Privacy notice

Who is responsible

Finportal is run by:

Send questions about data protection and requests about your data to info@finportal.ch.

What Finportal is

Finportal is software for financial advisers and for fiduciary and tax firms (“firms” below). Firms use it to look after their clients: contact details, appointments, documents, forms, emails and calls.

Each firm is responsible for its own clients’ data. It decides what it records and why. Finportal processes that data on the firm’s behalf and on its instructions (as a processor, Art. 9 FADP). If you are a client of a firm, its own privacy notice comes first, and the firm is the best place to send requests about your data.

Finportal is itself responsible for the advisers’ accounts, for keeping the platform secure and for these pages.

Data about advisers

When you use Finportal for your firm, we process:

• Your account: name, email address, phone number, role, firm, language and settings.
• What a secure sign-in needs (see “Sign-in”).
• Services you connect yourself: your mailbox, your Google calendar, Krisp.
• Telephony: numbers, time and length of the calls you make through Finportal.
• A log of important actions such as exports, deletions and changes to permissions, with the time, IP address and browser.

Why: to provide the service to you, run it securely, find faults and answer your questions.

Sign-in

Advisers’ sign-in is part of Finportal and runs on our own servers at AWS in Zurich. No other provider is involved.

• Your password is stored only as a hash; we cannot read it.
• If you turn on a second step, we store the secret of your authenticator app and the recovery codes, or the public key of your passkey. The passkey itself stays on your device.
• Links to set or reset your password, and invitations, come from our own email account and are valid for a short time only.
• Every sign-in, every failed attempt and every change to your password, second step or passkeys is recorded with the time and IP address. After ten failed attempts sign-in is locked for fifteen minutes.
• Your session ends after a day without activity, and a week after sign-in at the latest.

Data about the firms’ clients

What a firm keeps about you in Finportal depends on how it works with you. Typically:

• Contact details: name, address, email address, phone number, language.
• Notes, tasks, appointments, contracts and deals the firm keeps with you.
• Documents you upload through a request link, and forms you fill in. A form that asks for sensitive data, such as about your health, says so.
• Signatures you give through a link, with the time and IP address as proof.
• Appointments you book through a booking page.
• Emails you exchange with the firm, where the firm has connected its mailbox.
• Calls: where the firm has switched it on, phone calls are recorded, turned into text (a transcript) and briefly summarised.
• Meetings: where your adviser has connected Google Meet or Krisp, their transcripts are filed with your record.
• Sign-ups through a form on the firm’s website: what you entered and the consent you gave, word for word, with the language, time and IP address.

Why: so the firm can advise you, carry out what you ask of it and stay in touch with you.

Leads from ads on Facebook and Instagram

A firm can connect its Facebook Page to Finportal. When you fill in that firm’s form on Facebook or Instagram (a lead ad), Finportal receives what you entered, on the firm’s behalf:

• Your name, email address, phone number and your answers to the form’s questions.
• Which form and which ad it was, when you sent it, and Meta’s lead number.

This appears in the firm’s lead list, and the firm can turn it into a client record. Only people at that firm can see it.

Finportal also reads what the firm spends on its ads, and shows the firm what a lead and a new client cost. Where the firm has added its own access to Meta’s Conversions API, Finportal tells Meta Platforms Ireland Ltd., Ireland, with the lead number, what became of a lead (for example qualified, client, lost). This lets the firm see in its Meta reports which ads led to clients.

Leads are kept like other client data, for as long as the firm keeps them. How to ask for deletion is explained under “Your rights” and here:

Deleting your data

Visitors of public pages

Forms, booking, request and signing pages process what you enter and otherwise only what is technically needed:

• Your IP address, to limit how often a page can be called in a short time. It is held briefly, in memory, for that alone.
• A field people cannot see and the time the form took to fill in, to recognise forms sent by machines. No profile is made from either.
• The server’s technical logs, such as the time, the address called and errors, to keep it running.

These pages use no analytics, tracking or advertising tools.

Who processes data on our behalf

We use service providers who process data only on our behalf and for these purposes:

• Amazon Web Services (AWS), data centre in Zurich, Switzerland: servers, database, file storage and sign-in. This is where Finportal’s data lives. Mass mailings (campaigns) a firm sends from a sending domain of its own go out through AWS’s email service in Frankfurt, Germany.
• Microsoft Azure, Switzerland region: turning call recordings into text, where the firm has switched transcripts on.
• Anthropic, USA: AI features a firm or an adviser switches on deliberately — sorting emails, summarising meetings, translating form texts — and the short summary of transcribed calls. Only what the feature needs is sent.
• Google, USA: calendar and Google Meet transcripts, where an adviser connects their Google account.
• Krisp, USA: meeting transcripts, where an adviser connects Krisp.
• Apple and Google, USA: notifications to the phone of an adviser who has installed Finportal’s phone app, so that an incoming call rings. The caller’s number and name are sent.
• The firm’s email provider: emails to clients go through the firm’s own mailbox.
• The firm’s telephone provider: calls run over the line the firm connects.

The USA does not offer data protection equivalent to Switzerland’s. For transfers there we ensure adequate protection through contractual safeguards, in particular the standard contractual clauses recognised by the Federal Data Protection and Information Commissioner (FDPIC), or through the recipient’s certification under the Swiss-U.S. Data Privacy Framework.

How long data is kept

• Client data, documents and records: for as long as the firm keeps the client in Finportal. The firm decides when they are deleted, subject to legal retention duties.
• Call recordings: deleted once the transcript exists. Where the firm has chosen to keep recordings, after the number of days it set.
• Transcripts and summaries: kept with the client’s record.
• Sign-ups through website forms: until the firm accepts or rejects them. Accepted ones become part of the client’s record; rejected ones are kept for 90 days, to answer questions about them, and then deleted.
• Advisers’ accounts: for as long as they have access to Finportal.
• Technical logs: only as long as running the service securely requires.

Your rights

Under the FADP you can:

• ask what data about you is processed;
• have incorrect data corrected;
• ask for your data to be deleted;
• receive your data in a common electronic format, or have it passed on;
• object to processing and withdraw a consent you gave.

To do so, write to info@finportal.ch. We may ask you to confirm who you are, and usually answer within 30 days. Where your request concerns data a firm keeps about you, we pass it on to that firm, because the decision is theirs.

You can also ask for deletion on this page. The request goes to the firm that holds your data and appears there beside it, so that it cannot be overlooked:

Deleting your data

If you disagree with our answer, you can turn to the Federal Data Protection and Information Commissioner (FDPIC).

Cookies

Finportal uses only the cookies the service needs:

• a session cookie that keeps you signed in, and a short-lived one while you sign in;
• cookies for your settings, such as the light or dark appearance and the firm you chose;
• view settings your browser keeps, such as how a list is sorted.

Your language is stored with your account. There are no tracking, analytics or advertising cookies.

Security

• Every connection is encrypted.
• The database and files are stored encrypted; mailbox credentials and the links sent to clients additionally with a key of their own.
• Each person sees only what their role in the firm allows.
• Important actions are logged.

Changes

We update this notice when Finportal or the law changes. The version published here applies; the date at the top shows when it last changed.