Privacy Policy

Last updated: August 2026

1. Data Controller

The data controller responsible for your personal data is Crossbridge Energy Partners, a company incorporated and operating in Geneva, Switzerland. If you have any questions about this Privacy Policy or the handling of your data, please contact us at kycgeneva@crossbridgepartners.com.

2. Data We Collect

Through the KYC Document Portal, we collect and process the following personal data:

Identity information: Full name and email address.
KYC/AML documents: Identity documents, corporate records, and any other files you upload through the portal as part of the know-your-customer onboarding process.
Compliance questionnaire responses: Answers relating to Politically Exposed Persons (PEP) status and sanctions screening.
Usage data: Log data generated when you access the portal (IP address, browser type, timestamps), collected automatically for security purposes.

3. Purpose and Legal Basis

We process your personal data for the following purposes:

KYC/AML compliance: To fulfil our legal obligations under applicable anti-money-laundering and know-your-customer regulations (legal basis: legal obligation, Art. 6(1)(c) GDPR).
Counterparty onboarding: To manage the business relationship with your organisation (legal basis: legitimate interests, Art. 6(1)(f) GDPR).
Security and fraud prevention: To protect the integrity of the portal (legal basis: legitimate interests, Art. 6(1)(f) GDPR).

4. Data Retention and Automatic Anonymisation

We retain your personal data and uploaded KYC documents for a period of five (5) years from the date your KYC clearance was granted, or for as long as required to comply with applicable legal and regulatory obligations.

After this five-year period, an automated process permanently deletes all uploaded documents and replaces personally identifying information (name and email address) with the marker "ANONYMIZED". Audit log records are retained in anonymised form for legal accountability purposes. This process runs automatically on a daily basis.

You may request early erasure of your data by contacting us at kycgeneva@crossbridgepartners.com, subject to our legal retention obligations.

5. Data Processors and Transfers

Your data is processed by the following third-party service providers acting as data processors:

Microsoft Azure (Switzerland North) — All portal infrastructure and document storage is hosted on Microsoft Azure in the Switzerland North region. Switzerland is covered by an adequacy decision of the European Commission, which recognises that it ensures a level of protection for personal data equivalent to that of the European Union. Microsoft acts as a data processor under a Data Processing Agreement.
Azure Communication Services (Microsoft) — Transactional emails (invitations, verification codes, and notifications) are delivered through Azure Communication Services, operated within Crossbridge Energy Partners' own Microsoft tenant. Only your email address and the content of the message are processed for delivery purposes.
SendGrid / Twilio Inc. — Retained solely as a configured fallback delivery channel, used only if the primary email service is unavailable; the same limited data (email address and message content) applies.
OpenSanctions — The name of your organisation, and of the persons and entities recorded in its ownership chain, is transmitted for screening against consolidated international sanctions and politically-exposed-person lists. No documents are shared.
Creditsafe — Company data, and the details of associated key parties, are processed for know-your-customer verification and business-information checks.
GLEIF (Global Legal Entity Identifier Foundation) — Public register consulted to establish the ownership chain of legal entities. Only legal-entity information (company name and Legal Entity Identifier) is submitted; no personal data is transmitted.

We do not sell, rent, or share your personal data with any third party for marketing purposes. Personal data hosted in Switzerland benefits from the adequacy decision referred to above. Where data is transferred to a country that is not the subject of an adequacy decision — such as the United States, should the fallback email channel be used — we ensure appropriate safeguards are in place (e.g., Standard Contractual Clauses).

6. Your Rights

Under the General Data Protection Regulation (GDPR), you have the following rights regarding your personal data:

Right of access: You may request a copy of the personal data we hold about you.
Right to erasure: You may request that we delete your personal data, subject to our legal retention obligations.
Right to data portability: You may request that we provide your data in a structured, commonly used, machine-readable format.
Right to rectification: You may ask us to correct inaccurate or incomplete data.
Right to restriction: You may ask us to restrict processing of your data in certain circumstances.
Right to object: You may object to processing based on legitimate interests.

To exercise any of these rights, please contact us at kycgeneva@crossbridgepartners.com. You also have the right to lodge a complaint with your local supervisory authority. In Switzerland, this is the Federal Data Protection and Information Commissioner (FDPIC).

7. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. All data is transmitted over encrypted connections (HTTPS) and stored in access-controlled cloud infrastructure.

8. Changes to This Policy

We may update this Privacy Policy from time to time. The date at the top of this page reflects the most recent revision. Continued use of the portal following any update constitutes acceptance of the revised policy.