregated statistics from LinkedIn on how the page is used. We use this to communicate with you and to improve our content. See section 9 for details.

3.6 Other purposes

We also process personal data where necessary to comply with legal and professional obligations, to ensure IT security, to enforce or defend claims, and to organise and run our business.

4. Where does the data come from?

Most data we receive directly from you. Technical data arises when you use the website and the client area and is recorded by our hosting provider. Further data may come from publicly available sources, such as commercial registers or your professional profile, and from LinkedIn.

5. Who do we disclose your data to?

We disclose personal data only where necessary for the purposes above:

• Cloudflare (Cloudflare, Inc., USA, and affiliates) for hosting, security and access control of the client area, as a processor.
• Infomaniak (Infomaniak Network SA, Geneva) for the [email protected] mailbox, as a processor with data held in Switzerland.
• LinkedIn (LinkedIn Ireland Unlimited Company) in connection with our company page (section 9).
• Authorities and courts where we are legally obliged to, or where this is necessary to protect our rights.
• Advisers and auditors bound by a statutory or contractual duty of confidentiality.

We do not sell personal data or pass it to third parties for their own marketing.

6. Does your data go abroad?

We process your data primarily in Switzerland. Cloudflare operates a global network, so data may also be processed in other countries, in particular the USA. Cloudflare, Inc. is certified under the Swiss-U.S. and the EU-U.S. Data Privacy Framework; transfers are additionally based on the European Commission's standard contractual clauses in the form recognised by the Swiss Federal Data Protection and Information Commissioner (FDPIC). LinkedIn may transfer data to the USA and other countries and relies on its own safeguards for this.

In other cases we transfer data only where data protection law permits it, for example because you have consented or the transfer is necessary for a contract with you.

7. How long do we keep your data?

We keep personal data only as long as necessary for the purpose or as required by a statutory retention obligation. Server and access logs are deleted or anonymised after a short period. We delete enquiries and correspondence no later than 24 months after the last contact, unless a longer statutory retention period applies, for example for business correspondence under Art. 958f of the Swiss Code of Obligations. Access to the client area ends as soon as it is no longer needed.

8. How do we protect your data?

The website is served exclusively over encrypted HTTPS with strict browser security policies. The client area is protected by an access gate with a one-time email code and an access password. During the evaluation phase no case data is stored on our servers. Nobody can guarantee absolute security; we adapt our measures to the risk on an ongoing basis.

9. How do we process data on LinkedIn?

LinkedIn processes your data as an independent controller under its own terms: linkedin.com/legal/privacy-policy. For page statistics (Page Insights), we and LinkedIn are joint controllers; LinkedIn has taken primary responsibility, including for answering requests from data subjects (Page Insights Joint Controller Addendum). We receive only aggregated statistics, not profiles of individual visitors. We may moderate or remove content on our page.

10. Cookies and local storage

The website sets no analytics or advertising cookies. Cloudflare may set strictly necessary cookies to fend off attacks. After you sign in to the client area, an authentication cookie is set, and the application uses your browser's local storage for your working data. Without these, sign-in and the application do not work. You can delete cookies and local storage in your browser at any time.

11. What are your rights?

Within the limits of applicable law, you have the right to access, rectification, erasure, restriction of processing, objection to processing, and to receive or transfer your data. You may withdraw any consent at any time with effect for the future. Write to us at [email protected]; we may ask for proof of identity. Restrictions may arise from the rights of third parties, business secrets or professional secrecy.

You may also lodge a complaint with a supervisory authority: in Switzerland, the Federal Data Protection and Information Commissioner (FDPIC); in the EEA, the supervisory authority of your place of residence.

12. What applies where the GDPR applies?

We process personal data under the Swiss Federal Act on Data Protection (FADP). Where the EU General Data Protection Regulation (GDPR) applies, we rely on the following legal bases: contract and pre-contractual measures (Art. 6(1)(b) GDPR), for example for enquiries and access to the client area; legitimate interests (Art. 6(1)(f) GDPR), for example in the secure operation of the website, in communication and in developing our offering; legal obligations (Art. 6(1)(c) GDPR); and, where we ask for it, your consent (Art. 6(1)(a) GDPR).

If you do not provide the information needed for an enquiry or for access, we may be unable to handle your enquiry or grant you access.

13. Can this privacy policy change?

This privacy policy does not form part of any contract. We may amend it at any time. The version published on this page applies.