Data protection notice

1 Controller and contact details

The controller of the data described in this notice is:

Data protection contacts: Francesco Coldesina and Alessandro Calabrini. Email: [email protected].

For any question about the processing of your personal data, write to us at the address above or to our registered office, for the attention of the data protection contacts.

2 Scope of this notice

This notice describes how datashaker processes personal data as a controller, within the meaning of Art. 19 of the Swiss Federal Act on Data Protection (FADP). It applies:

• to the datashaker.ch website and to those who visit it, contact us or subscribe to our communications;
• to the app.datashaker.ch platform, limited to the data we process for our own purposes: managing the contractual relationship, billing, support and security.

This notice does not cover the accounting and administrative data that our customers upload to the platform or that reaches it through integrations. In respect of that data Datashaker acts as a processor on behalf of the customer, who is the controller: the applicable terms are those of the Data Processing Agreement attached to the Terms and Conditions of Service. If you are a customer, supplier or employee of a company that uses Datashaker and wish to exercise your rights over that data, you must contact that company directly; on request we will point you to the competent controller.

If you are located in the European Union, the provisions of Regulation (EU) 2016/679 (GDPR) also apply to the extent that it is applicable.

3 Data processed, purposes and legal bases

3.1 Visitors to datashaker.ch

Technical browsing data. When you connect, our server records your IP address, the date and time, the pages requested, your browser type and operating system, and the referring page. Purposes: delivering and securing the website, diagnosing faults and preventing abuse. Legal basis: legitimate interest in the security and proper functioning of the website.

Cookies and tracking technologies. The website uses technical, measurement and marketing cookies, managed by a consent system of our own, with no third-party provider: your choice stays on this website and is not passed to anyone. The categories, purposes and providers are detailed in the Cookie notice, which forms an integral part of this notice. Non-essential cookies are set only with your prior consent, which you may withdraw at any time.

Visit measurement. We use traffic analytics tools to understand how the website is used and to improve it. Legal basis: consent given through the banner.

Advertising tools. We use pixels and tags from advertising platforms to measure the effectiveness of our campaigns and to show ads to people who have visited the website. These tools may involve the creation of interest profiles. Legal basis: consent given through the banner.

3.2 Contact and demo requests

If you complete a contact form or request a demo, we process: your first and last name, company and role, email address, telephone number if given, the content of your request and any subsequent correspondence. Purposes: replying to your request, arranging the demo, preparing a quotation and managing the commercial follow-up. Legal basis: pre-contractual measures taken at your request, and legitimate interest in managing business contacts.

The fields marked as mandatory are those needed to get back to you; without them we cannot process your request.

3.3 Newsletter and marketing communications

If you subscribe to our mailing list we process your email address, name, company if given, subscription date and interaction data for the messages sent (opens, clicks). Purpose: sending updates on the product, our content and our initiatives. Legal basis: your consent.

Subscription requires explicit confirmation and can be withdrawn at any time through the unsubscribe link in every message or by writing to [email protected]. Withdrawal does not affect the lawfulness of messages sent beforehand.

3.4 Platform users and customers

For the data of which we are the controller we process: identification and contact details of the customer's contact persons and of users; credentials and authentication data; access and usage logs; communications with support; contractual, billing and payment data.

Purposes: entering into and managing the contractual relationship; delivering, maintaining and securing the service; support; billing, accounting and debt collection; preventing fraud and non-compliant use; complying with legal obligations; exercising and defending our rights.

Legal bases: performance of the contract, compliance with legal obligations, and legitimate interest in the security of the service and the protection of our receivables.

3.5 Job applications

If you send us an application we process the data contained in your documents solely to assess it. We keep the data for the duration of the procedure and, if the outcome is negative, for a maximum of 12 months, unless you consent to a longer period for future opportunities.

4 Recipients and providers

We do not sell your personal data and we do not disclose it to third parties for their own purposes.

To carry out the activities described we rely on providers acting as processors on our instructions:

The up-to-date list of the providers involved in delivering the platform is published at datashaker.ch/subresponsabili.

We may also disclose data to judicial or administrative authorities where required by law or necessary to assert our rights.

5 Disclosure of data abroad

Platform data and its backups are kept in Switzerland.

Some processing operations nevertheless involve disclosure abroad: the serving of the datashaker.ch website pages, analytics tools and advertising platforms, email delivery and support services where the provider operates outside Switzerland, and the processing of documents by artificial intelligence model providers, which takes place outside Swiss territory.

Such disclosures are made to states recognised by the Federal Council as providing adequate protection or, failing that, on the basis of appropriate safeguards under Art. 16 para. 2 FADP, in particular standard contractual clauses recognised by the Federal Data Protection and Information Commissioner. On request we will provide information about the safeguards applied to a specific processing operation.

6 Retention periods

At the end of these periods the data is deleted or anonymised, unless longer statutory retention obligations apply or the data is needed to defend legal claims.

7 Security

We apply technical and organisational measures appropriate to protect data against unauthorised access, loss and alteration: encryption of communications and stored data, individual and multi-factor authentication, permission management on a least-privilege basis, logging of administrative access, regular backups and documented incident management procedures.

No measure offers absolute security. Please keep your credentials safe and report any anomaly to us promptly.

8 Automated decisions and profiling

The platform performs automated processing on accounting documents — reading, classification, proposed bookkeeping entries — including by means of artificial intelligence models. Such processing does not produce decisions with legal effect on natural persons, nor does it similarly affect them: the proposals generated are always subject to review by the customer before any accounting or tax use.

The advertising tools described in section 3.1 may involve the creation of interest profiles for marketing purposes. Such profiles are activated only with your consent and can be switched off at any time through the cookie banner.

9 Your rights

Under the FADP you have the right to: obtain information about the data concerning you and its processing; have it rectified if inaccurate; request its erasure or the restriction of processing; object to processing based on our legitimate interest; request the handover or transfer to another controller of the data you have provided to us, in common formats; withdraw a consent given at any time.

To exercise these rights, write to [email protected] or to the postal address given in section 1. To protect your data we may ask you to identify yourself. We normally reply within 30 days; if we need more time we will tell you and explain why.

Exercising these rights is free of charge. In exceptional cases of manifestly unfounded or excessive requests we may charge a contribution towards costs or refuse the request, giving reasons.

If you believe the processing infringes the law, you may contact the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern.

10 Changes

We may update this notice to reflect changes to our services or to the law. The applicable version is the one published on datashaker.ch bearing the date shown at the top. In the event of substantial changes we will inform customers and subscribers to our communications.