Legal Terms

Privacy Policy of INDIGO Tech AG

(Last updated: 25 April 2025)

1. Purpose of this Privacy Policy

2. Contact Information

Responsible entity: INDIGO Tech AGDammstrasse 166300 ZugSwitzerlandEmail: compliance@indigo-tech.ch

3. Collection and Use of Personal Data

We collect personal data when you:

• - Visit our website;
• - Contact us;
• - Register or use our services;
• - Enter into a business relationship with us;
• - Apply for a position with us.

This includes general personal data, such as your name and contact details, and, if applicable, information about your position or role with the organization on whose behalf you are contacting us. Depending on the services you request from us or we provide to you, this may also include data related to your use of our platform and services, your account activity, and necessary compliance information.

We also process personal data that we receive from third parties, such as in correspondence or meetings with clients or partners, e.g. your name and role as a team member.

To the extent necessary, we may also collect personal data from publicly accessible registers and websites, from authorities and regulators, or from third-party providers such as credit rating agencies and compliance databases (e.g., to verify signature authorization or identity) or by obtaining references (e.g., in application processes, with your consent).

Without the necessary personal data, we may not be able or legally permitted to enter into or perform a contractual relationship.

4. Purpose and Legal Basis for Processing

We process personal data for the following purposes:

• - To provide and manage our services;
• - To verify your identity and fulfil legal obligations (e.g. KYC, compliance);
• - To process your inquiries and communications;
• - To comply with contractual and legal requirements;
• - To conduct internal analytics, product development, and improve user experience;
• - To manage events, newsletters, and marketing communications (only with your consent);
• - To ensure security, detect abuse or fraud, and exercise legal rights.

The legal bases include contractual necessity, compliance with legal obligations, legitimate interests, or consent where applicable.

5. Data Storage and Retention

We store your personal data only for as long as necessary for the purposes described in this Privacy Policy or to comply with legal and regulatory obligations.

Retention periods may vary depending on the nature of the data and applicable legal requirements. In general:

• - Data required by law is retained for the statutory retention period (e.g., commercial or tax laws);
• - Contractual data is stored for the duration of the business relationship and for up to ten years after its end;
• - Job application data is stored for up to six months unless consent is given for longer retention;
• - Other data is deleted or anonymized once no longer needed.

You acknowledge that certain information processed through blockchain may not be subject to deletion.

We will update our retention practices accordingly upon obtaining our official SRO membership.

6. Security of Your Data

We implement appropriate technical and organizational security measures, including encryption, access controls, multifactor authentication, whitelisting mechanisms, regular system audits, and internal compliance procedures, to safeguard personal data against unauthorized access, loss, misuse, or alteration.

All platform infrastructure is monitored 24/7 and access is restricted to authorized individuals under the principle of least privilege.

7. Use of Our Website and Online Services

When you visit our website or use our platform, we may collect log data and technical identifiers, including browser type, device information, access times, and IP address. This data helps us ensure service stability, conduct diagnostics, and detect possible misuse.

We may also use third-party tools for analytical purposes to improve the structure, content, and performance of our services. Where applicable, IP addresses are anonymized before transmission to these providers.

We do not use personal data collected via our website to create user profiles unless explicitly consented to.

8. Disclosure of Personal Data

To achieve the purposes outlined in this policy, we may share your data with:

• - Technical, operational and compliance service providers (under contract);
• - Financial institutions and regulated partners required to process transactions;
• - Authorities, courts or regulators upon legal obligation or valid request;
• - Auditors and legal advisers;
• - Affiliated companies if necessary to provide integrated services.

Your personal data will never be sold to third parties for commercial purposes.

9. International Transfers

While we primarily store and process data in Switzerland and the EU, your data may be transferred to countries outside these jurisdictions. Where this occurs, we ensure adequate protection through mechanisms such as standard contractual clauses approved by the EU Commission and FDPIC guidelines, or legal exceptions as permitted by law.

10. Your Rights

You have the right to:

• - Request access to and information about your personal data;
• - Request correction or deletion of inaccurate or unlawfully held data;
• - Object to or restrict certain processing;
• - Receive your personal data in a structured, portable format;
• - Withdraw consent (where processing is based on consent);
• - File a complaint with the Federal Data Protection and Information Commissioner (FDPIC).

To exercise your rights, contact: compliance@indigo-tech.ch

11. Updates to this Policy

We may amend this Privacy Policy to reflect changes in our data practices or legal obligations. The current version is always available at [insert link].

12. Supervisory Authority Contact

Federal Data Protection and Information Commissioner (FDPIC)Feldeggweg 1, 3003 Bern, SwitzerlandTel: +41 58 462 43 95 Website: https://www.edoeb.admin.ch

For more information, please also see our Cookie Policy and other legal notices published on our website. Please note that certain additional data processing activities, such as interactions with third-party provider tools used for onboarding and account opening, will be governed by separate privacy disclosures presented at the point of use.