Privacy Policy Website and App

This Privacy Policy explains how UMushroom Ltd., Josefstrasse 206, 8005 Zurich, Switzerland (“UMushroom”, “we” or “us”) collects and processes personal data (hereinafter “data” or “personal data”) of users who visit the website www.umushroom.com (“Website”) or the mobile application (“App”) and use the services offered via the Website or the App. The terms used in this Privacy Policy have the meanings given to them in the UMushroom Terms of Use and in this Privacy Policy.

Information on the processing of personal data in the B2B context is provided in the B2B Privacy Policy.

If the user transmits or discloses UMushroom data about other persons, the user confirms that he is authorized to do so and that this data is correct. The user undertakes to inform these persons of this Privacy Policy.

UMushroom may update this Privacy Policy at any time. The version published on this Website is the current version and was last updated on18.01.2024.

This Privacy Policy is in accordance with the European General Data Protection Regulation (“GDPR”) and Swiss data protection law. However, the applicability of these laws depends on the individual case.

1. Who is responsible for the processing of user data?

UMushroom is responsible for data processing in accordance with this Privacy Policy, unless otherwise communicated in individual cases.

The user can contact UMushroom in the event of data protection concerns and in order to exercise his rights in accordance with section 10 as follows:

UMushroom AG
Josefstrasse 206
8005 Zürich
Switzerland
[email protected]

You can also contact the following persons if you live in Europe or the UK: https://prighter.com/q/18996857572

2. What data is processed by UMushroom, for what purposes and on what basis?

UMushroom processes data about the user that UMushroom obtains through the user's use of the Website or App and the services. If the user does not provide UMushroom with the data marked as required before clicking on the registration button, UMushroom will not be able to offer its services to the user.

UMushroom mainly processes the following categories of personal data for the stated purposes:

– Technical and functional data: When the user uses the Website or App and our services, UMushroom collects the user's IP address and other technical data to ensure the functionality and security of the Website or App and the services. This may also be done by setting cookies and similar technologies (see section 11). The use of this data is in UMushroom’s legitimate interest in order to provide the Website or App and the services and to prevent errors and misuse.
– Registration and data in connection with our services: Registration is required to use our services. UMushroom processes the user data provided by the user when setting up an account, such as the e-mail address, the username and the user's place of residence. UMushroom processes this data for the conclusion, administration and fulfilment of the contractual relationship between UMushroom and the user. UMushroom also processes the personal data (e.g., the user data provided when filling in the user profile, comments or ratings on the investment products, the user's portfolio and payment data if the user opts for a paid subscription) for the purpose of providing its services to the user and the organization and running of contests and prize draws.
– Communication: When the user interacts with UMushroom, e.g., by e-mail, UMushroom collects the data exchanged, such as the name of the user and the content of the user's message, including the metadata of the communication. UMushroom uses this data to process the user's enquiry and to be able to contact the user.
– Tracking of behaviour and preferences (for statistics and marketing):: In order to best tailor the Website or App and the services to each individual user, to improve services and develop new products, and for market research purposes, UMushroom collects and processes data about the behaviour and preferences of users. UMushroom does this by evaluating already known information about the user (e.g., where and when the services are used) or by recording the user's behaviour on the Website or App with the help of cookies and similar technologies (see section 11 for details). In addition, UMushroom may use this data for marketing purposes and to maintain business relationships, e.g., for sending newsletters. The user can refuse or withdraw their consent at any time by contacting UMushroom (see section 1). With regard to targeted online advertising, see section 11.
– Business relationships and compliance: UMushroom also collects and processes user data in relation to UMushroom’s contractual obligations to its business partners (e.g., investment data providers or portfolio managers managing an investment product channel) or for marketing and promotional purposes, such as information about the user's contact details, portfolio, interests, role as an investor and client history. UMushroom also collects and processes user data for compliance with laws, instructions and recommendations from authorities and in certain situations, e.g., in connection with participation in administrative or legal proceedings or for risk assessment (e.g., in the case of acquisition or sale of receivables, businesses, parts of businesses or companies).

3. On what basis does UMushroom process user data?

When UMushroom obtains the user's consent for certain processing (e.g., for marketing emails and for advertising management and behavioural analysis on the Website or App and when using the services), the legal basis for this processing by UMushroom is the user's consent. The user can revoke his consent at any time with effect for the future by sending an email to UMushroom to the address given in section 1. For the revocation of consent to online tracking, see section 11. After receipt of the withdrawal of consent, UMushroom will no longer process the user data for the purposes to which the user has consented, unless UMushroom can invoke another legal basis. However, the withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.

If UMushroom does not obtain consent to the processing, the processing of the user Data is based on the necessity of the processing for the initiation or fulfilment of a contract with the user (or the legal entity represented by the user) or on the legitimate interest of UMushroom or a third party in the respective processing for the purposes described in section 2. This also includes compliance with legal regulations, unless compliance is already recognized as a legal basis by the applicable data protection law (e.g., in the case of the GDPR, the laws in the EEA and in the case of the Federal Act on Data Protection, Swiss law).

