Privacy Policy

The data controller responsible for sevensprings.ch and the Swiss Payroll Expert (SPE) service is:

SevenSprings Technology AG processes personal data in accordance with the Swiss Federal Act on Data Protection (nFADP / revDSG) and, where applicable, the EU General Data Protection Regulation (GDPR).

The Swiss Payroll Expert (SPE) is an AI-powered advisory companion designed for payroll and HR professionals in Switzerland. SPE provides tailored, context-aware guidance on Swiss payroll regulations, social insurance, tax obligations, and HR compliance.

SPE is not a payroll calculation engine. It acts as a knowledgeable advisor — helping professionals navigate complex regulatory questions, draft correspondence, and interpret legal requirements — rather than executing payroll calculations or storing employee records.

Because SPE operates as an advisory tool, it is not designed or intended to collect, store, or process personal data about employees or third parties.

When you visit sevensprings.ch, the following categories of personal data may be collected:

Contact Form Submissions

If you submit our contact form, we collect your first name, last name, email address, company name (optional), and the content of your message. This data is used solely to respond to your enquiry. It is stored in our database and forwarded to our team by email. We do not share it with third parties except as required to deliver the service (e.g. our email infrastructure provider).

Resource Download Registrations

If you register to download a resource (e.g. a whitepaper), we collect your name, email address, and company details. This information is used to provide the requested resource and, with your consent, to inform you of related services.

Server & Access Logs

Our hosting infrastructure automatically records standard server logs, including IP addresses, browser type, operating system, referring URL, pages visited, and timestamps. These logs are retained for up to 1 month for security monitoring, abuse prevention, and reliability analysis, and are then automatically deleted. They are not used for profiling or advertising.

Analytics

We may use privacy-respecting analytics tools to understand aggregate visitor behaviour (e.g. page views, session duration, country of origin). Where used, analytics data is anonymised or pseudonymised and is not linked to identifiable individuals. No personal profile is built or sold.

The following data may be processed as part of normal SPE service operation:

Account & Authentication Data

When accessing SPE through Microsoft AppSource or Azure Marketplace, your Microsoft account identity (email address, display name, tenant ID) is used for authentication and licence validation. This data is processed under Microsoft's own privacy policies and is not stored independently by SevenSprings beyond what is necessary for licence management.

Conversation / Query Content

The text of your queries is processed to generate responses. Queries are transmitted to the AI model provider (Microsoft Azure OpenAI) for processing. We recommend anonymising queries before submission (see Section 08). Query content is not persisted beyond the active session unless explicitly saved by the user within the application.

Usage & Diagnostic Data

Standard service logs (timestamps, session identifiers, error codes) are retained for up to 1 month for reliability monitoring and are then automatically deleted. These logs do not contain the content of your queries.

SPE is not designed to collect personal data relating to employees or third parties. Specifically, SPE does not intentionally collect, request, or process:

• Employee names, dates of birth, or national identification numbers (AHV/AVS numbers)
• Salary figures, bank account details, or payslip data
• Tax identification numbers or social insurance records
• Health data, disability status, or other sensitive personal attributes
• Family or dependent information

If personal data is inadvertently included in a query, SPE will use it solely to answer that question and will not retain it beyond the active session.

Purposes of Processing

Personal data collected through our website and services is used for the following purposes:

• Service delivery — responding to enquiries, providing the SPE AI advisory service, and managing licences.
• Security & fraud prevention — monitoring server logs to detect and prevent unauthorised access.
• Service improvement — analysing anonymised usage data to improve reliability and user experience.
• Legal compliance — meeting obligations under Swiss law, GDPR, and other applicable regulations.
• Marketing communications — only where you have explicitly consented; you may opt out at any time.

