Privacy policy

Controller

The controller for the processing of personal data on this website is:

Further details about the operator can be found in the legal notice.

Scope

This policy describes how we process personal data when you visit our website – that is, provara.ch, www.provara.ch and staging.provara.ch.

The Provara service itself (the platform for digital authorisations at app.provara.ch) is in a closed beta and is not the subject of this policy. Beta participants receive the data protection and contractual documents applicable to the service separately.

Principles

We process personal data in accordance with the revised Swiss Federal Act on Data Protection (revFADP/nFADP, German: revDSG). Where the European General Data Protection Regulation (GDPR) applies to visitors from the EEA, we additionally comply with its requirements.

We collect only the data required to operate the website and to get in touch in the context of the beta. We do not sell personal data and we use no advertising, profiling or tracking services.

Depending on the processing, the legal bases are your consent (for example when you join the waitlist), the initiation of a contractual relationship, and our overriding legitimate interest in the secure and functioning operation of the website.

Server log files

The website is operated in Switzerland and delivered via an upstream web server. For technical reasons, access data is logged with every request:

• IP address of the requesting device
• date and time of access
• page or file requested and HTTP status code
• volume of data transferred, referrer and user agent (browser and operating system details)

This data is required for the operation, stability and security of the website (detection and prevention of misuse, error analysis). It is not merged with other data sources and is not used to identify individual persons.

Waitlist form

On the home page you can put yourself on a waitlist for the closed beta. In doing so, we process the details you enter yourself – namely name, email address, company and any message.

The form transmits your details directly to our CRM system Zoho, which we operate in the EU data centre. Zoho processes the data as a processor, exclusively on our instructions.

We use your details exclusively to contact you about the beta. No newsletter is sent and no data is passed on for advertising purposes. You may request deletion at any time, without any formality (see Your rights).

After submitting, you are redirected to a confirmation page.

Spam protection (Google reCAPTCHA)

To protect the waitlist form against automated submissions, we use Google reCAPTCHA. The service is provided by Google Ireland Limited; processing of data in the USA by Google LLC is possible in this context.

To distinguish between human and machine, reCAPTCHA collects, among other things, your IP address, details about your browser and device, and your interaction behaviour on the page. This data is transmitted to Google and evaluated there.

Transparency note: The reCAPTCHA script is loaded exclusively on the home page – that is where the form is – and it is loaded before you fill the form in. It is not embedded on any other page, including this one. The legal basis is our legitimate interest in preventing spam and misuse.

Details can be found in Google's privacy policy.

Reach measurement (Umami Cloud)

For simple reach measurement we use Umami Cloud, hosted in the EU. Umami collects aggregated usage statistics – such as page views, referring page, approximate region, device type and browser.

Umami works without cookies and stores no identifiers on your device. No cross-site profiles are built and no data is passed on to third parties for advertising purposes. Your IP address is not stored; it is only processed in order to derive anonymous metrics.

We have configured the tracker to be data-minimising on top of that: query strings and hash anchors are not transmitted, paths containing identifiers (such as credential or session IDs) are cleaned before they are sent, and your browser's Do Not Track setting is respected.

The purpose is to understand which content is used, so that we can improve the website. The legal basis is our legitimate interest in data-minimising performance measurement.

Cookies and local storage

The pages of this website do not set any cookies – neither our own nor third-party cookies for advertising or analytics purposes. That is also why you see no cookie banner here: there is no processing requiring consent to which you would have to consent.

The language selection likewise works without any storage: German, French, Italian and English each have their own path (/, /fr, /it, /en), and the language switcher is an ordinary link.

Only once you sign in to the Provara service (app.provara.ch) are strictly necessary cookies set – for the session, for protection against cross-site request forgery and for the chosen interface language. These belong to the service and are covered by the beta documents.

Overview of the services used

Complete list of the third-party services that may process data when you visit this website:

The website and the Provara service are hosted in Switzerland. We do not embed any further analytics, advertising or social media services.

Disclosure abroad

As shown in the table, some data is processed outside Switzerland – in the EEA (Zoho, Umami) and in the USA (Google reCAPTCHA).

For countries without an adequate level of data protection, we base the disclosure on the Standard Contractual Clauses approved by the European Commission and recognised by the Federal Data Protection and Information Commissioner (FDPIC), or on equivalent safeguards provided by the respective provider.

Retention and deletion

We retain personal data only for as long as the respective purpose requires or the law prescribes.

• Waitlist details: until the end of the beta phase or until you request deletion – at the latest, however, 24 months after the last contact.
• Server log files: The access logs are not archived, not exported and not merged with other data sources. They remain in the server's running log buffer, are continuously overwritten there and are deleted in full at the latest with the next update of the website.

Data security

The website is delivered exclusively encrypted via HTTPS and runs under a strict Content Security Policy. We take appropriate technical and organisational measures to protect personal data against unauthorised access, loss and misuse. Absolute security of data transmission over the internet cannot, however, be guaranteed by anyone.

Your rights

Within the framework of the applicable law, you have in particular the following rights:

• Information about whether and which personal data we process about you
• Rectification of incorrect data
• Deletion of data and restriction of processing
• Objection to processing and withdrawal of consent given – with effect for the future
• Release or transfer of the data you have provided, in a common format

An informal message to notify@provara.ch is sufficient to exercise them. To protect your data, we may request proof of identity.

You also have the right to lodge a complaint with a supervisory authority – in Switzerland with the Federal Data Protection and Information Commissioner (FDPIC), and in the EEA with the data protection authority responsible for you.

Changes to this policy

We may adapt this privacy policy if the website, the services used or the legal situation change. The version published on this page, bearing the date given above, is the one that applies.