Privacy notice

Controller and contact

Each AquaSands group company is the controller for the personal data of the contracts it concludes and invoices; AquaSands Trading AG, which publishes the website, is also the controller for processing relating to aquasands.net and contact enquiries. The company that contracts with you is stated on your quote and on your invoice.

Contact: contact@aquasands.net; +41 77 981 72 76. A bank, an authority or a local professional carrying out independent processing gives its own notice.

When you are the client of a partner reselling our services under its own brand (white label), AquaSands processes your data to perform the engagement and for its legal checks; your partner passes this notice on to you.

Information and sources

We receive contact information and correspondence, voluntarily submitted form answers, technical browsing data, identity and address evidence, corporate and ownership documents, beneficial ownership statements, business, residence, income and source-of-funds information, engagement material and billing records. A client sharing another person's data should give that person this notice where reasonably possible.

Your answers to the diagnostic stay in your browser and reach us only when you send your request. When the booking page opens, it asks our server for free slots; the server then reads your IP address, in a local database, to suggest your time zone, without keeping it for that purpose. If you arrived through a campaign, a search engine, an assistant, another site or an introducer's recommendation, that origin (your last twenty arrivals at most) is kept in your browser and attached to your request; each arrival is erased ninety days later, on your next visit.

For the legal onboarding checks, we may process data concerning criminal and administrative proceedings or sanctions (criminal record extract, pending proceedings, results of screening against official sanctions lists), for that purpose only, with restricted access and for the corresponding retention period.

Purposes

We process your data for the following purposes, each on its own legal basis. Answering enquiries, quoting and contracting, performing and documenting the engagement, coordinating specialists and invoicing: performance of the contract or pre-contractual steps. Verifying identity and compliance risk, anti-money-laundering and keeping accounting records: legal obligation. Security, keeping evidence, defending our rights and, where relevant, inviting you to leave a review: legitimate interest. Setting measurement and advertising cookies and recording a meeting: your consent, which you may withdraw at any time. A verification tool may produce alerts, but a person reviews onboarding decisions under the internal procedure.

We may send email prospecting to professionals; depending on the recipient's country, it relies on their consent or on our legitimate interest. Every message carries a one-click unsubscribe link and you may object at any time; your objection is applied across the firm.

Recipients and international transfers

Where needed, your data is accessible to our authorised staff, the technical providers below, the local professionals needed for the matter, and the competent banks, registries and authorities. We neither sell nor rent your data.

Our technical providers, as the case may be: hosting of the server and uploaded documents at Infomaniak (Switzerland), where documents are encrypted on arrival; hosting of the public site on GitHub Pages (GitHub, Inc., United States), which receives visitors' IP address and no form data; sending and receiving our emails through Resend (United States); video meetings through LiveKit, the call library being loaded from the jsDelivr content delivery network, which receives the participant's IP address; transcription of a meeting through Deepgram; the assistance given to the adviser during a recorded meeting through an artificial-intelligence service based in the United States (Anthropic); measurement of the site and of our ads — Google Analytics and Google Ads — through Google (Google Ireland Limited and Google LLC, United States), subject to your consent; the Meta pixel through Meta Platforms Ireland Limited and Meta Platforms, Inc. (United States), subject to your consent; the appointments calendar kept in Google Calendar (reduced data: first name, file class, links); online notarisation of the mandate through an electronic-notary provider, where you use it; the review invitation through Trustpilot, your address being placed in blind copy of the invoice email; depending on your payment method, your bank and our banks (Revolut, Wise, Bank of Georgia); for a USDT payment, reading the public transaction on the TRON blockchain via TronGrid (only the public transaction and address are consulted), the screening of addresses against official sanctions lists being carried out on our machines.

Some of these providers are established outside Switzerland and the European Union, notably in the United States; your data may therefore be transferred there, and not all of it stays in Switzerland. Before transferring data to a country whose level of protection is not recognised as adequate, we assess appropriate safeguards or the relevant legal exception, minimise what is shared and provide the required information about countries and safeguards under the Swiss Federal Act on Data Protection (FADP); the engagement states the recipient categories and known countries. You may ask us for details of the providers and the safeguards in place.

Retention

Enquiries that do not lead to an engagement are kept for as long as needed to follow them up, subject to objection, evidence needs and disputes; you may ask for their deletion at any time. Engagement files and invoices are retained for the applicable legal periods and the time reasonably needed for claims. Identification records subject to a specific legal duty follow that duty and its lawful start date; other documents are deleted when no longer necessary.

Audio and video recordings of a meeting are deleted after ninety days, their transcripts after two years. Backup copies of our database rotate over thirty days.

Security and rights

Access is limited by role. Sensitive documents are uploaded to your client area, where they are encrypted on arrival; please do not send identity documents or financial records by unencrypted email.

Individuals may request access, correction, deletion, restriction or objection where legally available, the delivery or transmission of their data (data portability, art. 28 FADP / art. 20 GDPR), and information about transfers; they may withdraw a given consent (cookies, recording of a meeting) at any time, without affecting processing carried out before the withdrawal. Applicable retention duties or overriding lawful interests may limit deletion. Write to contact@aquasands.net; reasonable identity evidence may be requested. Complaints may be made to the Swiss Federal Data Protection and Information Commissioner (FDPIC), subject to other competent authorities where applicable.

Cookies and updates

The public site uses the Google tag (Google Ireland Limited, Dublin, and Google LLC, United States), loaded from googletagmanager.com, for two kinds of measurement: Google Analytics, which counts visits and pages read (where the visitor comes from, which pages they view), and Google Ads, which measures how well our ads work — how many visitors coming from an ad send a request. Without your consent it sets no measurement or advertising cookies (Google consent mode: everything refused by default) and Google only receives cookieless signals; with your consent, Google may set its measurement and advertising cookies. Personalised advertising nonetheless stays off: the "ad_personalization" signal is never granted, even after your consent. The same banner controls the Meta pixel (Meta Platforms Ireland Limited, Dublin, and Meta Platforms, Inc., United States), loaded from connect.facebook.net: without your consent it does not load and sends nothing; with your consent, it signals your visit (PageView) and a successfully sent request (Lead), to measure our ads and reach you again in our ads on Meta's services. You are asked on your first visit and can change your choice at any time: change my choice. Our server also counts, without cookies or identifiers, pages viewed and clicks to WhatsApp, Telegram, phone or email: it keeps only daily totals (page, origin, campaign, language), without your IP address or anything that could identify you. No other analytics; fonts are hosted on the site. Your browser keeps only your preferences there (currency, time zone), the origin described above (and, for every visitor, the landing page and the date of the first visit), session markers erased when the tab closes, which avoid counting the same visit twice, and, if you have started a questionnaire, your answers — without your contact details. The client area and the meeting room use a technical session cookie, needed to sign in; the meeting room loads the video library from the jsDelivr content network.

Any other analytics or advertising will require updated disclosure and, where necessary, a choice before placement. Material changes and the effective date will appear on this page.