Last updated: 29 October 2026
The controller responsible for the processing described in this policy is the party named in our Impressum (sole proprietorship Akram El Gebali, Allschwil, company ID CHE-292.959.874).
For questions about data protection and to exercise your rights, contact us at info@complyswiss.ch. We have not appointed a separate data protection advisor; the owner is personally responsible.
This privacy policy applies to the website complyswiss.ch and the ComplySwiss platform. We process personal data in accordance with the Swiss Federal Act on Data Protection (FADP) and the Data Protection Ordinance. Where the EU General Data Protection Regulation (GDPR) applies in individual cases, we also comply with it.
Depending on the type of data, we act in one of two roles:
When you visit our website, the web server stores technical information in log files: IP address, date and time, page visited, referrer URL, browser and operating system. We need this data to operate the site securely and to detect attacks, and keep it only as long as necessary for these purposes.
Our fonts are hosted on our own server in Switzerland. Google Analytics loads on public pages only with your consent; without that consent, no connection to Google Analytics is made.
When you contact us via the contact form or by e-mail, we process your name, e-mail address, optionally your company and the content of your message in order to answer your request. The form is processed on our server in Switzerland and forwarded to our inbox. External senders' or recipients' e-mail providers may also be involved.
Requests that do not lead to a contract are deleted no later than 12 months after the correspondence has ended.
When you apply for a company account, we process the company name, address, name and e-mail address of the contact person, the selected subscription plan and the payment reference. We review the application and activate the account once payment has been received. Payment is made by bank transfer; our bank provides us with the payer's details.
We keep contract, invoice and accounting records for the statutory period of ten years (Art. 958f Swiss Code of Obligations). Rejected applications are deleted after six months.
For each user account we process the name, e-mail address, role, company or organisation membership, the password as an irreversible hash and, if enabled, the two-factor authentication secret (stored encrypted).
Security-relevant events such as logins, password resets and changes to data are recorded with timestamp and user in an audit log. The audit log serves security and evidential purposes towards supervisory and audit bodies; it forms part of the customer data and is retained accordingly (section 7). To prevent abuse, we briefly process IP addresses during login and form attempts in order to limit the number of attempts.
For platform e-mails (e.g. password resets, notifications) we use our host's e-mail service in Switzerland.
Our customers record data about their own clients in ComplySwiss in order to fulfil their due diligence obligations under the Swiss Anti-Money Laundering Act (AMLA). This includes in particular: identification details, addresses, date of birth, nationality, occupation, details of beneficial owners, source of funds and wealth, identity documents and other evidence, risk ratings, results of sanctions and PEP screening, transactions, wallet addresses, alerts, cases and notes.
This data may include sensitive personal data, such as information on sanctions, administrative or criminal proceedings, or political functions. Clients can also enter their details themselves via an onboarding link; we process this data on behalf of the respective customer as well.
We process this data solely on our customer’s instructions and in accordance with the data processing agreement (DPA), which we provide on request. We do not use the data for our own purposes and do not analyse it. We disclose it only to the sub-processors listed in section 9, where the customer uses the function concerned. Only users authorised by the customer have access; we ourselves only access it where necessary for support or operations and where the customer requests or permits this.
The retention period is determined by the customer; the AMLA generally requires ten years (Art. 7 AMLA). After the contract ends, the customer can export its data. We then delete it within 90 days unless the customer requests longer retention. Deleted data may remain in backups until their scheduled rotation. The current recovery setup uses daily incremental backups and weekly full backups, retaining up to four full backups and their associated incremental backups. This backup rotation does not extend the separate 24-hour availability and deletion period for temporary ID/face images and video recordings.
The same applies to self-regulatory organisations (SROs) in the SRO module: we process member registers, audits, findings, self-declarations and the related documents on behalf of the respective SRO. The details are set out in our data processing agreement.
20.10.2026
For an identification review, ComplySwiss processes ID images, face images and, only with separate recording consent from both participants, the audio and video of the interview. These files remain on ComplySwiss infrastructure and are accessible only through authorized access. No external AI provider receives them. The assisted workflow does not confirm identity, document authenticity or liveness.
For this workflow, the financial intermediary must conduct the identity assessment through a live video conference led by appropriately trained personnel. It must ensure that its staff are trained to examine identity documents, compare them with the person participating in the call, and recognise indications of forgery, tampering or fraud. Automated document reading and facial comparison provide assistance only; responsibility for the assessment and compliance with applicable law and SRO requirements remains with the financial intermediary.
ComplySwiss provides temporary storage and download, not a permanent compliance archive. Completed ID/face captures and saved or interrupted video recordings remain available to authorized staff for 24 hours after completion. The service automatically removes its copies at their displayed deadline, unless an authorized person requests deletion or recapture earlier. Downloading, reviewing or refreshing does not extend the deadline.
The same 24-hour download window applies to ID images, face images, guided response images and videos. For ID/face captures, completion means the local analysis has finished; for videos, it means the recording has been saved or marked incomplete. Unfinished capture sessions expire 24 hours after the first acknowledged submission (unused invitations expire after 24 hours). Temporary captures and videos are encrypted in ComplySwiss storage and survive a normal service restart without a new 24-hour period. The page shows the applicable deadline. This temporary storage is not a long-term archive or a substitute for the intermediary’s own backups.
