Privacy Policy of RootBridge.

1. Contact Details 

RootBridge AG

Fröhlichstrasse 27a

8008 Zürich

Switzerland

If you have any questions about data protection or wish to exercise your rights, please contact our data protection contact person by sending an e-mail to the following address: contact@rootbridge.eu

2. Purpose of this Privacy Policy

This Privacy Policy shows how we handle personal data - already collected and in the future - and explains in particular what personal data is processed and for what purposes that personal data is processed. It also describes how collected personal data can be checked, corrected or deleted.

This Privacy Policy does not extend to any external links that lead to third-party offers and websites. These are outside our control, which is why the data protection provisions of the respective provider apply to such offers and websites.

3. Processing of personal data

Legal basis for the processing of your personal data is case-specific and is based on the law, on a contractual basis or on your consent. If the processing is necessary to safeguard a legitimate interest of Rootbridge or a third party and if your interests, fundamental rights and freedoms do not outweigh the former interest, the legal basis is the aforementioned legitimate interest of Rootbridge.

You transmit personal data to us by submitting information on the Website or by corresponding with us by phone, e-mail or otherwise.

3.1. Contact form

When contacting us via our contact address and channels (e.g. by e-mail, phone or contact form), the personal data you provide to us will be processed, such as the name of your company, your name, your e-mail address or phone number, your request and the time of receipt of the request.

This data will only be processed in order to fulfil your request (e.g. to provide you with information about our services, to improve our services, etc.).

3.2. Registering for customer account

When creating an account on our Website, we collect the following information:

1. Personal details including
   1. name (given name, family name)
   2. investor type (professional, institutional)
   3. address, postal code, city, country
2. Login data including
   1. e-mail address
   2. password

We use the personal details to confirm your identity and to check the requirements for registration. The e-mail address and password together serve as login details to ensure that the correct person is using the Website under your details.

We also require your e-mail address to verify and confirm the opening process of your account and for future communications with you required for the performance of the contract. In addition, this information will be stored in the customer account for future contracts. For this purpose, we also allow you to store other details in the account (e.g. your preferred method of payment).

We may also use the personal data to provide, protect, maintain and improve our Website and services.

You may at any time remove the information from your account, delete your account or request that we delete your account by sending us a message. To prevent misuse, you must always keep your login details confidential and should close the browser window when you have finished communicating with us, especially if you share your computer with others.

4. Disclosure of Personal Data to Third Parties

The publication of personal data to third parties relates to addresses such as our service providers (e.g. IT service providers), suppliers, subcontractors, authorities, courts, media, associations, etc.

We may disclose your personal data to third parties only if permitted by applicable data protection laws and if such disclosure is necessary to comply with a legal or contractual obligation, to protect our or any third party’s rights and property, to prevent or investigate possible misconduct in connection with the service, or to protect your personal safety.

We may only disclose your personal information if

1. We have your express consent
2. It is necessary for the establishment, exercise or defence of legal claims and there is no reason to assume that you have an overriding interest worthy of protection in the non-disclosure of your data;
3. It is necessary to comply with a legal or contractual obligation; or
4. There is an overriding private or public interest.

5. Cross-border Transfer of Personal Data

Your personal data generally is stored in databases within European Union. Under certain circumstances, however, it is necessary for us to transfer personal data to countries outside the European Union. This transfer of personal data only takes place with your knowledge and, where applicable, prior consent. Any transfer of personal data to countries whose data protection standards are not recognised as adequate by the Federal Council takes place on the basis of contractual agreements or on the basis of other guarantees that comply with the applicable law.

6. Retention Periods

We may retain your personal data for as long as necessary for the purposes for which it was collected, including, without limitation, to comply with contractual and legal obligations, to maintain accurate accounting, financial and other operational records, to resolve disputes and to enforce our rights in connection with the use of the Website.

7. Data Security

We use adequate technical and organisational security measures to protect your personal data stored by us against loss and unlawful processing, in particular against unauthorised access by third parties. Our employees and service providers are bound by us to maintain confidentiality and to comply with data protection laws.

However, data transmission over the Internet (e.g. when communicating by e-mail) may be subject to security vulnerabilities and complete protection of data against access by unauthorised third parties is not possible.

