Switzerland Privacy Notice (revised FADP / nFADP)

This regional annex describes how Tanqory Inc. ("Tanqory", "we", "us") processes personal data subject to the revised Federal Act on Data Protection of 25 September 2020 ("FADP" or "nFADP"), in force since 1 September 2023, and the implementing Data Protection Ordinance (DPO) of 31 August 2022. It supplements and must be read together with the Tanqory Privacy Policy, the Data Processing Addendum (DPA-master), the UK GDPR Regional Annex, and the EU GDPR-aligned provisions of the master DPA. Where this annex is stricter than another Tanqory document with respect to FADP-regulated processing, this annex prevails.

Authoritative sources referenced throughout this annex:

• Revised FADP consolidated text (SR 235.1): https://www.fedlex.admin.ch/eli/cc/2022/491/en
• Data Protection Ordinance (DPO, SR 235.11): https://www.fedlex.admin.ch/eli/cc/2022/568/en
• Federal Data Protection and Information Commissioner (FDPIC): https://www.edoeb.admin.ch/edoeb/en/home.html

1) Scope and territorial application (Article 3 FADP)

The revised FADP applies to the processing of personal data of natural persons by private persons and federal bodies. By virtue of Article 3 §1 FADP, the law also applies to matters that produce effects in Switzerland, even if they are initiated abroad. This annex therefore applies whenever Tanqory processes personal data of individuals in Switzerland, or where Tanqory's processing has effects in Switzerland (for example, where Tanqory offers services to data subjects in Switzerland or monitors their behaviour in Switzerland). Personal data of legal persons fall outside the revised FADP; this annex addresses only the data of natural persons.

2) Roles of the parties — controller, processor, DPO (Articles 5, 9, 10)

Under Article 5 FADP:

• Controller (Verantwortlicher / responsable du traitement / titolare del trattamento): the private person or federal body that, alone or jointly with others, determines the purpose and means of processing. For data processed on behalf of merchants and other Tanqory customers ("Customer Personal Data"), the customer is the controller. For data processed by Tanqory for its own purposes (account administration, billing, security, fraud prevention, service improvement, compliance), Tanqory is the controller.
• Processor (Auftragsbearbeiter): the private person or federal body that processes personal data on behalf of the controller. Tanqory acts as processor with respect to Customer Personal Data and processes such data only in accordance with the controller's instructions (Article 9 FADP). Sub-processing requires prior authorisation from the controller (Article 9 §3).
• Data Protection Adviser (Article 10 FADP): appointment of a data protection adviser ("conseiller à la protection des données") is voluntary for private controllers but recommended. Tanqory has designated a privacy contact point for FADP matters reachable at privacy@tanqory.com. The Company will appoint a data protection adviser where required.

3) Categories of personal data and sensitive personal data (Article 5 letter c FADP)

Tanqory processes the categories of personal data described in section 3 of the Singapore PDPA annex (account, transaction, technical, merchant customer, contextual). Under Article 5 letter c FADP, the following categories are "particularly sensitive personal data" and benefit from additional protections:

• (1) data on religious, philosophical, political, or trade-union views or activities;
• (2) data on health, the private sphere, or affiliation to a race or ethnicity;
• (3) genetic data;
• (4) biometric data that uniquely identify a natural person;
• (5) data on administrative or criminal proceedings and sanctions; and
• (6) data on social assistance measures.

Tanqory does not solicit particularly sensitive personal data through its standard service interfaces. Where such data are incidentally processed (for example, identity-verification artefacts that contain biometric features, or in the course of merchant-supplied content), Tanqory applies additional access restrictions, encryption, logging, and minimisation.

4) Principles of lawful processing (Article 6 FADP)

All processing complies with the principles of Article 6 FADP:

• (1) lawfulness;
• (2) good faith and proportionality;
• (3) purpose limitation — data are processed only for specific purposes that are recognisable to the data subject at the time of collection;
• (4) recognisability — collection must be recognisable to the data subject;
• (5) accuracy — Tanqory takes appropriate measures to correct, delete, or destroy inaccurate or incomplete data; and
• (6) data security commensurate with the risk (Article 8 FADP).

