Privacy Policy

Last updated: November 3, 2026

This Privacy Policy applies to KS-TF AG (the “Company”, “KS-TF”, “we”, “us” or “our”). It explains how we collect, use, disclose, retain and protect personal data in connection with the Financial Management Tool (FMT) website, subscription journey and FMT SaaS platform. It is intended to be read together with the applicable Cookies Notice, contractual terms and, where relevant, data processing agreement.

This Policy applies to individuals acting for or on behalf of business clients, prospective clients, business partners, suppliers, professional advisers, applicants and website or service users. It does not replace a client’s own privacy notice where that client determines the purposes and means of processing personal data.

Data Controller information

The data controller for the processing described in this Policy is KS-TF AG, Hinterbergstrasse 18, 6312 Steinhausen, Switzerland, Swiss Commercial Register ID (UID): CHE-327.634.392.

For privacy questions or to exercise a right, contact KS-TF Legal at legal@kstf.ch, +41 41 399 18 80, or the postal address above.

Personal data we may collect

Depending on your relationship with us and the relevant service, we may process the following categories:

Identity and contact data, such as name, business address, email address and telephone number.
Professional and business information, such as job title, employer, role, employment history and business relationship details.
Communications and enquiry data, including correspondence, meeting records and support requests.
Contractual and transaction data, including subscription, order, invoicing and payment-related information.
Technical and usage data, such as IP address, device and browser information, log data, pages viewed, interactions, approximate location and security events.
Compliance information, where relevant to a particular business relationship and lawfully collected, such as identity verification, screening results and information required for AML/KYC checks.

We do not intend to collect every category listed above from every individual. The categories processed depend on the context and the purpose. Please do not provide sensitive personal data unless it is specifically requested and there is an appropriate legal basis.

Purposes and legal bases for processing

We process personal data for the purposes below. Where the GDPR applies, the corresponding legal basis is identified. The applicable basis depends on the specific processing and circumstances.

Responding to enquiries and taking steps requested before entering into a contract	Article 6(1)(b): pre-contractual steps; or Article 6(1)(f): legitimate interests, where appropriate.
Entering and performing contracts; managing client and supplier relationships	Article 6(1)(b): performance of a contract.
Billing, accounting, tax, regulatory and other mandatory record-keeping	Article 6(1)(c): compliance with a legal obligation.
Marketing communications and relationship management	Article 6(1)(f): legitimate interests, where permitted; or Article 6(1)(a): consent where required.
Website/service analytics and improvement	Article 6(1)(a): consent where required for the relevant tracking technology; otherwise, Article 6(1)(f) only where lawful and appropriately balanced.
IT security, fraud prevention, troubleshooting and service integrity	Article 6(1)(f): legitimate interests in protecting our systems, users and business.
Establishing, exercising or defending legal claims	Article 6(1)(f): legitimate interests; and, where relevant, Article 6(1)(c): legal obligation.

Where we rely on legitimate interests under the GDPR, those interests include operating and protecting our business, maintaining business relationships, improving our services, preventing fraud and defending legal claims. We consider the impact on individuals and their rights before relying on this basis.

Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Collection of personal data

We collect data when you contact us, submit a form, subscribe to communications, enter or perform a contract, use the relevant website or service, communicate with our personnel, or interact with technologies such as cookies and analytics tools. Where analytics or similar technologies require consent, they are activated only in accordance with the applicable consent choices. Please consult the relevant Cookies Notice for details.

Disclosure and recipients

We may disclose personal data, to the extent necessary and subject to appropriate safeguards, to:

Service providers acting on our behalf, including hosting, cloud infrastructure, analytics, communications, IT support, payment and client-support providers.
Our professional advisers, auditors, insurers and financial institutions, where necessary.
Authorities, courts, regulators and law-enforcement bodies where required or permitted by law.
A purchaser, investor or other successor in connection with a proposed or actual corporate transaction, subject to confidentiality and applicable data protection requirements.
Other recipients where you have requested or authorised the disclosure, or where disclosure is otherwise lawful.

We require processors to process personal data under appropriate contractual terms and only for authorised purposes. The identity and location of relevant providers may change as our systems and suppliers evolve.

International data transfers

KS-TF AG is established in Switzerland. Personal data may be accessed or transferred to countries outside Switzerland and/or the European Union, depending on the location of our service providers, group entities and other recipients.

Before making a transfer, we assess the applicable Swiss and, where relevant, EU requirements. Transfers may be made to a country recognised as providing an adequate level of protection by the competent authority. Where an adequacy decision does not apply, we use an appropriate transfer mechanism, such as the EU Standard Contractual Clauses and/or the Swiss-recognised contractual safeguards, together with supplementary measures where required. A statutory derogation may be used only where its specific conditions are met and not as a routine substitute for appropriate safeguards.

Retention

We retain personal data only for as long as reasonably necessary for the purpose for which it was collected, including meeting legal, accounting or reporting requirements and establishing, exercising or defending legal claims. Retention periods differ by category and context. When data is no longer required, we delete or anonymise it, unless continued retention is required or permitted by law.