8. Cookies

When you visit our Website, we use cookies and similar technologies to ensure the proper functioning of the site, enhance your user experience, and – with your consent – analyze website usage. We use the following categories of cookies:

1. Essential cookies: These cookies are necessary for the proper functioning of the Website. They enable basic features such as security, network management, accessibility, and user login. These cookies are always active and do not require consent.
2. Analytics and preference cookies: These cookies help us understand how visitors interact with our Website and allow us to improve performance, user experience, and the relevance of content. These cookies are only used if you explicitly consent via our cookie banner.

Your Consent and Control

When you access the Website, you are shown a cookie banner allowing you to:

- Accept all cookies

- Reject all non-essential cookies

- Manually select your cookie preferences

You can update your choices at any time by clicking the cookie icon or settings button (if available). Most browsers also allow you to manage cookies via browser settings (e.g. deleting, blocking, or setting notifications). Rejecting cookies will not affect the functionality of the Website. Only marketing analytics will be disabled.

Cookies we use:

1. Analytical:
   1. Processing company with address/data recipent: GOOGLE ANALYTICS: Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland
   2. Cookie name: _ga_ TD86CS1PG8
   3. Cookie description: The analytical tool Google Analytics uses this cookie to record current session data and ensure that subsequent requests within the session window are assigned to the same session.
   4. Processed data: ISP, anonymized IP address, browser data, visit date and time, device data, location data, referral URL, user ID, order ID
   5. Storage duration: 2 years
   6. Legal basis for processing: Article 6(1)(a) GDPR Article 43(4) Electronic Communications Act
2. Analytical
   1. Processing company with address/data recipent: GOOGLE ANALYTICS: Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland
   2. Cookie name: _ga
   3. Cookie description: The analytical tool Google Analytics uses this cookie to record current session data and ensure that subsequent requests within the session window are assigned to the same session.
   4. Processed data: ISP, anonymized IP address, browser data, visit date and time, device data, location data, referral URL, user ID, order ID
   5. Storage duration: 2 years
   6. Legal basis for processing: Article 6(1)(a) GDPR Article 43(4) Electronic Communications Act
3. Analytical
   1. Processing company with address/data recipent: /
   2. Cookie name: _gid
   3. Cookie description: The analytical tool Google Analytics uses this cookie to retain the Google Analytics user ID to ensure that behavior on future visits to the same site is attributed to the same user ID.
   4. Processed data: ISP, anonymized IP address, browser data, visit date and time, device data, location data, referral URL, user ID, order ID
   5. Storage duration: 1 day
   6. Legal basis for processing: Article 6(1)(a) GDPR Article 43(4) Electronic Communications Act
4. Marketing
   1. Processing company with address/data recipent: /
   2. Cookie name: /
   3. Cookie description: Marketing cookies are used to track visitors across websites. The intention is to display ads that are relevant and engaging for the individual user, which is important for third-party advertisers and publishers.
   4. Processed data: /
   5. Storage duration: /
   6. Legal basis for processing: /

We will only use data collected via cookies for statistical purposes and will not link it to any personally identifiable information you may provide through the Website.

9. Server log files

As with any connection to a web server, the server of our web hosting provider (Hetzner Online GmbH) logs and stores certain technical information. This data includes the IP address and operating system of your device, the time of access, the type of browser and the browser request, including the origin of the request (referrer). This is necessary for technical reasons in order to make the Website available to you. The web hosting provider uses technical and organisational measures to protect this data from unauthorised access and does not pass it on to third parties. Where we process personal data, we do so in order to provide you with the best possible user experience and to ensure the security and stability of our systems.

10. Web analytics tools

In order to analyse the use of our Website, we use third party web analytics services to which your personal data may be transferred as part of the use of these services. This may involve the collection of data by the relevant service providers. You can prevent the processing of data by the web analytics services by using the opt-out mechanisms available from the relevant network operator. The available opt-out mechanisms are described in the respective privacy policy of the network operator. If you choose to opt out, you may not be able to use all the features of the Website.

