What we do with your data
This site does not follow you. There are no cookies, no analytics, no advertising pixels and nothing from a third party that notices you passing. We collect something only when you write to us, from the contact form or from the assistant, and below is the whole of what happens from that moment on.
Who processes the data
The controller is Goodwill Asset Management SA, Palazzo Grassi, Via Livio 14, 6830 Chiasso, Switzerland. Company identification number CHE-484.289.819, commercial register of the Canton of Ticino CH-501.3.020.350-3. Portfolio manager authorised by the Swiss Financial Market Supervisory Authority under number F01290346.
For anything concerning your data, including exercising the rights listed further down, the address is [email protected], or the telephone +41 91 225 63 52.
What we collect, and only if you write to us
There are two points in the whole site where anything is recorded, and at both of them it is you who open them and decide what to write inside.
The contact form. First name and surname, email address, telephone number if you leave one, the subject you choose from the menu, the text of the message, and the fact that you ticked the consent box.
The site assistant. The text of the questions you write to it. If you then decide to leave a contact detail or to send us the conversation, then also the name, the telephone number, the email address and the conversation in full.
Together with a request, automatically: the IP address it arrives from, the page you were reading while you wrote, how you first reached the site during this visit (a search, a link from another site, the address typed in), and the date and time.
In your browser. The assistant keeps an identifier for the conversation and the page the visit started from in session storage, and the ten year animation keeps a marker so that it does not start again on every page. It is session storage, not a cookie: it disappears when you close the tab, it is never sent to us on its own, and it is of no use in recognising you on a later visit.
Why, and under which rule
To reply to you. It is the reason you wrote. The legal basis is the performance of pre-contractual measures taken at your request, article 6 paragraph 1 letter b of European Regulation 2016/679, together with the consent you tick in the form, letter a of the same article.
To be able to show that the contact started with you. We are a Swiss company and some of the people who read us are in the European Union. The rule that allows us to reply is that the client approaches us on their own initiative, and that is something to be shown rather than declared. This is why the request is kept with the network address, the page and the referral: together they show where and when you wrote. The legal basis is legitimate interest, article 6 paragraph 1 letter f, and the interest is defending ourselves against a challenge with a document rather than with a memory.
To keep the records Swiss law obliges us to keep. Article 6 paragraph 1 letter c, and article 958f of the Swiss Code of Obligations.
Providing the data is voluntary. Without an address or a number we cannot reply to you, and that is the only consequence if you decide not to give them.
For how long
Contact requests, ten years from the last exchange, which is the length of the Swiss obligation to keep business records. They are deleted after that.
Questions put to the assistant by people who left no contact detail, twenty four months. They serve to understand what people ask and to write the answers that are missing, and nothing else. After that period they are deleted.
Deletion is not a statement of intent: it is a job that runs on our server every day and removes the expired rows.
Who sees them
The people at Goodwill Asset Management who answer the requests, and nobody else inside the company.
Outside the company one category only: the Swiss provider that hosts our email, because notice of a new request arrives by email at a company mailbox. We do not sell data, we do not pass it on, we do not exchange it and we do not process it on behalf of third parties.
If a Swiss authority asks us for it in the cases the law provides for, we are obliged to hand it over, and in some of those cases we are not allowed to tell you.
Where they are
In Switzerland. The site runs on a Swiss server and the email on a Swiss provider. No data collected by this site is transferred outside Switzerland.
If you write to us from the European Union, the movement of your data to Switzerland is covered by the adequacy decision of the European Commission, renewed on 15 January 2024: Switzerland is recognised as a country ensuring an adequate level of protection, so no additional safeguards are needed.
What this site does not do
There are no cookies of any kind, ours or anybody else's.
There is no analytics or audience measurement system of any kind. We do not know how many people read a page, nor who they are, nor when they come back.
There are no advertising pixels, no social buttons that recognise you, no embedded maps, no embedded videos, no typefaces loaded from elsewhere, and no script that is not written and served by us.
There is no profiling, there are no automated decisions concerning you, and no advertising profile is built.
There is no newsletter and there are no lists. We do not write to you unless you wrote to us, we do not buy addresses, we do not send promotional material, and we do not use for other purposes the contact detail you leave in order to get an answer.
No page on this site loads a single file from a server that is not ours: typefaces, images, stylesheets and scripts all come from gwam.ch. There is therefore no third party your browser introduces itself to while you read.
This is why you find no window asking for your consent. Consent is needed when somebody writes on your device in order to measure, to profile or to sell advertising. None of that happens here: the two things kept in session storage are there to make the page you opened work and they disappear when you close the tab. What you are reading here is a description of how the site is built, not a preference we are asking you to set.
What you can ask us
You can ask us to tell you which of your data we hold and to give you a copy of it, to correct it if it is wrong, to delete it, to restrict its use, to hand it over to you in a format another program can read, and you can object to processing based on our legitimate interest. The consent you gave in the form can be withdrawn whenever you want, and that does not make unlawful what was done before.
Write to [email protected]. We answer within a month. We do not ask for an identity document unless it is the only way to be sure the request comes from the right person.
If you believe we are getting it wrong you can turn to the Federal Data Protection and Information Commissioner, in Bern. If the European regulation applies to you, you can turn to the supervisory authority of the country where you live or work: in Italy that is the Garante per la protezione dei dati personali.
Security
Traffic to this site is encrypted. Requests end up on a machine of ours, not on a third party service, and the staff who have to answer you are the ones with access. No system is absolutely secure, and email in particular has never been: if you have something sensitive to tell us, the telephone remains the better way.
If this page changes
The date at the top says when it was last written. If something substantial changes in what we do, this page changes first.
The legal notices of the site, with the company form, the supervision and the mediation body, are on the legal notices page.