← Lookup

Privacy & data protection

Last updated: 2026-05-22

Who we are

ubo.swiss is a Swiss regtech tool that helps fiduciaries identify ultimate beneficial owners (UBOs) of Swiss legal entities under the new Swiss Transparency Act (TJPG / LTPM, in force autumn 2026). The service is operated by Alpina Travels GmbH (placeholder — fill in registered data controller before public launch), Switzerland.

Contact for data-protection matters: hello@uboswiss.ch.

What personal data we process

When you look up an entity, ubo.swiss receives and processes personal data extracted from public commercial-register publications. This includes:

  • Names of shareholders, beneficial owners, directors, and managers
  • Domicile (city, country) and (for some entries) nationality or country of origin
  • Share counts, capital contributions, and roles
  • Publication metadata (date, publication ID)

For Swiss entities this data comes from ZEFIX (the Federal Commercial Register), which is legally public under Swiss commercial-register law. For foreign intermediaries we may consult public foreign registers (e.g. the French Annuaire des Entreprises) on the same legal basis.

Beneficial-owner names are additionally screened against five public sanctions / compliance lists (Swiss SECO, US OFAC SDN, EU consolidated, UN Security Council, Swiss FINMA Warning List) via the OpenSanctions normalized feed.

Legal basis for processing

  • Swiss revDSG: lawful processing under Art. 6 (compatibility with public interest in commercial-register transparency and AML compliance).
  • EU GDPR(where applicable, e.g. processing of EU-resident personal data): Art. 6(1)(f) — legitimate interest. The interest pursued is compliance with Swiss anti-money-laundering law (GwG) and the Swiss Transparency Register (TJPG), which override the data subject's interest in non-processing because the underlying data is deliberately public by law for exactly these purposes.

How we use the data

  • Resolve the beneficial-ownership chain for the queried entity
  • Cross-reference identified persons against public sanctions lists
  • Surface compliance-relevant warnings (high-risk jurisdiction, unresolved chain)
  • Display the resolved state to the user who issued the lookup

We do not profile data subjects, sell data, build behavioral analytics, or use personal data for marketing.

Recipients and where data goes

ubo.swiss is a thin orchestration layer over public APIs. For each lookup, the request hits:

  • ZEFIX (Swiss Federal Office of Justice, hosted in Switzerland) — entity + publication data
  • OpenSanctions (Berlin, Germany) — sanctions lists. We download name lists, then match locally. Your query names are not sent to OpenSanctions.
  • Local LLM (Ollama + Mistral Nemo) — when French publications require structured extraction. Runs on the same server as ubo.swiss; no third-party LLM provider receives the text by default.
  • Foreign registries (planned, currently disabled): if added, would query e.g. the French Annuaire des Entreprises (data.gouv.fr) for cross-border chain resolution.

Retention

Resolved results (ZEFIX response, owner names, sanctions screening) are processed transiently for the duration of a single lookup request and returned to your browser. They are not persisted on our servers.

Pilot-phase query log: during the pre-launch pilot, the query you type(company name or UID), a non-reversible visitor hash (SHA-256 of IP + salt, truncated to 12 chars), and aggregate result metadata (canton, language, UBO count, sanctions hit count, latency) are stored in our hosting provider's server logs for product improvement and quality validation. Raw IP addresses are not stored by us. Retention: 30 days, then automatic deletion. This logging will be replaced by per-customer audit logs (opt-in) when ubo.swiss moves out of pilot.

In-memory caches: parsed LLM extractions, sanctions-list data, and ZEFIX entity responses are cached per server process / Vercel Data Cache (24h) to avoid re-downloads and re-extractions. These caches are cleared on every server restart / deployment and contain only data that is already public.

To request deletion of any log entry associated with you, email the data-protection contact above with the approximate date and query. Note that since visitor hashes are not reversible from your IP, we will ask you to identify your entry by query text and time window.

International data transfers

ubo.swiss is operated from Switzerland. The European Commission has issued an adequacy decision for Switzerland, and Switzerland has done the same for the EU and UK, so transfers between these jurisdictions do not require additional safeguards.

If you query a US-domiciled OFAC-listed person, we donot send any data to the US — we screen locally against the OpenSanctions feed.

Your rights (data subject rights)

If you are a data subject (e.g. a director or shareholder named in a Swiss commercial-register publication), under revDSG and GDPR you have the right to:

  • Request access to personal data we process about you
  • Rectification of inaccurate data
  • Deletion (within the limits of our legitimate-interest basis and statutory retention)
  • Restriction of processing
  • Object to processing
  • Lodge a complaint with the Swiss FDPIC or your local EU data-protection authority

Practical note: since we hold no persistent personal data between requests, deletion / restriction requests will typically result in confirmation that no stored data exists. The underlying public registers (ZEFIX, the French Annuaire des Entreprises, etc.) are operated by the respective national authorities — requests to delete entries from those registers must be addressed to them.

Cookies and trackers

ubo.swiss uses no analytics, no advertising trackers, and no third-party cookies. The site uses only essential first-party session state required for the form interaction.

Changes to this policy

We may update this policy as the product evolves (e.g. when adding new registry integrations or hosted LLM backends). The "last updated" date at the top reflects the latest version. Material changes affecting how we process personal data will be highlighted clearly.

Disclaimer

This policy is a working document for a pre-MVP product. It is provided in good faith but is not a substitute for legal counsel. Before commercial launch and onboarding paying fiduciaries, ubo.swiss commits to a formal data-protection review with a qualified Swiss data-protection lawyer.