Google Analytics is a web analytics service provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA ("Google"). Google Analytics uses "cookies" to help the Website analyse how you use the Website. The information generated by the cookie about your use of the Website (including your IP address, duration of use, frequency of visits to the Website, etc.) is transmitted to and stored by Google on servers in the United States.

We have activated IP anonymisation on this Website so that your IP address is shortened within the European Union and the European Economic Area. This makes it no longer possible to trace the shortened IP address back to the accessing device. Google will use this information for the purpose of evaluating your use of the Website, compiling reports on Website activity and providing other services relating to Website activity and internet usage.

Google may also transfer this information to third parties where required to do so by law, or where such third parties process the information on Google's behalf. Google will not associate your IP address with any other data held by Google. You may refuse the use of cookies by selecting the appropriate settings on your browser, however please note that if you do so, you may not be able to use the full functionality of this Website. By using the Website, you consent to the processing of personal data about you by Google in the manner and for the purposes set out above.

If you do not wish to allow Google Analytics, you can install the browser add-on (https://tools.google.com/dlpage/gaoptout) to opt out of Google Analytics at any time. For further information about Google's privacy practices in relation to Google Analytics, please visit the Google Privacy & Terms website at https://policies.google.com/privacy?hl=en or the Google Analytics Help website at https://support.google.com/analytics/answer/6004245?hl=en.

The data collected by Google Analytics is stored for as long as is necessary to analyse the Website. The data is automatically deleted after a period of 50 months at the latest.

11. Social Media

On our Website, we have included links to our profile on the social networking site LinkedIn Inc., based in Sunnyvale, California, USA, (hereinafter "LinkedIn"). LinkedIn is a web-based social network for maintaining existing business contacts and making new business connections.

By clicking on the LinkedIn icon, you will be automatically redirected to our LinkedIn profile. This establishes a direct connection between your browser and the LinkedIn server, which provides the network with the information that you visited our Website and clicked on the link.

If you click on a link while logged in to your LinkedIn account, the content of our Website may be linked to your LinkedIn account so that the network can associate your visit to our Website directly with your account. If you wish to prevent this, you should log out before clicking on these links. In any case, your access to our Website will be linked to your LinkedIn account if you log in after clicking on the link.

The nature, extent and purpose of LinkedIn's data processing are at LinkedIn's discretion. For more information on the collection and processing of data by the operator of the social network, please refer to their privacy policy, which can be found at www.linkedin.com.

12. Your Rights

If the legal requirements are met, you have the following rights as a data subject:

1. Information and access to personal data
   As a data subject, you have the right to know what personal data we are processing about you and you may at any time request that we provide you with a copy of the personal data we are processing about you. In addition, you may request information about the origin, disclosure, purpose of collection and use, the intended retention period, the logic applied in processing the personal data and, where applicable, the country to which the personal data has been disclosed.
2. Right to rectification
   We take all reasonable steps to ensure that personal data is accurate and that inaccurate or incomplete personal data is corrected, deleted or destroyed. You have the right to have inaccurate or incomplete personal data corrected and to be informed of the correction. In this case, we will inform the recipients of the data concerned of the corrections made, unless this is impossible or involves a disproportionate effort.
3. Right to erasure
   You have the right to have your personal data deleted in certain circumstances. In some cases, particularly where there is a legal obligation to retain data, the right to erasure may be excluded.
4. Right to restriction of processing
   You have the right to restrict the processing of your personal data.
5. Right to data output/data transfer
   You have the right to receive your personal data from us in a structured, commonly used and machine-readable format. You also have the right to have us transfer that data to another controller.
6. Right to object
   You may object to the processing of your data at any time.
7. Right to withdraw consent
   You have the right to withdraw your consent at any time. However, processing activities based on your consent in the past will not become unlawful as a result of your revocation.

To exercise these rights, please contact us at the e-mail address or postal address given in section 1.

You may also exercise your rights by lodging a complaint with the competent data protection authority. The competent authority is determined by your habitual residence, place of work or the location of the alleged infringement. In Switzerland, the competent authority is the Federal Data Protection and Information Commissioner (FDPIC, Feldeggweg 1, 3003 Bern, https://www.edoeb.admin.ch/edoeb/en/home.html). RootBridge AG – 21.07.2025