Legal

Privacy policy.

What we collect when you visit watson.am, why we collect it, who we share it with, and the rights you have over it.

Effective date: 21 June 2026 · Last updated: 21 June 2026

Watson AM AG ("Watson AM", "we", "us", "our") respects your privacy and is committed to protecting the personal data you share with us. This policy explains what we collect when you visit watson.am, why we collect it, who we share it with, and the rights you have over it.

1. Who is responsible for your data

The controller responsible for processing your personal data is:

Watson AM AG
Steinengraben 42
4051 Basel, Switzerland
UID: CHE-368.490.535
Email: contact@watson.am
Phone: +41 41 729 39 89

2. Which laws apply

We process personal data in line with the Swiss Federal Act on Data Protection (FADP, revised version in force since 1 September 2023) and, where you are located in the European Union or European Economic Area, the EU General Data Protection Regulation (GDPR). Where both apply, we hold ourselves to the higher standard.

3. The personal data we collect

Data you give us

When you contact us through the enquiry form, by email, or by phone, we collect the information you choose to provide. For the enquiry form this typically includes your name, email address, the audience you identify with (investor or borrower), and the content of your message. If you give us details about a project or an allocation, we process those too, so that we can respond.

Data we collect automatically

When you visit the site, certain data is collected by the systems that deliver and measure it:

  • Technical and log data, including your IP address, browser type, device type, operating system, referring page, and the pages you view. This is generated by our hosting provider for delivery and security.
  • Usage and analytics data, including how you arrived at the site, which pages you spend time on, and approximate location derived from your IP address. This is collected through cookies and similar technologies, and only where you have given consent.
  • Advertising and measurement data, used to understand whether our professional-audience campaigns reach the right people and to measure their effect. This is also collected only where you have given consent.

We do not knowingly collect special categories of data through the website, and we ask that you do not send us sensitive personal data through the enquiry form.

4. Cookies and similar technologies

A cookie is a small text file placed on your device when you visit a website. We group the technologies we use into three categories:

  • Strictly necessary. Needed for the site to function and to stay secure. These do not require consent.
  • Analytics. Set by Google Analytics and the HubSpot tracking pixel to measure how the site is used and, where you contact us, to link that activity to your contact record. These require your consent.
  • Advertising and targeting. Set by the LinkedIn Insight Tag to measure campaign performance and to reach professional audiences on LinkedIn. These require your consent.

Until you accept analytics and advertising cookies, none of that tracking runs. You can refuse or withdraw consent at any time through the cookie banner, and you can also manage cookies in your browser settings. Disabling strictly necessary cookies may stop parts of the site from working.

The cookie banner shows the current, authoritative list of the cookies and tags in use, with their providers and durations. We keep that list current as our tools change, which is why it, rather than this policy, is the live record of exactly what runs on the site at any given time.

5. Why we process your data, and on what legal basis

PurposeLegal basis (GDPR)
Responding to your enquiry and any follow-up correspondenceSteps taken at your request before entering a relationship (Art. 6(1)(b)), and our legitimate interest in handling enquiries (Art. 6(1)(f))
Managing our contacts and relationships in our CRMOur legitimate interest in managing investor, borrower, and partner relationships (Art. 6(1)(f))
Operating, securing, and maintaining the websiteOur legitimate interest in a safe, working site (Art. 6(1)(f))
Measuring and improving the website through analyticsYour consent (Art. 6(1)(a))
Advertising measurement and reaching professional audiencesYour consent (Art. 6(1)(a))
Sending the newsletter, where you have signed upYour consent (Art. 6(1)(a))
Meeting legal and regulatory obligationsCompliance with a legal obligation (Art. 6(1)(c))

Under the FADP we rely on the equivalent grounds: your consent where required, the performance or preparation of a contract, our overriding legitimate interests, and our legal obligations.

6. The tools and third parties we use

We work with a small number of service providers. Some process data strictly on our behalf (processors). Others, such as LinkedIn, also process it for their own purposes, which makes them independent or joint controllers for that processing. We share only what each one needs, and this list reflects the tools in use at the date above.

