The protection of your personal data and your privacy is very important to us. As a Swiss company, we process personal data in accordance with Swiss data protection law, in particular the Federal Act on Data Protection of 25 September 2020 (FADP; SR 235.1) and the Data Protection Ordinance of 31 August 2022 (DPO; SR 235.11).
Where the EU General Data Protection Regulation (GDPR) applies to a particular processing activity, for example because we offer goods or services to persons in the European Union or the European Economic Area (Art. 3(2) GDPR), we also comply with its requirements. The references to the GDPR in this privacy policy apply only in those cases.
This privacy policy fulfils our duty to inform under Art. 19 FADP. It explains which personal data we process in connection with this website and our business activities, for what purposes, to whom we disclose it, and which rights you have.
Controller
The controller within the meaning of Art. 5 lit. j FADP is XM Ventures Ltd., Rue de la Justice 1, 2800 Delémont, Switzerland (“XM Ventures”, “we”). XM Ventures operates this website and is responsible for:
- the technical operation and security of the website;
- the processing of enquiries you send us;
- customer, supplier and business-partner relationships;
- recruitment for positions at XM Ventures; and
- contracts concluded with XM Ventures.
Our office is located at Eichengasse 3, 4702 Oensingen, Switzerland.
XM Ventures is a company of XMB Group AG. If you interact directly with another company of the XMB Group, that company is generally the controller for the related processing. It is usually the company named in the contract, application process, email correspondence or other interaction.
Privacy contact
If you have any questions about the processing of your personal data or wish to exercise your data protection rights, please contact:
XM Ventures Ltd.Data protection
Rue de la Justice 1
2800 Delémont
Switzerland
Personal data we process
Visiting the website. When you visit this website, our hosting provider automatically processes technical data needed to deliver the pages and protect the service, such as your IP address, the date and time of access, the page requested, the referring page, and your browser and operating system. This data is stored in server log files for a limited period and is not combined with other data.
Enquiries. When you contact us by email, by telephone or through the contact form, we process the information you provide, such as your name, email address, company, telephone number and the content of your message, in order to respond and, where relevant, to prepare or perform a contract.
Business relationships. For customers, suppliers and business partners, we process the contact, order and contract data required to manage the relationship.
Applications. If you apply for a position, we process the documents and information you submit for the purpose of the recruitment process.
Data from other sources. Where we do not collect personal data from you directly, we obtain it from public sources (for example the commercial register or company websites), from your employer or business partners in the context of a business relationship, or from persons who refer you to us. In these cases we process the categories of data described above, in particular contact and business data (Art. 19(3) FADP).
We do not intentionally process sensitive personal data within the meaning of Art. 5 lit. c FADP. Please do not send us such data unless it is necessary.
Purposes and principles of processing
We process personal data only for the purposes described above, for purposes that are evident from the circumstances, or as provided for by law. We observe the processing principles of Art. 6 FADP: we process personal data lawfully, in good faith and proportionately, only for purposes that are recognisable to you, and we take reasonable steps to keep it accurate.
Under Swiss law, processing personal data does not require a legal basis as long as it respects these principles. Where processing could infringe your personality rights, we rely on a justification under Art. 31 FADP: your consent, an overriding private or public interest (in particular in connection with the conclusion or performance of a contract, or our interest in operating a secure website and answering enquiries), or the law.
Where the GDPR applies, we rely on the performance of a contract or pre-contractual measures (Art. 6(1)(b) GDPR), our legitimate interests in operating a secure website and answering enquiries (Art. 6(1)(f) GDPR), compliance with legal obligations (Art. 6(1)(c) GDPR) and, where we ask for it, your consent (Art. 6(1)(a) GDPR).
Cookies, analytics and third-party content
This website does not use cookies for analytics or advertising, does not use tracking or web analytics tools and does not embed social media plug-ins. Fonts, images and the homepage film are delivered from our own website; no requests are sent to external font or video services. Our hosting provider may use strictly necessary technical cookies to deliver the website securely. Should we introduce further technologies, we will update this privacy policy beforehand.
LinkedIn company page
We maintain a company page on LinkedIn. Our website only links to it; no data is transferred to LinkedIn until you follow the link. When you visit our LinkedIn page or interact with it, LinkedIn processes your data under its own privacy policy. For page statistics (“Page Insights”), we and LinkedIn Ireland Unlimited Company may be jointly responsible for certain processing; LinkedIn is responsible for answering requests concerning that processing. Further information: www.linkedin.com/legal/privacy-policy.
