1. PREAMBLE

XO Investments SA, Faubourg de l’Hôpital 10, 2000 Neuchâtel, CHE ID No. 105.597.899 (“XO Investments”), is authorized by FINMA as a collective investment manager within the meaning of Article 24(1)(b) of the Federal Act on Financial Institutions of June 15, 2018 (“FINIA”). XO Investments aims to provide all asset management and investment advisory services in Switzerland, particularly in the field of occupational pension provision, and any ancillary services directly or indirectly related to its purpose. More specifically, XO Investments enters into investment advisory mandates and/or asset management mandates (hereinafter the “Contract”) with its clients, both for pension institutions or institutions serving pension purposes and for private clients.

The purpose of this Personal Data Protection Charter (the “Charter”) is to ensure transparency in the processing carried out by XO Investments prior to or in connection with the conclusion of the Agreement, or during the performance of the Agreement. In this way, XO Investments fulfills its obligation to provide information as set out in Article 19 of the Federal Data Protection Act of September 25, 2020 (the “FADP”).

Personal data is defined by the FADP as any data relating to an identified or identifiable natural person (e.g., name, telephone number, address, position, assets). A person is identifiable if they can be identified directly or indirectly, in particular by reference to an identifier such as location data, an online identifier, or an IP address.

The Charter provides the information necessary for any Data Subject to exercise their rights over their personal data. The “Data Subject(s)” referred to in the Charter are the natural persons whose personal data is processed by XO Investments.

2. STATUS OF XO INVESTMENTS WITH REGARD TO THE DPA

In the above context, XO Investments is the Data Controller within the meaning of Article 5(j) of the DPA, i.e. XO Investments determines the purposes and means of processing personal data.

As Data Controller, XO Investments undertakes to process the personal data entrusted to it in this context in a lawful, fair and transparent manner. The processing of personal data also complies with the principle of data minimization, i.e., only personal data that is strictly necessary for the purpose determined by XO Investments (see Article 2 of this Charter) is processed.

For any information concerning the personal data processed, Data Subjects may contact XO Investments:

By mail at the following address: Faubourg de l’Hôpital 10, 2000 Neuchâtel
By email: info@xoinvestments.ch

3. PURPOSES OF PERSONAL DATA PROCESSING

XO Investments only processes data that is strictly necessary for the purposes pursued. Thus, the processing of personal data may be necessary to prepare for the performance or to perform a contract, or to comply with legal or regulatory obligations. It may also be based on the legitimate interests of XO Investments, as well as on the prior consent of the Data Subjects, which they may withdraw at any time, in accordance with the terms set out in Article 11 of this Charter.

The purposes of personal data processing within the framework of the Contract or prior to its conclusion are as follows:

Compliance with applicable regulations on anti-money laundering and counter-terrorist financing, in particular the Money Laundering Act and its implementing orders, which impose extensive duties on XO Investments with regard to the identification of prospects, clients, and (ultimate) beneficial owners, and the understanding and monitoring of their operations and transactions;

The processing of requests from the competent judicial or administrative authorities;

Processing requests for external audits;
Archiving or any other obligation as required by applicable regulations;
Performing services under the Contract: in particular, establishing the client’s risk profile, taking into account detailed information on their financial situation, investment knowledge and experience, and investment objectives;
Monitoring and administrative management of the Contract (issuing invoices and receiving payments, managing any complaints);
Processing requests to exercise the rights of Data Subjects in accordance with Article 11 of this Charter;
The enforcement of XO Investments’ claims through legal or other means;
The creation of a customer database;
The implementation of marketing/prospecting activities for new customers (e.g., sending newsletters, invitations to events organized by XO Investments);
Providing mandates for private clients to NextView SA, a partner company of XO Investments;
Ensuring the proper functioning of the XO Investments website and improving the user experience of the site through the use of cookies (see Article 9 of this Charter).

4. SOURCES USED TO COLLECT PERSONAL DATA

In order to pursue the purposes mentioned in Article 2 of this Policy, XO Investments collects or receives personal data through the following sources:

Directly from Data Subjects, for example when they contact XO Investments or through (pre)contractual documents they send to XO Investments; and/or
Indirectly from other external sources, including publicly available sources (e.g., the internet, lists of persons subject to international sanctions), sources available through subscription services (e.g., Bloomberg, World Compliance), or information provided by other third parties.

