Thank you for your interest in our financial services. It is important to YAPEAL that your personal data is handled confidentially. In this Privacy Policy you will find information on which and how personal data of our Customers and other data subjects are processed and what rights you have in this context.
YAPEAL AG,Gartenstrasse 14, 8002 Zurich, Switzerland, ("YAPEAL"/"we") collects and processes personal data concerning the Customer or other persons (so-called "third parties").
Personal data" refers to data relating to an identified or identifiable natural person. "Particularly sensitive personal data" is a category of personal data that enjoys special protection under applicable data protection law. For example, biometric data, data relating to administrative and criminal prosecutions or sanctions, but also health data or data relating to religious, ideological, political or trade union views or activities are considered to be particularly sensitive personal data. Section 3 contains information on data that we process within the scope of this Privacy Policy. "Processing" means any handling of personal data, e.g. obtaining, storing, using, adapting, disclosing and deleting.
We use the term " data " here synonymously with "personal data".
In this Privacy Policy, we describe what happens to your data when you use the YAPEAL Website or YAPEAL Frontends, obtain YAPEAL Services, otherwise contract with us, communicate with us or otherwise deal with us.
"YAPEAL Frontends" refers to the user-visible interfaces (digital interfaces) of the YAPEAL Apps, YAPEAL Web Frontends or third-party portals approved by YAPEAL (access to YAPEAL Services via an API interface), via which Users can access the specific products and YAPEAL Services.
In addition, we may inform you separately about the processing of your data, e.g. in declarations of consent, contractual terms and conditions, additional privacy policies and notices.
If you transmit or disclose data about other persons to us, we assume that you are authorized to do so, that this data is correct and that the third parties have been informed of this Privacy Policy.
This Privacy Policy is designed to meet the requirements of the EU General Data Protection Regulation ("GDPR") and the Swiss Data Protection Act ("DPA"). However, whether and to what extent these laws are applicable depends on the individual case.
This Privacy Policy does not apply to other websites for which YAPEAL is not responsible and to which we redirect you via a link.
Our data processing concerns the following persons in particular: Our current and former Customers and persons associated with them (e.g. business partners, authorized representatives, persons entitled to receive information), beneficial owners, control holders, Users of YAPEAL Services, Cardholders, heirs, interested parties and potential Customers, persons to whom we refer products, participants in competitions, prize draws, surveys and events, visitors, contact persons and employees of business partners, personal data from third-party sources, e.g. correspondent banks in payment transactions, representatives of official bodies, auditing companies and other bodies, applicants for YAPEAL Services or other data subjects. e.g. from correspondent banks in payment transactions, representatives of official bodies, auditing companies and other bodies, applicants for employment at YAPEAL or other data subjects.
YAPEAL is responsible for the data processing described in this Privacy Policy, which is also responsible for questions and concerns in connection with data protection or in connection with the exercise of your rights (see Section 12):
YAPEAL AG
Data protection
Gartenstrasse 14
8002 Zurich
Switzerland
E-Mail: datenschutz@yapeal.ch
We have the following data protection representation pursuant to Art. 27 GDPR in the European Economic Area(EEA) including the European Union (EU) and the Principality of Liechtenstein as an additional point of contact for supervisory authorities and data subjects for inquiries in connection with the General Data Protection Regulation (GDPR):
VGS Datenschutzpartner GmbH
Am Kaiserkai 69
20457 Hamburg
Hamburg, Germany
E-Mail: info@datenschutzpartner.eu
YAPEAL processes different categories of data depending on the YAPEAL Services we provide to you. The most important categories are as follows:
Identity data:
Data to prove identity, e.g. name, date of birth, gender, residential address, including image of ID card, video or audio recording, personal image, ID card number.
Proof of certification/assessment of identity, if applicable.
Identity data can also refer to third parties (such as authorized representatives) and include, for example, signature authorizations, powers of attorney and declarations of consent.
In connection with companies, we process contact person data and professional data. We may also process information about other relationships with third parties (e.g. controlling persons or beneficial owners). Depending on the area of activity, we may also be required to examine the company in question and its employees more closely, e.g. by means of a security check.
