Data privacy – Inyova Impact Investing

Privacy policy

With the following information, INYOVA AG ( (hereinafter called Inyova or we) provides customers with an overview of how their personal data is processed by Inyova and their rights under data protection law. What data is processed in detail and how it is used very much depends on the services requested or agreed in each case. Customers are also requested to disclose information to current and future authorised representatives and beneficial owners. These include beneficiaries in the event of death or authorised signatories, for example.

I. Data controller

The data controller responsible for the processing of personal data within the meaning of the Swiss Data Protection Act (DSG) is:

Inyova AG
Limmatstrasse 123
CH-8005 Zurich
Switzerland

Email: [email protected]
Telephone: +41 44 271 50 00

II. Data Protection Officer

CTM-COM GmbH
Marienburgstraße 27
64297 Darmstadt
Germany

Email: [email protected]
Telephone: +49 6151 3942 72

III. General Information on Data Processing

We process personal data in accordance with the Swiss Federal Act on Data Protection (DSG) and the associated Ordinance (VDSG). Where applicable in individual cases, we also comply with the data protection regulations of the European Union.

In particular, we process personal data when you:

visit our website,
contact us,
express an interest in our services,
open a client account,
use our financial and investment services,
apply for a job with us, or
work with us as a supplier or business partner.

IV. Categories of personal data

Depending on the nature of the business relationship or the use of our website, we process different categories of personal data. These include, in particular, master data and identification data such as first name and surname, date and place of birth, nationality, identity document details, IP addresses and photographs in the context of statutory identification requirements. In addition, we process contact details such as address, telephone number and email address.

As part of our financial and investment services, we also process financial and transaction data, in particular bank details (IBAN), custody account and payment information, details of financial circumstances, investor profiles and tax information. In addition, details regarding investment objectives and preferences may be processed, for example information on risk appetite, investment objectives, knowledge and experience with financial instruments, as well as sustainability preferences, exclusion lists and wish lists.

We also process communication and usage data, such as correspondence, telephone calls, chat histories, information on the use of our website, and log and technical access data. In the context of recruitment processes, we process, in particular, application documents such as cover letters, CVs, references, interview notes and other communication data.

Where we work with suppliers, service providers or other business partners, we also process contact details and payment information.

As a general rule, we do not process special categories of personal data within the meaning of the Swiss Data Protection Act (DSG), unless this is required by law, you voluntarily provide us with such data, or the relevant information is derived from legally required identification or verification documents.

V. Purposes of processing

We process personal data in particular to carry out pre-contractual measures, to establish, perform and terminate contractual relationships, for customer support and communication, and to provide our website and online services.

Furthermore, processing takes place to fulfil legal and regulatory obligations, in particular in connection with identity checks, the prevention of money laundering and fraud, sanctions and embargo checks, tax-related control and reporting obligations, and enquiries from public authorities or courts.

Where permitted, we also process personal data to improve our services, to ensure IT security, for risk and quality management, and for marketing and analysis purposes.

VI. Legal basis for processing

The processing of personal data is carried out in accordance with the provisions of Swiss data protection law, in particular the DSG and the VDSG.

Where processing is necessary for the initiation or conduct of a business relationship, we base it on the implementation of pre-contractual measures and the performance of the contract. Furthermore, we process personal data to fulfil legal obligations, in particular those arising from financial market, anti-money laundering, tax and supervisory regulations.

Where we process personal data to safeguard legitimate interests, these include, in particular, ensuring IT security, preventing fraud and misuse, internal administration and quality assurance, as well as the assertion, exercise or defence of legal claims.

Where consent is required for specific processing activities, processing takes place exclusively on the basis of your consent. This consent may be withdrawn at any time with effect for the future.

VII. Sources of data

We generally collect personal data directly from you, for example when you use our website, communicate with us, complete forms, submit documents or make use of our services.

In addition, personal data may originate from other sources, insofar as this is necessary for the initiation of business relations, the performance of a contract or statutory audit obligations. These include, in particular, publicly accessible registers, credit reference agencies, service providers, public authorities and other persons involved in a business relationship, such as legal representatives, beneficial owners or co-applicants.

VIII. Visiting the website and log files

When you visit our website, technical information is processed automatically. This includes, in particular, the IP address of the device used, the date and time of access, the content and files accessed, the browser type and version, the operating system, the referrer URL and the name of the internet service provider.

This data is processed for the purposes of providing the website, ensuring system security and stability, analysing errors and preventing unauthorised access.

IX. Cookies and similar technologies

Our website uses cookies and similar technologies. These are small text files that are stored on your device and contain certain information.

Technically necessary cookies are used to provide basic website functions, in particular for session management, to store language settings, or to ensure the security and stability of the website.

We only use analytics, tracking and marketing technologies if you have given your consent. You can adjust or withdraw your selection at any time via the consent banner or the cookie settings.

Furthermore, you can configure your browser to block cookies or to delete them automatically. Please note that this may restrict the functionality of the website.

X. Google Analytics

Provided you have given your consent, we use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Analytics uses cookies to analyse the use of our website. In particular, information regarding page views, session duration, interactions with the website, technical device and browser information, truncated IP addresses, approximate location data and referrer information may be processed.

IP anonymisation is enabled by default. Processing takes place exclusively on the basis of your consent.