4. How do we process data for social media presences?

On our Website or App, we offer you the option of using a “social media button” from Facebook, Instagram, LinkedIn, Twitter, YouTube and TikTok. The button leads to linked profiles. The offers are deactivated by default. As soon as you activate them (e.g., by clicking on the button), the relevant providers can recognize that you are on our Website or App. If you have a corresponding account with the social media provider, they can assign this information to you and thus track your use of online services. The responsibility for data protection-compliant operation lies with the respective provider. We therefore recommend that you read the privacy policy of the respective social media provider.

We operate our own presences (e.g., Facebook fan page and our own YouTube channel) on third-party platforms (e.g., social networks). If you communicate with us there or comment on or disseminate content, we collect information that we use primarily to communicate with you, for marketing purposes and for statistical analyses. Please note that the provider of the platform also collects and uses data itself (e.g., on user behaviour) when you visit our social media sites, possibly together with other data known to it (e.g., for marketing purposes or to personalize the platform content). Further information on data processing by the providers of social networks can be found in the privacy policies of the corresponding social networks.

5. What applies to profiling?

We may process and evaluate your data automatically for the purposes specified section 2. This also includes so-called profiling, i.e., UMushroom can create profiles based on the user data, in particular to continuously improve the services and the Website or App through statistical analyses and to market the services and the Website or App by addressing the user with offers and advertising that UMushroom considers to be of interest to the user. For these purposes, UMushroom may combine behavioural and preference data, but also master data, contract data and technical user data in order to better understand individual users.

6. To whom does UMushroom disclose the user data?

We may disclose data to various bodies within the scope of our activities. These include, in particular, the following recipients:

– persons associated with you, e.g., authorized representatives and deputies, and in the case of contact persons of companies, employees and the company itself;
– other users of UMushroom’s services and partners (e.g., portfolio and asset managers who manage an investment product channel);
– offices, authorities and courts within the scope of our legal obligations and in connection with proceedings in which we are a party or third party;
– third parties, e.g., in connection with the acquisition or sale of assets by us;
– credit reference agencies and providers of sanctions and other databases to which we may disclose the necessary information about you as part of an information request;
– service providers, in particular providers of IT services (examples are providers of hosting or data analysis services), online marketing and advertising providers (see also section 11), administration and consulting services, shipping services; furthermore also to audit firms, banks, post office, etc.

7. Is personal data transferred abroad?

As explained in section 6, UMushroom may disclose user data to other parties. These parties are not all located in Switzerland. User data is processed in Germany in particular, but also outside the European Economic Area (EEA), especially in the USA and the UK, potentially worldwide.

If a recipient is located in a country without an adequate level of data protection (as determined by the European data protection authorities or the Swiss Federal Council), we compensate for the lower level of protection through appropriate contracts, in particular through the Standard Contractual Clauses (SCC) issued by the European Commission on 4 June 2021. Further information and a copy of these clauses can be found here and here. An exception may apply, for example, in the case of legal proceedings abroad, but also in cases where there is an overriding public interest or if the fulfilment of a contract requires disclosure, if the user has consented or if the user data has been made generally accessible by the user and the user has not objected to the processing.

The European Commission's SCCs have also been recognized by the Federal Data Protection and Information Commissioner (FDPIC). You can find more information here.

8. How long will the user data be processed?

UMushroom stores the user data for as long as it is necessary for the specific purpose for which UMushroom collected it; in the case of contracts, generally at least for the duration of the contractual relationship. UMushroom also stores personal data based on UMushroom’s legitimate interest, e.g., in the case of statutory retention obligations and for the protection and defence of legal claims. After expiry of the aforementioned periods, UMushroom will delete or anonymize the user data.

9. How is user data protected?

UMushroom takes appropriate security measures to protect the confidentiality, integrity and availability of your personal data, to protect it against unauthorized or unlawful processing and to counteract the risks of loss, unintentional modification, unwanted disclosure or unauthorized access. However, security risks cannot generally be completely ruled out; residual risks are unavoidable.

10. What are the user's rights?

The applicable data protection laws grant the user the right to object to the processing of user data under certain circumstances, in particular for the purposes of direct marketing, profiling (for the purposes of direct marketing) and other legitimate interests in the processing.

Insofar as the applicable requirements are met and no legal exceptions apply, the user has the right to information, correction, deletion, restriction of data processing and the right to receive the user data provided by him in a common and machine-readable format. The user also has the right to object to data processing on the basis of UMushroom’s legitimate interest at any time and to revoke any consent that the user has given to UMushroom. The revocation is only valid for the future and UMushroom is authorized to continue processing on another legal basis (e.g., if this is required by law).

The user can exercise the above-mentioned rights by contacting UMushroom at the address given in section 1. In order to prevent misuse, UMushroom may request the identification of the user by means of a copy of his identity document, unless identification is otherwise possible.