In connection with recruitment, we process the following data in particular: Title, position, employment history, experience, immigration status, compensation with your current employer, other relevant data regarding your employment with your current employer, interview evaluations, family or other third party information.
Contact details:
Data on how the Customer can be contacted via various channels: e.g. postal addresses, e-mail addresses, telephone numbers.
Customer profile data (KYC):
KYC-related data of the Customer such as salary, occupation, account purpose or other data used to combat abuse and fraud or to comply with other legal requirements.
Data from the Customer's interaction with customer support.
Supplementary data from interaction with third parties, own investigations and other external sources.
Information and results of risk assessment(s), risk appetite, risk capacity, investment preferences and strategies.
Individual profile data or data from authorities may be particularly sensitive data.
Contract data:
Data on contractually agreed services with YAPEAL or third parties, including any supplementary data sharing agreements.
If applicable, data on the role of the Customer or User of YAPEAL Services in a company and signature rights.
Account and transaction data:
Account and card usage data, such as static account data, current and historical balances, including totals for incoming and outgoing transactions over time, including payment orders.
Counterparty data such as name, account number/IBAN, address; amount and currency.
If necessary, further data such as "Merchant Category", location of the "Point of Sale", location of the ATM, booking text (if necessary, free text with additional data such as payment purpose).
Order type, e.g. card payment, bank transfer, direct debit.
If applicable, other data reported via the YAPEAL system interface (API), such as order ID, name of the financial institution, financial institution code, location of the financial institution, date of order placement, type of order, date of order execution, amount of the order incl. currency, balance of the Customer account after execution of the order, success of order execution, fees incurred (see also section 5.6.
Technical communication data:
Log data from the interaction with the YAPEAL system and the use of YAPEAL Services such as IP address, device model, operating system version, browser version, date, time.
To ensure the functioning of these offers, we can also assign an individual code to you or your end device or system (e.g. in the form of a cookie). Technical data alone does not allow any conclusions to be drawn about your identity. However, together with the data from User accounts, registrations, access controls or the processing of contracts, for example, we can link it to other data and thus, under certain circumstances, to your person.
See also section 5.8.
Analytics data:
Pages viewed.
Contact requests and newsletter registrations.
Scroll behavior and dwell time.
Approximate location (country and city).
IP address (in abbreviated form, so that no clear assignment is possible).
Browser, internet provider, end device and screen resolution.
Which website or advertising medium brought you to YAPEAL.
See also section 5.8.
Google user data:
If you use a Google account to authenticate for specific services (e.g., API Portal), we collect the associated email address and your basic profile information (Name) to verify your identity.
We process different data from different sources depending on the situation and purpose.
We receive much of the data mentioned in Section 3 from you yourself, e.g. when you communicate with us and transmit data, visit our website or use our services or products. However, we may also obtain data from other sources, e.g. from public registers or other publicly accessible sources, from authorities or other third parties.
If you do not provide us with data that is required to fulfill legal or regulatory obligations or for the initiation, conclusion or execution of a contract or business relationship with you, YAPEAL may not be able to accept you as a Customer or provide YAPEAL Services to you.
YAPEAL processes data for the following purposes:
5.1. Establishing and managing the business relationship and identifying the Customer
We process your data when opening, processing, managing and terminating business relationships or in order to process the contract entered into with you (e.g. if you are our supplier). The type of data processed differs depending on the type and scope of the relationship and may primarily include master data, financial and risk data, order and transaction data as well as registration and communication data.
The following data is primarily collected as part of the opening of the business relationship and identification: Identification data, contact data and technical communication data (see section 3).
This is done by downloading the YAPEAL apps via an app store supported by YAPEAL (e.g. Apple, Google Play) to which you are logged in.
For authentication, you set a PIN code and can also activate login using fingerprint and/or facial recognition if the end device used supports these functions. This information will be used for all future logins in the YAPEAL Frontends. YAPEAL or the YAPEAL Frontends store this data for the purpose of enabling the secure use of the YAPEAL Frontends and YAPEAL Services. In this context, your biometric data (fingerprints and facial features) are not stored by YAPEAL or on the YAPEAL Frontends. If you have any further questions about how authentication by fingerprint or facial recognition works, it is best to contact the respective provider of this function or its end device.
