1-       PURPOSE OF THE PRIVACY POLICY AND SCOPE OF APPLICATION

Dear User,

Aurea Svizzera SA is committed to protecting your personal data in accordance with applicable regulations. This policy aims to inform you about the processing of your personal data carried out as a result of connecting to the web platform, www.invest.orocashswiss.ch (hereinafter referred to as the ‘Platform’).

This policy is drawn up pursuant to Article 19 of the Federal Act on Data Protection (FADP) and aims to provide information regarding the processing of your personal data in the context of the features offered and browsing activities on the following domains:

·         www.invest.orocashswiss.ch

It cannot be ruled out that, due to the languages available, the content published and the presentation of the products and services offered, the Platform is also aimed at data subjects residing in the European Union, or involves the monitoring of their behaviour within the EU. In this event, pursuant to Article 3(2) of Regulation (EU) 2016/679 (GDPR), the processing would also fall within the territorial scope of the GDPR. For this reason, from a prudential perspective, this Privacy Policy takes into account both the principles and provisions of the FADP and those of the GDPR.

The content of this Privacy Policy is supplemented by the following notices, which are specific to certain services:

Cookie Policy https://invest.OROCASHSWISS.CH/page/Privacy-policy/534/

This policy applies to the Platform as a whole, and not to other websites, pages, mobile apps or online services that can be accessed via any hypertext links published or present on the Platform but referring to resources outside the Data Controller’s domain, which the data subject may consult.

Through the Platform and the support of the integrated direct physical sales network (Physical Sites’), Aurea Svizzera SA offers a range of services aimed at individuals interested in accessing the physical gold market, including the purchase of bars and coins. For the processing of personal data of customers and/or clients of the physical offices, in respect of which Aurea Svizzera SA processes personal data acting as a data controller, please refer to the Privacy Policy that will be provided to you directly at the physical offices.

2-       DATA CONTROLLER AND CONTACTS

Aurea Svizzera SA is the Data Controller for the processing of your personal data. You can contact the Data Controller at info@aureasvizzera.ch.

The Data Controller and owner of the website is Aurea Svizzera SA (hereinafter ‘Aurea Svizzera’ or the ‘Company’), a Swiss company with its registered office at Via Livio 1, Chiasso, 6830, Switzerland. The Data Controller can be contacted at the registered office or the email address info@aureasvizzera.ch.

3-       THE TYPE OF DATA WE USE, HOW WE USE IT AND THE LEGAL BASIS

We will process the data necessary for managing browsing on the Platform and accessing its features, the data generated through cookies and any data you may provide and/or voluntarily disclose.

We process browsing data to ensure the operation, stability and security of the Platform. If you decide to use one of our services, we will process your data to provide the requested service. Each purpose is pursued on the basis of a legal basis that justifies the processing of the data.

By expanding the following sections, you will find information on the purposes for which we use your data as well as which data we use, how we use it and the relevant legal basis for each of such purposes.

The following sections explain, for each situation, the type of personal data we may collect, how we use that data and the associated legal basis.

3.1 Browsing the platform.

When you visit our Platform, we may collect certain information by automated means, including cookies and similar technologies, such as flash cookies, local storage, web beacons and pixels, JavaScript, software development kits (SDKs) and device identifiers.

What personal data do we collect?

The information collected in this way may include the device’s IP address, domain name, identifiers associated with the devices, the type and characteristics of the device and the operating system, web browser characteristics, language preferences, user interactions with the Platform (such as pages visited, clicked links and features used, access dates and times of access, pages that led you to or directed you to our site) and other information about your use of the Platform.

How we use your data

For information on the use of data related to cookies, please refer to the Cookie Policy https://invest.OROCASHSWISS.CH/page/Privacy-policy/534/

How do long we retain your data?

