Privacy

Data protection statement of SwissOps Sàrl

SwissOps is a service offered by SwissOps Sàrl. This Data Protection Statement of SwissOps Sàrl (hereinafter "we" or "SwissOps") is intended to inform the Client or User (hereinafter "you" or "the User") of our services, offers or products (hereinafter "the Services") about the collection and processing of their data (whether or not it is of a personal nature; hereinafter "the Data").

1. Introduction

In this document we answer, in particular, the following questions: who is responsible for the processing of your Data? What Data do we collect in connection with the use of our Services? For what purposes do we process this Data? Where applicable, to whom do we transmit this Data? We also inform you about the duration of the processing of your Data, the legal basis for this processing (insofar as such a basis is required) and the rights you may assert against us regarding the processing of your Data. This Data Protection Statement applies to all of your Data of which we are already aware or which will be transmitted to us in the future. Please note that we may adapt this Data Protection Statement at any time. The current version published on SwissOps.ch is authoritative. Personal data means all information relating to an identified or identifiable person (hereinafter "Personal Data"). This includes information such as name, address, telephone number, email address and, where applicable, IP addresses and device IDs. The generic term "Data" within the meaning of this Data Protection Statement covers both Personal Data and anonymised or non-personal data. The term "processing" refers to any handling of Data, in particular the collection, recording, use, transformation, disclosure, storage or deletion of Data, whatever the means or process used (hereinafter "the Processing"). Before providing us with the Personal Data of other persons, please make sure that they have read this Data Protection Statement, and only transmit their Personal Data to us if the applicable data protection legislation allows you to do so.

2. Controller

In accordance with this Data Protection Statement, the controller of the Data Processing is SwissOps Sàrl, whose registered office is in Renens, Switzerland. For any question or request relating to data protection, please contact our dedicated "Data protection" service (info@swissops.ch).

3. Categories of Data processed

We collect certain Data when you use our Services or are in contact with SwissOps (for example, when you visit our website, use one of our mobile applications or another digital Service, conclude a contract, register or log in to a user account, or when you are in contact with our staff). As a rule, we collect this Data directly from you. In certain cases, however, other persons may provide us with Data (for example, if a third party writes a review or a comment concerning you, if your employer gives us your contact details, or if a company with which you have a contractual relationship transmits your Data to us). The Personal Data we process may include:

• Data communicated to us when registering for one of our Services (names, contact details, gender, marital status, date of birth, profession, photo, family members, staff, language, payment information, access data, information relating to advertising, opt-in and opt-out, etc.);
• Data relating to offers and concluded contracts (contract date, contract type, contract content, contractual product, contracting parties, contract duration, contract value, contract amendments, payment details, contact details, contact persons, billing and correspondence addresses, client feedback, terminations, disputes, etc.);
• Data obtained or disclosed when our Services are used by registered or unregistered Users. This includes IP and MAC addresses or the ID of the device used, cookies, the pages visited and the search terms entered by Users, the values entered in dialogue boxes, bookings, reviews, the date, time and duration of visits, clicks, reactions to offers from SwissOps or third parties, referrers/exit URLs, information relating to the date and time of use, the browser and device type, the operating system and the internet service provider, and the amount of data transferred. Also concerned is Data published or communicated through our Services or third-party services that may be integrated into them (images, texts, comments, reviews, bookings, videos, etc.). We may also merge Personal Data collected in connection with one of our Services with Data collected in connection with another Service;
• Data exchanged during any contact with us or concerning such contacts (communication by post, telephone, fax, email, SMS, MMS, video message or instant messaging, reactions to communications and offers from SwissOps, preferred means of communication, etc.);
• Data that you or third parties communicate as part of any participation in competitions or surveys, or in other similar operations;
• Location Data that certain Services may collect and record if the geolocation function of the device used is activated;
• Data made available to us by third parties with whom we have business relationships (entries in directories, address databases, changes to database entries, creditworthiness data, information concerning contact persons within a company, etc.);
• Data from public sources (entries in the commercial register, other registers, directories, etc.).

The above-mentioned Data is not always Personal Data. As a rule, unless there is a registration (for example, by means of a user account), we are not able to link the Data generated when our Services are used to a specific person. In individual cases, however, such a link may be possible if this Data is combined with other Data. Where applicable, in order to use our Services, you will have to provide certain Personal Data required by law or necessary to establish a contractual relationship, to process it or to fulfil the related contractual obligations. Without this Personal Data, we will generally not be able to conclude and perform the contract or provide a specific Service. The recording of access to our digital Services and the resulting collection of connection data (such as the IP address) are also indispensable. They are carried out automatically during use and cannot be deactivated for specific Users. Consequently, if you object to the collection of such Data, you should refrain from using our Services.