YAPEAL collects and stores the necessary data as part of the identification of the Customer in accordance with FINMA Circular 2016/7 Video and Online Identification or in accordance with the CDB. This is done by the Customer entering this data via YAPEAL Frontends or sending it to us via other channels or by a contractual partner making it available to us electronically via an interface with the Customer's consent. This includes, for example, photographs of the identification documents presented and the associated data (surname, first name(s), date of birth, etc.), photographs and video recordings of the Customer, contact details (address of residence, e-mail address, cell phone number, etc.).
5.1.1. Use of Google API services for authentication
To access certain restricted areas, such as our API documentation or partner portals, we offer authentication via Google API Services.
Data Accessed: When you log in via Google, YAPEAL accesses only your Google email address and your basic profile information (name) to verify your identity.
Data Usage: This data is used exclusively to grant you access to the protected portal areas and to manage user permissions within these restricted user groups.
Restriction: No Google user data is processed or stored in the YAPEAL app, the web app, or our core systems. There is no further use or disclosure of this Google user data.
5.2. Opening and using an account
For the activation of YAPEAL Services and the corresponding opening of one or more customer accounts, the Customer collects further data, in particular customer profile data (KYC) via YAPEAL Frontends (see also section 3), e.g. professional data (employment relationship, industry, etc.), data on the purpose and scope of account use, economic entitlement or information on the controlling person, tax domicile / tax status, in particular in accordance with FATCA and AEOI, personalizable IBAN.
In the course of the business relationship or for Customers who are classified as higher risk business relationships, YAPEAL may collect additional data, e.g. origin of assets, income, education, expected transaction volumes, in order to comply with its due diligence obligations.
YAPEAL is also obliged to regularly check that the data is up to date and to have this confirmed by the Customer. The Customer can view much of this data himself in the YAPEAL Frontends and update it if necessary.
5.3. Use of payment transaction, payment card and supplementary services
As a private or business Customer, the Customer has the option of using various payment transaction and payment card services, depending on the selected account package or individual contractual agreement, to manage them largely themselves in the YAPEAL Frontends and to view them digitally at any time. In addition to identification and technical communication data, YAPEAL also processes account and transaction data (see section 3).
If the Customer makes use of supplementary or additional services that are offered in cooperation with YAPEAL's partners, supplementary contract data may be collected for the respective contractual relationship (see Section 3).
5.4. Communication and notifications
The YAPEAL app uses a notification function to transmit and display current information about the Customer's or the User's Account via "push notification", e.g. orders (credits and debits), account balance updates, etc. Through this notification function, the use of the YAPEAL app by the Customer or the User and the content of the messages are known and stored at Apple Push Notifications Service of Apple Inc ("Apple"), One Apple Park Way, Cupertino, California 95014, USA or at Google Firebase Cloud Messaging Service of Google LLC. ("Google"), 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.
YAPEAL only sends a reference in the notification, which takes the Customer or User directly to the corresponding information in the protected YAPEAL app. The Customer or User can contact the respective provider of these functions for further information on how they work.
5.5. Compliance with laws, directives and recommendations from authorities and internal regulations ("Compliance")
We process data:
to comply with legal requirements such as the fight against money laundering and sanctions;
to prevent and investigate criminal offenses and other misconduct (e.g. conducting internal investigations, data analysis to combat fraud);
for the assertion of legal claims and defense in connection with legal disputes and official proceedings;
to ensure the operation, in particular of IT, websites, apps and other platforms;
for building and system security (e.g. access control);
for business and risk management measures.
5.6. Development and market cultivation
YAPEAL also processes your data, to the extent permitted and deemed appropriate, for measures to further develop services and products, to optimize the needs analysis for customer approach and acquisition as well as for advertising and marketing, unless you have objected to the use of your data.
