Privacy Policy

Last updated: May 2026

1. Data Controller

The data controller responsible for your personal data is Crossbridge Energy Partners, a company incorporated and operating in Geneva, Switzerland. If you have any questions about this Privacy Policy or the handling of your data, please contact us at kycgeneva@crossbridgepartners.com.

2. Data We Collect

Through the KYC Document Portal, we collect and process the following personal data:

Identity information: Full name and email address.
KYC/AML documents: Identity documents, corporate records, and any other files you upload through the portal as part of the know-your-customer onboarding process.
Compliance questionnaire responses: Answers relating to Politically Exposed Persons (PEP) status and sanctions screening.
Usage data: Log data generated when you access the portal (IP address, browser type, timestamps), collected automatically for security purposes.

3. Purpose and Legal Basis

We process your personal data for the following purposes:

KYC/AML compliance: To fulfil our legal obligations under applicable anti-money-laundering and know-your-customer regulations (legal basis: legal obligation, Art. 6(1)(c) GDPR).
Counterparty onboarding: To manage the business relationship with your organisation (legal basis: legitimate interests, Art. 6(1)(f) GDPR).
Security and fraud prevention: To protect the integrity of the portal (legal basis: legitimate interests, Art. 6(1)(f) GDPR).

4. Data Retention and Automatic Anonymisation

We retain your personal data and uploaded KYC documents for a period of five (5) years from the date your KYC clearance was granted, or for as long as required to comply with applicable legal and regulatory obligations.

After this five-year period, an automated process permanently deletes all uploaded documents and replaces personally identifying information (name and email address) with the marker "ANONYMIZED". Audit log records are retained in anonymised form for legal accountability purposes. This process runs automatically on a daily basis.

You may request early erasure of your data by contacting us at kycgeneva@crossbridgepartners.com, subject to our legal retention obligations.

5. Data Processors and Transfers

Your data is processed by the following third-party service providers acting as data processors:

Microsoft Azure (Spain Central, EU) — All portal infrastructure and document storage is hosted on Microsoft Azure in the Spain Central region, located within the European Union. Microsoft acts as a data processor under a Data Processing Agreement.
SendGrid / Twilio — Transactional emails (invitations, verification codes, and notifications) are delivered via SendGrid, a Twilio Inc. service. Only your email address and the email content are shared with this processor for delivery purposes.

We do not sell, rent, or share your personal data with any third party for marketing purposes. Where data is transferred outside the EEA, we ensure appropriate safeguards are in place (e.g., Standard Contractual Clauses).

6. Your Rights

Under the General Data Protection Regulation (GDPR), you have the following rights regarding your personal data:

Right of access: You may request a copy of the personal data we hold about you.
Right to erasure: You may request that we delete your personal data, subject to our legal retention obligations.
Right to data portability: You may request that we provide your data in a structured, commonly used, machine-readable format.
Right to rectification: You may ask us to correct inaccurate or incomplete data.
Right to restriction: You may ask us to restrict processing of your data in certain circumstances.
Right to object: You may object to processing based on legitimate interests.

To exercise any of these rights, please contact us at kycgeneva@crossbridgepartners.com. You also have the right to lodge a complaint with your local supervisory authority. In Switzerland, this is the Federal Data Protection and Information Commissioner (FDPIC).

7. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. All data is transmitted over encrypted connections (HTTPS) and stored in access-controlled cloud infrastructure.

8. Changes to This Policy

We may update this Privacy Policy from time to time. The date at the top of this page reflects the most recent revision. Continued use of the portal following any update constitutes acceptance of the revised policy.