5) Legal grounds and justifications for processing (Articles 6 §6, 30, 31)

The revised FADP does not require an exhaustive prior legal basis for every processing operation by a private person (unlike the EU GDPR), but processing must comply with the principles in Article 6 and must not unlawfully infringe the data subject's personality (Article 30). Where processing would otherwise constitute a breach of personality, it is justified only where one of the grounds in Article 31 §1 applies, namely:

• the consent of the data subject;
• an overriding private interest of the controller or a third party; or
• an overriding public interest, or where the law allows the processing.

Article 31 §2 provides a non-exhaustive list of overriding private interests, including direct contact with customers in connection with previously contracted goods or services, processing personal data not classified as particularly sensitive personal data and not used for profiling that presents a high risk for the personality, processing data of public figures regarding their public activities, processing for non-personal purposes (particularly research, planning, statistics), professional information about persons, and personality-protection-compliant credit checks under defined conditions.

Tanqory documents the overriding interest analysis where it relies on Article 31 §1 letter b, including for security, fraud prevention, network and information security, and service-reliability processing. Consent (Article 6 §6) is obtained where required and is given in particular for the processing of particularly sensitive personal data, high-risk profiling by a private person, or profiling by a federal body. Consent is express where required by the FADP.

6) Information obligations at collection (Article 19 FADP)

Tanqory provides the data subject with adequate information about the procurement of personal data, in advance or at the latest at the time of collection (Article 19 §1). The information includes at minimum:

• (a) the identity and contact details of the controller;
• (b) the purpose of the processing; and
• (c) where applicable, the recipients or categories of recipients to whom personal data are disclosed.

Where personal data are not obtained directly from the data subject, the information also identifies the categories of personal data processed (Article 19 §2). For disclosures abroad, the information includes the destination country and, if applicable, the guarantees in accordance with Article 16 §2 or the application of an exception in accordance with Article 17 (see section 9 below). The information must be communicated in a comprehensible form so that the data subject can adequately assess the processing of his or her personal data (Article 19 §4).

7) High-risk processing and Data Protection Impact Assessment (Article 22 FADP)

A Data Protection Impact Assessment ("DPIA"; "analyse d'impact relative à la protection des données") is carried out by the controller in advance where the processing is likely to result in a high risk to the personality or fundamental rights of the data subject (Article 22 §1). A high risk arises in particular from the use of new technologies, from the nature, scope, circumstances, or purposes of the processing, and especially in cases of extensive processing of particularly sensitive personal data or systematic large-scale monitoring of public areas (Article 22 §2). Where the DPIA identifies a high residual risk that the controller cannot mitigate, the FDPIC is consulted in advance (Article 23). Tanqory maintains a DPIA register and conducts assessments before new or materially changed processing meeting these thresholds.

8) Privacy by design and by default (Article 7 FADP)

The controller is obliged to design data processing technically and organisationally so that the data protection regulations, in particular the principles in Article 6, are complied with from the planning phase ("data protection by design", Article 7 §1). Suitable pre-settings ensure that personal data are processed only to the extent necessary for the intended purpose, unless the data subject specifies otherwise ("data protection by default", Article 7 §3). Tanqory embeds these principles in its product, security, and engineering lifecycles.

9) International disclosure of personal data (Articles 16–18 FADP)

Personal data may be disclosed abroad only if an adequate level of data protection is guaranteed (Article 16 §1). The Federal Council determines the states whose legislation guarantees an adequate level of protection; the list is set out in Annex 1 of the DPO. Where the destination country does not appear on that list, disclosure abroad is permitted only if appropriate safeguards under Article 16 §2 ensure adequate protection, namely:

• (a) an international treaty;
• (b) data protection clauses in a contract between the controller or processor and the contracting party, of which the FDPIC has been informed beforehand;
• (c) specific guarantees prepared by the competent federal body and of which the FDPIC has been informed beforehand;
• (d) standard data protection clauses that the FDPIC has approved, issued, or recognised beforehand; or
• (e) binding corporate rules of the company that have been approved beforehand by the FDPIC or by an authority responsible for data protection in a state guaranteeing an adequate level of protection.

