Privacy Policy

Last updated: September 10, 2026

1. Data Controller

This Privacy Policy is drafted in accordance with the Swiss Federal Act on Data Protection (nLPD, RS 235.1) and, where applicable, the EU General Data Protection Regulation (GDPR – Regulation (EU) 2016/679).

2. Personal Data Collected

2.1 From the website

• Full name, retained for up to 24 months from creation or last access, then deleted unless session renewed by the user
• Email address, retained for up to 24 months from creation or last access, then deleted unless session renewed by the user
• Session and consent cookie UUID, retained for up to 24 months or until consent revoked
• Technical, access, security and error logs, including timestamps and relevant technical activity, retained for up to 24 months where necessary for security, fraud and abuse prevention, troubleshooting, service reliability, incident investigation, and the establishment, exercise, or defence of legal claims.
• Algotrading section funnel analytics: anonymous session identifier (scoped to the browser tab, not persistent), browser type, interaction events (funnel step, page path, referrer, CTA clicked), retained for up to 6 months. No IP address or persistent identifier is collected or stored for this purpose.

2.2 From the TWM software

• Machine ID: a device identifier calculated by the TWM software and transmitted to ASKO SA for licensing and device access management. The Machine ID is stored until the User deletes it through the Machine ID controls in the profile area, or until ASKO SA removes it for account, security, or legal reasons.
• Trading activity and order data: information necessary to transmit Orders to Trading Providers may also be processed for internal operational and statistical purposes, including calculation of aggregate trading volume. Retention is limited according to the purposes for which the data are processed and applicable legal or security requirements.

2.3 Not collected or stored

• API keys, always stored locally on the user computer
• Hardware data (CPU, RAM, GPU)
• Account balances, wallets, or full financial history

2.4 AI Support Assistant

The AI Support Assistant available on the TWM website uses the OpenAI API. When a User interacts with the assistant, the User’s message and relevant conversation context are transmitted to OpenAI for the purpose of generating a response.

To improve the relevance of support responses, the website may also send up to three excerpts from previously resolved support tickets that an administrator has selected for inclusion in the TWM knowledge base.

A normal AI Support Assistant conversation is not automatically stored by ASKO SA as a support ticket. If the User chooses to open a support ticket from the assistant, the conversation may be offered as a prefilled draft. The conversation becomes part of the support ticket and visible to support staff only if the User submits that ticket.

Resolved support tickets may be selected by an administrator for inclusion in a separate vector knowledge base used by the AI Support Assistant. Content selected for the knowledge base is transmitted to OpenAI when the corresponding vector embedding is created. The current knowledge base workflow stores selected ticket content as provided and may therefore include personal data contained in the ticket. Knowledge base entries are stored separately from the original ticket, are not automatically deleted when the original ticket is deleted, and may remain stored until manually removed. Relevant excerpts from those entries may later be transmitted to OpenAI as context for AI Support Assistant responses.

Users must not submit passwords, exchange API Keys, private keys, authentication secrets, recovery phrases, payment credentials, or other information that is not reasonably necessary for the support request.

The AI Support Assistant is not used by ASKO SA to make solely automated decisions that produce legal effects or similarly significant effects concerning Users.

2.5 User Enabled External AI Integrations

The TWM desktop software may allow Users to connect an External AI Provider, including OpenAI or Anthropic, using the User’s own account with that provider.

Requests from TWM Desktop are sent directly from the User’s computer to the selected External AI Provider. ASKO SA does not route, receive, or store those desktop AI prompts and responses as part of the AI connection.

Depending on the function used and the information made available through TWM, the selected External AI Provider may receive prompts, strategy or indicator source code where the User has made source code available through a Custom project, compiler output, debugging output, TWM documentation, configuration information, market data, balances, open positions, previous orders, account names, exchange identifiers, and other technical or account information relevant to the User’s request.

TWM AI agents are not provided access to locally stored exchange API Keys, private keys, passwords, payment credentials, or other authentication secrets. Users must not intentionally include such secrets in prompts or content sent to an External AI Provider.

Because the External AI Provider is connected through the User’s own account, that provider processes the information under its own terms, privacy policy, retention practices, and account settings. Users should review the selected provider’s privacy and data usage settings before enabling the integration.

2.6 Personal External AI Accounts and Provider Controlled Processing

Where a User enables a TWM Desktop AI integration using the User’s own account with an External AI Provider, the User has a separate relationship with that provider. Information submitted or made available through the integration is processed by the provider according to its own privacy policy, terms, retention practices, data usage rules, model improvement settings, and account configuration.

