ATESO GmbH (hereinafter referred to as the “Provider”, “we” or “us”) is the author of this Privacy Policy. This Privacy Policy applies to all users of the Provider’s services insofar as personal data are processed in connection therewith. This includes, in particular, customers who have concluded a contract with the Provider for the Provider’s services, their employees and website visitors. In addition, the Provider may declare this Privacy Policy applicable to other contractual partners on a contractual basis. For the sake of simplicity, all persons affected by data processing are hereinafter referred to as “Customers”. Personal data or “Data” means all information relating to an identified or identifiable person.
The Provider is committed to handling its Customers’ personal information carefully and conscientiously. The Provider is responsible for collecting, processing, disclosing, storing and protecting its Customers’ personal information and ensures compliance with applicable data protection legislation.
If you provide us with personal data of other persons, please ensure that these persons are aware of this Privacy Policy and only provide us with their personal data if you are permitted to do so and if such personal data are accurate.
1. Contact Details
The controller responsible for data processing is:
ATESO GmbH, Blumenstrasse 40a, 8500 Frauenfeld, Switzerland
The Data Protection Officer can be reached at legal@ateso.ch.
2. Applicable Law
This Privacy Policy is designed to meet the requirements of the Swiss Data Protection Act (“revDSG”) and the EU General Data Protection Regulation (“GDPR”). Whether and to what extent these laws apply, however, depends on the individual case.
3. Type and Scope of Collection of Personal Data
General
We primarily process the personal data that we receive from our Customers and other business partners and other persons involved in the context of our business relationship with them, or that we collect from users when operating our websites, apps and other applications.
Where permitted, we also obtain certain data from publicly accessible sources (e.g. debt enforcement registers, land registers, commercial registers, the press, the Internet) or receive such data from other partner companies, authorities and other third parties. In addition to the data you provide to us directly, the categories of personal data that we receive about you from third parties include, in particular, information from public registers, information we learn in connection with official and court proceedings, information in connection with your professional functions and activities (so that we can, for example, conclude and execute transactions with your employer with your help), information about you in correspondence and discussions with third parties, credit information (where we conduct business with you personally), information about you provided to us by persons in your environment (family, advisers, legal representatives, etc.) so that we can conclude or execute contracts with you or involving you (e.g. references, your delivery address, powers of attorney, information on compliance with legal requirements such as anti-money laundering and export restrictions, information from banks, insurers, sales and other contractual partners of ours regarding your use or provision of services (e.g. payments made, purchases made), information from media and the Internet about you (where indicated in the specific case, e.g. in the context of an application, press review, marketing/sales, etc.), your addresses and, where applicable, interests and other sociodemographic data (for marketing), data in connection with the use of the website (e.g. IP address, MAC address of the smartphone or computer, information about your device and settings, cookies, date and time of the visit, pages and content accessed, functions used, referring website, location information).
Visiting Our Website
When Customers visit the Provider’s online presence outside the login-protected area, the web server technology used automatically logs general technical visit information. This includes, among other things, the IP address of the device used, which is anonymised by Google before being stored so that it can no longer be associated with the Customer. It also includes information about the browser type, Internet Service Provider and operating system used.
Use of ATESO Software Solutions
The Provider operates various software solutions such as the ATESO Portal, Exeoflow, ExeoAI, ExeoDocs, ExeoExpense, ExeoCRM, ExeoTime, ExeoTranscribe, ExeoAssistant and other software products (hereinafter referred to as “ATESO Solution”). During free trial access as well as paid use of the ATESO Solution within the login-protected area, all data entered or submitted by the Customer during the registration process and in the context of using the software are also stored. This is particularly the case when the Customer registers, places orders, completes online forms, participates in surveys or competitions, corresponds with the Provider online or offline, or interacts with the Provider via social media, blogs or other interactive media.
As a rule, personal master data (name, address, email address) as well as the settings required for the respective service are collected here.
By entering data, the Customer consents to the processing, use and disclosure of personal data for the purposes described in this Privacy Policy, within the scope and extent described herein.
Data Exchange with Third Parties
The Customer has the option of sharing their data with third parties, e.g. their personal fiduciary or other external users defined by them. By granting access rights, the Customer declares their consent for the Provider to make all data of the respective Customer available to third parties (e.g. the fiduciary or other external users) or to permit access thereto. The Customer retains full control over the third party’s access rights to their data at all times and may restrict or deny access at any time.
In addition, the Provider enables the third party to open an account of the ATESO Solution as a Customer themselves. In this case, the third party, as a Customer, manages the access rights and may grant, restrict or deny them to other third parties. However, the Provider reserves the right to disclose specific data to authorised third parties in justified individual cases.
