> For the complete documentation index, see [llms.txt](https://docs.obligate.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.obligate.com/legal/privacy-notice.md).

# Privacy Notice

Version 3.0. Effective as of June 1, 2026.

## 1. ABOUT US

The Website or Platform you are visiting or intend to visit is operated by Obligate AG, Mühlebachstrasse 162, 8008 Zurich, Switzerland (**"Obligate"**, **"we"**, **"our"**, or **"us"**).

This privacy notice ("**Privacy Notice**") explains how we process and protect your personal data when you visit and use our website, accessible at <https://www.obligate.com/> (“**Website**”), our platform and application, accessible at <https://app.obligate.com/marketplace> (“**Platform**”), and our other services (together, the "**Services**").

Unless otherwise defined in this Privacy Notice or our General Terms of Use, as amended from time to time, the definitions used in this Privacy Notice have the same meaning as in the Swiss Federal Act on Data Protection (FADP).

## 2. PERSONAL DATA WE COLLECT

We collect the following categories of personal data when you access or use our Services:

* Personal details (name, surname, date of birth).
* Identity documents (passports, identity cards, identification pictures, source of fund documentation, and other related documentation).
* Client requests.
* IP address, geolocation (country).
* Login details (email address, password).
* Payment details (wallet).
* Blockchain wallet addresses.
* Application details (for job applications).

## 3. HOW WE COLLECT AND PROCESS PERSONAL DATA

We collect information about you when you access or use our Services, including taking certain actions within it.

**Directly**

* When you access, use, or otherwise interact with our Services.
* When you communicate with us by electronic means.
* When you submit their data to us.

**Indirectly**

* From identification or trust service providers.
* From public websites and sources.
* From third parties, such as social media and third-party cookies.

## 4. USE OF BLOCKCHAIN TECHNOLOGY

By accessing and using our Services, you acknowledge that, due to the immutable nature of blockchain technology, certain data recorded on-chain cannot be deleted or altered once confirmed. To manage this, we will endeavor to keep your personal data off-chain wherever possible, and apply industry-standard security measures to protect all data processed under this Privacy Notice. Nevertheless, you accept that your blockchain wallet addresses, and potentially other information, will inherently be documented within the publicly accessible ledger of the corresponding blockchain.

## 5. LEGAL BASIS AND PURPOSES

Our legal basis for collecting and using the personal data described in this Privacy Notice depends on the personal data we collect and the specific purposes for which we collect it.

**Contract:** To perform our contractual obligations or take steps linked to a contract with you. In particular:

* To provide access to our products and services.
* To recruit.

**Consent:** We may rely on your freely given consent at the time you provided your personal data. In particular:

* To provide you with news, special offers, newsletters, and general information about goods and services which we offer (requires explicit consent).
* To publish testimonials of satisfied customers and other endorsements on our Services.

**Legitimate interests:** We may rely on legitimate and/or vital interests based on our evaluation that the processing is fair and reasonable. In particular:

* To maintain and improve our Services.
* To develop new services.
* To verify your identity and ensure security.
* For administration, planning and account management.

**Public interest:** To meet regulatory and public interest obligations. In particular:

* To comply with applicable legislations and regulations, especially with anti-money laundering regulations and criminal laws.

## 6. DATA RETENTION

Under relevant anti-money laundering and counter financing terrorism legislation, we are required to keep your personal information and information about your transactions for at least 10 years from the end of your relationship with us.

In like manner, we may retain your personal data for a minimum of 10 years in compliance with the statutory retention requirements mandated by Swiss law.

We retain personal data for so long as it is needed for the purposes for which it was collected or in line with legal and regulatory requirements or contractual arrangements.

## 7. SERVICE PROVIDERS

We may employ third-party companies (“**Service Providers**”) to facilitate the operation of our Services, assist us in analyzing how our Services are used or perform specific services, such as payment and debt collection, and delivery of IT infrastructure services. These third parties may obtain access to your personal data only and insofar as necessary to perform these tasks on our behalf.

Type(s) of service providers who might access your personal data:

* Other companies in the Obligate Group (the “**Obligate Group**” includes Obligate AG and any entity that directly or indirectly controls, is controlled by, or is under common control with, Obligate AG).
* Banks, payment processing service providers, intermediaries and financial institutions.
* Web hosting and IT systems administrators.
* Marketing, social media, and mailing providers.
* User behavior and analytics services.
* Debt collectors, and professional advisors.
* Candidate management, recruitment and human resources service providers
* Regulators, self-regulatory bodies, and law enforcement agencies in Switzerland and in other countries.

## 8. USE OF ARTIFICIAL INTELLIGENCE (AI) TOOLS

We may use Artificial Intelligence (AI) tools, which are considered Service Providers, to enhance our business operations, such as for drafting support, research, and data analysis. When using these tools, we apply the following data protection safeguards:

* **Data Processing Agreements (DPAs):** Where available, we maintain Data Processing Agreements (DPAs) with our AI Service Providers to ensure the security and compliance of data processing.
* **Training on Your Data:** We ensure that data submitted to these tools is by default not used for training the generative AI models. However, we cannot fully exclude that the AI Service Provider may use uploaded data under certain conditions, such as when submitting feedback to the AI Service Provider or when the AI Service Provider carries out content safety reviews.
* **Data Storage and Retention:** Data processed by our AI Service Providers is stored within the European Economic Area (EEA), the US or in certain other countries and, where available, is subject to limited and/or configurable retention and deletion policies outlined in our DPAs or the applicable terms.
* **Internal AI Use Policy:** We process your personal data and other sensitive data in accordance with our internal AI Use Policy, as amended from time to time, which includes the prohibition of submitting certain data to an AI tool or compliance with minimum requirements such as statutory or contractual confidentiality obligations.