Recipients of data
We disclose personal data only where required by law, where necessary to provide our contractual services, or where you have consented to the disclosure. The following categories of recipients may receive personal data: IT, hosting and email service providers; other companies of XMB Group AG, where this is necessary for the purposes described; professional advisers such as auditors, lawyers and fiduciaries; and authorities and courts where we are legally obliged to disclose data.
Service providers who process personal data on our behalf are processors within the meaning of Art. 9 FADP. They are contractually obliged to process personal data only as we would be permitted to ourselves, to follow our instructions and to guarantee data security.
Disclosure required by law
If required by law or by order of a public authority, XM Ventures may process and disclose personal data without prior notice or consent, for example to comply with a court order or another legal obligation. Where permitted by law, we will inform you of such disclosure afterwards.
XM Ventures does not sell personal data to third parties.
Disclosure abroad
We process personal data primarily in Switzerland. Our IT, hosting and email service providers may also process personal data in the member states of the European Union and the European Economic Area and in the United States of America (Art. 19(4) FADP).
The Swiss Federal Council has recognised the EU and EEA member states as providing an adequate level of data protection (Art. 16(1) FADP in conjunction with Annex 1 DPO). For the United States, this applies to recipients certified under the Swiss-U.S. Data Privacy Framework. Where we disclose personal data to a recipient in a country without an adequate level of protection, we ensure appropriate protection by means of the standard contractual clauses recognised by the Federal Data Protection and Information Commissioner (FDPIC) (Art. 16(2) lit. d FADP), supplemented by additional technical measures where necessary, or we rely on an exception under Art. 17 FADP, such as the conclusion or performance of a contract with you or your express consent.
Use of artificial intelligence and automated decisions
XM Ventures may use artificial intelligence (AI) or AI-assisted tools to support business processes, such as drafting and translating documents, handling correspondence or administrative tasks. Where AI is used to process personal data, we ensure that this complies with applicable data protection law and that appropriate technical and organisational measures are in place.
We do not take automated individual decisions within the meaning of Art. 21 FADP, that is, decisions based exclusively on automated processing that have legal effects on you or affect you significantly. Should we do so in future, we will inform you separately.
Retention
We keep personal data only as long as necessary for the purposes for which it was collected, or as long as statutory retention obligations require. Business records are generally kept for ten years under Art. 958f of the Swiss Code of Obligations. Server log data is deleted after a short period unless it is needed to investigate a security incident.
Data security
In accordance with Art. 8 FADP, we take appropriate technical and organisational measures to protect personal data against loss, unauthorised access and misuse. This website is delivered over an encrypted connection (HTTPS). If a data security breach is likely to result in a high risk to your personality or fundamental rights, we will notify the FDPIC and, where required, inform you (Art. 24 FADP).
Your rights
Under the FADP, you have in particular the following rights:
- the right to request access to your personal data (Art. 25 FADP); access is generally free of charge and provided within 30 days (Art. 18 and 19 DPO);
- the right to receive personal data you have provided to us in a common electronic format, or to have it transferred to another controller (Art. 28 FADP);
- the right to have inaccurate personal data corrected (Art. 32(1) FADP);
- the right to object to processing, to request that it be restricted or stopped, and to request the deletion of your personal data (Art. 30 and 32 FADP); and
- the right to withdraw your consent at any time with effect for the future.
These rights are subject to the restrictions provided for by law, for example where statutory retention obligations or overriding interests prevail (Art. 26 FADP). To exercise your rights, please contact us using the details above; we may ask you to prove your identity. Where the GDPR applies, you have the corresponding rights under Art. 15 to 22 GDPR.
If you believe that we do not process your personal data in accordance with the law, you can assert your claims before the civil courts (Art. 32 FADP) or report the matter to the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, www.edoeb.admin.ch. Where the GDPR applies, you may also lodge a complaint with a data protection supervisory authority in the EU or EEA.
Applicable law
This privacy policy and the processing of personal data by XM Ventures are governed by Swiss law, in particular the FADP and the DPO, subject to mandatory provisions of foreign law such as the GDPR where it applies.
Changes to this privacy policy
We may amend this privacy policy at any time. The version published on this website applies.