Information notice on the processing of personal data — nDSG / GDPR.
IBEX SERVICES SA (IBEX SERVICES AG / IBEX SERVICES Ltd) — CHE-114.803.997 — Società Anonima — Via Serafino Balestra 6, 6830 Chiasso, Switzerland — privacy contact: info@smemarket.ch — Data Protection Officer: Ilaria Gatti — effective 26 April 2026.
Avv. Thomas Contin — Corso di Porta Vittoria 13, 20122 Milano, Italy — tc@advisorn.com — +39 333 790 6976.
1.1 This Privacy Policy informs you about the processing of personal data carried out by IBEX SERVICES SA (the “Controller”, “SMEMARKET”, “we” or “us”) when you visit www.smemarket.ch (the “Platform”), register an account, submit information, communicate with us, or otherwise interact with our services.
1.2 It is issued under the Swiss Federal Act on Data Protection of 25 September 2020 (“nDSG / FADP”), the Ordinance on Data Protection (“OPDP”), and — to the extent applicable to processing within the territorial scope of Article 3 GDPR — the EU General Data Protection Regulation 2016/679 (“GDPR”).
1.3 It applies to data subjects who are natural persons. Information concerning legal entities is not in principle “personal data” under the nDSG, but is treated with comparable diligence.
2.1 We process the following categories of personal data:
2.2 We do not in principle process special categories of personal data within the meaning of Article 5 lit. c nDSG and Article 9 GDPR (sensitive data such as health, religious beliefs, genetic or biometric data). Should the processing of such data become necessary, we will process it only on a lawful legal basis and inform you accordingly.
3.1 We collect personal data primarily directly from you when you interact with the Platform.
3.2 We may also collect data from third-party sources, including (i) commercial registers and other public records; (ii) sanctions and politically-exposed-persons (PEP) databases; (iii) Fiduciaries who refer Underlying Clients; (iv) counterparties in a Transaction; (v) credit-information providers, where lawful; and (vi) publicly available professional sources.
4.1 We process personal data for the following purposes:
4.2 Under Article 31 nDSG, processing is in principle lawful when justified by (i) the data subject's consent, (ii) an overriding private or public interest, or (iii) by law. Under Article 6 GDPR, where applicable, our legal bases are: (a) performance of a contract (Art. 6(1)(b)); (b) compliance with a legal obligation (Art. 6(1)(c)); (c) our legitimate interests (Art. 6(1)(f)) — operating and securing the Platform, preventing fraud, recovering fees and managing our business; and (d) consent (Art. 6(1)(a)) — for non-essential cookies and direct marketing where consent is required.
5.1 Personal data may be disclosed to the following categories of recipients, on a strict need-to-know basis:
5.2 We do not sell personal data and do not disclose it to third parties for their own marketing purposes without your prior consent.
6.1 The Controller is established in Switzerland and processes personal data primarily within Switzerland and the European Economic Area (“EEA”). Switzerland and the EEA recognise each other as providing an adequate level of data protection.
6.2 Where we transfer personal data to third countries, we do so only if (i) the destination country offers adequate data protection as recognised by the Swiss Federal Council and/or the European Commission, or (ii) appropriate safeguards are in place — in particular Standard Contractual Clauses recognised by the FDPIC, supplemented where necessary by additional technical and organisational measures, or (iii) one of the statutory exceptions applies.
6.3 A list of countries to which transfers may take place, and a copy of the relevant safeguards, are available upon written request to the contact set out at the head of this Policy.
7.1 We retain personal data only for as long as necessary to achieve the purposes for which it was collected and to comply with our legal obligations.
7.2 In particular:
7.3 After expiry of the applicable retention period, personal data is deleted or anonymised, save where retention is required by law or necessary for the establishment, exercise or defence of legal claims.
8.1 Subject to the conditions and limitations set out in the nDSG and the GDPR, you have the following rights:
8.2 Requests should be addressed in writing to info@smemarket.ch. We may request reasonable proof of identity. We will respond within 30 days, extendable in complex cases as permitted by law.
9.1 The Platform uses cookies and similar technologies for: (i) strictly necessary cookies; (ii) functional cookies; (iii) analytics cookies (anonymised/pseudonymised where possible); and (iv) where applicable and only with your prior consent, marketing cookies.
9.2 You can manage your cookie preferences at any time through the cookie banner displayed on first visit and through the cookie settings accessible from the footer of the Platform.
9.3 A detailed list of cookies in use, their providers, purposes and retention periods is set out in the cookie information notice accessible from the Platform footer.
10.1 We do not in principle take decisions based solely on automated processing, including profiling, which produce legal effects concerning you (Art. 21 nDSG / 22 GDPR).
10.2 Should we introduce such processing in the future, we will inform you in advance, provide the safeguards required by law, and give you the right to obtain human intervention, to express your point of view and to contest the decision.
We implement appropriate technical and organisational measures to protect personal data against unauthorised or unlawful access, accidental loss, destruction, alteration or disclosure (Art. 8 nDSG / 32 GDPR). These include access controls, encryption in transit and at rest where appropriate, segregation of environments, regular backups, logging and monitoring, staff training, and contractual safeguards with our processors. In the event of a personal-data breach likely to result in a high risk to data subjects, we will notify the FDPIC and, where applicable, the competent EEA supervisory authority and affected data subjects within the timeframes prescribed by law.
The Platform is intended exclusively for use by professionals and businesses. It is not addressed to children. We do not knowingly collect personal data of persons under the age of 16. If we become aware that we have inadvertently collected such data, we will delete it without delay.
We may update this Policy from time to time. The current version is identified by the version number and effective date set out at the head of this document. Material changes will be notified to registered Users by email and through the Platform. The latest version is always accessible from the footer.
14.1 Privacy contact. For any question relating to this Policy or the exercise of your rights, please contact us at info@smemarket.ch or by registered mail to IBEX SERVICES SA, Via Serafino Balestra 6, 6830 Chiasso, Switzerland.
14.2 Swiss supervisory authority. FDPIC, Feldeggweg 1, 3003 Bern, Switzerland — www.edoeb.admin.ch.
14.3 EEA supervisory authority. Data subjects in the EEA may lodge a complaint with their habitual-residence supervisory authority, place of work, or place of the alleged infringement.