In determining retention periods, we consider the nature and sensitivity of the data, the purposes of processing, the risk of harm from unauthorised use or disclosure, applicable statutory limitation and record-keeping periods, and whether the purpose can be achieved by other means. A ten-year statutory retention period may apply to certain accounting or AML records, but it does not apply automatically to all personal data.

Your rights

Depending on the applicable law and the circumstances, you may have the right to request access to your personal data, correction of inaccurate data, deletion, restriction of processing, data portability, and to object to certain processing. Where processing is based on consent, you may withdraw consent at any time.

Where the GDPR applies, you may also object at any time to processing your personal data for direct marketing. Where we rely on legitimate interests, you may object on grounds relating to your situation. We will stop processing unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is needed for legal claims. You also have the right to lodge a complaint with a competent data protection supervisory authority.

Under Swiss law, you may exercise the rights provided by the FADP, including the right to information and, where the statutory conditions are met, data portability and the remedies available under Swiss law. Rights are subject to applicable legal conditions and exceptions.

To exercise a right, contact us using the details in section “Data Controller Information”. We may need to verify your identity before responding. We will respond within the period required by applicable law.

Data security

We implement technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. Measures are selected having regard to the nature, scope, context and purposes of processing and the risks to individuals.

Complaints and supervisory authorities

In Switzerland, you may contact the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, CH-3003 Bern, Switzerland (www.edoeb.admin.ch).

Where the GDPR applies, you may lodge a complaint with a supervisory authority, in the EU Member State of your habitual residence, place of work or the place of the alleged infringement.

Changes to this Policy

We may update this Policy to reflect changes in our processing activities or legal requirements. The current version and its effective date will be published on the relevant website. Where required by law, we will provide additional notice or obtain consent for a new or changed processing activity. Continued use of a website or service does not, by itself, constitute consent to a change in this Policy.

FMT-specific processing and roles

FMT is a business-to-business software service. This Policy applies to visitors to the FMT website, prospective clients, client representatives, administrators and authorised users of the FMT platform.

KS-TF AG as an independent controller

KS-TF AG acts as an independent controller when it determines the purposes and means of processing personal data for its own business operations, including prospective-client enquiries, client relationship and subscription administration, user account administration, authentication and access management, billing, service communications, platform security, fraud prevention, legal compliance and its own product analytics.

KS-TF AG as a processor for Client Data

A client may enter or upload personal data into FMT relating to its own clients, employees, counterparties or other individuals (“Client Data”). In relation to such Client Data, the client will generally determine the purposes and means of processing and act as controller, while KS-TF AG processes the data on the client’s documented instructions as processor, subject to the applicable Data Processing Agreement (DPA) and contract.

The client is responsible for ensuring that it has an appropriate legal basis and has provided the required privacy information to the individuals whose data it submits to FMT. Individuals should direct requests relating to Client Data to the relevant client in the first instance. KS-TF AG will assist the client as required under the DPA and applicable law.

KS-TF AG may act as an independent controller for limited processing of Client Data where it is necessary to comply with a legal obligation, protect the security of FMT, prevent fraud or establish, exercise or defend legal claims. The precise role depends on the processing activity and applicable law.

FMT data categories

Depending on the FMT functionality used and the client’s configuration, data may include:

Client organisation and subscription information, including company details, plan, contract, billing and payment information.
User account information, such as name, business email, role, access permissions, authentication and account activity.
Platform usage, technical logs, audit trails, security events, support tickets and configuration data.
Financial information entered or generated through FMT, including financial statements, credit-related information, financial ratios and supporting documents.
Personal data included by a client in its records or uploaded documents. This may include identity or contact details and, where the client’s lawful use case requires it, identification or compliance-related information.

The fact that a category is listed does not mean that KS-TF AG routinely requests it or processes it as an independent controller. Client Data is processed in accordance with the client’s instructions and the DPA.

Hosting and service providers

FMT is hosted using Amazon Web Services (AWS) infrastructure in Switzerland, as currently described for the service. Other providers may support analytics, communications, payment processing, authentication, client support, monitoring and security. Provider names, locations, roles and access arrangements must be verified against the current FMT subprocessor list and technical configuration.

The FMT policy should be read together with the DPA and any applicable subprocessor list. The DPA governs KS-TF AG’s processing of Client Data on behalf of clients, including instructions, confidentiality, security, assistance, subprocessors, international transfers, breach notification, audits and deletion/return of data.

Automated processing and credit-related functionality

FMT may provide financial analysis, calculations, indicators or risk-related functionality. The availability of such functionality does not, by itself, mean that KS-TF AG makes decisions about individuals. Clients remain responsible for how they use outputs in their own processes. If any FMT functionality is used by KS-TF AG or a client to make a decision based solely on automated processing that produces legal effects or similarly significantly affects an individual, the responsible controller must assess and provide the information and safeguards required by Article 22 GDPR and, where applicable, Article 21 FADP.

Contact and publication details

KS-TF Legal | legal@kstf.ch | +41 41 399 18 80
KS-TF AG, Hinterbergstrasse 18, 6312 Steinhausen, Switzerland | UID: CHE-327.634.392