Users are also free to file a complaint with the competent supervisory authority in their country of residence. A list of authorities in the European Economic Area can be found here. The UK supervisory authority can be contacted here. The Swiss supervisory authority can be contacted here.

11. Does UMushroom use online tracking and online advertising techniques?

UMushroom uses cookies and similar technologies that enable UMushroom and third parties engaged by UMushroom to recognize the user while using the Website or App in order to maintain, improve and personalize the Website or App and the services. If the user wishes to block certain types of cookies or similar technologies, these can be disabled or deleted in the browser settings or on the Websites or Apps of the third parties listed below.

UMushroom distinguishes between the following categories of cookies and similar technologies:

– Necessary cookies and similar technologies: Some cookies and similar technologies are necessary for the functioning of the Website or App and the services (e.g., to ensure that the user remains logged in). If these are blocked, the Website or App may not function properly. The processing of such cookies is in UMushroom’s legitimate interest to operate a user-friendly Website or App.
– Performance cookies and similar technologies: UMushroom uses cookies and similar technologies to analyse how the Website or App and the services are used and to maintain, operate and continuously improve them. For this purpose, UMushroom uses the third-party analytics services listed below. Before using such cookies and similar technologies, UMushroom asks the user for their consent. Consent can be withdrawn at any time.
– Marketing cookies and similar technologies: UMushroom and its advertising partners (as listed below) have an interest in targeting advertising as effectively as possible. For this purpose, if the user consents, UMushroom and its advertising partners use cookies and similar technologies that allow UMushroom and its advertising partners to track the user's activities across different Websites or Apps and record the user's activities (e.g., whether the user has seen or clicked on an ad) in order to customize the advertising, the user sees. If the user does not consent, they will not see fewer advertising, but simply different advertising.

In addition to marketing cookies, UMushroom also uses other technologies to control online advertising on other Websites or Apps. For example, UMushroom can transmit the email addresses of users to whom UMushroom would like to display advertising to operators of advertising platforms (e.g., social media). If these persons are registered with the same email address there (what the advertising platforms determine using a matching process), the providers display our advertising specifically to these persons. The providers do not receive any email addresses from persons who are not already known to them. However, in the case of known email addresses, they learn that these persons are in contact with UMushroom and what content they have accessed.

UMushroom may also integrate buttons from third-party providers (so-called plug-ins) on the Website or App, in particular from social media providers. These offers are deactivated by default. As soon as they are activated by the user (e.g., by clicking on a button), these providers can assign the user's visit to the Website or App to the user and, if applicable, their account. When collecting user data via social plug-ins, UMushroom and the third-party company act as joint data controllers. For any further processing, the third-party company acts as a separate controller.

Two of our most important third-party providers are Google and Hotjar. You can find more information about them below. Other third-party providers generally process personal and other data in a similar way.

– Google Analytics, an analysis service provided by Google LLC (1600 Amphitheatre Parkway, Mountain View, CA, USA) and Google Ireland Ltd (Google Building Gordon House, Barrow St, Dublin 4, Ireland; both together “Google”, whereby Google Ireland Ltd. is responsible for the processing of personal data). For the purposes of the GDPR, the UK GDPR and the FADP, Google Ireland Ltd. is the controller. Google tracks the behaviour of visitors to the Website or App (duration, page views, geographical region of access, etc.) using performance cookies (see above) and on this basis compiles reports for UMushroom on the use of our Website or App. UMushroom has configured the service so that the IP addresses of visitors are shortened by Google in Europe before they are forwarded to the United States and can then no longer be traced. Google provides UMushroom with reports and can therefore be regarded as UMushroom’s sub-processor, but also processes data for its own purposes. Google can use the data collected to draw conclusions about the identity of visitors, create personal profiles and link this data to the Google accounts of these persons. The user should assume that this processing takes place if the user consents to the use of performance cookies. Information on data protection at Google Analytics can be found here, and if the user has a Google account, further details on processing by Google can be found here.
– Hotjar: Hotjar Ltd (Dragonara Business Centre, 5th Floor, Dragonara Road, Paceville St Julian's STJ 3141, Malta) is the provider of the “Hotjar” service. Hotjar is a technology service that helps UMushroom to better understand the user experience (e.g., how much time is spent on which pages, which links the user clicks on, what they like and dislike, etc.) and enables UMushroom to develop and maintain its Website or App and services with the help of user feedback. Hotjar uses cookies and similar technologies to collect data about the behaviour of users and their devices. This includes the IP address of a device (processed during the user's session and stored in anonymized form), the screen size of the device, the device type (unique device identifiers), browser information, geographical location (country only) and the preferred language in which the Website or App is displayed. Hotjar stores this information on behalf of UMushroom in a pseudonymized user profile and can therefore be regarded as a sub-processor of UMushroom. Further information on data protection at Hotjar can be found on the Hotjar support page.