Privacy policy

We protect your data.

General information / introduction

Based on Article 13 of the Swiss Federal Constitution and the federal data protection regulations (Federal Data Protection Act, nFADP), everyone has the right to privacy and protection against the misuse of their personal data. The operators of this website take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the statutory data protection regulations and this privacy policy.

In cooperation with our hosting providers, we strive to protect the databases as effectively as possible against unauthorized access, loss, misuse, or falsification.

Please note that data transmission over the Internet (e.g., communication by email) can have security vulnerabilities. Complete protection of data against access by third parties is not possible.

This website can generally be visited without registration. Data such as pages visited or names of accessed files, date and time, are stored on the server for statistical purposes, without this data being directly linked to you personally. Where personal data (e.g., name, address, or email addresses) is collected on our website, this is always done on a voluntary basis, where possible. We only pass it on to third parties where this privacy policy describes it or you have consented.

Controller

The controller responsible for processing your personal data on this website and in Effizo is:

Wolkenreich GmbH
Via da Fidaz 16a
7017 Flims Dorf
Switzerland

Email: info@effizo.ch

We have not appointed a data protection officer. For questions about data protection and to exercise your rights, write to us at info@effizo.ch.

Processing of personal data

Personal data is any information relating to an identified or identifiable natural person. A data subject is a person whose personal data is processed. Processing includes any operation performed on personal data, regardless of the means and procedures used, in particular the storage, disclosure, acquisition, erasure, retention, alteration, destruction, and use of personal data.

We process personal data in accordance with Swiss data protection law. Where and to the extent that the EU GDPR is applicable, we also process personal data on the following legal bases in conjunction with Article 6(1) GDPR:

We process personal data for the period necessary for the respective purpose(s). In the case of longer-term retention obligations due to legal and other obligations to which we are subject, we restrict processing accordingly.

Cookies

This website uses cookies. These are small text files that allow us to store specific, user-related information on the user’s device while they are using the website. Cookies make it possible, in particular, to determine the frequency of use and the number of users of the pages, to analyze user behavior patterns, and also to make our website more user-friendly. Cookies remain stored beyond the end of a browser session and can be retrieved when the website is visited again. If you do not wish this, you should configure your internet browser to refuse the acceptance of cookies.

A general objection to the use of cookies for online marketing purposes can be declared for many services, especially tracking, via the US website http://www.aboutads.info/choices or the EU website http://www.youronlinechoices.com. Furthermore, the storage of cookies can be prevented by deactivating them in your browser settings. Please note that in this case, not all functions of this website will be available.

With SSL/TLS encryption

This website uses SSL/TLS encryption for security reasons and to protect the transmission of confidential information, such as requests you send to us as the website operator. You can recognize an encrypted connection by the fact that the browser’s address bar changes from “http://” to “https://” and by the padlock icon in your browser’s address bar.

When SSL or TLS encryption is enabled, the data you transmit to us cannot be read by third parties.

Server log files

The provider of this website automatically collects and stores information in so-called server log files, which your browser automatically transmits to us. This information includes:

This data cannot be attributed to specific individuals. This data is not merged with other data sources. We reserve the right to review this data retrospectively if we become aware of concrete indications of unlawful use.

Newsletter

On our website you can subscribe to our newsletter. It occasionally contains tips on bookkeeping, VAT and tax for Swiss sole proprietorships, as well as news about Effizo.

To subscribe, we only need your email address. We use the double opt-in procedure: after subscribing, you receive an email with a confirmation link, and only once you have confirmed your subscription through it do we add your address to the mailing list. This way, nobody can subscribe someone else’s address. The confirmation link is valid for seven days. We delete an unconfirmed subscription at the latest when the same address is subscribed again. The “This wasn’t me” link in the confirmation email deletes it immediately.

As proof of your consent, we store your email address, the language you chose, the page on which you subscribed, the version of the consent text and the dates of subscription, confirmation and, where applicable, unsubscription. We do not store your IP address or information about your browser for this purpose. The legal basis is your consent (Art. 6 para. 1 lit. a GDPR). We use this data exclusively for the newsletter and do not pass it on to third parties, except to the service provider that sends the emails on our behalf (see “Sending emails – Postmark”).

You can withdraw your consent at any time: via the unsubscribe link in every email, via the unsubscribe function of your email program or by writing to support@effizo.ch. If you report one of our emails as spam, we also treat this as an unsubscription. After unsubscribing, you will no longer receive the newsletter. We keep your address as a suppression entry, so that we do not write to you again by mistake and can prove the withdrawal. If you would like us to delete this entry as well, a message to support@effizo.ch is enough.

