This page explains what personal data we collect, why, how long we keep it, who it is passed to, and how you stay in control of it. It covers the ridgerock.ch website and the exchanges that follow from it.
Who is responsible
The controller is RidgeRock Partners Sàrl, International Center Cointrin, Route de Pré-Bois 20, CP 1913, 1215 Geneva, Switzerland.
We process your data in accordance with the Swiss Federal Act on Data Protection (FADP) and, where you reside in the European Union, with the General Data Protection Regulation (GDPR).
For any question about your data, write to contact@ridgerock-wm.com or call +41 78 327 46 28.
The data we collect
What you give us
- Identity and contact details: first name, last name, email address, phone number.
- The content of your message, including any details of your wealth or pension situation you choose to mention.
- Information exchanged during a meeting booked online, and anything you hand us afterwards as part of an advisory engagement.
What is collected automatically
- Browsing data: pages viewed, date and time, device and browser type.
- Where the visit came from: search engine, campaign, referring link.
- What you do on the site: buttons clicked, taps on the phone number, video playback, how far down a page you read, a form started or sent, a document downloaded. If you accepted audience measurement, these actions are tied to a randomly generated visit identifier, and to your request when you write to us; otherwise they are counted without being linkable to you.
- IP address and browser identifier, only if you have accepted the relevant cookies.
We ask for no sensitive data within the meaning of article 5 FADP or article 9 GDPR, and the site collects none. No payment is made on this site: we collect no bank or card details.
Why, and on what basis
- Answering your contact or audit request and arranging a meeting: pre-contractual steps taken at your request, article 6.1.b GDPR and article 31 para. 2 let. a FADP.
- Sending you information about our services when you asked for it: your consent, article 6.1.a GDPR, article 6 para. 6 FADP.
- Measuring site audience and improving our content: your consent, collected through the banner.
- Knowing which path (page, button, video, phone) led you to write to us, to measure what produces meetings: your consent to audience measurement, article 6.1.a GDPR. Without that consent we only count the day's actions anonymously, with no identifier that could be linked to you: our legitimate interest in measuring audience, article 6.1.f GDPR.
- Measuring the effectiveness of our advertising campaigns: your consent, collected through the banner.
- Keeping the site secure and preventing automated abuse: our legitimate interest in protecting our systems, article 6.1.f GDPR.
- Meeting our legal and regulatory obligations, in particular the retention of business records and the obligations attached to our financial activity: article 6.1.c GDPR, article 958f of the Swiss Code of Obligations.
Required form fields are marked as such. Without them we cannot handle your request. Everything else is optional.
Who your data is passed to
Your data is accessible to the RidgeRock staff responsible for client relationships. It is never sold, rented or handed to third parties for commercial purposes.
We use the following providers, which act as processors and only on our instructions:
- Vercel Inc.: hosting and delivery of the website.
- Supabase: the database behind our client management tool, and storage of the documents you hand us.
- Resend: sending confirmation and follow-up emails.
- Calendly LLC and Google: online booking and calendar.
- DocuSign: electronic signature, where a document has to be signed.
- Google Ireland Limited and Google LLC: audience measurement and campaign measurement, only if you have consented.
- Meta Platforms Ireland Limited: campaign measurement, only if you have accepted marketing cookies.
- n8n: automated routing of form submissions.
We may also disclose your data where the law requires it, for instance to a judicial or supervisory authority making a request in due form.
Transfers abroad
Some of these providers are established in the United States or in Ireland, or may transfer data there. Transfers to a country of the European Economic Area go to countries recognised as offering adequate protection, as listed in annex 1 of the Swiss Data Protection Ordinance.
Transfers to the United States rest on the safeguards set out in article 16 FADP and chapter V GDPR, namely the European Commission's standard contractual clauses, recognised by the Federal Data Protection Commissioner, and where applicable the provider's certification under the EU and United States data privacy framework. A copy of the applicable safeguards can be requested at the address above.
How long we keep it
- A contact request that leads nowhere: three years from the last exchange.
- Client data: the duration of the contractual relationship, then ten years under the retention of business records, article 958f of the Swiss Code of Obligations.
- Documents you hand us as part of an advisory engagement: the same period as the file they belong to.
- Trackers and audience measurement data: thirteen months at most.
- Actions on the site (pages, buttons, video, phone, forms): thirteen months, then automatic deletion. Those tied to your request disappear with it if you ask for erasure.
- Proof of your cookie choice: six months, after which the banner asks you again.
Your rights
You have the right to access your data and to have it corrected or erased. You may object to a processing operation, ask for it to be restricted, withdraw at any time a consent you have given, and ask for the data you provided to be handed over or transferred to someone else in a common electronic format.
These rights are exercised by email to contact@ridgerock-wm.com or by post to the address above. Proof of identity may be requested where there is reasonable doubt about who is asking. We answer within thirty days, or one month if you reside in the European Union.
Erasure may be refused, in whole or in part, where a legal obligation requires us to keep a record. We then tell you which one, and for how long.
If, after contacting us, you believe your rights are not respected, you may approach the Federal Data Protection and Information Commissioner, Feldeggweg 1, 3003 Bern, edoeb.admin.ch. If you reside in the European Union you may lodge a complaint with the supervisory authority of your country of residence, in France the Commission nationale de l'informatique et des libertés, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, cnil.fr.
Cookies and trackers
On your first visit a banner lets you accept or refuse non-essential cookies. No measurement or marketing tracker is set before you choose, and refusing takes a single click, on the first screen.
- Necessary cookies: they make the site work and remember the decision you make here. They do not require your consent.
- Audience measurement: number of visits and pages viewed, to improve the site and our content. If you accept it, we set a cookie named “rr-vid”: a randomly generated identifier, valid for 90 days, which lets us tie your actions on the site to your contact request. It is deleted as soon as you withdraw that choice. If you refuse, it is never set.
- Marketing: measuring how well our campaigns perform and adapting advertising content.
You can change your mind at any time through the “Manage cookies” link in the footer, or through your browser settings. We also honour your browser's “Global Privacy Control” signal and “Do Not Track” header: until you have accepted audience measurement, they rule out even anonymous counting.
Automated decisions
We make no automated individual decision producing legal effects concerning you or significantly affecting you. Our tools may sort or rank incoming requests to organise our work, but the decision to contact you, to advise you or to enter into a relationship is taken by a person.
Security
The site is served over HTTPS only. Access to data is limited to the people who need it for their work, documents are stored in private buckets, and our providers are contractually bound by the same confidentiality and security obligations as we are.
Links to other sites
Our site may contain links to sites we do not control. We are not answerable for their data practices. We encourage you to read their own policy before entrusting them with anything.
Changes
This policy is updated as the site, our tools or the regulations change. The date below indicates the version in force.
Last updated
Version of 1 October 2026.