Version 3.0 – Last updated: 26 September 2026
This policy describes how Foliostone processes personal data in connection with the website app.foliostone.com, its mobile applications, its application programming interface and its communications (the "Service"). It is drawn up in accordance with the Swiss Federal Act on Data Protection of 25 September 2020 (FADP) and its Ordinance (DPO), and with Regulation (EU) 2016/679 (GDPR) for persons located in the European Economic Area or the United Kingdom.
The data processed by the Service is, by its nature, sensitive in the ordinary sense of the word. Foliostone processes it in accordance with the principles of minimisation, purpose limitation, segregation and security, and never exploits it for commercial purposes on behalf of third parties.
Foliostone [SA / Sàrl], a company under Swiss law in the course of formation, [Address], [Postcode] [City], Switzerland, represented by [Name of legal representative].
Contact for any question relating to personal data, including the data protection adviser within the meaning of art. 10 FADP: privacy@foliostone.com.
Representative in the European Union (art. 27 GDPR): [to be appointed].
Where a professional user processes their own clients' data through the Service, that user is the controller of the processing and Foliostone acts as processor, under a data processing agreement available on request.
Foliostone processes the following categories of data, depending on how you use the Service:
Foliostone does not request any sensitive data within the meaning of art. 5 let. c FADP or art. 9 GDPR. If you enter or upload such data, you do so under your sole responsibility; it benefits from the same level of protection as your wealth data.
| Purpose | Legal basis (GDPR) | Justification (FADP) |
|---|---|---|
| Provision of the Service: management of the account and shared spaces, features, bank aggregation, document extraction, exports, support | Performance of the contract | Contract |
| Artificial intelligence features | Consent, activated by the authorised user and revocable at any time | Consent |
| Billing, debt collection, accounting, tax | Performance of the contract; legal obligation | Contract; legal obligations |
| Security of the Service: authentication, prevention of abuse and fraud, rate limiting, logging, technical monitoring and error correction | Legitimate interest; security obligation | Overriding interest; art. 8 FADP |
| Service communications (security, billing, alerts, reports, invitations) | Performance of the contract | Contract |
| Audience measurement and improvement of the Service | Consent (cookie banner) | Consent |
| Aggregated and anonymised statistics | Legitimate interest | Overriding interest |
| Foliostone's commercial communications | Consent or legitimate interest, with the right to object at any time | Overriding interest, with the right to object |
| Compliance with legal obligations, responses to authorities, defence of Foliostone's rights | Legal obligation; legitimate interest | Legal obligations; overriding interest |
No decision producing legal effects concerning you is taken on the basis of solely automated processing (art. 21 FADP, art. 22 GDPR). Your wealth data is not used to train artificial intelligence models.
Your data is accessible to Foliostone's authorised staff, on a need-to-know basis, and to processors acting on Foliostone's instructions, bound by contracts compliant with art. 9 FADP and art. 28 GDPR, for the following categories of services: hosting and infrastructure; database and storage; payment and billing; sending of e-mails, SMS and notifications; bank account aggregation (licensed provider); document recognition; artificial intelligence model providers (only if you activate these features, on pseudonymised data, with a contractual prohibition on retention and training); anti-bot protection and rate limiting; technical monitoring; audience measurement (only with your consent); delegated authentication (if you choose it).
The named and up-to-date list of processors, with their location and the applicable safeguards, is available on request at privacy@foliostone.com and will be published on the Service. It may change; material changes are notified to you.
Market data providers and public address or company search services receive only the instrument identifiers or search terms entered, without any personal data.
Your data may also be disclosed, to the extent required, to the competent judicial or administrative authorities, to Foliostone's advisers bound by professional secrecy, and to any entity succeeding Foliostone in the event of restructuring, sale or merger, which will be bound by this policy.
When you invite a third party or generate a sharing link, that third party accesses the data you choose to share; you control and revoke that access.
Your data is hosted in Switzerland: the database and documents are stored in Zurich. The application servers that process them are located in the European Union (France). Switzerland and the EU/EEA mutually recognise each other as providing an adequate level of protection; flows between these territories require no additional safeguards.
Certain processors process data in countries that do not provide an adequate level of protection, in particular the United States. These transfers are governed by the standard contractual clauses of the European Commission, supplemented for Switzerland, and/or by the providers' certification under the Data Privacy Framework (EU-US and Swiss-US frameworks). Transfers relating to the artificial intelligence features and to audience measurement take place only if you activate them. A copy of the applicable safeguards is available on request.
Data is retained for as long as necessary for the purposes pursued, then deleted or anonymised, according to the following criteria:
Free accounts that have been inactive for an extended period may be deleted after a notification that has remained without effect.
Foliostone implements technical and organisational measures appropriate to the risk (art. 8 FADP, art. 32 GDPR), including: encryption of data in transit and at rest, enhanced application-level encryption of the most sensitive identifiers with separate key management, strict multi-level segregation of workspaces, robust password hashing, multi-factor authentication for administrative access (being rolled out to users), time-limited sessions with detection of fraudulent reuse, time-stamped audit log, least-privilege access control, encrypted backups, regular security testing and security commitments imposed on processors.
As no system is infallible, you contribute to the security of your data by protecting your authentication methods and your devices.
In the event of a data breach likely to result in a high risk to your rights, Foliostone informs the competent authority and the persons concerned under the conditions and within the time limits provided by law (art. 24 FADP, arts. 33 and 34 GDPR).
Under the conditions provided by the applicable law, you have the rights of access, rectification, erasure, restriction, portability, objection, withdrawal of consent at any time (without affecting prior processing) and the right not to be subject to a solely automated decision.
You can exercise most of these rights directly within the Service (export of your data, management of consents, deletion of the account) or by e-mail to privacy@foliostone.com. Foliostone may ask you to prove your identity and responds within the statutory time limits (in principle thirty days, extendable in complex cases).
You may lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, Switzerland, or, if you reside in the EEA, with the supervisory authority of your State of residence (in France, the CNIL).
The use of cookies and similar technologies is described in the Cookie Policy.
The Service is intended for adults. Foliostone does not knowingly collect data from minors. When you record data relating to third parties (including minors of whom you are the legal representative), you warrant that you are entitled to do so and, where applicable, that you have informed those persons; they may exercise their rights with you or with Foliostone.
Foliostone may amend this policy. Material changes are notified by any appropriate means before they take effect. The version in force is the one published on the Service, with its update date.
Foliostone – Data Protection, [Address], Switzerland – privacy@foliostone.com