The financial intermediary, not the person being identified, must download the required ID/face PDF, review record and video before the applicable deadline, check that the files open completely and store them in its own protected archive. The intermediary is responsible for access controls, backups and the retention required by the applicable law and SRO rules. ComplySwiss does not archive these temporary media files on the intermediary’s behalf after expiry. PDF copies are generated in the authorized staff browser; no separate PDF copy is stored by this feature on the server. Copies already downloaded remain under the intermediary’s responsibility and are not deleted by server expiry.
ID/face capture and call recording require affirmative consent; recording has a separate checkbox for each participant. Opening the privacy notice does not select a checkbox or authorize a recording. Recording consent may be withdrawn using the interruption control. For access, deletion or other data-protection requests, contact your financial intermediary; statutory retention duties may apply. This temporary-media rule is separate from the retention of other platform records described above.
ComplySwiss offers an optional AI assistant that drafts a text on an alert or case (explanation, open points, a draft note or closing memo). It is only active if the customer has expressly switched it on and consented to the transfer of data to the AI provider. Without this consent, no data is sent to an AI provider.
When an authorised person requests a draft, ComplySwiss sends the details of the alert or case concerned (including description, rule, transactions and case notes) to Mistral AI in Paris, France. Before sending, we replace names, company names, customer numbers, addresses, beneficial owners, email addresses, IBANs, wallet addresses and phone numbers with placeholders; the real details are put back into the answer only within ComplySwiss. The remaining details may still be personal data.
Mistral does not use the data to train its models (training is switched off in our account) and keeps inputs and outputs for up to 30 days to detect abuse. The draft and its use (time, user, model, cost) are stored in ComplySwiss and retained like other customer data. ID and face images and videos are never sent to the AI provider (section 7a).
The draft is an aid. It makes no decision and changes nothing in the file; review and decision remain with the customer.
Technically necessary cookies support sign-in and protect forms. We store your analytics choice in our own cookie for up to six months. You can change it at any time using “Cookie settings” in the footer.
With your voluntary consent, we use Google Analytics 4 (G-R3CCYJTTEX) to measure public-website page views and usage and improve the website. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Consent is also the legal basis where the GDPR applies. Refusing does not restrict your use of the website.
This involves pseudonymous cookie identifiers, page views and technical browser and device information. Google also receives technical connection data, including the IP address, when a connection is established; this processing is therefore not fully anonymous. We supply cleaned public-page addresses without query parameters and no full referrer address. We do not transmit form entries or set a user ID. Portal, account, customer and ID/video pages are excluded. Google Signals and advertising personalisation are disabled.
Our configured analytics-cookie lifetime is up to six months without automatic renewal. This is not the retention period for events already stored by Google. You can withdraw consent at any time for the future. We then stop further collection on this website and remove its Google Analytics cookies where the browser permits; this does not automatically erase data already sent.
Google may process these website statistics in the USA and other countries whose data-protection laws may differ from Swiss law. This optional transfer starts only after your consent. It does not include customer data held in the ComplySwiss platform. Further information about Google’s handling of data:
We do not sell personal data. We only disclose personal data to the following recipients where necessary for the purposes described:
Google Ireland Limited: optional public-website statistics, exclusively with consent under section 8. This does not add Google as a recipient of your KYC/AML customer data.
We only engage new sub-processors for customer data after informing our customers in advance; details are set out in the DPA.
Platform data described in sections 5 to 7 is stored in Switzerland. If a customer uses the optional AI assistant (section 7b), the necessary, partly masked details are sent to Mistral AI in France. Under Annex 1 of the Data Protection Ordinance, France provides adequate data protection (Art. 16(1) FADP). Mistral primarily uses providers in the EU; sub-processors outside the EU that it engages in exceptional cases are bound by the European Commission’s standard contractual clauses. With consent, optional public-website statistics may transfer data to Google abroad (section 8).
A further exception applies if a customer uses optional blockchain analytics and connects a provider of its choice. To check a transaction, the following details are sent to that provider: transaction hash, wallet addresses, amount and currency, country of the transaction, customer number, risk level and country of residence — no names. The transfer takes place on the customer’s instructions; if the provider is abroad, the customer is responsible for meeting the requirements of Articles 16 and 17 FADP.
We take appropriate technical and organisational measures to protect personal data against loss, unauthorised access and misuse. These include:
Some residual risk can never be fully excluded when data is transmitted and stored over the internet. If we become aware of a data security breach affecting customer data, we inform the affected customer without delay so that it can meet its obligations under Art. 24 FADP.
Within the scope of applicable law, you have the right to access your personal data, to have it corrected or deleted, to restrict or object to its processing, and to receive or transfer your data. You may withdraw consent at any time with effect for the future. Statutory retention obligations, in particular under the AMLA, may prevent deletion.
Please send your request to info@complyswiss.ch. We may ask for proof of identity and usually respond within 30 days. If your request concerns data that a financial intermediary or supervisory body has recorded about you in ComplySwiss (section 7), we forward it to them.
You may also lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC, www.edoeb.admin.ch).
We amend this privacy policy when our services or the legal requirements change. The version published on this page applies.
See also: Impressum.
