Privacy Policy

1. Data Controller

Defy-Capital is responsible for data processing within the meaning of the Swiss Federal Act on Data Protection (FADP) and, where applicable, the EU General Data Protection Regulation (GDPR).

Contact: Email info@defy-capital.ch
Address: Stammheimerstrasse 3, 8537 Uerschhausen, Switzerland

2. Subject of this Privacy Policy

This Privacy Policy describes how Defy-Capital processes personal data of investors, prospective investors, contracting parties, and website visitors.

Defy-Capital is not a financial institution within the meaning of FinIA, not a regulated asset manager, and does not operate collective investment schemes within the meaning of CISA.

Data processing takes place exclusively within the framework of private loan agreements and for internal business purposes.

3. Personal Data Collected

Defy-Capital processes only the data required for the contractual relationship or for legally required documentation.

3.1. Data of Investors / Contracting Parties

— First and last name

— Residential address

— Date of birth

— Contact information (email, phone number)

— Identification data (copy of ID, proof of residence — where necessary)

— Bank account details (for processing loans and profit payouts)

— Contract data (loan amount, contract term, compensation rate)

— Communication records (e.g. emails)

— Financial information, where voluntarily provided

3.2. Website Data (if applicable)

— IP address

— Browser information

— Date and time of access

— Cookies (technically necessary cookies only)

3.3. Sensitive Data

Defy-Capital does not collect particularly sensitive personal data unless voluntarily provided by the user.

4. Purpose of Data Processing

The data is used exclusively for the following purposes:

4.1. Contract Performance

— Conclusion and administration of profit-participating loan agreements

— Communication with the Investor

— Payout of profit participations

— Preparation of reports and performance overviews

4.2. Legal Obligations

— Compliance with civil-law documentation obligations

— Retention in accordance with Swiss tax and commercial law requirements

4.3. Security & Fraud Prevention

— Protection against fraud or unlawful activity

— Internal review and control mechanisms

4.4. Website Functionality

— Provision and optimization of the website

— Ensuring technical stability

5. Legal Basis for Processing

Depending on the applicable law, processing is based on:

Switzerland (FADP)

— Consent of the data subject

— Performance of a contract

— Overriding private interest

EU (GDPR), where applicable

— Art. 6(1)(b) (contract performance)

— Art. 6(1)(a) (consent)

— Art. 6(1)(f) (legitimate interest)

— Art. 6(1)(c) (legal obligation)

6. Disclosure of Data

Defy-Capital discloses personal data only where strictly necessary for contract performance or legally required.

Possible recipients:

— Banks and payment service providers

— Accounting / tax advisors

— IT service providers (server hosting, email systems)

— Authorities, where legally obligated

No disclosure to:

— Marketing companies

— Advertising partners

— Third parties for commercial purposes

7. Data Transfer Abroad

Where data is transferred via technical systems to countries outside Switzerland or the EU (e.g. hosting providers), this occurs exclusively:

— to countries with a recognized level of data protection, or

— using appropriate safeguards (standard contractual clauses, SCCs).

8. Retention Period

Data is stored only as long as necessary for the respective purposes:

— Contract and financial data: 10 years (statutory retention obligations)

— Communication data: up to 3 years after contract end

— Website data: per cookie and server logs (max. a few months)

After these periods expire, the data is deleted or anonymized.

9. Data Security

Defy-Capital employs technical and organizational measures to protect personal data against loss, unauthorized access, misuse, and unauthorized disclosure.

These include encrypted transmission channels, access restrictions, and regular security reviews.

10. Rights of Data Subjects

Data subjects (investors, prospective investors, website visitors) have the following rights:

— Access to stored data

— Correction of incorrect or incomplete data

— Deletion ("right to be forgotten"), provided no statutory retention obligation applies

— Restriction of processing

— Objection to data processing

— Data portability (provision in machine-readable form)

— Withdrawal of given consent at any time

Requests may be submitted at any time to the contact address given in Section 1.

11. Cookies & Tracking

Defy-Capital does not use marketing or tracking cookies. Only technically necessary cookies required for the website's functionality are used.

No analysis of user behavior for advertising purposes takes place.

12. Amendments to this Privacy Policy

Defy-Capital reserves the right to amend this Privacy Policy at any time.

The version in force at the relevant time, as published on the website or provided directly to the Investor, applies.

13. Contact for Privacy Inquiries

For questions or concerns regarding data protection: Email info@defy-capital.ch
Address: Stammheimerstrasse 3, 8537 Uerschhausen, Switzerland