1. Controller
The controller for the processing described here is GM Data Centers AG, Dammstrasse 16, 6300 Zug, Switzerland, register and UID number CHE-200.150.787.
For any question about data protection, or to exercise your rights, write to hi@gm-data-centers.com. We have not appointed a data protection officer, and are not required to.
2. Scope and applicable law
This notice covers this website only. It does not cover the investor platform, the data room, or any onboarding process operated separately by GM Data Centers AG or its group companies. Where those exist, they have their own notices, provided at the point of registration.
We process personal data under the Swiss Federal Act on Data Protection (FADP, revised version in force since 1 September 2023) and its implementing ordinance. Because this website addresses investors in Germany and elsewhere in the EU, the EU General Data Protection Regulation also applies to that processing under its Article 3(2). Where both apply, we meet the stricter requirement.
3. What we process
This website is a set of static pages. It has no user accounts, no forms, no login and no payment function. We collect no personal data from you directly. Two categories of data arise:
- Server log data. When your browser requests a page, our hosting provider records the request. This typically includes your IP address, the date and time, the page requested, the referring page, your browser type and version, and your operating system. This data is generated automatically by the transmission itself and cannot be avoided if the page is to reach you.
- Correspondence. If you write to us, whether by using an email link on this site or otherwise, we process your email address, your name if you give it, and the content of your message, in order to answer you.
4. Purposes and legal bases
We process server log data to deliver the website, to keep it available, and to detect and defend against attacks and abuse. Under the FADP this rests on our overriding legitimate interest in the secure operation of our own website. Under the GDPR the legal basis is Article 6(1)(f), our legitimate interest in the security and integrity of our systems.
We process correspondence in order to respond to your enquiry. Under the GDPR the legal basis is Article 6(1)(b) where the exchange concerns a prospective contractual relationship, and otherwise Article 6(1)(f), our legitimate interest in answering enquiries addressed to us.
We do not process your data for advertising, profiling or automated individual decision making. We do not sell personal data, and we do not disclose it for anyone else's marketing purposes.
6. Recipients and processors
We keep the number of parties involved as small as the service allows. The following process personal data on our behalf as processors, under a data processing agreement:
- Cloudflare, Inc. (United States)
- Hosting, content delivery, TLS termination, and protection against denial of service and other attacks. Processes server log data.
- Our email service provider
- Transmission and storage of email correspondence sent to and from hi@gm-data-centers.com. We will name the provider on request.
7. Transfers abroad
Some of the providers above are established in the United States or may process data there. We rely on the European Commission's adequacy decision for the EU-US Data Privacy Framework and the corresponding Swiss recognition for participating providers, and on the European Commission's Standard Contractual Clauses with the Swiss addendum where the Framework does not apply. On request we will tell you which mechanism covers a given transfer and provide a copy of the Standard Contractual Clauses. Write to hi@gm-data-centers.com.
8. How long we keep data
Server log data is retained by our hosting provider only for as long as it is needed to investigate a security incident or a delivery fault, and is then deleted or aggregated so that it no longer identifies you. We do not retain a copy ourselves. The retention period follows from our data processing agreement with that provider; on request we will tell you the period that currently applies.
Correspondence is kept for as long as needed to deal with the matter and to document it, and is then deleted, unless a statutory retention obligation under Swiss or other applicable law requires us to keep it longer.
9. Your rights
Subject to the conditions and limits of the applicable law, you have the right to:
- obtain confirmation of whether we process personal data about you, and receive a copy of it
- have inaccurate data corrected and incomplete data completed
- have data erased where we have no continuing basis for holding it
- have processing restricted while a request is being resolved
- object to processing that rests on a legitimate interest
- receive data you provided in a structured, commonly used format, or have it transmitted to another controller, where the GDPR grants portability
- withdraw any consent you have given, with effect for the future
10. Exercising your rights, and complaints
Write to hi@gm-data-centers.com. We will respond within the period the applicable law allows, normally one month. We may need to ask you for information to confirm your identity before we act, so that we do not disclose data to the wrong person.
If you consider that we process your data unlawfully, you may lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, Switzerland. If you are in the EU or EEA, you may instead complain to the supervisory authority of your habitual residence, place of work, or the place of the alleged infringement.
11. No automated decision making
We do not make decisions about you by automated means, and we do not carry out profiling, in connection with this website. The AI assisted matching described on the home page is a feature of the separate investor platform. Where it is introduced, it will be covered by that platform's own notice, including the safeguards the GDPR requires.
12. Investor onboarding is handled elsewhere
Identity verification, know your customer and anti money laundering checks, financial suitability data and subscription documents are not collected through this website. They will be handled in the separate investor platform, under its own privacy notice and retention rules, which will reflect the statutory record keeping periods that apply to those checks.
13. Changes to this notice
We update this notice when the website changes. If we ever add a contact form, an analytics tool, an embedded third party component or any other function that processes personal data, we will amend this notice at the same time, and the statements in section 5 will change accordingly. The date at the top shows the current version.