Messages to customers

If you have opened an account in Effizo, we occasionally email you, as the account owner, about what is new in Effizo, about your subscription or about your trial. This also applies once your trial or subscription has expired. For this we use only your email address, your name, the language of your account and the details of your subscription.

The legal basis is our legitimate interest in informing our customers about our own offering (Art. 6 para. 1 lit. f GDPR); under Swiss law we rely on Art. 3 para. 1 lit. o UCA. Each of these emails contains a link to unsubscribe; you can also write to us at support@effizo.ch. After unsubscribing you will no longer receive such messages; emails needed to use Effizo, for example for signing in or for a payment, will still be sent to you.

We send these messages via Postmark (see “Sending emails – Postmark”), separately from the emails sent from Effizo. We do not analyse whether you open them or click on links in them. We only see in the subscriptions in Effizo itself whether someone takes out a subscription after a message.

Rights of the data subject

Right to confirmation

Every data subject has the right to obtain confirmation from the website operator as to whether or not personal data concerning him or her are being processed. If you wish to exercise this right of confirmation, you can contact us at any time (info@effizo.ch).

Right of access

Every data subject whose personal data are being processed has the right to obtain from the operator of this website, at any time and free of charge, information about the data stored concerning him or her and a copy of this information. Furthermore, information may be provided regarding the following:

In addition, the data subject has the right to be informed whether personal data are transferred to a third country or to an international organisation. Where this is the case, the data subject also has the right to be informed of the appropriate safeguards relating to the transfer.

If you wish to exercise this right of access, you can contact us at any time (info@effizo.ch).

Right to rectification

Every data subject has the right to request the immediate rectification of inaccurate personal data concerning them. Furthermore, taking into account the purposes of the processing, the data subject has the right to have incomplete personal data completed, including by means of providing a supplementary statement.

If you wish to exercise this right to rectification, you can contact us at any time (info@effizo.ch).

Right to erasure (right to be forgotten)

Every individual whose personal data are being processed has the right to request from the controller of this website the erasure of personal data concerning him or her without undue delay where one of the following grounds applies and the processing is no longer necessary:

If one of the above grounds applies and you wish to have your personal data stored by the operator of this website erased, you can contact us at any time (info@effizo.ch). We will comply with the erasure request without delay, as far as this is technically possible and no statutory retention obligation stands in the way (see section 8.3 of our GTC).

Right to restriction of processing

Every data subject has the right to request from the controller of this website the restriction of processing if one of the following conditions is met:

The data subject has objected to processing on grounds relating to his or her particular situation, and it is not yet clear whether the legitimate interests of the controller override those of the data subject.

If one of the aforementioned conditions applies, you can contact us at any time (info@effizo.ch) to request the restriction of the processing of your personal data. We will then restrict the processing.

Right to data portability

Every data subject has the right to receive the personal data concerning him or her in a structured, commonly used, and machine-readable format. Furthermore, the data subject has the right to have the personal data transmitted directly from one controller to another, where technically feasible and provided that this does not adversely affect the rights and freedoms of others.

To exercise your right to data portability, you can contact us at any time (info@effizo.ch).

Right to object

Every data subject has the right to object, on grounds relating to their particular situation, at any time to the processing of personal data concerning them.

In the event of an objection, the operator of this website will no longer process the personal data unless we can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or the processing serves the purpose of establishing, exercising or defending legal claims.

To exercise your right to object, you can contact us directly (info@effizo.ch).

Every data subject has the right to withdraw their consent to the processing of their personal data at any time.

If you wish to exercise your right to withdraw consent, you can contact us at any time (info@effizo.ch).

Right to lodge a complaint with the supervisory authority

As a data subject in Switzerland, you have the right to lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC) if you believe that your personal data is being processed in violation of Swiss data protection law. The FDPIC can be reached at: https://www.edoeb.admin.ch.

Objection to email marketing

We hereby object to the use of contact information published as part of our legal notice for sending unsolicited advertising and informational materials. The operators of this website expressly reserve the right to take legal action in the event of unsolicited advertising, such as spam emails.

To provide our paid services, we ask for additional data, such as payment details, in order to carry out your order. We keep the details of your payments to us until the statutory retention periods have expired (as a rule ten years, Art. 958f CO).