The User decides which requests to make and which information to intentionally submit or expose through the integration, subject to the functions and information that TWM makes available. Users should review the provider’s privacy and data usage settings before using the integration and should avoid submitting information they are not authorised or willing to disclose to that provider.

ASKO SA does not control the External AI Provider’s independent processing within the User’s own account. ASKO SA remains responsible for the operation and design of TWM, for accurately describing the information and functions that TWM makes available through the integration, and for its own processing of personal data under this Privacy Policy.

3. Purpose and Legal Basis

Personal data are processed in accordance with the principles of lawfulness, transparency, proportionality, purpose limitation, data minimisation, accuracy, and security under the Swiss Federal Act on Data Protection. Where the GDPR applies, the relevant legal bases under Art. 6 GDPR are identified below.

• Contract performance and service operation: account functionality, licensing, Machine ID management, API connectivity with Trading Providers, order transmission, and other processing necessary to provide the Services. Where the GDPR applies, Art. 6(1)(b) GDPR may apply.
• Support and service communications: responding to support requests, account communications, product information, and communications requested by the User. Where the GDPR applies, Art. 6(1)(b), Art. 6(1)(f), or consent under Art. 6(1)(a) may apply depending on the communication.
• Marketing communications: newsletters and promotional communications where consent is required. Where the GDPR applies, processing is based on Art. 6(1)(a) GDPR where consent is used.
• Functional analysis and statistics: website analytics and performance measurement. Where the GDPR applies and consent is required, processing is based on Art. 6(1)(a) GDPR.
• Internal funnel analytics: anonymous or pseudonymous interaction data used to measure and improve conversion flows. Where the GDPR applies, processing may be based on ASKO SA’s legitimate interests under Art. 6(1)(f) GDPR, subject to applicable rights and safeguards.
• Legal, accounting, security, and fraud prevention: processing necessary to comply with legal obligations, protect the Services, investigate misuse, enforce rights, and maintain security. Where the GDPR applies, Art. 6(1)(c) or Art. 6(1)(f) GDPR may apply.
• AI Support Assistant: processing User messages, relevant context, and support knowledge to answer questions, troubleshoot issues, maintain service security, and enable human support. Where the GDPR applies, Art. 6(1)(b) or Art. 6(1)(f) GDPR may apply depending on the processing activity.
• Support knowledge base: selected resolved support content may be reused to maintain and improve a technical support knowledge base. Where the GDPR applies, ASKO SA may rely on legitimate interests under Art. 6(1)(f) GDPR where appropriate, subject to applicable rights and safeguards. Where another legal basis is required by applicable law, ASKO SA will rely on that basis.
• User enabled External AI integrations: the User directs TWM Desktop to make information available to the External AI Provider selected by the User. ASKO SA generally does not receive or store the resulting desktop AI exchange.

4. Data Protection Officer (DPO)

ASKO SA has not appointed a Data Protection Officer. Under Swiss data protection law, appointment of a data protection officer by a private company is voluntary.

Where the GDPR applies, ASKO SA assesses whether the conditions requiring designation of a Data Protection Officer under Art. 37 GDPR are met and will appoint one where required by applicable law.

Privacy related inquiries may be directed to privacy@twm.one.

5. Data Protection Impact Assessment (DPIA)

ASKO SA assesses whether new or materially changed processing activities are likely to result in a high risk to the personality, privacy, or fundamental rights of data subjects.

Where required by applicable law, ASKO SA carries out a Data Protection Impact Assessment in accordance with Art. 22 of the Swiss Federal Act on Data Protection and, where applicable, Art. 35 GDPR. ASKO SA may also perform preliminary privacy risk assessments for new technologies, service providers, or material changes even where a formal DPIA is not legally required.

6. Download Link Email Collection

When a visitor requests to receive the TWM download link by email through the download form on the website, ASKO SA collects and processes the following personal data:

• Email address — used to deliver the requested download link and for follow-up communications described below.

6.1 Purpose

The email address is collected for the following purposes:

• Sending the requested download link for the TWM desktop application;
• Asking for feedback on the user's experience with the software;
• Communicating relevant product updates, new releases, or feature announcements.

The user consents to all three purposes at the time of form submission. No separate newsletter subscription is implied; communications will be limited to product-related content.

6.2 Legal Basis

Processing is based on the User’s freely given, specific, informed, and unambiguous consent where consent is required. Where the GDPR applies and consent is used, the legal basis is Art. 6(1)(a) GDPR. Consent is given through the consent mechanism presented with the form.