In addition, Article 17 provides exceptions for disclosure abroad, including where the data subject has expressly consented in the individual case, the disclosure is directly connected with the conclusion or performance of a contract, disclosure is essential to safeguard an overriding public interest or to establish, exercise, or enforce legal claims before a court or other competent foreign authority, disclosure is necessary to protect the life or physical integrity of the data subject or a third party and consent cannot be obtained within a reasonable period, the data subject has made the data generally accessible and has not expressly prohibited their processing, or the data come from a register provided for by law accessible to the public or to persons with a legitimate interest.

For disclosures to the European Economic Area, the FDPIC has retained the EU as a jurisdiction providing adequate protection under the revised FADP; disclosures to the EEA are therefore permitted without additional Article 16 §2 safeguards.

For disclosures to the United States, Tanqory relies on either (i) the Swiss-U.S. Data Privacy Framework where the U.S. recipient is self-certified and the Framework is recognised by the Federal Council for the disclosure in question, or (ii) the FDPIC-approved Swiss addendum to the EU standard contractual clauses, accompanied by a transfer impact assessment and supplementary measures as appropriate. Tanqory does not currently rely on a Swiss-U.S. Data Privacy Framework certification; transfers rely on Standard Contractual Clauses with the Swiss addendum.

10) Representative in Switzerland (Article 14 FADP)

Private controllers domiciled or resident abroad must designate a representative in Switzerland if they process personal data of persons in Switzerland and the processing meets the cumulative conditions of Article 14 §1, namely:

• (a) the processing relates to the offering of goods and services to persons in Switzerland or the monitoring of their behaviour;
• (b) is carried out extensively;
• (c) is carried out regularly; and
• (d) presents a high risk for the personality of the data subject.

The representative serves as the contact point for the data subjects and the FDPIC (Article 14 §3). The controller publishes the name and address of the representative (Article 14 §4) and keeps a record of the processing activities, accessible to the representative (Article 15). The Company will appoint a representative in Switzerland if and when the cumulative thresholds under Article 14 FADP are met. In the absence of a triggering event under Article 14 §1, the data subject and the FDPIC may continue to contact Tanqory through privacy@tanqory.com.

11) Data subject rights (Articles 25–32 FADP)

Subject to the conditions and exceptions of the FADP, every person has the following rights against the controller:

• Right of access (Article 25): the data subject may request from the controller information as to whether personal data concerning them are being processed and, if so, the prescribed information set out in Article 25 §2 (identity and contact details of the controller; processed personal data as such; purpose of processing; retention period or criteria; available information on the source of the data where they were not obtained from the data subject; existence of an automated individual decision and the logic on which the decision is based; recipients or categories of recipients; where applicable, the foreign country and the guarantees in accordance with Article 16 §2 or the application of an exception under Article 17).
• Right to data portability (Article 28): the data subject may request that personal data which they have disclosed to the controller and which the controller processes by automated means with the data subject's consent or in connection with the conclusion or performance of a contract be handed over to them in a commonly used electronic format, or be transferred to another controller where technically possible and without disproportionate effort.
• Right to rectification (Article 32 §1): the data subject may request that inaccurate personal data be corrected, unless a legal provision prohibits the modification, or an erasure of data is mandated.
• Right to object and to erasure (Articles 30, 32 §2): the data subject may request the cessation of processing, the erasure or destruction of personal data, or that no data be disclosed to third parties, where the processing unlawfully infringes their personality, unless a justification under Article 31 §1 is available.
• Right to obtain a note (Article 32 §3): where neither the accuracy nor the inaccuracy of personal data can be proven, the data subject may demand that a corresponding note be added.

Requests are submitted to privacy@tanqory.com with the subject line "FADP request" and are processed within 30 days from receipt (Article 25 §7 DPO). The information is provided free of charge; cost-based exceptions apply under Article 19 DPO.