The data you enter in Effizo, such as receipts, invoices and entries, is kept for as long as your account exists. After your subscription or trial has ended, we may delete it after six months (section 4.7 of our GTC); you are responsible for keeping your own books. Whatever you delete in Effizo disappears from the application but remains stored in the history of your accounts and in our backups (section 8.3 of our GTC).

The copyright and all other rights to the content, images, photos, or other files on this website belong exclusively to the operator of this website or the named copyright holders. Prior written consent from the copyright holders is required for the reproduction of any files.

Anyone who commits copyright infringement without the consent of the respective copyright holders may be liable to prosecution and may, under certain circumstances, claim damages.

Disclaimer

All information on our website has been carefully reviewed. We strive to ensure that the information we provide is current, accurate, and complete. However, errors cannot be entirely ruled out, and therefore we cannot guarantee the completeness, accuracy, or timeliness of the information, including journalistic and editorial content. Liability claims relating to material or immaterial damages caused by the use or non-use of the information provided, or by the use of incorrect or incomplete information, are generally excluded.

The publisher may change or delete texts at its sole discretion and without prior notice and is under no obligation to update the content of this website. Use of or access to this website is at the visitor’s own risk. The publisher, its clients, or partners are not responsible for damages, such as direct, indirect, incidental, or consequential damages, allegedly caused by visiting this website and therefore assume no liability for such damages.

The publisher also assumes no responsibility or liability for the content and availability of third-party websites that can be accessed via external links from this website. The operators of the linked sites are solely responsible for their content. The publisher therefore expressly distances itself from all external content that may be criminally or civilly liable or that violates common decency.

Hosting – Google Cloud

This website and Effizo run on Google Cloud Platform, provided by Google Cloud EMEA Limited, Dublin, Ireland. We use data centres in the Zurich region; the data you enter in Effizo is also stored there. Google processes the data on our behalf. When you visit the website, the information listed under “Server log files” is processed in the course of this.

The legal basis is our legitimate interest in providing our services securely and reliably (Art. 6 para. 1 lit. f GDPR). Access from outside Switzerland, for example by Google’s support, cannot be ruled out; it is based on the European Commission’s Standard Contractual Clauses. Further information can be found at https://cloud.google.com/privacy.

Google Analytics

This website uses Google Analytics 4 (GA4), a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. If the party responsible for data processing is located outside the European Economic Area or Switzerland, the processing is carried out by Google LLC. Google LLC and Google Ireland Limited are referred to below as “Google”. Google Analytics is integrated via Google Tag Manager (see the “Google TagManager” section).

The legal basis for the use of Google Analytics is your consent (Art. 6 para. 1 lit. a GDPR); under Swiss data protection law we likewise rely on your consent. You give it through our cookie banner by enabling the “Analytics” category and confirming your selection. Without your consent, no analytics cookies are set and no analytics data is transmitted to Google: we use Google Consent Mode, which only permits Google Analytics to store or read data on your device once you have agreed. You can withdraw your consent at any time with effect for the future, via the “Cookie settings” link in the footer of every page. This does not affect the lawfulness of the processing carried out up to the point of withdrawal.

Google Analytics processes in particular the pages you access and when, the time spent on them, the language used, information about your device and browser, and the website from which you reached us. Your IP address is used by Google Analytics 4 solely to determine your approximate location, generally at country or region level, and is neither logged nor stored in the process. We use neither the “User-ID” feature nor any cross-device consolidation of your usage.

Google Analytics uses cookies that are stored on your device, including “_ga” and “ga”. Their lifetime is generally two years. The event data and user data collected are deleted in Google Analytics after 14 months; for user data, this period starts again whenever the same person is active again.

Google processes the data on our behalf in order to evaluate your use of the website and to compile reports on website activity. Data may also be transferred to the USA in the process. Google bases such transfers on the Standard Contractual Clauses of the EU Commission (SCC) and is certified under the EU-US Data Privacy Framework.

Independently of our cookie banner, you can prevent collection by Google Analytics across your entire browser by installing the opt-out add-on provided by Google: https://tools.google.com/dlpage/gaoptout. Further information on how user data is handled in Google Analytics can be found in Google’s privacy policy: https://policies.google.com/privacy

User account and sign-in

For signing in to Effizo we run our own sign-in service (Keycloak) in the same data centres in Zurich as Effizo itself (see “Hosting – Google Cloud”). It stores your email address, your first and last name, the language of your account and your password, the latter only as a hash value from which it cannot be recovered. When you register, you confirm your email address via a link we send you. If you are invited to a company, your address counts as confirmed by the invitation link.