Who Has Access to Your Data

Access to personal data is limited to SevenSprings Technology AG personnel who require it for the purposes listed above. We engage the following categories of third-party data processors, all bound by data processing agreements and appropriate safeguards:

• Microsoft Corporation — authentication (Microsoft Entra ID / Azure AD), marketplace licensing (AppSource / Azure Marketplace), and AI model processing (Azure OpenAI Service). Data processed under Microsoft's Privacy Statement.
• Cloud hosting provider — our application is hosted on infrastructure located in Switzerland or the European Economic Area.
• Email infrastructure provider — used to deliver contact form notifications and service communications.

We do not sell, rent, or trade personal data to third parties. We do not share personal data with advertising networks or data brokers.

International Transfers

Where personal data is transferred outside Switzerland or the EEA (e.g. to Microsoft Azure datacentres), such transfers are governed by Standard Contractual Clauses (SCCs) or equivalent safeguards approved under Swiss and EU data protection law.

Our website uses cookies and similar technologies to ensure basic functionality and to understand how visitors interact with our pages. We do not use cookies for advertising, behavioural profiling, or cross-site tracking.

What Are Cookies?

Cookies are small text files placed on your device by a website. They allow the site to remember information about your visit (e.g. your language preference or session state) for a period of time.

Cookies We Use

Third-Party Cookies

We do not embed third-party advertising or social-media tracking scripts. Where we use third-party analytics services, they are configured to anonymise IP addresses and not to build individual profiles.

How to Control Cookies

You can control and delete cookies through your browser settings. Most browsers allow you to:

• View cookies stored on your device and delete them individually or in bulk.
• Block third-party cookies.
• Block cookies from specific sites.
• Block all cookies from being set.
• Delete all cookies when you close your browser.

Please note that disabling strictly necessary cookies may affect website functionality. For guidance on managing cookies, visit allaboutcookies.org.

Where personal data is processed, we rely on the following legal bases under Swiss nFADP and, where applicable, GDPR Art. 6:

• Contractual necessity — processing required to deliver the SPE service to licensed users and to respond to contact form enquiries.
• Legitimate interests — operational logging for service reliability, security monitoring, and fraud prevention.
• Consent — for optional marketing communications, feature announcements, and non-essential analytics cookies, where applicable. Consent may be withdrawn at any time.
• Legal obligation — where processing is required to comply with applicable Swiss or EU law.

All data processed by SevenSprings Technology AG is stored in Switzerland or within the European Economic Area. We apply industry-standard security controls including:

• Encryption of data at rest and in transit (TLS 1.2+)
• Role-based access controls limiting data access to authorised personnel
• Regular security reviews and vulnerability assessments
• Incident response procedures in line with nFADP/GDPR requirements

Retention periods:

• Server / diagnostic logs: retained for 1 month, then automatically deleted.
• Contact form data: retained for up to 2 years to manage ongoing correspondence, then deleted unless legal obligations require longer retention.
• Account data: retained for the duration of the subscription and deleted within 30 days of subscription termination.
• Conversation content (SPE): not persisted beyond the active session unless explicitly saved by the user within the application.
• Analytics data: retained in anonymised / aggregated form for up to 13 months.

Under Swiss nFADP (and GDPR where applicable), you have the following rights regarding your personal data:

• Access — obtain confirmation of whether we hold data about you and receive a copy.
• Rectification — request correction of inaccurate or incomplete data.
• Erasure — request deletion of your personal data, subject to legal retention obligations.
• Restriction — request that we limit processing in certain circumstances.
• Data portability — receive your data in a structured, machine-readable format.
• Objection — object to processing based on legitimate interests.
• Withdraw consent — where processing is based on consent, withdraw it at any time without affecting prior processing.

To exercise any of these rights, contact us using the details in Section 12. We will respond within 30 days.

You also have the right to lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC) at www.edoeb.admin.ch, or with the supervisory authority in your EU member state of residence.

For any privacy-related questions, to exercise your data subject rights, or to report a concern, please contact our Data Protection Officer:

This Privacy Policy was last updated in August 2026. We reserve the right to update it to reflect changes in our services or applicable law. Material changes will be communicated via the application or our website.