5. CATEGORIES OF PERSONAL DATA PROCESSED

Depending on the purposes listed in Article 2 of this Charter, XO Investments processes different categories of personal data, including:

Identification data: surname, first name, postal address, email address, date of birth, gender, telephone number, identity document, social security number, tax identification number;
Data relating to family situation: marital status, number of children;
Financial data and data relating to assets: details of the client’s knowledge and experience according to the type of asset, income, wealth, previous investments, transaction details, asset allocation, debts, liquidity, investment horizon, risk tolerance, generally derived from the investment profile and risk profile linked to the Contract; bank details; extract from the debt collection register;
Data relating to professional status: profession, employer, qualifications, CV, work permit;
Data from external sources: details available on the internet or in public databases (e.g. sanctions lists) or private databases (e.g. information on legal or administrative proceedings, PEP status);
Internet data: electronic identification data (IP address, browser, identification information); data provided via online contacts and/or collected through browser cookies (e.g., language preferences, see Article 9 of this Policy).

XO Investments processes sensitive personal data (e.g., criminal records, information concerning proceedings) solely in order to comply with a Swiss legal or regulatory obligation.

6. DISCLOSURE OF PERSONAL DATA TO THIRD PARTIES

XO Investments may disclose or make personal data available to the following categories of recipients:

Government, legal, tax, and regulatory authorities, or similar authorities, when necessary;

To XO Investments’ external auditors;
To banking institutions;
To business introducers, accountants, tax advisors, legal advisors, trustees, and any other service providers;
To XO Investments’ subcontractors, such as IT service providers.

XO Investments may also be required to disclose personal data in the context of its partnership with NextView SA, in particular when it refers clients to NextView SA who are seeking the services provided by the latter, such as family office services, more specifically wealth and tax advice, as well as advice on mergers and acquisitions (M&A transactions).

7. TRANSFER OF PERSONAL DATA OUTSIDE SWITZERLAND

In connection with the performance of the Agreement, primarily when the custodian bank for the client’s assets is located outside Switzerland, or when it collaborates with third-party service providers outside Switzerland in the interests of its clients, XO Investments may be required to transfer personal data relating to Data Subjects to a third country.

In this case, XO Investments undertakes to ensure that this transfer is carried out under conditions that guarantee a level of personal data protection equivalent to that provided for by the FADP, which is particularly the case if the recipient country benefits from an adequacy decision by the Federal Council, in accordance with Annex 1 of the Data Protection Ordinance.

In the absence of such an adequacy decision, XO Investments may transfer personal data abroad if an appropriate level of protection is guaranteed by:

An international treaty;
The data protection clauses included in the contracts concluded between XO Investments and its co-contractors, previously communicated to the Federal Data Protection and Information Commissioner (FDPIC);
Standard data protection clauses previously approved, established or recognized by the FDPIC, and included in contracts between XO Investments and its contractors (Standard Contractual Clauses, SCC); or
Binding corporate rules previously approved by the FDPIC or by a data protection authority of a country that ensures an adequate level of protection (Binding Corporate Rules, BCR).

XO Investments may also transfer personal data abroad if the Data Subject has expressly consented to the transfer, or if the transfer is directly related to the conclusion or performance of a contract between XO Investments and the Data Subject, or between XO Investments and its co-contractor in the interest of the Data Subject.

8. SECURITY AND CONFIDENTIALITY MEASURES FOR PERSONAL DATA

XO Investments has put in place the necessary technical and organizational measures, taking into account the nature of the data processed, to ensure its security and confidentiality.

Only the bodies and employees of XO Investments involved in the performance of the Contract or other tasks mentioned in Article 2 of this Charter will have access to the personal data collected.

XO Investments and all its bodies and employees are subject to the obligation of professional secrecy in accordance with Article 69 FinIA.

Subcontractors are also subject to an obligation of confidentiality and data security in accordance with Article 9 LPD and the clauses contained in the contracts they enter into with XO Investments.