The legal basis is the performance of our contract with you (Art. 6 para. 1 lit. b GDPR). The web app at app.effizo.ch and the sign-in pages load no fonts and no analytics or advertising services from third parties. The only exception is Stripe’s payment form, which the web app loads while you pay for a subscription (see “Payments – Stripe”).

Google Tag Manager

Google Tag Manager is a solution that allows us to manage so-called website tags via an interface. We use it exclusively to integrate Google Analytics (see the “Google Analytics” section). When the Tag Manager loads, your browser transmits your IP address to Google; the Tag Manager itself sets no cookies and does not analyse any data. Terms of use: https://www.google.com/intl/de/tagmanager/use-policy.html.

Payments – Stripe

When you pay for your Effizo subscription, we process the payment via Stripe. You enter your payment details, such as your card number, directly with Stripe; we do not receive them, only the confirmation of whether the payment was accepted or declined, along with the details of your subscription. Stripe also processes the data for fraud prevention and may transfer it to the USA; Stripe bases such transfers on appropriate safeguards such as the European Commission’s Standard Contractual Clauses.

The legal basis is the performance of the contract with you (Art. 6 para. 1 lit. b GDPR). Further information can be found in Stripe’s privacy policy: https://stripe.com/ch/privacy

Sending emails – Postmark

We send emails from Effizo, the emails relating to the newsletter subscription and our messages to customers via Postmark, a service of AC PM LLC, 1 North Dearborn Street, 5th Floor, Chicago, IL 60602, USA, a company of the ActiveCampaign group. This includes the invoices and payment reminders you send to your customers with Effizo. For this purpose, Postmark receives the sender’s and recipient’s addresses, the content of the email and any attachments, and processes them on our behalf. Postmark reports back to us whether an email could be delivered. The transfer to the USA is based on the European Commission’s Standard Contractual Clauses, which form part of Postmark’s data processing agreement. Receipts you send by email to your Effizo address also reach us via Postmark; Postmark forwards them to Effizo together with the sender, subject and attachments.

For the newsletter and the messages to customers, we do not analyse whether you open our emails or click on links in them; the corresponding tracking is switched off at Postmark. If you unsubscribe, Postmark keeps your address on a suppression list so that you receive no further such emails. If we later use a different service provider for these emails, we will update this section beforehand.

Social media presence

Effizo has its own pages on Facebook (https://www.facebook.com/effizo.ch), Instagram (https://www.instagram.com/effizo.ch) and LinkedIn (https://www.linkedin.com/company/effizo). This website only links to them; it does not embed any plugins, like buttons or tracking pixels from these networks. Only when you follow a link do you reach the platform, and its privacy policy then applies.

If you visit one of our pages, the respective operator processes your data, such as your IP address, information about your device and browser, and your interactions such as likes, comments or shared posts, even if you do not have an account there. The operators analyse this data for advertising purposes, among others, and may transfer it to the USA. We have no influence over this.

From this data, the operators compile statistics on the use of our pages (Page Insights) and make them available to us. We only see aggregated figures, such as how many people have seen a post, and cannot attribute them to any individual. Where the GDPR applies, we are jointly responsible with the respective operator for these statistics:

We operate these pages to make Effizo known and to get in touch with interested people; this is our legitimate interest (Art. 6 para. 1 lit. f GDPR). You can exercise your rights most effectively directly with the respective operator, as only they have access to your data. However, you can also contact us (info@effizo.ch); we will forward your request.

Operators’ privacy policies: Facebook https://www.facebook.com/privacy/policy, Instagram https://privacycenter.instagram.com/policy, LinkedIn https://www.linkedin.com/legal/privacy-policy

Contractual services

We process the data of our contractual partners and prospective clients, as well as other clients, customers, or contractual partners (collectively referred to as “contractual partners”), in accordance with the data protection provisions of the Swiss Federal Act on Data Protection (FADP) and the EU General Data Protection Regulation (GDPR) pursuant to Art. 6 para. 1 lit. b GDPR, in order to provide them with our contractual or pre-contractual services. The data processed in this context, its type, scope, and purpose, as well as the necessity of its processing, arise from the underlying contractual relationship. The processed data includes our contractual partners’ master data (e.g., names and addresses), contact details (e.g., email addresses and telephone numbers), contract data (e.g., services used, contract content, contract communication, names of contact persons), and payment data (e.g., amounts paid, payment date and payment method). We generally do not process special categories of personal data unless they are part of order or contract processing.