It cannot be ruled out that data may be transferred to Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Appropriate safeguards, in particular standard contractual clauses, are used for such transfers.

Further information can be found in Google’s Privacy Policy.

XI. Google Ads

Provided you have given your consent, we use Google Ads and the associated conversion tracking provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Ads enables us to display adverts in Google’s search results or on websites within the Google Display Network, and to measure the success of our advertising campaigns. To this end, cookies and similar technologies are used, which enable information about the use of our website to be processed. In particular, information about page views, clicks on adverts, conversions, technical device and browser information, IP addresses, referrer information and interactions with our website may be processed.

If you access our website via a Google advert, Google may store a cookie on your device. This cookie is used to evaluate the effectiveness of our advertising campaigns and to compile statistical analyses of user behaviour.

Processing takes place exclusively on the basis of your consent.

Further information can be found in Google’s Privacy Policy.

XII. Meta Ads

Provided you have given your consent, we use Meta Ads and the Meta Pixel provided by Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.

Meta Ads enables us to place adverts on Meta’s platforms, in particular Facebook and Instagram, and to analyse the success of our advertising campaigns. To this end, the Meta Pixel is used, which processes information about the use of our website and records certain user interactions.

In particular, information regarding page views, click behaviour, conversions, technical device and browser information, IP addresses, referrer information and interactions with our website may be processed. Furthermore, it is possible to track whether users have arrived at our website via an advert and what actions they have carried out there.

Processing takes place exclusively on the basis of your consent.

The data collected may be combined by Meta with other data from your Meta user account and used for its own advertising purposes. We have no influence over the further processing of the data by Meta.

It cannot be ruled out that data may be transferred to Meta Platforms, Inc., 1 Meta Way, Menlo Park, California 94025, USA. Appropriate safeguards, in particular standard contractual clauses, are used for such transfers.

Further information can be found in Meta’s Privacy Policy.

XIII. Recipients of personal data

Within our organisation, access to personal data is granted only to those departments that require it to fulfil their respective tasks.

In addition, personal data may be transferred to external service providers, data processors, IT and support service providers, payment and financial service providers, brokers, audit and consultancy firms, as well as to authorities and public bodies, insofar as this is necessary for the performance of a contract, to fulfil legal obligations or on the basis of your consent.

All recipients are contractually or legally obliged to treat personal data as confidential and to process it exclusively for the permitted purposes.

XIV. Transfer of Data Abroad

Personal data will only be transferred to countries outside Switzerland or outside the European Economic Area if this is necessary for the performance of a contract, if there are legal obligations, if you have given your consent, or if there are suitable safeguards ensuring an adequate level of data protection.

Where necessary, we use, in particular, standard contractual clauses or other suitable safeguards.

XV. Retention period

We store personal data only for as long as is necessary for the respective processing purposes or where statutory retention and documentation obligations apply.

Retention periods arise in particular from provisions under commercial, tax, financial markets and anti-money laundering law and typically amount to up to ten years.

Furthermore, longer storage may be necessary insofar as this is required to assert, exercise or defend legal claims. In such cases, the retention period is determined by the applicable statutory limitation periods.

XVI. Job Applications

If you apply for a job with us, we process your personal data solely for the purpose of conducting the application process and assessing your suitability for the position in question.

In doing so, we process, in particular, application documents, communication data and information from job interviews.

For application management, we use the ‘Greenhouse’ application portal provided by Greenhouse Software, Inc., USA. Where personal data is processed outside Switzerland or the European Economic Area in this context, we ensure an adequate level of data protection through appropriate safeguards.

Unless you are offered a position, application data will generally be deleted no later than six months after the conclusion of the recruitment process, unless longer retention is permitted on the basis of your consent.

XVII. Automated Decision-Making and Profiling

We use partially automated procedures for risk and fraud prevention, as well as to comply with legal obligations, particularly in connection with anti-money laundering and the detection of suspicious transactions.

In this context, existing information and transaction patterns may be analysed on the basis of defined criteria in order to identify risks at an early stage and to comply with legal requirements.

As a general rule, no decision with legal or similarly significant effects is made solely by automated means.

XVIII. Rights of data subjects

In accordance with applicable data protection law, you have, in particular, the right to access information regarding the processing of your personal data, to have inaccurate data rectified, to have data erased, to restrict processing, and to have your data disclosed or transferred in accordance with statutory provisions.

Furthermore, you may object to processing where it is based on legitimate interests. Where we process personal data on the basis of your consent, you may withdraw this consent at any time with effect for the future.

To exercise your rights, you may contact us or our Data Protection Officer at any time.

XIX. Right to lodge a complaint

If you believe that the processing of your personal data infringes applicable data protection law, you may contact the competent data protection supervisory authority.

The competent supervisory authority in Switzerland is the Federal Data Protection and Information Commissioner (FDPIC).

XX. Obligation to provide data

Certain personal data is required in order to conclude contracts, fulfil statutory audit obligations or provide services.

If this data is not provided, it may not be possible to establish or carry out a business relationship.

XXI. Updates to this Privacy Policy

We reserve the right to amend this Privacy Policy at any time, in particular in the event of changes to legal requirements, technical developments or further developments to our services.

The version currently published on this website shall apply.

Last updated: June 2026