Updated: 8 October 2026
Legal review pending: the active cookies, recipient data flows, overseas safeguards and record-specific retention requirements remain to be verified. This notice is not a certification of legal compliance.

1. Purpose and controller
Aurum Helvetica GmbH, Weissbadstrasse 8b, 9050 Appenzell, Switzerland (the Company), is responsible for personal data it processes in connection with its precious-metals business, except where another party is independently responsible. This notice explains its processing under the Swiss Federal Act on Data Protection (FADP) and, where applicable, the EU/EEA General Data Protection Regulation (GDPR). Contact: info@aurumhelvetica.com; +41 76 720 10 63.

2. Scope
This notice concerns prospects, clients, former clients, beneficial owners, representatives, website visitors, suppliers, business contacts and applicants. It covers information collected through conversations, forms, contracts, correspondence, transactions, service providers and the website.

3. Personal data collected
Depending on the relationship, the Company may process names, contact details, date of birth, nationality, identification and address evidence; beneficial ownership and source-of-funds information; bank and payment details; trade, invoice, delivery and allocated-storage records; KYC, AML, sanctions, politically exposed person and adverse-media checks; correspondence; and technical website data such as IP address, device/browser information, access logs and cookie preferences. Special categories of data are processed only when necessary and permitted by law.

4. Purposes
Data is used to answer enquiries; assess and establish business relationships; perform identification, due diligence and financial-crime screening; quote, buy, sell, deliver, allocate and store precious metals; process payments and maintain holdings and accounting records; administer suppliers and service providers; protect systems and prevent fraud; meet legal obligations; resolve disputes; and send marketing where lawful.

5. Legal grounds
Under Swiss law, processing follows the principles of lawfulness, good faith, transparency, proportionality and purpose limitation, and any applicable justification requirements. Where GDPR applies, grounds may include contract performance, legal obligations, legitimate interests (such as business security and administration) and consent where required. Consent can be withdrawn prospectively without affecting earlier lawful processing.

6. Recipients and service providers
Data may be disclosed as necessary to banks and payment partners, including Bankwell, Relio AG and Monex Europe Limited; compliance screening provider ComplyAdvantage; secure transport, custody and vault service providers, including Loomis where relevant; technology and hosting providers including Wix, Microsoft 365, Google Workspace and Aurum Helvetica's operational systems; newsletter providers where used; and professional advisers, auditors and competent authorities. The exact recipients depend on the service and transaction. Service providers receive only information necessary for their roles, subject to applicable confidentiality and contractual protections. The Company does not sell personal data.

7. Transfers abroad
Service providers and custody arrangements may involve Switzerland, the EEA/UK and other jurisdictions, potentially including Singapore, Cayman Islands and the United States, depending on the service selected. If personal data is disclosed abroad, the Company must assess the destination and apply safeguards required under Swiss law and, where applicable, GDPR, such as adequacy decisions, appropriate contractual clauses or a permitted statutory exception. A vault location is not by itself evidence that personal data is transferred there. Verification pending: the actual destination countries and safeguards used for each recipient have not yet been confirmed for this notice.

8. Marketing
The Company may send business updates, newsletters and product information where permitted by applicable law. Where consent is required, it must be obtained; recipients may unsubscribe using the link in a message or by contacting the Company. Transactional, compliance and account-service communications may continue when necessary. The current newsletter platform and consent process remain to be verified.

9. Website, cookies and analytics
The website is hosted and operated using Wix. It may use essential cookies, hosting logs and optional analytics or marketing technologies depending on the site's actual configuration and visitor preferences. Information about specific cookies, purposes, durations and third parties should be presented in the website's cookie controls or cookie declaration. Non-essential technologies are subject to applicable consent requirements. Verification pending: the active cookie inventory and consent configuration have not yet been confirmed for this notice. Contact forms should not be used to transmit identity documents or sensitive financial information unless a secure channel has been provided. Any client portal, if made available, will require appropriate access and security controls; its present availability has not been verified for this notice.

10. Information security
The Company uses risk-based technical and organisational measures, which may include encryption, multi-factor authentication, role-based access, restricted authorisations, audit logs, secure suppliers and incident response. No electronic system is completely risk-free. Access to personal data is limited to authorised persons with a business need. The implementation of each measure across all relevant systems remains subject to verification.

11. Retention
Personal data is kept only as long as needed for its purpose and to satisfy legal obligations. AML, commercial, accounting and transaction records are generally retained for ten years where required by applicable law, subject to the specific trigger date, any longer legal retention duty and legal holds. Other data, such as enquiries and website logs, may have shorter periods. At the end of the applicable period, information is deleted, anonymised or securely archived as required. Verification pending: the applicable record categories, legal retention periods and trigger dates must be confirmed; this is not a blanket ten-year rule for all personal data.

12. Individual rights
Subject to applicable law and exceptions, individuals may request access, rectification, deletion, objection or restriction of certain processing, and data portability where statutory conditions are met. Where GDPR applies, additional GDPR rights may be available. Requests should be sent to info@aurumhelvetica.com; identity may need to be verified. Individuals may contact the Swiss Federal Data Protection and Information Commissioner (FDPIC), or a competent European supervisory authority where applicable.

13. Incidents
Suspected security or privacy incidents are investigated, contained, recorded and remediated. The Company reports personal-data security breaches to the FDPIC when they are likely to result in a high risk to the personality or fundamental rights of affected individuals, and informs individuals where legally required. Applicable GDPR notification duties are considered separately.

14. Responsibilities
Management oversees practical implementation, appropriate access and vendor controls; personnel and authorised contractors must protect information and report incidents. External advisers provide guidance but do not replace the Company's legal responsibilities.

15. Contact
Aurum Helvetica GmbH, Weissbadstrasse 8b, 9050 Appenzell, Switzerland. Email: info@aurumhelvetica.com. Telephone: +41 76 720 10 63. Privacy and rights requests can be submitted by email.

16. Updates
This notice may be updated when services, service providers, technology or law changes. Updated: 8 October 2026. Legal review remains pending, including verification against the Company's records of processing, live cookie configuration, contractual data transfers, retention schedule and applicable GDPR obligations.