We process data that is necessary for establishing and fulfilling contractual obligations and point out the necessity of its disclosure unless this is obvious to the contractual partners. Disclosure to external persons or companies only occurs if required within the scope of a contract. When processing data entrusted to us within the scope of an order, we act in accordance with the instructions of the client and the applicable legal provisions.

When using our online services, we may store the IP address and the time of the respective user action. This storage is based on our legitimate interests and the interests of users in protection against misuse and other unauthorized use. As a general rule, this data will not be disclosed to third parties unless disclosure is necessary for the enforcement of our claims pursuant to Article 6(1)(f) GDPR or there is a legal obligation to do so pursuant to Article 6(1)(c) GDPR.

Data will be deleted when it is no longer required for the fulfillment of contractual or legal obligations, as well as for the processing of any warranty claims or similar obligations. The necessity of retaining the data is reviewed periodically. Statutory retention periods also apply.

Administration, accounting, etc.

We process data in accordance with the data protection regulations of the Swiss Confederation (Federal Act on Data Protection, FADP) and the EU GDPR within the scope of administrative tasks, the organization of our business, financial accounting, and the fulfillment of legal obligations, such as archiving. In doing so, we process the same data that we process in the context of providing our contractual services. The legal bases for this processing are Art. 13 para. 1 FADP, Art. 6 para. 1 lit. c GDPR, and Art. 6 para. 1 lit. f GDPR. Customers, prospective customers, business partners, and website visitors are affected by this processing. The purpose of and our legitimate interest in the processing lies in administration, financial accounting, office organization, and data archiving—i.e., tasks that serve to maintain our business operations, fulfill our obligations, and provide our services. The deletion of data relating to contractual services and contractual communication is carried out in accordance with the data specified in these processing activities.

In this context, we disclose or transmit data to the tax authorities, advisors such as tax consultants or auditors, as well as other fee-collecting agencies and payment service providers.

Furthermore, due to our legitimate business interests, we store information about suppliers, event organizers, and other business partners, for example, for the purpose of future contact. This mostly company-related data is generally stored permanently.

Use of artificial intelligence

Effizo reads the receipts and bank statements you upload, photograph or send by email using artificial intelligence (AI): for example the supplier, date, amount, VAT and payments. To do this, we send the document to an AI provider, which analyses it on our behalf and returns the result to us. A receipt may contain personal data, for example names and addresses on an invoice or payment details on a bank statement.

We currently use Anthropic. We keep OpenAI as an alternative; we can switch the analysis to OpenAI at any time, for example if Anthropic is unavailable. Both providers process the documents only to give us the result and, under their terms for the programming interface, do not use them to train their models.

OpenAI

We use services provided by OpenAI, LLC, 3180 18th St, San Francisco, CA 94110, USA (“OpenAI”). OpenAI processes data in compliance with appropriate safeguards for third-country transfers (Standard Contractual Clauses pursuant to Art. 46 GDPR). For more information, please refer to OpenAI’s privacy policy at: https://openai.com/policies/privacy-policy.

Anthropic

We use services provided by Anthropic, PBC, 548 Market St, PMB 90375, San Francisco, CA 94104, USA (“Anthropic”). Anthropic processes data in compliance with appropriate safeguards for third-country transfers (Standard Contractual Clauses pursuant to Art. 46 GDPR). For more information, please refer to Anthropic’s privacy policy at: https://www.anthropic.com/legal/privacy.

The legal basis is the performance of our contract with you (Art. 6 para. 1 lit. b GDPR): the analysis takes place only when you submit a document and serves only to record it for you.

Data transfer to the USA

Our website uses tools from companies based in the USA. When these tools are active, your personal data may be transferred to the US servers of the respective companies. Please note that the USA is not considered a safe third country under EU data protection law. US companies are obligated to disclose personal data to security authorities without you, as the data subject, having any legal recourse. Therefore, it cannot be ruled out that US authorities (e.g., intelligence agencies) may process, analyze, and permanently store your data located on US servers for surveillance purposes. We have no control over these processing activities.

Changes

We may amend this Privacy Policy at any time without prior notice. The current version published on our website applies. If the Privacy Policy is part of an agreement with you, we will inform you of any updates by email or other suitable means.

Disclaimer

The author assumes no liability for the accuracy, completeness, or timeliness of the information provided.

Liability claims against the author for damages of a material or immaterial nature arising from access to or use or non-use of the published information, from misuse of the connection, or from technical malfunctions are excluded.

All offers are subject to change without notice. The author expressly reserves the right to change, supplement, or delete parts of the pages or the entire website without prior notice, or to temporarily or permanently discontinue publication.