PRIVACY STATEMENT OF MAINSTRAIT AG ON THE PROCESSING OF PERSONAL DATA IN ACCORDANCE WITH APPLICABLE DATA PROTECTION LAWS AND REGULATIONS
Preamble
MainStrait AG takes care to protect your personal data collected, processed, and used in relation to business activities with MainStrait AG and during visits to our firm’s website. By engaging in any business activity with MainStrait AG or by accessing the MainStrait AG website you accept this Privacy Statement. By engaging in any business activity with MainStrait AG or by accessing the MainStrait AG website you also give consent for your data, including personal data, to be collected, processed and used by the firm.
If you do not agree with this Privacy Statement, you are required not to engage in any business relation with MainStrait AG and not to proceed to further web pages of the MainStrait AG’s website.
MainStrait AG is committed to safeguarding the personal information that it collects from individuals who engage in business relations with MainStrait AG or use this website. The firm takes reasonable precautions to keep your data secure. This statement is not applicable to any internet websites controlled by third parties not affiliated with MainStrait AG that the MainStrait AG website may link to.
The following information is intended to provide you with an overview of how your data is processed by MainStrait AG, Bellerivestrasse 59, 8008 Zürich, Switzerland (‘MainStrait AG ’) and outlines your rights under applicable data protection legislation, including the Swiss Federal Data Protection Act and its corresponding ordinance as well as the EU General Data Protection Regulation 2016/679 (GDPR), as applicable. Which specific data is processed and how it is used depends upon the requested or agreed services.
If anyone represents you in dealings with us, such as agents or attorneys, or you provide us with information about other people that is relevant to the services we provide, such as family members, this Privacy Statement also covers how we handle the data of those individuals. Please ensure that you provide these individuals with a copy of this Privacy Statement, or, alternatively, you can ask us to provide a copy directly to an individual.Contact details of the person responsible for data protection at MainStrait AG
MainStrait AG, Data Protection Officer, Bellerivestrasse 59, 8008 Zürich, Switzerland
Which data is used by MainStrait AG?
MainStrait AG processes data that it receives from you and that it generates as part of the business relationship with you. In addition to data that MainStrait AG receives directly from you, it also obtains and processes data on you that is available in the public domain (e.g. the internet, commercial registry, media, social networks) or from other authorized third parties (e.g. credit agencies, authorities).
This includes in particular:
- personal details (e.g. name, address and other contact data, date and place of birth, nationality)
- professional details (e.g. job title, work experience, knowledge of and experience in investment matters)
- identification and authentication data (e.g. identification documentation data, specimen signature)
- request data (e.g. trust distributions request orders, letters of wishes)
- data arising from the fulfilment of obligations (e.g. data required for payment transactions, trust distribution request orders, letters of wishes)
- information regarding your financial situation (e.g. origin of assets)
- keeping data (e.g. minutes of meetings or consultations)
- data on related legal entities (e.g. trusts, foundations, fiduciary structures etc., including data on beneficial owners, controlling corporate bodies, authorized signatories, beneficiaries, foundation originators and trustees)
as well as other comparable data in line with the above outlined criteria.
Special category data
MainStrait AG is required under Swiss anti-money laundering (AML) legislation to verify certain information in relation to parties to a business structure with MainStrait AG, including their source of wealth. MainStrait AG may utilize publicly accessible sources and commercial databases to do this, which may contain special category data (e.g. political opinions, offences committed or alleged to have been committed, inclusion in sanctions lists). This type of data processing is based on legal duties and does not require your explicit consent.
Cookies
Cookies are bits of text that are placed on your device when you visit our website. They may also be used to improve user experience, for security purposes and to gather website statistical data (e.g. the paths taken by visitors to this website). You have control over cookies and can refuse their use by selecting the appropriate settings on your browser. However, note that by not accepting or deleting the use of cookies, you may not be able to take full advantage of all features on this website.
For what purpose and on what legal basis does MainStrait AG use your data?
- For the fulfilment of contractual obligations
The processing of your data allows to initiate, execute and administer the business relationship and to provide the services contractually agreed with you (e.g. corporate consulting). - For the safeguarding of MainStrait AG ’s and of third-party interests
- prevention and/or investigation of criminal acts
- testing and optimisation of processes for requirement analyses or client contact
- risk management, IT security and business continuity
- assertion of legal claims and defence in legal disputes
- measures for business management purposes and for the development of new services and/or products
- collection of personal data from sources available in the public domain for the purpose of market research and business development
- On the basis of laws, rules and regulations
MainStrait AG is subject to various legal requirements (e.g. anti-money laundering legislation, tax laws, supervisory requirements). The processing of data is used, among others, for identity verification, the prevention of fraud and money laundering, the fulfilment of tax-related reporting obligations, as well as risk management. - Any other purposes as required by the firm's business activities.
By engaging in any business relations with MainStrait AG or accessing our firm’s website, you give your consent for your data to be collected, processed and used for these purposes. You are able to withdraw your consent at any time. Please note that the withdrawal of consent has no retroactive effect on the use of your data.