Some browsing data will be retained only for the duration of the browsing session; the retention period for cookies is specifically described in the Cookie Policy https://invest.OROCASHSWISS.CH/page/Privacy-policy/534/

3.2 Contact Our Customer Service

You can request assistance or support by contacting our customer service team via our  ‘Contact Us’ online form or by emailing info@orocashinvest.ch.

What personal data do we collect?

If you contact our customer service and support team with a query or to request assistance, the types of personal data we collect or process about you include:

·         identifying and contact information, such as first name, surname and email address;

·         spontaneous information about you or your purchase/order that you include in your request.

How we use your data

We will use your data to reply to you, provide you with the necessary support and follow up on your request, including, where applicable, to ensure compliance with our regulatory obligations and to establish, exercise or defend ourselves against legal claims. We may retain our communications with you for evidentiary purposes.

We will use your data for the above purposes under the following legal bases:

·         We are obligated to complete the contract we may have with you (if you are an existing customer) or to take pre-contractual measures at your request;

·         Our legitimate interests, in particular in training our staff, improving our services and defending our legal rights; or

·         We are obligated to comply with our legal obligations.

How long do we retain your data?

We will retain your personal data for the period necessary to fulfil your requests and, in any case, for no longer than 2 years from the last contact.

3.3 Geolocation when accessing the Platform

When you first access the Platform, we may ask you to authorise the use of your location to offer you a personalised experience based on your geographical area, for example, by suggesting content or stores relevant to your area.

What personal data do we collect?

If you authorise the geolocation request shown when first accessing the Platform, the types of personal data we collect or process about you include:

·         The geolocation data of your device (geographical coordinates), obtained via your browser.

How we use your data

We use this data to personalise your browsing experience based on your geographical area, for example, by prioritising content or stores that are most relevant to your location.

The processing is based on your consent, which you actively give by authorising the request displayed by the browser when first accessing the Platform. If you refuse permission, you will still be able to browse the Platform and use all its features, including the store locator tool described in the next section, without any restrictions.

You can withdraw your consent at any time via your browser or device settings.

How long do we retain your data?

We will retain your geolocation data only for the duration of your browsing session, unless you have chosen to store your decision for a longer period using the relevant option shown in the authorisation request (where available).

3.4 Search for Stores

In the ‘Stores’ section of the website, there is a search tool that allows you to find the nearest OroCash stores by entering a city or postcode or by authorising access to your device’s location using the ‘Location’ button.

What personal data do we collect?

Depending on the method you use, the types of personal data we collect or process about you include:

·         By using  the ‘Location’ button: your device's geolocation data (geographical coordinates);

·         By using the manual search: the city or postcode you enter in the search field;

·         In both cases, any additional search criteria you have selected (service or product searched for, search radius).

How we use your data

We use this data to process your search and show you the list and map location of the stores nearest to you. The map is provided via the Google Maps service.

Location button: By using the ’Location’ button to automatically detect your location, the processing is based on your consent, which you actively give by granting the permission requested by the browser when activating the button. You can refuse or withdraw this permission at any time via your browser or device settings, while still being able to use the manual search function. When you consent to geolocation, you interact with Google Maps, which receives and processes data (IP address, coordinates) as an independent data controller. In this case, please refer to Google's  Privacy Policy.

Manual search: If you enter a city or postcode manually, the processing is based on our legitimate interest in providing you, at your request, a service for locating stores. 

How long do we retain your data?

We will retain your data for the time necessary to fulfil your requests and, in any case, no longer than the duration of your session on the website.

3.5 Registration on the Platform

In the Platform registration section, you can create a user account to access the Platform.

What personal data do we use?

In this case, the types of personal data we collect or process about you include your identification and contact information (including username and password).

How we use your data

We will use your data to: 

·         Register the user account on the Platform;

·         Allow the user to access their account and use the services available on the Platform;

·         Send communications relating to the services for which the data subject has provided their personal data;

·         Process and follow up on any requests made by the user;

·         Provide assistance through the specified digital channels (Contact form and/or info@orocashinvest.ch);

How long do we retain your data?