Contact form

When you write to us through the contact form, we record the information you enter (name, email address, subject, message, language) as well as, automatically, your IP address and the technical characteristics of your browser (the "user agent" string). This technical Data is used exclusively to handle your request, to fight spam and abuse (your IP address is transmitted for that purpose to Cloudflare Turnstile, see section 8) and to keep our systems secure. It is neither used for advertising nor transmitted to any other third party. Contact messages are kept for as long as necessary to follow up on your request and on our business relationship (see section 6); the technical Data attached to them (IP address, "user agent" string) is automatically erased at the latest 24 months after the message is received. A submission refused by the anti-spam check is not treated as a message: it is deleted automatically after 90 days.

Acceptance of terms in the client portal

When an authorised person of a client accepts contractual terms in our client portal (for example hosting and operation terms), we record, as evidence that the contract was concluded, the identity of that person (name, email address, role in the portal), the date and time of the acceptance, the declarations ticked, the IP address and the technical characteristics of the browser ("user agent" string), the time of the password confirmation, and the views and downloads of the document. This Data is set out in an acceptance record sent to the client by email, to the person who accepted and to the contact designated by the client, and an evidence copy is kept on our backups. The legal basis for this Processing is the performance of the contract and our legitimate interest in being able to prove its conclusion and its content. This Data serves no other purpose. It is kept for ten years after the end of the contract concerned (limitation period and retention of business records) and cannot be modified, as it constitutes the proof of the contract.

4. Purposes of the Processing and legal bases

To the extent permitted by law, we process Personal Data in particular for the following purposes:

• preparation, conclusion, performance and handling of contracts;
• offering, developing and improving our Services, developing new Services, operating, maintaining, optimising and ensuring the security of our Services and our infrastructure;
• managing the Users of our Services, identity checks, logins and other authentications;
• maintaining, managing and developing our client relationships, communicating with clients and third parties, customer service and technical support, promotions, advertising and marketing, creating user profiles, offering personalised Services and relevant content;
• keeping and publishing registers or directories (on paper, on data carriers and/or on the internet), keeping, comparing and updating databases, including central directories of addresses and other contact details belonging to us or to companies with which we have a contractual relationship;
• protecting Users, our staff and third parties, protecting our Data, secrets and assets, ensuring the security of our systems, buildings and other infrastructure;
• quality controls, market research, production of statistics, reports and management information, management and development of the company, of our offering and of our activities, purchase and sale of business units, companies or parts of companies;
• compliance with legal or regulatory obligations and internal rules, law enforcement, civil, criminal or administrative proceedings, complaints, fight against abuse, investigations and responses to requests from authorities or official bodies.

We may also process Personal Data for other purposes if a legal obligation requires it, if we inform you of it elsewhere, or if, in view of the circumstances, the Processing was evident at the time the Data was collected. Insofar as a legal basis is required by the applicable data protection legislation, we use Personal Data for the above-mentioned purposes on the following legal bases:

• performance of a contract;
• compliance with legal obligations;
• consent obtained by SwissOps or by a third party;
• legitimate interests of SwissOps or of third parties, in particular:
• offering and providing Services;
• advertising and marketing;
• maintaining relationships and communicating with Users and third parties;
• understanding the behaviour, preferences and needs of Users, market research;
• developing and improving our Services, developing new Services;
• managing Users, identity checks, logins, authentications;
• protecting Users, our staff and third parties, protecting our Data, secrets, infrastructure and assets;
• maintaining and organising business activity in a secure, efficient and effective manner, including the secure, efficient and effective operation and development of digital Services and other IT systems, problem resolution;
• timely management and development of the company, sale or purchase of business units, companies or parts of companies, other corporate-law transactions;
• compliance with legal or regulatory obligations and internal rules, law enforcement, civil, criminal or administrative proceedings, complaints, fight against abuse, investigations and responses to requests from the authorities.