Marketing
MainStrait AG may use your personal information to tell you about products, services and events that we think may be of interest to you. You have the right at any time to ask us to stop sending you marketing messages. To do this, please contact MainStrait AG ’s Data Protection Officer using the details given in paragraph 1 of this document.
Who can access your data?
Within MainStrait AG, access is granted only to personnel requiring your data for the fulfilment of MainStrait AG ’s contractual and legal obligations towards you (need-to-know principle). Service providers and other agents appointed by MainStrait AG process your data for the same purpose and are obliged to protect your data to the same extent as we are. This includes companies in the areas of banking and IT services, logistics, accounting, printing services, telecommunications, consultancy, as well as sales and marketing. In addition, access may be granted to agents and advisors (including legal and other professional advisors) in any jurisdiction for the purpose of establishing and administering a fiduciary structure (e.g. third-party trust and company service providers). If MainStrait AG transfers data to external recipients, it has an obligation to ensure the confidentiality of your information is preserved. Information relating to you may therefore only be forwarded by MainStrait AG if there is a legal requirement, or should you have agreed to this (e.g. for a financial transaction on your behalf), or if MainStrait AG is authorized to issue fiduciary-related information.
Subject to these conditions, recipients of personal data can include, among others:
- public bodies and institutions (e.g. financial authorities, law enforcement authorities)
- financial services institutions or similar institutions to which MainStrait AG transfers personal data within the context of its business relationship with you (e.g. correspondent banks, custodian banks, brokers, stock exchanges, information agencies)
- Third-party service providers, fiduciary service providers, IT service providers, legal and other professional advisors
- other companies as a result of legal or regulatory obligations
Does MainStrait AG transfer data cross border?
MainStrait AG transfers your data to countries outside Switzerland and the European Economic Area where:
- it is a statutory requirement (e.g. disclosure obligations under tax law)
- it is a business requirement (e.g. contracting)
These data transfers are secured through corresponding guarantees, i.e. the EU Model Contractual Clauses approved by the European Commission and/or the Transborder Data Flow Agreement published by the Swiss Federal Data Protection and Information Commissioner to ensure an appropriate level of data protection.
If MainStrait decides to transfer your data to countries with significantly inferior data protection, it will apply additional safeguards and measures as required.
How long will your data be stored?
MainStrait AG processes and retains your data only for as long as is necessary to fulfil its contractual and legal obligations. Thereafter the data will be deleted at regular intervals, subject to statutory retention requirements. Data may also be stored for an indefinite period, if MainStrait AG requires it for a specific situation, e.g. in the event of anticipated litigation.
What are your rights under the GDPR?
The GDPR, as applicable, grants you the following rights:
- obtaining information on personal data that MainStrait AG holds on record to verify the lawfulness of processing
- demanding that the information be rectified should it be incorrect and completed should it be incomplete
- asking that your data be deleted if MainStrait AG is not permitted or is not legally obliged to retain the data
- demanding that the processing of this data be restricted, if you have disputed the accuracy of the data stored by MainStrait AG and it has not yet completed its assessment, you object to the deletion although MainStrait AG is obligated to delete the data, MainStrait AG no longer needs your data for the purposes of processing, but you require your data for the establishment, exercize or defence of legal claims, or you have objected to the processing but it has not yet been established whether this outweighs MainStrait AG ’s reasons for processing your data
- objecting to the processing by MainStrait AG, if MainStrait AG only processes the data on the basis of its legitimate interests; in this case it will cease the processing unless this is outweighed by its own interests or it needs to process the data in order to exercize its rights, or the processing is carried out with a view to direct advertising
- demanding that your personal data which you have provided to MainStrait AG be transferred in a generally useable, machine readable, and standardized format. You also have a right to lodge a complaint with the respective Data Protection Supervisory Authority
What data are you asked to supply?
In order to establish and carry out a business relationship, certain personal data is required. Without this information, it is not possible to establish a contractual relationship.
In particular, under the provisions of the Anti-Money Laundering Act (AMLA), we are obliged to verify the identity of contractual partners, beneficial owners, and other involved parties.
Is the decision-making automated?
As a basic principle, MainStrait AG does not use fully automated decision-making. If MainStrait AG does apply this procedure in exceptional cases, it will inform you accordingly if this is a statutory requirement.
Will your data be automatically processed?
In specific cases, MainStrait AG will process your data on a semi-automated basis, the aim being to evaluate personal criteria, for example to combat financial crime or do provide market analysis.
How do we deal with information from individuals under the age of 18?
The MainStrait AG website is not directed at individuals under the age of 18. Minors must receive permission from their parent or legal guardian before providing any personal data.
Where can you find the current Privacy Statement?
This Privacy Statement can be adapted at any time. You can find the applicable version at www.mainstrait.com
How can you contact MainStrait AG?
Should you have any questions about the treatment of your data, please contact your relationship manager or our Data Protection Officer who will be happy to assist you.
Zurich, September 2025