Privacy Policy

This policy explains how we handle personal data in connection with the Pension Lens website and service. It is based on the Swiss Federal Act on Data Protection (FADP) and, where applicable, the EU General Data Protection Regulation (GDPR).

1. Who is responsible

Questions about data protection can be sent to the email address above.

2. Data we process

We do not use advertising trackers and do not sell personal data.

3. Purposes and legal bases

• Providing the service: creating and managing accounts, reviewing and approving access, signing you in. Basis: performance of a contract (GDPR Art. 6(1)(b)).
• Answering requests sent through the contact form or by email, including offers. Basis: pre-contractual measures and our legitimate interest in responding (Art. 6(1)(b) and (f)).
• Operations and security: running, protecting and improving the website and detecting misuse. Basis: legitimate interest (Art. 6(1)(f)).
• Service emails such as account confirmation, password reset and important changes to the service or Terms. Basis: performance of a contract.
• Legal obligations such as bookkeeping and retention duties. Basis: legal obligation (Art. 6(1)(c)).

We will only send you marketing emails if you have agreed to receive them, and you can unsubscribe at any time.

4. People named in fund profiles

Fund profiles may include the names and roles of individuals in their professional function, for example the head of investments of a pension fund, as published by the pension fund itself in its annual report or on its website. We process this information to provide accurate, sourced information about the pension funds, which is our legitimate interest. If you are named in Pension Lens and want to object or request a correction, please contact us.

5. Service providers

We use carefully selected providers who process data on our behalf and under contractual data protection obligations:

If we add a provider for sending emails or invoicing, we will update this list.

6. Transfers abroad

Some of our providers are companies based in the USA, and data may be accessed from there for support or operations. Where data is transferred to a country without adequate data protection, we rely on the EU Standard Contractual Clauses with the Swiss amendments or, where available, on certification under the Swiss-US and EU-US Data Privacy Framework.

7. Cookies

We only use cookies that are necessary to keep you signed in and to protect your session. We do not use analytics, advertising or social media cookies, and we do not load fonts or scripts from third-party servers on our pages.

8. Retention

• Account data is kept as long as your account exists and deleted within 90 days after the account is closed, unless we must keep it longer.
• Contact requests are deleted after two years if no contract results from them.
• Contract and invoicing records are kept for ten years as required by Swiss law.
• Server logs are kept by our hosting provider for a short period, typically not more than 30 days.

9. Security

Data is transmitted encrypted (HTTPS). Passwords are stored only as hashes. Access to the database is restricted by row-level security rules, so that each user can only access data they are entitled to.

10. Your rights

You can request access to your personal data, its correction or deletion, restriction of processing and, where applicable, a copy of your data in a portable format. You can object to processing based on legitimate interest and withdraw consent at any time with effect for the future. Send your request to onemoremeier@gmail.com.

You also have the right to lodge a complaint with a supervisory authority. In Switzerland this is the Federal Data Protection and Information Commissioner (FDPIC). In the EU, it is the authority in your country of residence.

11. Changes

We may update this policy. The current version is always available on this page.