  • Cloudflare, Inc. hosts the website and delivers it through its content network. It processes technical and log data, including IP addresses, for delivery, performance, and security.
  • StaticForms. Submissions from the enquiry form are processed by StaticForms, which validates the submission, filters spam, and forwards it to our inbox. It handles the form field data you enter and technical data such as your IP address.
  • Google Workspace. Email you send us, and our replies, are processed in our Google Workspace inbox.
  • Google Analytics (Google Ireland Limited). Measures how visitors use the site, through cookies and online identifiers, only after you consent. Data may be transferred to Google LLC in the United States.
  • LinkedIn Insight Tag (LinkedIn Ireland Unlimited Company). A tag that measures campaign performance and lets us reach professional audiences on LinkedIn. After you consent, it processes data including your IP address, device and browser information, page activity, and a pseudonymised LinkedIn identifier. LinkedIn processes some of this for its own purposes as a controller. Data may be transferred outside the EEA and Switzerland.
  • HubSpot (HubSpot, Inc.). Our customer relationship management system, where we record enquiries and contact details so that we can manage our correspondence with you. We also run the HubSpot tracking pixel on the website. After you consent, it sets cookies and processes data such as your IP address, device and browser information, and the pages you view, so we can understand how visitors engage with the site and link that activity to your contact record if you get in touch. HubSpot, Inc. is based in the United States.

Each of these providers acts under a data processing agreement or its own published terms. We do not sell your personal data.

7. Transfers outside Switzerland and the EEA

Several of our providers process data in the United States. Where data leaves Switzerland or the EEA, we rely on recognised safeguards, including the European Commission's standard contractual clauses, the Swiss addendum to those clauses, and, where applicable, the EU-US and Swiss-US Data Privacy Framework. You can ask us for a copy of the relevant safeguard using the contact details above.

8. How long we keep your data

We keep personal data only as long as we need it for the purpose we collected it, and then delete or anonymise it.

  • Enquiry correspondence: kept for the duration of our exchange and for 24 months after our last contact, then reviewed and deleted if no relationship follows.
  • CRM contact records: kept while the relationship is active and for 24 months after the last meaningful interaction, after which inactive or cold records are reviewed and deleted.
  • Analytics data: retained for 14 months in Google Analytics. HubSpot tracking cookies expire after 6 months; analytics tied to a contact are held with that contact's CRM record and follow the CRM retention rule above.
  • Advertising data: the LinkedIn Insight Tag cookie expires on a rolling 6-month basis. LinkedIn removes direct identifiers within 7 days and deletes the remaining pseudonymised data within 180 days.
  • Newsletter data: kept until you unsubscribe.

Data we are legally required to retain is kept for the period the law requires.

9. Your rights

Subject to the conditions in the FADP and the GDPR, you have the right to:

  • ask for access to the personal data we hold about you,
  • ask us to correct data that is inaccurate or incomplete,
  • ask us to delete your data,
  • ask us to restrict how we process it,
  • object to processing based on our legitimate interests,
  • ask us to transfer your data to you or another controller, where that right applies,
  • withdraw consent at any time, without affecting processing that already took place, and
  • lodge a complaint with a supervisory authority.

To exercise any of these, write to contact@watson.am. We will respond within the time the law allows. We may need to verify your identity first.

10. How we protect your data

We use appropriate technical and organisational measures to protect personal data against loss, misuse, and unauthorised access. No website or transmission method is completely secure, so we cannot guarantee absolute security, but we work to keep our measures current.

11. Children

The website is intended for professional and qualified investors, developers, and their advisers. It is not directed at children, and we do not knowingly collect data from anyone under 16.

12. Changes to this policy

We may update this policy from time to time. When we do, we will change the date at the top, and where the change is significant we will give clearer notice on the site.

13. Contact and supervisory authorities

For any question about this policy or your data, contact us at contact@watson.am.

If you are in Switzerland, the supervisory authority is the Federal Data Protection and Information Commissioner (FDPIC), www.edoeb.admin.ch. If you are in the EU or EEA, you may contact the data protection authority in your country of residence.