6.3 Retention Period

The email address is retained for as long as necessary to fulfil the above purposes, and in any case for no longer than 24 months from collection, unless the user requests deletion earlier. Technical delivery logs may be retained for up to 30 days for error-tracking purposes.

6.4 Right to Withdraw Consent

Consent can be withdrawn at any time by contacting ASKO SA at privacy@twm.one or by clicking the unsubscribe link included in each communication. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

6.5 No Third-Party Sharing

The email address collected through the download form is not sold, shared with third parties for marketing purposes, or used for profiling or advertising beyond the product-related communications described above.

7. Retention, Deletion, and Administrative Costs

• Registration and web profile data: retained for up to 24 months from creation or last access, unless a longer period is required for legal, security, accounting, dispute, or fraud prevention purposes.
• Technical, access, security and error logs: retained for up to 24 months where necessary for security, fraud and abuse prevention, troubleshooting, service reliability, incident investigation, and the establishment, exercise, or defence of legal claims. Logs may be deleted or anonymised earlier where they are no longer required. Specific records may be retained for longer where necessary for an ongoing security incident, dispute, investigation, or legal obligation.
• Machine ID: retained until the User deletes the Machine ID through the profile area or until ASKO SA removes it for account, security, or legal reasons.
• Submitted support tickets and associated correspondence: retained for up to 6 months after closure, unless a longer period is necessary for legal, security, fraud prevention, dispute resolution, or other legitimate obligations.
• AI knowledge base entries derived from selected support tickets: stored separately from the originating support ticket and may be retained until manually removed. Deletion of the originating ticket does not automatically delete the corresponding knowledge base entry.
• Trading activity data used for internal operations or statistics: retained according to the purpose for which the data are processed and applicable legal, accounting, security, or dispute requirements. Aggregate statistical information that no longer identifies a User may be retained for longer.
• AI Support Assistant conversations: not retained as support tickets unless the User submits a ticket containing the conversation. Other technical records may be retained where necessary for security, troubleshooting, or legal obligations.

ASKO SA deletes or anonymises personal data when they are no longer required for the applicable purpose, subject to legal, accounting, security, dispute, and evidentiary obligations.

Requests concerning access, correction, deletion, restriction, objection, portability, or withdrawal of consent are handled in accordance with applicable law. Requests are generally handled free of charge. Where permitted by applicable law, ASKO SA may charge a reasonable fee or refuse a request that is manifestly unfounded, excessive, or requires disproportionate effort, subject to the applicable legal conditions.

8. Cookies and Tracking

8.1 Types of Cookies Used

8.1.1 Necessary Cookies

These cookies are essential for the website to function and cannot be disabled:

• UserUUID: Technical identifier for consent management (12 months)
• consent: Stores your cookie preferences (12 months)
• .AspNet.Consent: Session consent indicator (1 year)
• .AspNetCore.Cookies: Authentication and session management (1 year)
• .AspNetCore.Antiforgery: Security against CSRF attacks (session)
• .AspNetCore.Culture: Language preferences (1 year)

Legal basis: technical functionality and security. Where the GDPR applies, ASKO SA may rely on legitimate interests under Art. 6(1)(f) GDPR where appropriate.

8.1.2 Functional Cookies

These cookies improve your experience but require your consent:

• Google cookies for Maps integration and service personalization (LSOLH, COMPASS, ACCOUNT_CHOOSER, APISID, LSID, NID, SAPISID, __Host-GAPS)

Legal basis: consent where required. Where the GDPR applies and consent is used, Art. 6(1)(a) GDPR applies.

8.1.3 Statistical/Analytical Cookies and Session Storage

Used for anonymous or pseudonymous website analytics and performance measurement:

• Google Analytics 4: _ga, _gid, _gat (anonymized before processing where applicable)
• Microsoft Clarity: CLID, MR, SM
• twmAlgotradingSessionId (sessionStorage): anonymous UUID scoped to the browser tab session. Expires automatically when the tab is closed. No persistent tracking, no IP address associated. Used exclusively for internal funnel analytics by ASKO SA.

Data collected through these tools are used to measure website usage, performance, and interactions, and may be processed in aggregated, anonymised, or pseudonymised form depending on the provider and configuration.

Legal basis: consent where required for third party analytics tools. Where the GDPR applies and consent is used, Art. 6(1)(a) GDPR applies. Internal funnel analytics are processed for ASKO SA’s legitimate interests in measuring and improving the Services where Art. 6(1)(f) GDPR is applicable.