Modules of ATESO Software Solutions
When using the Provider’s optional software modules (e.g. the CRM, employee or time recording module), personal data of the Customer’s employees are partly transmitted to the Provider. The Provider handles these data with appropriate care and ensures their security in accordance with the standards set out in this Privacy Policy. By using them, the Customer declares their consent and releases the Provider from any potential claims. Obtaining the employees’ consent is the Customer’s responsibility. The Customer further declares that they bear sole responsibility for informing their employees about the possible storage, use, processing and disclosure of data by the Provider in accordance with the guidelines in this Privacy Policy. Should individual employees of the Customer not agree to the intended data processing, the Customer is responsible for deleting the relevant data of their employees accordingly in their ATESO Solution cloud.
App Marketplace / Third-Party Add-ons
The Provider makes an interface (“API”) available to the Customer for communication with third-party software. This enables the Customer to integrate various additional packages or offers from third-party providers (“Add-ons”) beyond the ATESO Solution. The Customer may order various Add-ons in the Provider’s App Marketplace. Furthermore, the Customer may grant additional third-party providers authorisation to use the interface to their ATESO Solution account. Unless expressly agreed otherwise, a contractual relationship regarding the use of third-party Add-ons arises exclusively between the Customer and the third-party provider.
If access rights are required for the use of an Add-on, by ordering or integrating the Add-on, the Customer expressly agrees to grant all access rights necessary for this purpose. The Provider is then entitled to make all Customer data necessary for using the Add-on available or to permit access thereto. The Customer retains full control over the third-party provider’s access rights to their data at all times and may restrict or deny access at any time. The Customer agrees that the Provider or the third-party provider may exchange data with that third-party provider when using additional Add-ons.
By ordering the Add-on, the Customer declares their agreement to the General Terms and Conditions and the Privacy Policy of the respective third-party provider. The Provider assumes no responsibility for the third-party provider’s data processing.
Consulting Services from Third-Party Providers
The Provider offers its Customers consulting services from third-party providers. In order for the third-party provider to verify the Customers’ authorisation and have the necessary contact details, the following data, among others, are transmitted to the third-party provider: name / company name; address (street, postcode, city, address additions); concluded contracts between the Provider and the Customer; telephone number(s); email address(es). In all other respects, reference is made to the Privacy Policy of the respective third-party providers in its currently valid version.
Additional Partner Functions
When using any other optional partner functions of the Provider or when connecting the Customer’s own account to a partner, data are exchanged between the Provider and the relevant partner.
4. Purposes of Data Processing and Legal Basis
For controllers based in Switzerland, the permissibility of processing is governed by the principles of Art. 6 revDSG and the grounds for justification under Art. 31 revDSG. The “legitimate interest” mentioned below is relevant as an independent legal basis only insofar as the GDPR applies to EU data subjects.
We primarily use the personal data we collect to conclude and execute our contracts with our Customers and business partners, in particular in the context of the ATESO Portal, Exeoflow and Software as a Service services for our Customers, and to purchase products and services from our suppliers and subcontractors, as well as to comply with our legal obligations in Switzerland and abroad. If you work for such a Customer or business partner, you may naturally also be affected in this capacity with your personal data.
Furthermore, we process personal data concerning you and other persons, where permitted and where we consider it appropriate, also for the following purposes, in which we (and sometimes also third parties) have a legitimate interest corresponding to the purpose:
- Offering and further developing our offerings, services and websites, apps and other platforms on which we are present;
- Communicating with third parties and handling their enquiries (e.g. applications, media enquiries);
- Reviewing and optimising procedures for needs analysis for the purpose of direct customer contact, as well as collecting personal data from publicly accessible sources for customer acquisition;
- Advertising and marketing (including holding events), provided that you have not objected to the use of your data (if we send you advertising as an existing Customer, you may object at any time, and we will then place you on a blocking list to prevent further advertising mailings);
- Market and opinion research, media monitoring;
- Asserting legal claims and defence in connection with legal disputes and official proceedings;
- Preventing and investigating criminal offences and other misconduct (e.g. conducting internal investigations, data analyses to combat fraud, complying with official instructions and orders);
- Ensuring our operations, in particular our IT, our websites, apps and other platforms;
- Video surveillance to safeguard domiciliary rights and other measures for IT, building and facility security and the protection of our employees and other persons and assets owned by or entrusted to us (such as access controls, visitor lists, network and email scanners, telephone recordings);
- Purchase and sale of business units, companies or parts of companies and other corporate transactions, including the transfer of personal data in connection therewith, as well as measures for business management and to the extent necessary to comply with legal and regulatory obligations and internal rules.
Where you have given us consent to process your personal data for specific purposes (for example, when registering to receive newsletters or conducting a background check), we process your personal data within the scope of and based on that consent, unless we have another legal basis and require one. Consent that has been granted may be withdrawn at any time, although this has no effect on data processing already carried out.
5. Disclosure of Personal Data
In the course of our business activities and for the purposes set out above, where permitted and where we consider it appropriate, we also disclose personal data to third parties, either because they process them for us or because they wish to use them for their own purposes. This concerns, in particular, the following entities:
- Our service providers (internally and externally, such as payment processors), including processors (such as IT providers);
- Dealers, suppliers, subcontractors and other business partners;
- Buyers or prospective buyers of business units, companies or other parts of the Provider;
- Other parties in possible or actual legal proceedings;
- Collectively referred to as “Recipients”.
