Zugtrust AG

Privacy Policy

This privacy notice applies to taxpertzug.ch, a service of Zugtrust AG, Sinserstrasse 67, 6330 Cham ZG, Switzerland (CHE-100.866.081). It supplements the general privacy notice of Zugtrust AG with site-specific information.

1. Controller

Zugtrust AG. Data protection contact: info@zugtrust.ag.

2. Applicable law

Revised Swiss Federal Act on Data Protection (revFADP / nDSG).

3. Data we process

  • Server logs (IP, user agent, timestamp) — retained max. 30 days.
  • Funnel inputs (legal form, turnover, VAT status, headcount, banking, document volume etc.) — used to provide a non-binding cost estimate.
  • Contact data (company, name, email, phone, notes) — used to handle your request and onboard a mandate.

4. Purposes

  • Replying to enquiries, providing cost estimates, mandate onboarding.
  • Performing the mandate (bookkeeping, financial statements, tax returns, advisory).
  • Operating, securing and improving the site.
  • Compliance with statutory retention obligations (esp. Art. 958f Swiss CO).

5. Recipients

  • Hosting and mail provider: Infomaniak Network SA, Geneva (Switzerland).
  • Secure document room: Tresorit AG, Zurich (Switzerland) — used during mandate execution.
  • Authorised personnel and assistants of Zugtrust AG.
  • Authorities, where legally required.

No transfer abroad in the funnel itself. All listed processors are based in Switzerland.

6. Retention

  • Server logs: max. 30 days.
  • Funnel and contact data without mandate: deleted at the latest 24 months after last contact.
  • Mandate-related data: retained per statutory obligations (typically 10 years).

7. Cookies

Only technically necessary cookies. No tracking, no analytics, no advertising tags.

8. Your rights

You have the rights to information, rectification, erasure, data portability and objection. Contact: info@zugtrust.ag.

9. Security

TLS in transit, STARTTLS for mail, access on a need-to-know basis.

10. Data Processing Agreement (DPA / ADV)

When acting on a mandate, Zugtrust AG processes personal data of third parties on behalf of the client (e.g. employees, customers, suppliers of the client) within the meaning of Art. 9 revFADP. The DPA forms part of every mandate and is supplied with the offer. It governs subject, duration, nature and purpose of processing, technical and organisational measures, sub-processors (incl. Infomaniak, Tresorit) and the return or deletion of data after the mandate ends.

As of