Privacy

What we do with what you send us.

Version of November 11, 2026

This notice covers gencapholding.com. It is short because the website does very little: it shows pages and it has two forms. There is no account to create, no advertising and no tracking profile, and nothing is sold. We process personal data under the Swiss Federal Act on Data Protection (FADP) and, where it applies, the EU General Data Protection Regulation (GDPR).

1. Who is responsible

The controller is genCap Holding AG, Oberallmendstrasse 18, 6300 Zug, Switzerland. Full details are in the imprint. For anything in this notice, including the requests in section 8, use the contact form or write to us by post at that address.

2. Visiting the website

This website sets no cookies and uses no local storage. To see how many people visit and how they find us, we count visits with Counterscale, an open-source counter operated for us by capXholding AG, Zug, on Cloudflare (stats.capxholding.com). For each page view it records the page, the referring site, the type of browser and device, and the country. No IP address is stored and no profile is built. To tell a first visit of the day from a repeat one, Counterscale relies on your browser's ordinary cache of one small response, which holds a time and no identifier. Visit data is deleted after 90 days.

The website is delivered by Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA, which processes the technical data your browser transmits (IP address, time of the request, requested page, referrer, browser and operating system) to deliver and secure the website, and may measure page speed with Cloudflare Web Analytics, without cookies. Legal basis: our legitimate interest in running, securing and improving the website (Art. 6(1)(f) GDPR; Art. 31(1) FADP).

3. The briefing request

If you request a briefing, we receive only what you enter: the kind of institution you represent, the subjects you choose, your name, your role, your institution if you give it, the channel you prefer and the address or number for it, and anything you add. We record the time of the request. We do not store your IP address.

We use this to read your request and answer it, and for nothing else. A person reads every request; there is no profiling and no automated decision. The records are stored for us by Cloudflare, in the EU. Legal basis: steps taken at your request before a possible contract (Art. 6(1)(b) GDPR) and our legitimate interest in answering people who write to us (Art. 6(1)(f) GDPR).

4. The contact form

If you use the contact form, we receive what you enter: your matter, a reference, your name, organization and role, your e-mail and postal address, how you came to the website, when you need an answer, and your message. We record the time. We do not store your IP address. We ask for a postal address and a role because the form is the route for legal, privacy, press and regulatory matters, where we must know who is writing and where to answer. The records are stored for us by Cloudflare, in the EU, and are used only to handle the matter. Legal basis: our legitimate interest in handling such matters properly (Art. 6(1)(f) GDPR) and, for requests about your rights, our legal obligations (Art. 6(1)(c) GDPR).

4a. The mandate login

Entries in the mandate login are processed in your browser only. They are not transmitted to us or to anyone else and are not stored.

5. If you write to us

If you contact us by post or by any other route, we process what you send to handle your inquiry and any follow-up, on the legal bases named in section 3.

6. Business contacts and contractual partners

Outside this website, we process personal data of our contractual partners, prospective partners and their representatives (master data, contact data, contract and payment data, correspondence) to the extent necessary to prepare and perform contracts, to comply with legal obligations (including accounting, tax and anti-money-laundering rules) and to protect our legitimate interests. Data may be disclosed to auditors, tax and legal advisers, banks and authorities where required.

7. Recipients and transfers abroad

Authorized personnel and service providers receive the information needed for the purposes above; professional advisers or authorities receive it where correspondence, legal obligations or claims require it. We do not sell personal data or disclose it for anyone's advertising. No advertising network, embedded video, chat widget or social plugin is loaded by this website; fonts come from our own domain.

Cloudflare's global network may process connection data outside Switzerland and the EEA. Where personal data is transferred to a country without an adequate level of data protection, we rely on the Swiss-U.S. or EU-U.S. Data Privacy Framework, on the standard contractual clauses recognized by the Swiss Federal Data Protection and Information Commissioner and the European Commission, or on another lawful ground.

8. Retention and your rights

Briefing requests and correspondence are kept while needed to handle the inquiry or a resulting relationship. Necessary records may be kept longer to meet legal duties (in Switzerland generally ten years for business records) or to establish, exercise or defend legal claims, with use restricted to those purposes. They are not kept for unrelated marketing. Repeat submissions create separate dated records. Ask us to remove data that is no longer needed.

Depending on the applicable law, you may request access, correction, deletion, restriction or portability, object to processing based on legitimate interests, withdraw any consent for the future, and complain to the Swiss Federal Data Protection and Information Commissioner or to a competent authority where you live or work. Rights follow their statutory conditions, including lawful retention exceptions. We may request proportionate proof of identity where reasonably needed to protect data; a fee or refusal is possible only where the law permits it, such as for a manifestly unfounded or excessive request. We respond within the statutory period, including any lawfully notified extension.

This website is served only over encrypted connections. Appropriate safeguards reduce risk but cannot guarantee absolute security. This notice explains processing; it is not blanket consent and not a separate contractual guarantee of security, availability or deletion. The applicable agreement governs contractual commitments, subject always to mandatory privacy law.

9. Changes

We update this notice when processing changes; the date identifies the version. We provide any notice or fresh consent the law requires before a relevant change.