Legal
Privacy
How this website processes personal data. Swiss nFADP; GDPR where it applies.
24 August 2026
1. Controller and scope
The controller is A. Romeo & Partners Capital AG, Firststrasse 3a, 8835 Feusisberg, Switzerland. Privacy enquiries: office@romeo-partners.com. This notice covers the classification-gated website, the separate invitation-gated holdings area and Investment Guide delivery. It does not replace documentation for a specific mandate or product.
2. Hosting and technical logs
Vercel hosts the site. Requests may process IP address, time, URL, referrer, browser, device and error data to deliver and secure the service and investigate abuse. Vercel may process data outside Switzerland, including in the United States, under its terms and applicable safeguards. Legal basis: our legitimate interest in operating and securing the site (Art. 6(1)(f) GDPR, where it applies). Log data are short-lived and typically retained for no more than 90 days.
3. Audience declaration
Before commercial or editorial pages are shown, we record a pseudonymous token hash, country, declared investor category, locale, accepted legend version, acceptance time and expiry. We do not request email, wealth information or identity documents at this gate. The purpose is audience restriction and an auditable declaration record. The declaration does not establish legal eligibility, and access may still be refused. Declaration records are retained for the validity of the declaration and for five years thereafter to document the operation of the audience restriction, then deleted. Legal basis: our legitimate interest in restricting and documenting the audience of this site (Art. 6(1)(f) GDPR, where it applies).
4. Investment Guide
If you request the Guide, we process your email, optional name and company, the country and category from your declaration, locale, Guide version, delivery time and download time. We use these data to validate, deliver, secure and document the requested download and to limit repeated requests. Records of requests, deliveries and downloads are retained for 24 months after the last delivery or download, then deleted. Legal basis: the steps you request from us and the delivery itself (Art. 6(1)(b) GDPR, where it applies) and our legitimate interest in securing it.
5. Optional marketing consent
Guide delivery is separate from marketing. The marketing box is optional and is not preselected. If selected, we record the consent version and time and use the supplied contact details for occasional professional updates until you withdraw. Legal basis: your consent (Art. 6(1)(a) GDPR, where it applies). You may withdraw at any time by writing to office@romeo-partners.com; withdrawal does not affect Guide delivery or prior processing.
6. Supabase and recipients
Supabase provides the private database and Storage backend as a processor. It stores declaration records, Guide leads, delivery and download records, and the private versioned PDF. Vercel and Supabase receive only the data needed for their services and act under data processing agreements; transfers outside Switzerland or the EEA rely on recognised safeguards such as adequacy decisions or standard contractual clauses. We do not sell personal data and use no analytics, advertising or CRM tags.
7. Private holdings access and security
The holdings area remains subject to a separate invitation code and the arpc_invite cookie in addition to the site declaration. We apply access controls, private Storage and short-lived signed download URLs. Internet transmission is not absolutely secure.
8. No profiling or automated decisions
We do not use profiling. Beyond the rule-based audience gate that you complete yourself, no automated decisions with legal or similarly significant effects are made, and a declaration can be submitted again at any time.
9. Rights and changes
Depending on applicable law, you may request access, rectification, erasure, restriction, objection or portability, and withdraw consent where processing relies on it. Contact office@romeo-partners.com. You may also contact the FDPIC or, where the GDPR applies, your local supervisory authority. We may update this notice when the law, processors or site operation changes; the date above identifies the current version.