In addition, YAPEAL processes your data for statistical purposes. Whenever possible, we use aggregated and anonymized data for this purpose.
5.7. Customer support
If the Customer contacts YAPEAL Frontends (Customer Support, Partner Helpdesk or other support centers) via the YAPEAL Frontends, in addition to technical communication data, only the information that the Customer transmits to us during the communication is transmitted to YAPEAL. YAPEAL stores the exchange of information between the Customer and Customer Support regardless of the means of communication used.
YAPEAL Services may also use the services of external service providers to process Customer inquiries (e.g. emergency hotline) (see Section 7.4.).
5.8. Use of the YAPEAL website, analysis and tracking
When you visit the YAPEAL website (yapeal.ch), we may collect identity data, contact data, technical communication data and analytics data (see section 3).
When you visit the YAPEAL website, your browser primarily transmits technical communication data (see section 3). This data is collected and processed for the purpose of enabling the use of the YAPEAL website (connection establishment) and to ensure its long-term system security and stability. The IP address is only evaluated in the event of attacks on the YAPEAL network infrastructure and continuously in anonymized form for statistical purposes, without it being possible to draw conclusions about your person. The browser on your end device automatically sends information to YAPEAL when you visit the YAPEAL website.
Google Analytics
If you have given your consent to the use of the necessary cookies, the YAPEAL website uses Google Analytics 4, a web analytics service provided by Google LLC. The controller for Users in the EU/EEA and Switzerland is Google Ireland Limited, Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google").
Google Analytics uses cookies to help the website analyze how users use the site. The information collected by the cookies about the use of this website is usually transferred to a Google server in the USA and stored there.
In Google Analytics 4, the anonymization of IP addresses is activated by default. Due to IP anonymization, your IP address will be shortened by Google within member states of the European Union or in other contracting states of the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and shortened there. According to Google, the IP address transmitted by your browser as part of Google Analytics will not be merged with other Google data.
During your visit to the website, your user behavior is recorded in the form of "events". Events can be: page views, first visit to the website, start of the session, web pages visited, "click path", interaction with the website, scrolls, clicks on external links, internal search queries, interaction with videos, file downloads, ads viewed/clicked on, language setting. The following is also recorded: approximate location (region), date and time of the visit, IP address (in abbreviated form), technical information about the browser and the end devices used (e.g. language setting, screen resolution), internet provider, the referrer URL (via which website/advertising medium you came to this website). The reports provided by Google Analytics are used to analyze the performance of our website.
Recipients of the data are/may be:
Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (as processor pursuant to Art. 28 GDPR)
Google LLC, 1600 Amphitheatre Parkway Mountain View, CA 94043, USA
Alphabet Inc., 1600 Amphitheatre Parkway Mountain View, CA 94043, USA
The maximum lifespan of Google Analytics cookies is 2 years. You can withdraw your consent at any time with effect for the future by accessing the cookie settings and changing the selection there. This does not affect the lawfulness of the processing carried out on the basis of your consent until you withdraw it.
You can find more information on the terms of use of Google Analytics and data protection at Google at https://marketingplatform.google.com/about/analytics/terms/us/
and https://policies.google.com/privacy?hl=en.
Friendly Automate
YAPEAL uses Friendly Automate (hello.yapeal.ch) to send e-mails (e.g. newsletters or surveys) and to evaluate the behavior in e-mails and on our website. Friendly Automate is a service provided by Friendly GmbH from Switzerland, which stores all personal data exclusively on dedicated servers in Switzerland or the EU. Visitors are identified across visits and devices; information on visitor behavior is collected; presentation of relevant content based on the visitor's preferences. Emails are sent by Friendly Automate via Amazon AWS with locations in the EU. Information on the type, scope and purpose of data processing and an overview of Friendly's sub-processors can be found in Friendly's Privacy Policy: https://friendly.ch/en/privacy.
Cookies
YAPEAL uses so-called cookies on its website. Cookies are small text files that are stored on your end device (e.g. computer, smartphone, tablet) when you visit our website. The information collected by cookies is used to simplify and improve the use of the website.
