Controller
Collection and Processing of Personal Data
We process data from website use, customer accounts, correspondence, appointments and services.
- • Technical data, including IP addresses, browser information and error reports
- • Contact details and correspondence
- • Appointment and project details
- • Newsletter subscriptions
- • Business contact information from public sources and business information providers
Calls and meetings
We record and transcribe calls and meetings for notes and summaries. Recordings can include voice, video and shared content.
We inform you before recording and stop if you object. You can also contact us by email or post.
Sophia chat assistant
Sophia uses AI to answer website enquiries and prepare portal support requests.
AI service providers process your messages, conversation context and tool results to generate replies.
Verified website conversations can include customer information returned by authorised tools. Portal chat receives your messages and ticket drafts.
Submitted support requests form part of our business records.
We opt out of our chat provider’s use of new chat data for model training.
Customer portal
Customer accounts contain contact details, correspondence preferences, company permissions and sign-in records.
The portal processes invoices, payments, proposals and support requests for your company.
Passkey checks take place on your device. We store public credential data. We do not receive your fingerprint, face scan or device PIN.
We use email codes and letters sent to the verified postal address for account setup and recovery.
Purposes and Legal Bases
Swiss law applies, including the FADP (SR 235.1) and DPO (SR 235.11). The GDPR applies where relevant. The GDPR bases are listed below.
- • Website operation and security, and business communication (legitimate interests, Art. 6(1)(f) GDPR)
- • Appointments, customer accounts, support and services (contract, Art. 6(1)(b) GDPR)
- • Newsletters and recordings (consent, Art. 6(1)(a) GDPR)
- • Accounting and legal compliance (applicable legal duties; Art. 6(1)(c) GDPR for EU or Member State duties)
Data Transfer
We use service providers for hosting, communication, administration and service delivery.
Data are processed in Switzerland and abroad. The linked provider list identifies processing countries.
Transfers rely on recognised adequacy or suitable safeguards, including standard contractual clauses (Art. 16 FADP; Art. 44 et seq. GDPR where applicable). Details are available at privacy@axtero.com.
Storage Duration
We delete or anonymise data when no longer needed. Legal retention duties and claims may require longer storage.
| Data | Retention |
|---|---|
| Technical logs | As needed for operation, security and troubleshooting |
| Correspondence, support and project records | For the business relationship and applicable retention or limitation periods |
| Website chat transcripts | 30 days in the chat service |
| Portal chat transcripts | 30 days in the chat service |
| Website chat history in your browser | Until you reset the chat or end the browser session |
| Account and security records | As needed for account operation, security and applicable legal periods |
| Newsletter subscriptions | Until you unsubscribe; consent and opt-out records as needed |
| Accounting records | 10 years from the financial year end (Art. 958f Swiss Code of Obligations) |
| Meeting recordings | 120 days by default; longer when needed for project records or legal duties |
| Transcripts and summaries | As needed for notes and project records |
Data Security
We protect data with access controls, encrypted connections and security updates (Art. 8 FADP).
Obligation to Provide Data
We need relevant contact and project details to respond to enquiries and provide services.
Profiling and Automated Decision-Making
Rights of Data Subjects
You can request the following rights under the applicable law.
- • Access, correction and deletion (Art. 25 and 32 FADP)
- • Data delivery or transfer (Art. 28 FADP)
- • Withdrawal of consent and an end to direct marketing
- • Where the GDPR applies, access, correction, deletion, restriction, portability and objection (Art. 15 to 21), and withdrawal of consent (Art. 7(3))
Contact privacy@axtero.com to exercise your rights.
You can contact the Swiss FDPIC or, where the GDPR applies, the competent supervisory authority.
Axtero Connect Apps
This section applies to the iOS and iPadOS apps Axtero Connect and Axtero Connect Enterprise.
- • The apps collect no personal data. They use no analytics, no tracking and no user account.
- • The keys stay on the smart card. The apps do not store the PIN.
- • The apps send no data off the device on their own.
- • A diagnostic report leaves the device only when you share it. It contains no name, no email address and no PIN.
- • Axtero Connect Enterprise reads a licence key. Your organisation's IT installs the key with mobile device management (MDM), or you enter it. The app checks the key on the device and sends nothing to Axtero.
Amendments
We publish the current version on our website.