## 9. DATA TRANSFERS

We and/or the Service Providers may transfer your personal data to and process it:

* In Switzerland.
* In the EU and EEA.
* Globally.

We safeguard your personal data per our contractual obligations and applicable data protection legislation when transferring data abroad.

Such safeguards may include:

* Restricting the transfer to countries that have been deemed to provide an adequate level of protection according to lists of countries published by the Federal Data Protection and Information Commissioner.
* Applying European Union Commission's standard contractual clauses, binding corporate rules or other standard contractual obligations that provide appropriate data protection.

## 10. DATA DISCLOSURE

We may disclose your personal data in the good faith belief that such action is necessary:

* To comply with a legal obligation (i.e., if required by law or in response to valid requests by public authorities, such as a court or government agency).
* To protect the security of the Services and defend our rights or property.
* To prevent or investigate possible wrongdoing in connection with us.
* To defend ourselves against legal liability.

## 11. DATA SECURITY

We take reasonable technical and organisational security measures that we deem appropriate to protect your stored data against manipulation, loss, or unauthorised third-party access.

Our security measures include:

* **Technological measures** such as Secure Socket Layer (SSL) encryption, which creates a secure connection with your browser when you register and login into our online services, or Two-factor authentication (2FA), which is a security process requiring two distinct forms of identification to access accounts – usually a password ("something you know") and a temporary code or push notification ("something you have"), or access control, which is a security technique that regulates who or what can view or use resources, in particular logical (passwords, encryption) restrictions.
* **Physical measures** such as restricted access to offices and strategic measures such as security clearances and limiting access to a “need-to-know” basis.

We also take internal data privacy very seriously. Our employees and the Service Providers that we retain are required to maintain secrecy and comply with applicable data protection legislation. In addition, they are granted access to personal data only insofar as this is necessary for them to carry out their respective tasks or mandate.

The security of your personal data is important to us but remember that no method of transmission over the Internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your personal data, we cannot guarantee its absolute security. We recommend using antivirus software, a firewall, and other similar software to safeguard your system.

## 12. YOUR RIGHTS

You have the below data protection rights. Please note that we may ask you to verify your identity before responding to such requests.

* **Right of access:** You have a right to request a copy of your personal data, which we will provide to you in an electronic form.
* **Right to amendment:** You have the right to ask us to correct our records if you believe they contain incorrect or incomplete information about you.
* **Right to withdraw consent:** If you have provided your consent to the processing of your personal data, you have the right to withdraw your consent. This includes cases where you wish to opt-out from marketing communications. Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose(s) to which you initially consented unless there is another legal basis for processing. To stop receiving emails from us, please click on the 'unsubscribe' link in the email you received.
* **Right to erasure:** You have the right to request that we delete your personal data when it is no longer necessary for the purposes for which it was collected or when it was unlawfully processed.
* **Right to restriction of processing:** You have the right to request the restriction of our processing of your personal data where you believe it to be inaccurate, our processing is unlawful, or where we no longer need to process it for the initial purpose, but where we are not able to delete it due to a legal obligation or because you do not want us to delete it.
* **Right to portability:** You have the right to request that we transmit your personal data to another data controller in a standard format such as Excel, where this is data which you have provided to us and where we are processing it on the legal basis of your consent or to perform our contractual obligations.
* **Right to object to processing:** Where the legal basis for our processing of your personal data is our legitimate interest, you have the right to object to such processing on grounds relating to your particular situation. We will abide by your request unless we have a compelling legal basis for the processing which overrides your interests or if we need to continue to process the personal data for the exercise or defence of a legal claim.
* **Right to lodge a complaint with a supervisory authority:** You have the right of appeal to a data protection supervisory authority if you believe that the processing of your personal data violates data protection law. The competent data protection authority in Switzerland is the Federal Data Protection and Information Commissioner (<https://www.edoeb.admin.ch/en>).

## 13. LINKS TO THIRD-PARTY APPS AND SITES

Our Services may contain links to websites or applications that we do not operate. If you click a third-party link, you will be directed to that third party’s website or application. We have no control over and assume no responsibility for the content, privacy policies or practices of any third-party sites or services.

## 14. COOKIE POLICY

Cookies are files with a small amount of data that are commonly used as a unique anonymous identifier. These are sent to your browser from the website you visit and stored on your computer’s hard drive.

Our Services use these cookies to collect information and to improve our Services. You have the option to either accept or refuse these cookies and know when a cookie is being sent to your computer. If you choose to refuse our cookies, you may not be able to use some portions of the Services.

## 15. CHANGES TO THIS PRIVACY NOTICE

We may update our Privacy Notice from time to time. We, therefore, encourage you to review this Privacy Notice periodically for any changes. Changes to this Privacy Notice are effective when they are posted on the Website.

## 16. CONTACT US

If you have any questions about this Privacy Notice, do not hesitate to get in touch with us at:

Obligate AG\
Mühlebachstrasse 162\
8008 Zurich, Switzerland\
[legal@obligate.com](mailto:info@obligate.com)