9. RETENTION OF PERSONAL DATA

XO Investments deletes personal data as soon as its retention is no longer reasonably necessary for the specific purposes mentioned in Article 2 of this Charter or if consent is withdrawn (where applicable), unless its retention is required by any applicable law. In particular, XO Investments retains personal data in order to fulfill its legal and tax obligations, for evidentiary purposes, to conduct internal audits, to respond to requests for information from the competent authorities, or to exercise and/or defend its rights in court, until the end of the necessary retention period or the settlement of the claim in question.

10. COOKIES

XO Investments uses cookies on its website. Cookies are small text files placed on the computer, smartphone, or other device used by people visiting its website. XO Investments uses two types of cookies:

Cookies related to the session on the website, which are technically necessary for the proper functioning of the site (“session cookies”). These cookies are automatically deleted as soon as the Data Subject leaves the website.
Cookies that distinguish users in order to offer them an improved browsing experience on its website (“functional cookies”). XO Investments only uses functional cookies if Data Subjects have given their prior consent via the banner displayed on the XO Investments website. Data Subjects may therefore refuse the use of functional cookies. However, such refusal will have an impact on the functioning of the website, in that some of the website’s functions may no longer be available. In any case, these cookies are deleted after one year.

If a Data Subject wishes to disable or delete cookies, they can do so in their browser settings.

11. LINKS TO OTHER WEBSITES

The XO Investments website may, from time to time, contain links to other websites. By clicking on such a link, the Data Subject is then subject to the privacy policies governing the visit to the website in question. XO Investments recommends that Data Subjects consult these privacy policies before transmitting any personal data to these websites and declines all responsibility in this regard.

12. TERMS AND CONDITIONS FOR EXERCISING THE RIGHTS OF DATA SUBJECTS WITH REGARD TO PERSONAL DATA

Subject to the limitations set out in this Policy and/or applicable data protection laws, Data Subjects may exercise the following rights free of charge by contacting XO Investments at the contact details provided in Article 1 of this Policy:

Request access to the personal data that XO Investments holds about them and receive a copy of it;
Request the rectification or deletion of inaccurate personal data;
Request the erasure of personal data when its processing is no longer necessary for the purposes pursued, or when it is not or is no longer lawful for other reasons, subject however to any applicable retention periods;
Request a restriction on the processing of personal data when the accuracy of the data is contested, the processing is unlawful, or if the Data Subject has objected to the processing;
Withdraw their consent at any time when the processing of personal data is based on consent;
Receive personal data in a structured, commonly used, and machine-readable format (right to data portability);
Obtain a copy of or access to the appropriate or adequate safeguards that XO Investments has put in place for the transfer of personal data abroad;
Object to the processing of personal data, in which case XO Investments will cease such processing.

The above rights may be limited, for example, where XO Investments is required to obtain and process personal data to comply with applicable laws and regulations, to assert legal rights or defend against claims, or where XO Investments has other legitimate grounds for processing that override the interests and rights of the Data Subjects. Therefore, XO Investments may be entitled to continue processing the personal data of a Data Subject even after the Data Subject has chosen to withdraw their consent or object to the processing.

The provision of certain personal data may be mandatory, in particular with regard to XO Investments’ compliance with legal and regulatory obligations to which it is subject. A refusal by the Data Subject to provide such information may prevent XO Investments from establishing or continuing a business relationship with the Data Subject and/or providing its services to them.

Requests from the Data Subject relating to their personal data must be sent to XO Investments by post or email to the address indicated in Article 1 of this Policy.

XO Investments reserves the right to ask the Data Subject for a copy of their identity document in order to ensure that they are the source of the request to exercise their rights over their personal data.

XO Investments will make every effort to respond to requests from the Data Subject within a maximum of thirty (30) days of receiving the request. The information is in principle provided free of charge by XO Investments, provided that this communication does not require disproportionate effort, in which case fees may be charged under the conditions of Article 19 of the Data Protection Ordinance.

13. MODIFICATION OF THE CHARTER

XO Investments may modify this Charter at its sole discretion.

XO Investments shall inform the Data Subjects and communicate the amended Charter to them by any means it deems appropriate (in particular by email). The amended Charter shall take effect immediately.

Done and adopted by the Management on July 3, 2025.

Contact us