8.1.4 Marketing/Advertising Cookies

Used for personalized advertising, remarketing, campaign attribution, and cross-platform measurement:

• Google DoubleClick / Google Ads: test_cookie, IDE, DSID, FLC, AID, TAID, ADS_VISITOR_ID, OTZ, __gads, __gac, NID, UULE
• Google account and personalization cookies on embedded Google services: SAPISID, SID, SIDCC, SSID, HSID, SEARCH_SAMESITE
• Microsoft Advertising: ANONCHK, MUID
• Meta / Facebook: datr, fr, sb, xs
• TikTok Advertising / Tracking: ttcsid, ttcsid_D5GFV53C77U3VC0C2T50, odin_tt, tt_chain_token, ttwid

These cookies may be used by their respective providers to recognize browsers, measure conversions, attribute campaigns, personalize advertisements, and support retargeting across websites or devices.

Legal basis: consent where required. Where the GDPR applies and consent is used, Art. 6(1)(a) GDPR applies.

8.2 Consent Management

The cookie banner appears on the first visit and is renewed:

• Every 12 months from last consent
• When site or code changes introduce new cookies
• After browser cache/cookies are cleared

You can manage consent through three options:

• "Accept All": Accepts all cookie categories
• "Accept Selected": Accepts only chosen categories (functional, statistical, marketing)
• "Only Necessary": Only essential cookies (same as clicking "X")

Prior blocking: ASKO SA uses a consent management mechanism configured to prevent non essential analytics and marketing technologies from being activated before the relevant consent is granted, where consent is required.

8.3 Withdrawal of Consent

You can withdraw consent at any time by:

• Clicking the cookie icon at the bottom-left of the page
• Accessing the Cookie Statement via the privacy policy
• Clearing your browser cookies manually

Effect of withdrawal: When you revoke consent:

• First-party cookies (_ga, _gid, etc.) are deleted immediately
• Tracking scripts (Google Analytics, GTM, Clarity) are blocked
• Third-party cookies (test_cookie, IDE) may remain temporarily but are no longer used or renewed
• Third-party cookies expire automatically (e.g., test_cookie expires in 15 minutes)

8.4 Third-Party Data Controllers

8.4.1 Google LLC / Google Ireland Limited

Google services used on the website may include Google Analytics 4, Google Tag Manager, Google Ads, DoubleClick, Google Maps, YouTube embeds, and other Google-delivered content or security components.

Depending on the service and browser state, Google may set cookies such as _ga, _gid, _gat, IDE, NID, OTZ, AID, ADS_VISITOR_ID, SAPISID, SID, SIDCC, SSID, HSID, SEARCH_SAMESITE, UULE and related identifiers.

Google acts as an independent data controller for the data it collects through its own services. Data transfers may rely on the EU–US Data Privacy Framework and the Swiss–US Data Privacy Framework, where applicable.

Google's privacy terms: policies.google.com/privacy

Google Analytics opt-out: tools.google.com/dlpage/gaoptout

Google Ads settings: adssettings.google.com

8.4.2 Microsoft Corporation

Microsoft services may include Microsoft Clarity and Microsoft Advertising technologies. Cookies may include CLID, MR, SM, ANONCHK, MUID.

Microsoft acts as an independent data controller for the data collected through its services. Data transfers may rely on the EU–US Data Privacy Framework and the Swiss–US Data Privacy Framework, where applicable.

ASKO SA does not use these tools to identify users directly. Microsoft's privacy terms: privacy.microsoft.com

8.4.3 Meta Platforms Ireland Limited / Meta Platforms, Inc.

Meta services may be used for advertising, conversion measurement, or embedded social content. Cookies observed may include datr, fr, sb, xs.

These cookies may support browser recognition, fraud prevention, ad delivery, measurement, and personalization across Meta services and partner sites.

Meta acts as an independent data controller for processing carried out through its own services and technologies.

Meta privacy terms: facebook.com/privacy/policy

8.4.4 TikTok Technology Limited / TikTok Information Technologies UK Limited / ByteDance group entities

TikTok technologies may be used for campaign attribution, analytics, event measurement, and advertising optimization. Cookies observed may include odin_tt, tt_chain_token, ttcsid, ttcsid_D5GFV53C77U3VC0C2T50, ttwid.

These cookies may be used to measure site interactions, attribute visits and conversions, and support ad delivery or performance reporting across TikTok services.

TikTok acts as an independent data controller for processing performed through its own tracking and advertising technologies.