5. Publication and transmission of Data

We may publish and transmit Data in accordance with the following provisions:

Publication of Data

Some of our Services involve the publication of Data. As a rule, published Data can be consulted anywhere, including outside Switzerland. For example, published directory data is accessible to the public (on SwissOps.ch, etc.). Data published through the corresponding features of our Services (posts, images, texts, videos, comments, reviews, etc.) may also be accessible to the public. This also applies to the username used for this purpose. We or third parties may publish the published Data on other platforms or in other media (for example, in print media), if necessary after adapting its form. It is also possible that Data published through our Services may be indexed by search engines (such as Google) or relayed by third parties, over which we have no control. Consequently, this Data may be accessible to the public in any country, even after we may have deleted it.

Data processors

We are entitled to commission third parties to provide certain services (IT services, application operation, management, printing, dispatch, etc.) or to process and store Data (hereinafter "the Data Processors"). Data Processors may have access to Personal Data and process it within the scope of the mandate we have given them. The Data Processors likely to receive Personal Data may be established in any country, in particular in Switzerland, in EU or EEA countries and in the United States.

The documents we keep (contracts, offers, project files and other files, including those we share in the client portal) and the backup copies of our systems may be stored with one of the following storage providers, or with both: Infomaniak Network SA, Geneva, in its data centres in Switzerland; DigitalOcean, LLC, United States, in its data centres in Frankfurt (Germany) or Amsterdam (Netherlands). We encrypt these files before sending them: the storage service never receives the key that makes them readable. Germany and the Netherlands are among the States the Federal Council has found to offer an adequate level of protection (art. 16 para. 1 FADP). As DigitalOcean, LLC is established in the United States, any access it may have to these files from that country rests on its Swiss-U.S. Data Privacy Framework certification and, failing that, on the standard contractual clauses of its data processing agreement.

When we disclose Personal Data to a recipient established in a country that does not provide an adequate level of protection, we rely on the recipient's Swiss-U.S. Data Privacy Framework certification, on standard contractual clauses recognised by the Federal Data Protection and Information Commissioner or, failing that, on an exception provided by law, in particular where the disclosure is directly connected with the conclusion or performance of a contract with you (art. 17 para. 1 let. b FADP). Sending the meeting reminders we receive on our devices through the Pushover notification service (Pushover, LLC, United States) relies on this exception. These reminders state the client's name, the day, the time and the form of the meeting (online, in person or by phone). Pushover deletes them from its servers once their delivery is confirmed, and after 21 days at the latest; its backup copies follow its own deletion schedule.

Contractual partners

We may transmit Data to our contractual partners (distribution partners, service providers, clients, suppliers, financial institutions, etc.). Such a transmission may take place, among other things, with a view to fulfilling contractual obligations, offering specific Services or comparing, validating and updating databases (including central directories of addresses and other contact details belonging to us or to our contractual partners); it may also serve debt-collection and marketing purposes, the analysis of the use and operation of our Services, systems and infrastructure, and payment processing. Purchasers or parties interested in acquiring business units, companies or parts of companies are also potential recipients. Contractual partners may have access to Personal Data and process it for their own purposes (for example, to perform their contracts or to fulfil their legal obligations). In this context, they too are required to comply with the applicable data protection legislation. The contractual partners likely to receive Personal Data may be established in any country, in particular in Switzerland, in EU or EEA countries and in the United States.

Transmissions to authorities and other transmissions for legal reasons

In certain cases, we may disclose Data to authorities, official bodies or other third parties (in the context of requests from authorities or official bodies, inquiries and investigations, administrative investigations, criminal proceedings, civil and/or criminal procedures, etc.). We make such a disclosure when authorities or official bodies request it from us, when we believe we are required to do so, or when we can assume in good faith that access to the Data concerned, its use, storage or transmission is reasonably necessary to enforce the applicable terms of use, to detect, prevent or combat abuse or security breaches, or to protect the rights and property of SwissOps.

6. Retention period

We keep Personal Data for as long as necessary to fulfil the purpose for which we collected it. As a rule, however, we delete earlier, namely as soon as their Processing is no longer of interest to us, the Personal Data generated in connection with the use of our Services (protocols, logs, analyses, etc.) that is not subject to such retention or limitation periods. Anonymised Data may be kept longer. Subject to any express contractual agreement, we are not required to keep Data for a specific period.