For the purpose described above, we will retain your personal data for a maximum period of 10 years.

3.6 ‘My Profile’ section

In the section for completing the identification details for registration on the ‘My Profile’ Platform, you can complete your user account to purchase the products and/or services offered.

What personal data we use?

In this case, the types of personal data we collect or process about you include your name, surname, date of birth, tax code, country, home address, identity document, mobile phone number and email address.

How we use your data

We will use your data to: 

·         Fill out the contract for the purchase of the Company's goods and/or services;

·         Provide eligibility to benefit from special offers and promotions  advertised from time to time and available while stocks last.

How long do we retain your data?

For the purpose described above, we will retain your personal data for a maximum period of 10 years.

3.7 Execution of commercial transactions

In order to purchase the Company's products and/or services, your financial and transaction data may be collected.

What personal data do we use?

In this case, the types of personal data we collect or process about you include your IBAN, bank details and the identification data on the credit card used.

How we use your data

We will use your data to process the user’s payment to complete the purchase on the Platform.

How long do we retain your data?

For the purpose described above, we will retain your personal data for a maximum period of 10 years.

3.8 Direct marketing communications by sending newsletters

Using the form on the Platform or the form that appears when you complete the ‘My Profile’ identification during registration on the Platform or when registering on the Platform, you can request to receive the promotional newsletter for Aurea Svizzera products.

What personal data do we collect?

For sending such communications material, the types of personal data we collect or process include: 

·         Contact details, such as your email address.

·         Metadata collected by cookies or similar techniques, including any data to understand how you have interacted with our Platform and whether you have opened or clicked on the content of emails we have sent you. For more information on how we use cookies and your choices in this regard, please refer to our Cookie Policy https://invest.OROCASHSWISS.CH/page/Privacy-policy/534/

How we use your data

We use this data to tailor our communications to your specific interests and preferred method of communication, to avoid sending you communications that are not of interest to you or for which you have not given your consent, and to keep you informed about news and promotions that appear to be most relevant and useful to you. To this end, we can organise the data collected into interest groups.

We will ask you to opt in or consent to the use of your personal data for the purposes of such communications. You can decide to stop receiving these communications at any time by using the opt-out procedure provided in the relevant email (for example, by clicking on the unsubscribe link in our promotional emails) or, alternatively, by contacting us as specified in Section 2 ‘Contact Details’.

If permitted by applicable law, we may rely on our legitimate interests to carry out some of the activities mentioned above.

Please note that if you choose to no longer receive promotional messages from us, we may still continue to send you information relevant for other legal purposes, such as to administer any account or contract you may have with us, send you operational communications or respond to your requests, and if required by law.

How long do we retain your data?

For the purpose described above, we will retain your personal data for a maximum period of 2 years from the date on which you give your consent.

3.8 Online advertising

You may occasionally come across advertisements for our Company online, including on social media platforms. These ads are often shown to users based on their perceived interests, as determined by their social media activity or internet browsing.

What personal data do we collect and how do we collect it?

Online advertising can be based on the user’s search terms (in the case of search engine ads) or on the user’s personal data on online platforms (such as the email address associated with the social media account, the country or the professional interests selected on a social media platform).

In some cases, we will use your email address to show ads for our products and services on Meta and Google social media platforms. To this end, we will provide your email address, in encrypted or otherwise secure form, to the social media platform. The social media platform will then match the user’s email address with the personal data (such as email addresses) provided by the user and will use this information to show the user or other users of the platform a particular advertisement from our Company. For more information on how social media platforms use your data, please refer to their privacy policies.