The list of cookies used can be found on the YAPEAL website in the Cookiebot pop-up window under Details. YAPEAL uses Cookiebot to ensure that the use of cookies on our YAPEAL website complies with applicable data protection regulations and laws. Cookiebot analyzes the cookies used on our website and ensures that only those cookies are set that are necessary for the operation of the website or the forum or for which we have obtained your consent.
When you visit our website, you will see a cookie banner informing you about the use of cookies. You can change your cookie settings or delete cookies at any time by adjusting the settings in your browser. You can see in detail which types of data are stored in the cookies. Please note that deactivating cookies will limit the functionality of our websites.
5.9. Social networks
We may operate pages and other online presences on social networks and other platforms operated by third parties and may collect data about you there. We receive this data from you and the platforms when you come into contact with us via our online presence (e.g. when you communicate with us and comment on our content). At the same time, the platforms (i.e. not YAPEAL) evaluate your use of our online presence and link this data with other data about you known to the platforms (e.g. about your behavior and preferences). They also process this data on their own responsibility and independently of YAPEAL for their own purposes, in particular for marketing and market research purposes (e.g. to personalize advertising) and to control their platforms (e.g. what content they show you).
5.10. Applications
You can submit your application for a job to us digitally. The personal data that we process from you may include the following: Identity data, contact details (see section 3). If you provide us with information about your family or other third parties as part of your application (e.g. emergency contacts or references), we assume that the respective data subjects have been informed and have consented to you disclosing their personal data to us.
The application documents and all personal data disclosed to us will only be processed for the purpose of processing your application for employment with us. Without your consent to the contrary, your application file will be deleted after the application process has been completed, unless it is subject to a statutory retention obligation.
Personio
We use the Personio software solution for our recruitment tasks (see section 7.4). Personio also operates our recruitment website. You can find Personio's corresponding Privacy Policy for the recruitment website here: https://yapeal-ag.jobs.personio.de/privacy-policy?language=en
Personio is a provider from Germany.
Contact:
Personio SE & Co KG
Seidlstrasse 3
80335 Munich
Phone: +49 (89) 1250 1004
Due to contractual obligations
Entering into, concluding or performing a contract or business relationship with the Customer or for the fulfillment of YAPEAL's obligations arising from such a contract or business relationship.
To safeguard the legitimate interests of YAPEAL
Protecting our business, monitoring and managing risk, receiving and handling complaints, improving our YAPEAL Services and our use of technology and market research.
To fulfill legal or regulatory obligations or for the performance of tasks in the public interest
YAPEAL may be required by law or regulation to provide, disclose or transfer information about you, e.g. to fulfill control and reporting obligations under applicable financial regulations, identity verification, fraud and financial crime; also to fulfill ongoing compliance obligations, data on outgoing and incoming payments is collected, processed and stored, e.g. for AML controls, PEP, sanctions and media screening.
With the consent of the Customer
For other purposes, Customer data may be processed on the basis of their consent, which can be revoked at any time.
7.1. Other Customers (peer-to-peer payments)
YAPEAL can offer Customers the option of easily sending money to other Customers without having to enter their IBAN (peer-to-peer payments). If the Customer wishes to use this functionality, he must give his consent in the YAPEAL Frontends that he can be found by other Customers in the YAPEAL Frontends for this purpose. This consent can be revoked at any time by the Customer in the YAPEAL Frontends and can also be given again. In order to use the functionality, the Customer must also allow access to his address book so that other Customers who have given their consent to be found can be recognized by the telephone number stored in the address book. The Customer can also revoke this consent at any time and also give it again.
7.2. Persons or companies to whom the Customer transfers money
Due to legal requirements for payment service providers, we share your data (transaction data, name, IBAN) with the payee when you make a payment from your YAPEAL account.
7.3. Persons or companies transferring money to the Customer
When you receive a payment to your YAPEAL account, we will share your details with the payer (for example, your name and IBAN). This is necessary to confirm that the payment has been made to the correct account.