TikTok privacy terms: tiktok.com/legal/page/eea/privacy-policy/en

8.5 Cookie Lifespan and Storage

8.6 How to Disable Cookies in Your Browser

You can configure your browser to refuse cookies:

• Chrome: Settings → Privacy and security → Cookies and other site data
• Firefox: Settings → Privacy & Security → Cookies and Site Data
• Safari: Preferences → Privacy → Block all cookies
• Edge: Settings → Cookies and site permissions

Note: Blocking all cookies may affect website functionality.

8.7 Additional Information

For detailed information about each cookie, including purposes, categories, and third-party providers, please refer to our Cookie Statement accessible from every page via the cookie icon.

The cookie banner and cookie statement may include cookies from ASKO SA and from third-party providers such as Google, Microsoft, Meta, and TikTok, depending on the services enabled on the site and the user’s consent choices.

The complete list of cookies currently detected and categorized is also displayed in the cookie banner under the "Details" tab.

9. Data Sharing

Trading Providers receive the information necessary to process and execute User instructions under the User’s separate relationship with the relevant Provider. ASKO SA may also process limited trading activity information for operational and internal statistical purposes, including aggregate trading volume.

ASKO SA may use third party service providers and platforms for analytics, advertising, attribution, embedded content, payments, technical service delivery, support, and artificial intelligence, depending on the Services enabled and the User’s consent choices where consent is required.

Some third party providers act as processors on behalf of ASKO SA, while others may act as independent data controllers for information collected through their own cookies, tags, pixels, SDKs, embedded services, or user accounts. Their processing is also governed by their own privacy terms where applicable.

ASKO SA does not sell personal data. Where the User has provided consent required by applicable law, online identifiers and other data described in the Cookies and Tracking section may be collected by or disclosed to analytics, advertising, attribution, and social media providers for the purposes described in this Policy.

9.1 AI Service Providers and International Processing

For the website AI Support Assistant, ASKO SA uses the OpenAI API. User messages, relevant conversation context, and up to three relevant excerpts from the TWM support knowledge base may be transmitted to OpenAI to generate a response.

When an administrator selects a resolved support ticket for the TWM vector knowledge base, the selected ticket content is transmitted to OpenAI to create the corresponding vector embedding. The knowledge base entry is stored separately from the original ticket and may later be used to retrieve relevant excerpts for future AI Support Assistant conversations.

For TWM Desktop AI integrations, the User connects the External AI Provider using the User’s own account. Those requests are sent directly from the User’s computer to the selected provider, such as OpenAI or Anthropic, and ASKO SA does not route or store the desktop AI exchange as part of the AI connection.

Processing by AI service providers may take place outside Switzerland. Where required, international transfers are protected through an adequacy decision, recognised data protection framework, standard contractual clauses, contractual safeguards, or another lawful transfer mechanism applicable to the relevant transfer.

Where a User independently connects an External AI Provider through the User’s own account, the User should review that provider’s privacy, retention, data usage, and model improvement settings because those settings are controlled by the External AI Provider and the User’s account configuration.

9.2 AI Transparency and Human Support

Where Users interact directly with the AI Support Assistant, the interface identifies the interaction as involving artificial intelligence. AI generated responses may contain errors and should be verified where important.

The AI Support Assistant does not make solely automated decisions producing legal effects or similarly significant effects concerning Users. If an AI response does not resolve a support issue, Users may submit a support ticket for human review where support is available.

10. Data Subject Rights

Subject to applicable law, Users may have rights concerning access, rectification, deletion, restriction, objection, portability, and withdrawal of consent, and information about the processing of their personal data.

Requests are handled without undue delay and within the time limits required by applicable law. Where the GDPR applies, ASKO SA will respond within one month of receipt of the request, subject to any lawful extension permitted by Art. 12 GDPR.

ASKO SA may request information reasonably necessary to verify the identity of the requester before acting on a request.

Users may contact the Federal Data Protection and Information Commissioner (FDPIC) in Switzerland regarding concerns about data processing. Where the GDPR applies, Users may also have the right to lodge a complaint with the competent supervisory authority.

11. Updates to This Policy

ASKO SA may update this Privacy Policy to reflect changes in the Services, technology, processing activities, legal requirements, or service providers.

Material changes will be communicated where required by applicable law. Non-material changes will be reflected by updating the “Last updated” date.

Where a change to processing requires new or renewed consent under applicable law, ASKO SA will obtain that consent before relying on it.

12. Contacts and Support

Requests to exercise data rights should include sufficient information to allow ASKO SA to identify the relevant account or data, such as the registered e-mail address where applicable.