We may also place advertising cookies or similar technologies provided by social media platforms or other third parties on our website. If you visit our website and accept these advertising cookies and similar technologies, as required by law, the information collected (such as device identifiers and information about the pages visited) may also be used to display ads relevant to our products and services on social media platforms or third-party websites, and to create interest-based profiles for advertising purposes. Our Company often does not receive identifying data about the user when such ads are displayed, but may be able to further tailor advertising to the user based on ads previously viewed and may receive aggregate statistics on the number of ads viewed and clicked on, etc.

As specified in the Cookie Policy, we rely on the user’s consent to use their data for online advertising purposes (e.g. when the user accepts advertising cookies) or otherwise on our legitimate interest in doing so as permitted by law. You should be able to configure cookie settings on websites that use tracking cookies for advertising purposes. For more information on how we use cookies and how to configure your preferences on our Platform, please see our Cookie Policy https://invest.OROCASHSWISS.CH/page/Privacy-policy/534/

How long do we retain your data?

For the purpose described above, we will retain your personal data until you object or withdraw your consent.

3.9 Fulfilment of legal obligations and defence in legal proceedings

We may use your data to comply with legal obligations or to exercise rights in legal proceedings. For example, the judicial authorities may request information from us concerning our users in the event of computer fraud or, if a legal dispute arises, we may use the data to take legal action or defend ourselves in court. In particular, we process the personal data necessary to fulfil the obligations of identification, due diligence (KYC), record-keeping and, where the conditions are met, reporting under Swiss anti-money laundering and counter-terrorist financing legislation (including the Swiss Anti-Money Laundering Act (AMLA) and FINMA Circular 2016/7 on Online Video Identification of 3 March 2016 and its implementing provisions).

What personal data do we use?

In this case, the types of personal data we collect or process about you include your identifying and contact information, and any other information necessary and relevant to the specific case. For example, in the event of a dispute, this includes information collected in the evidence necessary for the dispute; as well as, for anti-money laundering and counter-terrorist financing purposes, a copy of your identity document, date of birth, nationality, address, photo/selfie for verification, data relating to PEP checks and sanctions, information on the beneficial owner, bank or payment details, information on the origin of funds and/or assets and on planned investments, as well as the results and evidence of the checks carried out.

How we use your data

We will use your data to: 

·         Comply with applicable legal requirements, regulations, court orders or other legal processes;

·         Establish, exercise or defend our legal rights.

We will do so if necessary to comply with the legal obligations to which we are subject, including those under the Federal Anti-Money Laundering Act and related regulations (e.g. identification, retention and, where applicable, reporting obligations to MROS and SRO VQF), or, where applicable, to satisfy our legitimate interests in preventing fraud and abuse. We may disclose the data, to the extent permitted by law, to the competent authorities (including judicial, supervisory and self-regulatory bodies), to MROS and SRO VQF when required, and to financial institutions and providers that assist us with online identification and PEP/sanctions checks.

How long do we retain your data?

For the purpose described above, we will retain your personal data for a maximum period of 10 years from the termination of the relationship or the completion of the transaction, in accordance with the applicable Swiss AML legislation.

4-       COOKIES AND OTHER TRACKING TOOLS

The Platform uses cookies and other tracking tools to ensure its proper functioning, to carry out statistical surveys and for marketing purposes. You can find more information in the Cookie Policy https://invest.OROCASHSWISS.CH/page/Privacy-policy/534/

This website uses cookies and other tools belonging to the following categories:

·         technical cookies which ensure the smooth operation of the Platform,

·         profiling cookies which are used to provide additional services that are not essential for the operation of the Platform; for example, to store your choices, perform statistical analyses and for other marketing purposes.

You can choose which cookies you prefer to install by selecting them according to their purpose. For more information on how these tools work, you can consult our Cookie Policy (https://invest.OROCASHSWISS.CH/page/Privacy-policy/534/) or contact us at info@aureasvizzera.ch.

5-       CONSENT MANAGEMENT

You can withdraw your consent at any time via the link at the bottom of personal communications.

