Privacy starts
with clarity.

Dornoch Services & Holdings AG, Gutenbergstrasse 6, 8002 Zürich, Switzerland, is the controller for applications, client relationships, managed-investment records, and this website. We process personal data in line with the Swiss Federal Act on Data Protection and, where it applies to us, Regulation (EU) 2016/679 (GDPR). This policy covers applicants, clients, beneficial owners, representatives, visitors, and people who contact us.

If we appoint a data protection officer or a representative in the EU or EEA, their details will be published on this page.

We collect the following information only where relevant to a specified purpose:

• Identity: legal name, date of birth, nationality, identity-document number and copy, address evidence, and verification results.
• Contact and account: email, telephone, correspondence address, account identifier, authentication records, and authorised representatives.
• Financial and tax: bank-account details, tax residence and identifiers, source of funds or wealth where required, employment, beneficial ownership, and payment references.
• Investment: objectives, knowledge and experience, financial position, capacity for loss, preferences, agreed mandate, holdings, orders, executions, fees, statements, and withdrawals.
• Interaction and technical: support messages, complaints, consent records, IP address, browser and device information, login events, and security logs.

We do not use biometric face matching, voiceprints, health records, or telephone recording. If we introduce any of these, we will first establish its necessity, lawful conditions, notice, retention, and safeguards. An ordinary identity-document photograph is not automatically biometric special-category data; technical identification processing changes that assessment. Criminal-offence screening is carried out only where a legal basis under applicable law permits it.

Information comes from your application, profile updates, mandate, payments and investment activity, and communications. Representatives may supply details about people they are authorised to act for. Public company and beneficial-ownership registers and lawful sanctions or politically exposed person sources may support verification.

Other sources include identity-verification providers, sending and receiving banks, brokers, custodians, and screening providers. Where we collect information about you indirectly, we will inform you within the timescales set by applicable law unless a valid exception applies.

We process personal data for the following purposes and on the following bases:

Identity, required verification, and mandate information are necessary for the relevant service; without them an application or transaction may not proceed. Marketing is optional. Accepting our terms is not consent to unrelated processing, and we do not rely on consent to avoid mandatory financial-record duties.

We disclose information only as necessary for these purposes: identity and screening providers receive verification details; banks and payment institutions receive payment instructions; brokers and custodians receive account and transaction information; hosting and support providers process relevant system or enquiry data; professional advisers receive information needed for advice or claims; competent authorities receive legally required disclosures.

Our processors are bound by data-processing agreements with confidentiality and security obligations, controlled subprocessing, and return or deletion terms. Banks, custodians, and authorities may act as independent controllers for their own legal purposes. Where joint-controller arrangements apply, responsibilities are allocated transparently.

We do not sell personal data, upload advertising audiences, run cross-site behavioural marketing, or disclose client details to investment projects merely because Dornoch invests in them. Any investor disclosure necessary for a particular structure is explained to you before commitment. We maintain a register of providers and their roles.

We aim to host client records in Switzerland or the EEA and to restrict access accordingly. A support session or subprocessor outside those areas can still create a transfer even when storage is in Europe.

Before transferring personal data to a country without an adequate level of protection, we document the destination, recipient, purpose, and lawful route. Where applicable, we rely on an adequacy decision; otherwise we use appropriate safeguards such as standard contractual clauses, with a transfer-impact assessment and supplementary measures where needed. If adequate protection cannot be achieved, we do not proceed.

We do not use consent as the default basis for routine outsourced transfers. You may request a copy or explanation of the applicable safeguards from the Privacy Team, with justified redactions.

We keep personal data only as long as needed for the purposes above, or longer where the law requires. The periods below are our standard periods; a mandatory legal period overrides a shorter one, and we do not retain an entire account indefinitely because one record is subject to a hold.

Deletion or effective anonymisation follows expiry. Every hold records its reason, scope, owner, and review date.

Depending on the applicable law, legal basis, and circumstances, you may have rights to:

Not all rights are absolute. Financial-record duties, other people’s rights, or legal exemptions can affect a request. We explain any refusal or limitation and the available complaint route. This policy cannot waive your statutory rights.

Use the Privacy Team channel to request access, correction, deletion, restriction, portability, objection, or consent withdrawal. Requests can be made in ordinary language. State the relevant account or relationship and what you need; we ask for proportionate verification only where needed.

We log requests on receipt, acknowledge them within five working days, and respond without undue delay and normally within one month. Where necessary because of complexity or the number of requests, the law allows up to two additional months; we give our reasons within the first month. The five-working-day acknowledgement is our service target, not a legal deadline.

Requests are normally free. Any fee, refusal, identity-related timing issue, or exemption must meet legal conditions and will be explained. You may complain to the supervisory authority in your place of habitual residence, place of work, or place of the alleged infringement, and seek a judicial remedy. In Switzerland, the authority is the Federal Data Protection and Information Commissioner ↗. For the EU and EEA, find your authority in the EDPB directory ↗.

Account rejection, suitability decisions, and material account restrictions receive meaningful human review. Screening alerts may support a decision but are not treated as proof of wrongdoing. You can ask for a review and correct inaccurate information.

We do not make solely automated decisions that produce legal or similarly significant effects. Before introducing one, we would complete a separate assessment, confirm a permitted legal condition, give clear information about the logic and consequences, and provide safeguards including human intervention, the chance to state your view, and the right to challenge the decision.

Investment algorithms executing a valid mandate and automated decisions about an individual are not automatically the same activity; each processing operation is assessed on its own.

We obtain your prior opt-in for analytics, advertising, and optional embedded services that access or store device information, unless an applicable exception for strictly necessary technologies applies. Strictly necessary technologies are limited to functions you explicitly request. Optional choices are separate, off by default, and as easy to reject or withdraw as to accept.

This page sets no optional cookies and so does not use a consent manager. Other pages on this site may load external resources such as chat, translation, CAPTCHA, or chart providers; where they do, we request your consent first where the law requires it.

Marketing is opt-in email only, with an unsubscribe link in every campaign and no bought lists or retargeting audiences. Service and legal notices are separate from marketing. A suppression record prevents a withdrawn address being silently resubscribed.

Our security measures include TLS for transmission, encryption of stored client records where appropriate, staff multi-factor authentication, role-based least-privilege access, quarterly access reviews, confidentiality training, vulnerability management, secure backups, and documented supplier and incident procedures.

We record and assess all suspected personal-data breaches. Where required, we notify the competent authority without undue delay and, where feasible, within 72 hours of becoming aware, unless the breach is unlikely to risk individuals’ rights and freedoms. We notify affected individuals without undue delay when high risk requires it, subject to lawful exceptions. Our providers must notify us without undue delay.

We assess high-risk processing before deployment, including by carrying out a data protection impact assessment where required. Security measures reduce risk; they do not guarantee absolute confidentiality or prevent every incident.

Our service is for adults only. We do not offer junior accounts, target children, or seek parental consent to market investments to minors. If a minor’s information is submitted, we limit its use to establishing the facts and applying an appropriate deletion or lawful retention decision.

Swiss data protection law and, where it applies, the GDPR form the baseline of this policy. National ePrivacy, AML, investment, and consumer rules also remain relevant.

We review this policy at least annually and before any material change in processing. We publish the revision date, retain previous versions, and notify affected clients directly where appropriate. We obtain new consent before starting a new consent-dependent purpose and do not use an amendment clause to create retroactive permission.

Version 1.0 — effective 17 October 2026. Read the Terms of Engagement for the separate investment relationship.