7. Cookies, web audience measurement tools, tracking tools and other technologies

We use several common technologies to collect, record and analyse Data when you use our Services. In particular, we use cookies, which make it possible to identify your web browser or your device. A cookie is a small file that is stored on your computer or mobile device by the browser you use when you use one of our Services. When you access that Service again, it can recognise your browser or device using cookies. In addition to "session cookies", which are automatically deleted after each visit, we may use temporary and permanent cookies, which are kept longer on your computer or mobile device. Strictly necessary cookies serve above all to offer you the features of the various Services in a secure and convenient way (for example, logging in to your user account); they do not require consent.

On your first visit to SwissOps.ch, a consent banner lets you accept or refuse non-essential cookies, category by category. No audience-measurement cookie is set without your agreement: all non-essential storage types are denied by default. You can change or withdraw your consent at any time via the "Manage cookies" link at the bottom of every page, or by deleting cookies in your browser settings. If you refuse analytics cookies, you can continue to use the site normally.

In addition to cookies, we may use other technologies (pixels, web beacons, tags, etc.) to analyse the use of our Services. For example, when we send newsletters or emails, we may use technologies that allow us to analyse whether, when and how you react to our communications (downloading images contained in an email, clicking on URLs, etc.).

Analytics services

WireBoard: we use WireBoard, our own real-time audience analytics tool, to measure the use of our Services. Without your consent, WireBoard runs exclusively in cookieless mode: no cookie or local storage is used and no permanent identifier allowing you to be recognised from one visit to the next is kept. If you accept analytics cookies, WireBoard then uses cookies to measure returning visits more precisely.

Google Analytics 4: we also use Google Analytics 4 (GA4), a web analytics service provided by Google LLC, for additional analytics. GA4 is only loaded after your explicit consent to analytics cookies; without your consent, GA4 is not loaded at all. We additionally use Google's Consent Mode, which blocks all advertising and audience-measurement storage by default until you have given your agreement. When GA4 is active, information relating to your use of our Services may be transmitted to Google servers, including in the United States, where it is stored.

Scope of measurement: these tools measure the use of the whole of SwissOps.ch, including the client portal, its administration and the login pages. For each page viewed, they receive its address and its title. In the client portal, that title can name a project, an invoice number or a contract. Pages opened from a personal link received by email (invitation, password reset, email address confirmation) are not measured, because their address contains a secret code. We use these measurements to understand how our Services are used and to improve them; we do not use them for advertising. The "Manage cookies" link is also available in the client portal and on the login pages.

8. Integration of third-party services

Our website does not integrate social media plugins ("Like" buttons, sharing modules, etc.) or any social-network login service. We do, however, integrate certain technical services provided by third parties. For example, our contact form is protected by Cloudflare Turnstile, an anti-bot verification service provided by Cloudflare, Inc.; when the form is displayed, a connection is established with Cloudflare servers, which may process certain technical Data (IP address, browser characteristics, etc.) in order to distinguish legitimate visitors from automated programs. Furthermore, our Services contain links to third-party websites and services, including our own products (such as WireBoard or LaminarFlow). When you follow these links, the third parties concerned process your Data in accordance with their own terms of use and data protection provisions.

9. Rights of data subjects

Every data subject has a right of access to the Personal Data concerning them. They also have the right to demand that we rectify or delete Personal Data concerning them or that we restrict its Processing and use, and may also object to such Processing of Personal Data. As a rule, however, the data subject must be able to clearly prove their identity in order to exercise such rights. If the data subject has consented to the Processing of Personal Data, they may revoke their consent at any time. Within the EU or EEA member states, the data subject has the right, in certain cases, to receive the Data generated during the use of online Services in a structured, commonly used and machine-readable format that allows the further use and transmission of that Data. Any request relating to these rights must be addressed to the dedicated "Data protection" service (see section 2 above). We reserve the right to restrict the rights of the data subject to the extent permitted by law and, for example, not to provide complete information or not to delete Data. Furthermore, we draw your attention to the fact that, if your Personal Data is deleted, Services or parts of Services may no longer be available or usable. It is possible that an automated decision by SwissOps concerning a particular person may produce legal effects for that person or otherwise substantially affect them. In such a case, and to the extent provided for by law, the data subject may contact a responsible person within SwissOps and ask them to reconsider the automated decision, or demand from the outset that the decision be taken by a person rather than automatically. In this case, the data subject may no longer be able to use certain automated services. They will be informed separately of such decisions. Every data subject has the right to lodge a complaint with the competent data protection authority. If the controller of the Data Processing is located in Switzerland, this is the Federal Data Protection and Information Commissioner (http://www.edoeb.admin.ch).