You can withdraw your consent to receiving the newsletter at any time by:

·         Using the ‘Unsubscribe’ link at the bottom of promotional messages;

·         Writing to the Data Controller at info@aureasvizzera.ch.

These methods are alternative options and equally effective. Withdrawal of consent will stop the sending of communications, without, however, affecting the lawfulness of the processing carried out before the withdrawal.

6-       MANDATORY PROVISION OF PERSONAL DATA

The nature of the provision of data (mandatory or optional) depends on the specific processing carried out.

The provision of browsing data is mandatory, as it is automatic and inherent in the use of browsing protocols. Instead, providing data to access specific services is always optional and depends on your free choice.

7-       WHO CAN ACCESS YOUR DATA?

Your personal data are processed by duly authorised staff of our Company and shared with third parties who work on our behalf for specific purposes described in this Privacy Policy.

The processing is carried out directly by the Data Controller’s organisation, through employees or other suitably appointed and trained persons, who act as data processors.

We may share your personal data with:

Suppliers acting on our behalf (data processors) or as independent data controllers

We use external providers who process personal data on our behalf and act as data processors pursuant to Article 9 of the FADP and, where applicable, Article 28 of the GDPR, exclusively for the purposes indicated in this policy. This includes:

• OP IQUAD S.p.A. — Tax Code/VAT No. 05866450967 — Registered office: Via Pietro Paleocapa 6, 20121 Milan (MI), Italy — Provider of IT and website management services;

·         Cookiebot (Usercentrics A/S) — CVR: DK34624607 — Registered office: Havnegade 39, 1058 Copenhagen, Denmark — Cookie consent management platform;

·         TWOW S.r.l. — Tax Code/VAT No. 02337580993 — Via Lomellini 2/1, 16124 Genoa (GE), Italy — Management of the newsletter, mailings and the related database;

·         TECH S.r.l. — Tax Code/VAT No. 03532980103 — Lungobisagno Dalmazia, 71 16141 - Genoa (GE), Italy;

·         Wordline Svizzera SA – Hardturmstrasse 201 Zurich, Switzerland

·         Post CH SA – Wankdorfallee 4, Bern, Switzerland

·         BEYOND AUDIT AG – Gubelstrasse 11, 6300 Zug, Switzerland

COMPANIES OF THE GROUP

·         Companies affiliated with the Gens Aurea S.p.A. Group, of which Aurea Svizzera SA is a member: given the corporate structure of Gens Aurea S.p.A., the user’s personal data may be shared with other affiliates within the group.

Business partners and professional consultants

·         We may share your personal data with external organisations with which we collaborate (e.g. research partners or co-branding initiatives) and with external professional advisers (such as lawyers, tax advisers, auditors, banks and payment service providers) to the extent necessary for them to provide us with their advice or assistance.

Public authorities and other parties for legal reasons

·         We may disclose your personal data to other parties, including public and judicial authorities, (1) if we believe we are required to do so by law or in connection with legal proceedings (such as a court order or subpoena); (2) in response to requests from government agencies, such as law enforcement or regulatory authorities; (3) to establish, exercise or defend our legal rights; (4) when we believe disclosure is necessary or appropriate to prevent physical or other harm or financial loss; or (5) in connection with an investigation into suspected or actual illegal activity.

And upon your request

·         With your consent, we will share your personal data with any other party you choose.

The data will not be disclosed to third parties for commercial purposes and will not be disseminated under any circumstances.

Some information may be disclosed to independent data controllers, such as public bodies or law firms, solely when the legal conditions are met.

The list of data processors can be provided on request by contacting the Data Controller at  info@aureasvizzera.ch.

8-       TRANSFER OF DATA ABROAD

The data may be transferred abroad to the operating centres of our service providers.

The above recipients may be located in countries other than the country in which the information was originally collected. These countries may not have the same data protection laws as the country in which you originally provided the information.

