Privacy Policy

We do not sell your personal data. We may share your data with the following categories of recipients:

• Service Providers: Third-party vendors who process data on our behalf (e.g., hosting, payment processing, analytics, customer support). These providers are contractually bound to process data only as instructed and implement appropriate security measures.
• Professional Advisors: Legal, accounting, and compliance advisors under professional confidentiality obligations.
• Business Transfers: In connection with a merger, acquisition, reorganization, or sale of assets, your data may be transferred to the acquiring entity.
• Legal Requirements: Where disclosure is required by law, regulation, court order, or governmental request.
• Safety and Rights: To protect the rights, property, or safety of the Company, our users, or the public.

Your personal data may be transferred to and processed in countries outside of Switzerland and the European Economic Area (EEA). We ensure that such transfers are protected by appropriate safeguards in accordance with Art. 16–17 nFADP and Chapter V of the GDPR, including:

• Transfers to countries recognized by the Swiss Federal Council or the European Commission as providing an adequate level of data protection;
• Standard Contractual Clauses (SCCs) approved by the European Commission (Decision 2021/914);
• Binding Corporate Rules (BCRs) where applicable;
• Your explicit consent for specific transfers where no other safeguard applies.

A copy of the relevant safeguards may be obtained by contacting us at privacy@sxguard.com.

We retain your personal data only for as long as necessary to fulfill the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law. The following table summarizes our retention periods:

• Data Category
• Retention Period
• Justification
• Account Data
• Duration of account + 30 days
• Service provision and data export period
• Payment & Billing Data
• 10 years from transaction date
• Swiss commercial law (Art. 958f CO) and tax obligations
• Usage & Technical Data
• 24 months from collection
• Service improvement and security analysis
• Communication Data
• 36 months from last interaction
• Service quality and dispute resolution
• Log Files
• 90 days (rolling)
• Security monitoring and incident response

When personal data is no longer required, it is securely deleted or anonymized in accordance with our data retention procedures.

We implement appropriate technical and organizational security measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction, in compliance with Art. 8 nFADP and Art. 32 GDPR. These measures include:

• Encryption of data in transit (TLS 1.2+) and at rest (AES-256);
• Access controls and role-based permissions;
• Regular security assessments, penetration testing, and vulnerability scanning;
• Multi-factor authentication for privileged access;
• Incident response procedures with notification obligations under Art. 24 nFADP and Art. 33–34 GDPR;
• Employee security awareness training and confidentiality agreements.

No system is completely secure. While we strive to protect your data, we cannot guarantee absolute security. You are encouraged to use strong passwords and protect your Account credentials.