Privacy policy

Xstreco AG, an Aktiengesellschaft (a company limited by shares) incorporated under Swiss law with its registered seat in Zug, is the controller for the personal data described in this policy. Its registered address is General-Guisan-Strasse 6, 6300 Zug, Switzerland, and its Swiss company identification number is UID CHE-145.395.037.

Swiss law does not oblige a private controller to appoint a data protection officer. Responsibility for data protection is assigned within the Group and named in the governing policy. Any person may write to compliance@xstreco.com or use the contact page, and the Speak up channel is available where a confidential route is preferred.

This policy explains how we handle personal data that we collect through this website, including through the contact enquiry form and the Speak up reporting channel. It does not cover personal data that we handle in other contexts, such as employment or recruitment, and it does not cover websites operated by others that we link to.

Data you give us. If you complete the contact enquiry form, we collect the details you enter. These may include your name, your organisation, your contact details and the content of your message. If you use the Speak up channel, we collect whatever information you choose to provide. You may use that channel without giving your name.

Technical data. When you visit this website, technical data necessary to deliver the pages to you is processed automatically. This data is used to operate and secure the site and is not used to identify you.

Data from cookies and similar technologies. The site uses cookies and similar technologies. These are described in our cookies policy.

We process personal data in order to respond to enquiries sent through the contact form, to receive, assess and follow up reports made through the Speak up channel, to operate, secure and maintain the website, including guarding against spam and misuse of our forms, and to comply with legal and regulatory obligations.

Under the revised Federal Act on Data Protection, a private controller may process personal data where the processing is lawful, carried out in good faith and proportionate. Where a justification is required, we rely on your consent, on the performance or preparation of a contract, or on an overriding private interest, depending on the processing concerned.

Reports made through the Speak up channel are treated as confidential. You may report anonymously. If you give your name, access to your identity is limited to those who need it in order to assess and act on the report. Retaliation against a person who raises a concern in good faith is prohibited.

We share personal data with service providers who act for us. Those providers process personal data on our instructions and are bound by confidentiality and data protection obligations. We share personal data within the Group where it is necessary for the purposes described above. We may disclose personal data where we are required to do so by law, by a court or by a competent authority, or where it is necessary to establish, exercise or defend legal claims. Separately, where a page loads content from a third-party provider, such as the mapping library and map tiles described in our cookies policy, that provider receives technical data about your request as an independent controller rather than on our instructions. We do not sell personal data and we do not share it for advertising purposes.

Some of our service providers are located outside Switzerland. Where we transfer personal data to a country that the Swiss Federal Council has not recognised as providing adequate protection, we put appropriate safeguards in place. This is normally a set of standard contractual clauses recognised by the Federal Data Protection and Information Commissioner, or we rely on an exception permitted by the Federal Act on Data Protection. If you want to know which countries are involved and which safeguard applies, write to compliance@xstreco.com.

We keep personal data for as long as it is needed for the purpose for which it was collected, and then for any further period required by law or necessary to establish, exercise or defend legal claims. Enquiries sent through the contact form and reports made through the Speak up channel are retained in line with our internal retention rules. If you want to know the retention period that applies to your data, write to compliance@xstreco.com.

We take appropriate technical and organisational measures to protect personal data against loss, misuse and unauthorised access, and we require our service providers to do the same. No transmission of information over the internet can be guaranteed to be completely secure.

Subject to the conditions and limits set by law, you may ask whether we process personal data about you and ask for a copy of it. You may ask us to correct personal data that is inaccurate. You may ask us to delete personal data or to stop a particular processing activity. You may ask us to provide personal data you gave us in a common electronic format, or to transfer it to another controller. You may object to a processing activity. Where we rely on your consent, you may withdraw it at any time, and doing so does not affect the lawfulness of what we did before you withdrew it.

We may need to verify your identity before acting on a request, and we will respond within the period required by law. There are cases in which we may refuse or restrict a request, for example where the rights of another person or a legal obligation prevent us from acting on it. Where that happens we will tell you why.

If you consider that we have handled your personal data unlawfully, please raise the matter with us first so that we can look into it. You may also contact the Federal Data Protection and Information Commissioner, which is the Swiss supervisory authority for data protection.

This website is a corporate information site. It is not directed at people in the European Union, we do not offer goods or services through it, and we do not use it to monitor the behaviour of visitors. On that basis, our position is that the General Data Protection Regulation does not generally apply to the processing described in this policy. We keep that position under review, and where the Regulation does apply to a particular processing activity we will comply with it. If European Union data protection law applies to the handling of your personal data, you may also have the right to complain to a supervisory authority in the country where you live or work.

On the position stated above, we do not consider ourselves required to appoint a representative in the European Union under Article 27 of the General Data Protection Regulation.

For any question about this policy, or to exercise a right described in it, write to compliance@xstreco.com or use the contact page. The Speak up channel is available where a confidential route is preferred. Written correspondence may be addressed to Xstreco AG, General-Guisan-Strasse 6, 6300 Zug, Switzerland.

We may update this policy from time to time. The current version is the one published on this page.

Last updated: 15 August 2026. This page is kept under review. For questions about it, write to compliance@xstreco.com.