7.4. Service provider of YAPEAL
We work with the following categories of service providers in Switzerland and abroad who process data about you on our behalf or under joint responsibility with us or who receive data about you from us under their own responsibility in order to comply with our contractual, legal and regulatory obligations:
IT services: for the provision of our cloud services, security infrastructure and web hosting (e.g. Google, Futurae, Cyon);
Compliance: for sanctions screening, e.g. KYC spider, for supplementary video identification (e.g. Intrum) or online identification (e.g. DeepCloud);
Financial market infrastructure: access to the payment traffic network in Switzerland (e.g. Swisscom, Bottomline, SIX, SIC, SNB) and access to the payment traffic network abroad (e.g. Incore)
Card manufacturer: for the production, personalization and dispatch of our cards (e.g. TagSystems);
Payment networks, card processors, mobile payment providers: to carry out transactions with your physical debit card or with your cell phone (e.g. VISA, Marqeta, Apple Pay, Google Pay, Samsung Pay);
Register provider: for the validation of addresses and company information (e.g. Swiss Post, Moneyhouse);
Customer support: for telephone availability in emergencies (e.g. Telag)
Providers of communication services: so that we can send emails and push notifications (e.g. Apple, Google, Friendly);
Contact management (e.g. user segmentation & CRM Salesforce);
Employee recruitment: support for the recruitment process (e.g. Personio).
7.5. Partner of YAPEAL
We may share your data with partners to provide certain services you have requested in the YAPEAL Frontends or via digital interfaces. In these cases, we will only pass on your personal data if you have requested the corresponding service and have consented to the data being passed on. If we provide you with products and services, we may transfer your data to a partner. For statistical purposes, we also share your data with our partners in aggregated and/or anonymized form.
7.6. Authorities
E.g. courts, supervisory authorities, audit companies in order to fulfill our legal obligations, legal justification reasons or official orders as far as necessary to protect the legitimate interests of YAPEAL at home and abroad. The latter applies in particular in the event of legal action threatened or initiated by the Customer against YAPEAL or public statements, to secure YAPEAL's claims against the Customer or third parties and to restore contact with the Customer after contact has been broken off with the competent Swiss authorities.
7.7. Market development service provider
Providers of analysis functions, social media and advertising companies (e.g. Google, YouTube, X, LinkedIn, Facebook, Instagram).
7.8. Other third parties if you instruct us to share your personal data
If you instruct us to disclose your data to a third party, we may do so. For example, you may authorize a third party to act on your behalf (e.g. a lawyer). We may need to request proof that a third party has been validly authorized to act on your behalf.
7.9. Other persons
Data may also be disclosed to other recipients if we are obliged or authorized to do so.
We would like to point out that several Internet providers are involved in data transmission when data is transmitted via networks. It can therefore not be ruled out that third parties may access transmitted data and use it without authorization. Sensitive data should therefore never be transmitted by e-mail, text message or via other unencrypted channels. Even with encrypted transmission, the names of the sender and recipient remain recognizable. Third parties may therefore be able to draw conclusions about existing or future business relationships.
As explained in section 7, YAPEAL also discloses data to other bodies. These are not only located in Switzerland. Your data can therefore be processed both in Europe and in the USA; in exceptional cases, however, in any country in the world.
If YAPEAL transfers data to third parties in countries outside Switzerland for processing and for the free movement of data, YAPEAL ensures that the recipients of the data operate in countries with an adequate level of data protection.
If a recipient is located in a country without adequate statutory data protection, we contractually oblige the recipient to comply with the applicable data protection (we use the revised standard contractual clauses of the European Commission, which are available here: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?eliuri=eli%3Adec_impl%3A2021%3A914%3Aoj&locale=en), unless the recipient is already subject to a legally recognized set of rules to ensure data protection and we cannot rely on an exemption provision. In addition to the service providers described in section 5.8, data may also be transferred to the USA or other third countries during processing by service providers in the area of payment networks, card processors and mobile payment providers in accordance with section 7.4.
An exception may apply in particular in the case of legal proceedings abroad, but also in cases of overriding public interests or if the processing of a contract requires such disclosure, if you have given your consent or if the data in question has been made generally accessible by you and you have not objected to its processing.