12) Automated individual decisions and profiling (Article 21 FADP)

The controller informs the data subject of any decision based exclusively on automated processing that has legal effects on the data subject or significantly affects them ("automated individual decision", Article 21 §1). At the data subject's request, the controller gives the data subject the opportunity to express his or her point of view, and the data subject may request that the automated individual decision be reviewed by a natural person (Article 21 §2). Exceptions apply where the decision is directly connected with the conclusion or performance of a contract and the request of the data subject is fulfilled, or where the data subject has expressly consented (Article 21 §3). High-risk profiling by a private person requires express consent (Article 6 §7 letter b in conjunction with Article 5 letter g).

13) Data security (Article 8 FADP and Articles 1–6 DPO)

The controller and the processor ensure, through appropriate technical and organisational measures, data security commensurate with the risk (Article 8 §1). The measures must enable breaches of data security to be avoided. Articles 1 to 6 of the DPO concretise the requirements (purposes of processing, confidentiality, availability, integrity, traceability, etc.). Tanqory's measures include encryption in transit and at rest, role-based access controls and multi-factor authentication, network segmentation, vulnerability management, security monitoring, secure software development, business continuity and disaster recovery testing, and vendor security due diligence. Sub-processors are bound by equivalent obligations under the DPA-master.

14) Notification of data security breaches (Article 24 FADP)

The controller notifies the FDPIC of any breach of data security that is likely to result in a high risk to the personality or fundamental rights of the data subject, as soon as possible (Article 24 §1). The notification contains at minimum the nature of the breach, its consequences, and the measures taken or planned (Article 24 §2). The data subject is informed where this is necessary for their protection or where the FDPIC so requires (Article 24 §4), subject to the restrictions in Article 24 §5 (legal obligation of secrecy or where the information would jeopardise an investigation). The processor notifies the controller of any breach of data security as soon as possible (Article 24 §3). Tanqory's internal triage targets notification to the FDPIC and impacted controllers within timelines consistent with "as soon as possible" and provides controllers acting under Tanqory's processor capacity with the information required to fulfil their own Article 24 obligations.

15) Records of processing activities (Article 12 FADP)

Both controllers and processors maintain a record of their processing activities (Article 12 §1). The DPO provides for an exemption for companies with fewer than 250 employees whose data processing entails a limited risk of infringement of the personality of the data subjects (Article 24 DPO). Tanqory maintains records of processing activities for FADP-regulated processing and makes them available to the FDPIC on legitimate request.

16) Subprocessors and onward processing

Tanqory engages sub-processors under written agreements that impose obligations equivalent to those applicable to Tanqory under the DPA-master. The current list of sub-processors is published at https://legal.tanqory.com/legal/data-protection/subprocessor-list. Material changes are notified through the customer channel agreed in the DPA-master. Sub-processing is subject to prior authorisation by the controller under Article 9 §3 FADP.

17) FDPIC complaint channel

Data subjects who consider that the processing of their personal data infringes the FADP may file a report with the FDPIC. The FDPIC opens an investigation ex officio or upon a report (Article 49 FADP) and may order measures under Article 51. Contact: Federal Data Protection and Information Commissioner, Feldeggweg 1, 3003 Bern, Switzerland — https://www.edoeb.admin.ch/. Data subjects retain the right to bring civil actions for the protection of personality (Articles 32, 28 ff. Swiss Civil Code).

18) Relationship with other Tanqory documents

This annex supplements the Tanqory Privacy Policy, the DPA-master, the UK GDPR Regional Annex, and the EU GDPR-aligned provisions of the master DPA. Where a single processing activity is subject simultaneously to the FADP and to the EU GDPR, Tanqory applies the regime that affords the higher level of protection for the right concerned, without prejudice to the territorial scope of each instrument.

19) Contact

• Privacy and FADP requests: privacy@tanqory.com
• Registered agent (controller): Tanqory Inc., c/o Harvard Business Services, Inc., 16192 Coastal Highway, Lewes, DE 19958, USA
• Swiss representative under Article 14 FADP: the Company will appoint a representative in Switzerland if and when the cumulative thresholds under Article 14 FADP are met.

20) Change history