Deep Field Capital AG - Data Protection and Privacy Policy

Data Protection and Privacy Policy

This policy explains how Deep Field Capital AG («Deep Field Capital», «we») processes personal data of clients, prospective clients, business contacts and visitors of this website («data subjects»). The guiding principle is that we use as little personal data as possible and share it only with those we can trust to keep it safe, or with authorities that are legally entitled to request it.

1. Controller

Deep Field Capital AG
Moosmattstrasse 4
6331 Hünenberg
Switzerland
UID: CHE-236.913.809, registered in the commercial register of the Canton of Zug
+41 41 511 55 88
info@deepfieldcapital.com

Please direct any questions about data protection, and any request to exercise your rights, to the address above.

2. Legal basis

As a Swiss company, we are subject to the Swiss Federal Act on Data Protection (FADP) and the Data Protection Ordinance (DPO), both in force since 1 September 2023. Where the EU General Data Protection Regulation (GDPR) applies, for example to data subjects in the EU/EEA, we also comply with its requirements. Under the GDPR, we process personal data on the basis of the performance of a contract or pre-contractual measures (Art. 6(1)(b) GDPR), compliance with legal obligations (Art. 6(1)(c) GDPR), our legitimate interests (Art. 6(1)(f) GDPR) or your consent (Art. 6(1)(a) GDPR).

3. Personal data we process

We process personal data that you share with us, such as names, postal and e-mail addresses, telephone numbers, company names and the content of our correspondence. For clients, we also process the data required to conclude and perform a portfolio management agreement and to meet our regulatory duties, including identification documents, information on beneficial ownership and the origin of assets, client classification, and account and transaction data.

When you visit this website, our hosting provider automatically records technical data in server log files (such as IP address, date and time of access, page requested and browser type). This data is used only to operate and secure the website and is not combined with other data. This website does not use cookies for tracking or analytics.

4. Purposes of processing

We process personal data in order to:
- conclude and perform contracts with our clients and business partners;
- comply with our legal and regulatory obligations, in particular under the Financial Institutions Act (FinIA), the Financial Services Act (FinSA) and the Anti-Money Laundering Act (AMLA);
- communicate with you and respond to your enquiries;
- send you publications and invitations to events, unless you have objected to this;
- ensure the security of our IT systems and this website.

We do not carry out profiling, and we do not make automated individual decisions within the meaning of Art. 21 FADP or Art. 22 GDPR. You may object to the use of your data for publications and invitations at any time by contacting us.

5. Disclosure of personal data

Personal data is accessible within Deep Field Capital only on a need-to-know basis. We disclose personal data to third parties only where this is necessary for the purposes above, in particular to:
- supervisory authorities and bodies, such as FINMA, our supervisory organisation OSFINcontrol AG and our regulatory audit firm, as well as courts and other authorities where we are legally obliged to do so;
- custodian banks, brokers and other financial service providers involved in executing a client mandate;
- service providers who process data on our behalf (processors), such as IT, e-mail and cloud providers, who are contractually bound to protect the data and to use it only on our instructions;
- professional advisers who are bound by professional secrecy.

We never sell personal data and never share it with firms that process and resell data.

6. Choice of service providers and transfers abroad

Where we use external providers, we prefer, in this order: in-house solutions; open source software whose code can be examined; Swiss providers with a strong privacy and security record; and providers that comply with at least the GDPR. We carry out a due diligence on cloud providers to which we entrust personal data and review their data protection compliance at least annually.

Personal data may be transferred to countries outside Switzerland only if the Swiss Federal Council has recognised the recipient country as providing an adequate level of data protection (Annex 1 DPO, which includes the EU/EEA member states), or if appropriate safeguards are in place. For recipients in the United States, we require that the recipient is certified under the Swiss-U.S. Data Privacy Framework (and, where the GDPR applies, the EU-U.S. Data Privacy Framework), or that the standard contractual clauses recognised by the Federal Data Protection and Information Commissioner (FDPIC) and the European Commission have been concluded. Under no circumstances do we share personal data with providers that do not meet at least these requirements.

7. Retention and deletion

We retain personal data only for as long as necessary for the purposes for which it was collected, or for as long as we are legally obliged to do so. Business records and documents relating to client relationships are generally kept for ten years after the end of the business relationship (in particular under the Swiss Code of Obligations and AMLA). We review the data we hold at least annually and delete or anonymise data that we no longer need.

8. Data security and data breaches

We take appropriate technical and organisational measures to protect personal data against unauthorised access, loss and misuse. If we detect or suspect a breach of data security, we assess its legal and regulatory implications and its possible impact on the data subjects without delay. Where required, we notify the FDPIC and any other competent authority and inform the data subjects concerned, and we work with them to minimise any harm.

9. Your rights

Subject to the applicable law, you have the following rights, which we extend to all data subjects regardless of their place of residence:
- the right to access your personal data (Art. 25 FADP, Art. 15 GDPR);
- the right to have inaccurate personal data rectified (Art. 32 FADP, Art. 16 GDPR);
- the right to have your personal data erased (Art. 32 FADP, Art. 17 GDPR), unless we are legally obliged or entitled to retain it;
- the right to restrict processing (Art. 18 GDPR);
- the right to receive your personal data in a commonly used electronic format and to have it transferred to another controller (Art. 28 FADP, Art. 20 GDPR);
- the right to object to processing (Art. 30 FADP, Art. 21 GDPR) and to withdraw any consent you have given, with effect for the future.

To exercise these rights, please contact us at the address in section 1. We may ask you to verify your identity. You also have the right to lodge a complaint with the competent data protection authority. In Switzerland, this is the Federal Data Protection and Information Commissioner (FDPIC), www.edoeb.admin.ch.

10. Changes to this policy

We may amend this policy at any time. The version published on this website applies.

Last updated: October 2026

← Back