We take appropriate technical and organizational measures (TOM) to protect the confidentiality, integrity and availability of your data, to protect it against unauthorized or unlawful processing and to counteract the risks of loss, unintentional modification, unwanted disclosure or unauthorized access.
All data transmission via the YAPEAL Frontends is end-to-end encrypted. All data is stored encrypted in the YAPEAL system. The keys are in the sole possession of YAPEAL.
YAPEAL's online communication is fully encrypted using the standardized TLS/SSL protocol. All orders are processed via YAPEAL Frontends, which only communicate via secure YAPEAL IT services (for approved third-party portals, the corresponding data protection regulations of these third-party providers apply). All customer data (but not transaction data) is stored in Swiss data centers.
Where possible, Customer-YAPEAL Customer communication always takes place via secure communication within the YAPEAL Frontends (see GTC YAPEAL Customer Relationship Section A 3 Communication).
YAPEAL would like to point out that data transmission via the Internet (e.g. when communicating by e-mail) may be subject to security vulnerabilities. Complete protection of data against access by third parties is not possible.
Our service providers who process Customer data on our behalf are subject to the data protection laws applicable to them. They are carefully selected by us and checked by us for compliance with the technical and organizational measures taken by them to protect the Customer's data. They are contractually obliged to process the data exclusively in accordance with YAPEAL's instructions and only for the purpose of fulfilling their contract.
YAPEAL reserves the right to analyze and evaluate data automatically in the future in order to identify essential personal characteristics of the Customer or to predict developments and create customer profiles. These are used in particular for business checks and the provision of offers and information that YAPEAL may make available to the Customer.
YAPEAL does not carry out any automated individual decisions based on customer profiles, but examines any automated negative assessments (e.g. in the area of identification, sanctions screening) individually in each case.
The duration of the storage of personal data is determined by statutory retention obligations or the purpose of the respective data processing. We store your data for as long as required by the applicable legal provisions or the purpose of the processing. We also take into account the need to protect our own interests (e.g. to enforce or defend against claims and to ensure IT security, for documentation and evidence purposes).
As a rule, YAPEAL stores the data for the duration of the business relationship or contract period and then for a further ten or more years (depending on the applicable legal basis). This corresponds to the period during which legal claims can be asserted against YAPEAL. Ongoing or anticipated legal or regulatory proceedings may result in storage beyond this period.
Retention may be technically necessary because certain data cannot be separated from others and we must therefore continue to store it together with them (e.g. in the case of backup or document management systems).
If you do not agree with our handling of your rights or data protection, please let us know (see section 2).
You have the right to request certain information about your personal data and its processing (right of access). In particular, you can request that we correct or complete incorrect or incomplete data (rectification). You can also object to the processing for certain purposes or revoke a separate consent (in each case with future effect). Under the given conditions, you can request that we transfer certain data (data portability).
You also have the option of customizing certain data (e.g. home address and email) yourself in the YAPEAL Frontends.
Withdrawal of consent may mean that YAPEAL Services are no longer available to you without restriction or that the contractual relationship with you must be terminated. This also applies in the event that you wish to delete your data. The rights to erasure and objection are not unrestricted rights. Depending on the individual case, overriding interests may make further processing necessary, e.g. certain data may be collected and stored on a legal basis, irrespective of the existence of consent.
You have the right to enforce your claims in court or to lodge a complaint with the competent data protection authority in your country. The competent data protection authority in Switzerland is the Federal Data Protection and Information Commissioner: https://www.edoeb.admin.ch/en. The competent data protection authorities in the EU can be found at the following link: https://www.edpb.europa.eu/about-edpb/about-edpb/members_en.
YAPEAL reserves the right to change this Privacy Policy at any time. The currently valid version can be viewed in the YAPEAL Frontends and at www.yapeal.ch/en/privacy-policy.
In case of doubt, the German language version of this Privacy Policy and other supplementary provisions shall take precedence over translations into other languages.
Last update of this Privacy Policy: 10.07.2026.