When we transfer your personal data to recipients in other countries (including the United States), we will implement appropriate security measures to ensure an adequate level of data protection as required by applicable law. This may include selecting service providers and business partners located in a country recognised as providing an adequate level of data protection and implementing safeguards based on standard data protection clauses (such as the EDPB’s standard contractual clauses), where applicable. Under applicable law, you may request a copy of these warranties by contacting us as detailed in Section 2 ‘Contact Us’.

9-       DATA STORAGE

We will retain your personal data for the time strictly necessary to provide the service you are accessing through the Platform.

Some browsing data will be stored for the duration of the browsing session only; the storage period for cookies is specifically described in the Cookie Policy. Some personal data will be stored for the time necessary to pursue the purposes described above, and in any case in accordance with the terms applicable by law or, in the cases provided for by law, until you object to the processing. The right to object may be exercised in the manner described in Section 11 ‘Exercising Privacy Rights and Complaints’.

10-   SECURITY AND PROCESSING METHODS

We protect your personal data using security measures appropriate to the risk.

Data will be processed using both manual and IT tools, and with organisational and processing methods related to the purposes pursued.

We guarantee data security through appropriate security measures, commensurate with the risk identified to your rights and freedoms, pursuant to Section 1 of the OPDA and, to the extent that the processing falls within the scope of the GDPR, pursuant to Article 32 of the GDPR. Security measures include, among other things, the encryption of communications and the use of SSL certificates.

11-   EXERCISING PRIVCY RIGHTS AND COMPLAINTS

You may exercise the privacy rights provided for by the FADP and the GDPR, such as the right to access your data, request its erasure, withdraw your consent or lodge a complaint with the Federal Data Protection and Information Commissioner and, where applicable, with the Italian Data Protection Authority. In the cases provided for by law, you may object to the processing of your data.

You can…

·         request access to the personal data we process about you (Article 15 GDPR; Article 25 FADP). The request must contain a detailed and accurate description of the personal data to which access is sought;

·         request that we rectify any information about you that you consider to be inaccurate or incomplete (Article 16 GDPR; Article 32 FADP);

·         object, based on your particular situation, to any use or processing of your personal data based on our legitimate interests (Article 21 GDPR);

·         withdraw the consent previously granted to use your data. In this case, this will not affect the lawfulness of the data we processed before the withdrawal of consent;

·         request that we receive, in a structured, commonly used and machine-readable format, the personal data that you have provided to us directly and to transmit this information to another company, where technically feasible. This right can only be exercised in certain circumstances, where the user has provided us with their personal data directly on the basis of their consent or a contract to which they are a party (Article 20 GDPR; Article 28 FADP);

·         request that we restrict or limit the use of your personal data (Article 18 GDPR).;

·         request that we delete your personal data (Article 17 of the GDPR; Article 32 of the FADP). Please note that we may not be able to delete all of your personal data, as this right only applies in certain circumstances, for example, when your data is no longer necessary for the purposes set out in this Privacy Policy and there is no legal or regulatory obligation requiring us to retain it. 

If you wish to exercise your rights, please contact us as specified in the ‘Contact Us’ section. In some cases, we may ask you to verify your identity before we can process your request.

Data subjects have the right to assert their rights in court or to lodge a complaint with the competent supervisory authority.

The competent supervisory authority in Switzerland is the Federal Data Protection and Information Commissioner (FDPIC): https://www.edoeb.admin.ch/it.

The competent supervisory authority in the EU is the Italian Data Protection Authority (GPDP): https://www.garanteprivacy.it.

12-   AMENDMENTS AND UPDATES TO THE WEBSITE PRIVACY POLICY

This Website Privacy Policy may be subject to amendments or additions, including as a result of any changes to and/or additions to the legislation. You will be able to view the text of the Privacy Policy, which is constantly updated, on the Platform.

This version of the Website Privacy Policy has been in effect since 20.09.2026.

[Policy updated on 20.09.2026]