These Recipients are primarily located in Switzerland but may also be located abroad. In particular, you must expect your data to be transferred to all European countries and the USA, where the service providers we use are located (such as Microsoft, Google, etc.). In particular, the Provider has certain data processing carried out by service providers commissioned in compliance with data protection laws that are based in the EU or Switzerland. These include, in particular, companies in the categories of IT services, printing service providers, billing, debt collection and consulting, as well as sales and marketing and service providers engaged within the framework of processing relationships.
If a Recipient is located in a country without adequate statutory data protection, we contractually oblige the Recipient to comply with applicable data protection law (for this purpose, we use the revised standard contractual clauses of the European Commission), unless it is already subject to a legally recognised framework for ensuring data protection and we cannot rely on an exemption. An exemption may apply in particular to legal proceedings abroad, but also in cases of overriding public interests or where the performance of a contract requires such disclosure, where you have consented, or where the data have been made generally accessible by you and you have not objected to their processing.
Standard Contractual Clauses of the European Commission
7. Cookies
Cookies help make visits to the Provider’s website easier, more convenient and more meaningful. Cookies are information files that the web browser automatically stores on the computer’s hard drive when the Customer visits the Provider’s website and uses its offerings.
The Customer can independently manage the security settings in the browser and thereby block or deactivate the cookies used, although certain Provider services may no longer be usable (in full).
Tracking and Analysis Tools / Social Media
Use of the Provider’s digital offerings is measured and evaluated using various technical systems, predominantly from third-party providers such as Google Analytics. These measurements may be conducted both anonymously and on a personal basis. It is possible that the data collected may in turn be disclosed by the Provider or the third-party providers of such technical systems to third parties in Switzerland and abroad for processing. The most frequently used and best-known analysis tool is Google Analytics, a service provided by Google Inc. The data collected may generally be transmitted to a Google server in the USA (or a location determined by Google).
The Provider’s website uses Google Analytics, a web analytics service provided by Google Inc., located at 1600 Amphitheatre Parkway, Mountain View, CA 94043, U.S.A. (“Google”). Google Analytics uses so-called cookies, text files that are stored on the Customer’s computer and enable analysis of their use of the website. The information generated by the cookies about use of the website (including the IP address, which is anonymised by Google before being stored so that it can no longer be associated with the Customer) is transmitted to and stored on a Google server in the USA (or a location determined by Google). Google will use this information to evaluate use of the website, compile reports on website activities for the Provider and provide other services associated with website and Internet use. Google may also transfer this information to third parties where required by law or where third parties process these data on Google’s behalf. Under no circumstances will Google associate Customers’ IP addresses with other Google data.
The Provider’s website uses the “demographic features” function of Google Analytics. This enables reports to be created that contain information on the age, gender and interests of Customers. These data originate from Google’s interest-based advertising and from visitor data from third-party providers. These data cannot be assigned to a specific person. Customers may deactivate this function at any time via the advertising settings in their Google account or generally prohibit Google Analytics from collecting their data.
If the Customer does not want their website activities to be available for Google Analytics, they can install the browser add-on to deactivate Google Analytics:
Browser Add-on to Deactivate Google Analytics
This prevents activity data from being shared with Google Analytics via JavaScript executed on websites (ga.js, analytics.js and dc.js). Analysis of data by other tools of the website owner is not prevented when the Customer uses the add-on. Data may still be sent to the website or to other web analytics services.
Finally, the Provider collects certain information through its website in so-called server log files, which the Customer’s Internet browser automatically transmits. This includes, among other things, the user agent (browser type and browser version, operating system used), http header information (referrer URL, IP address of the accessing computer), the time of the server request and login status. These server log files are combined with other data sources only for error analysis.
Technologies for Advertising Purposes
The Provider’s website uses the functions of Google Analytics Remarketing in conjunction with the cross-device functions of Google AdWords and Google DoubleClick. The provider is Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (“Google”).
This function enables the advertising target groups created with Google Analytics Remarketing to be linked with the cross-device functions of Google AdWords and Google DoubleClick. In this way, interest-based, personalised advertising messages that have been adapted to the Customer depending on their previous use and browsing behaviour on one device (e.g. mobile phone) can also be displayed on another device (e.g. tablet or PC).
If the Customer has given Google the relevant consent, Google links their web and app browsing history with their Google account for this purpose. In this way, the same personalised advertising messages can be displayed on every device on which the Customer logs into their Google account. To support this function, Google Analytics collects Google-authenticated user IDs, which are temporarily linked with the Provider’s Google Analytics data in order to define and create target groups for cross-device display advertising.
The Customer may permanently object to cross-device remarketing by deactivating personalised advertising in their Google account:
Deactivation of Personalised Advertising
Further information can be found in Google’s Privacy Policy at:
The Provider’s website also uses the Google AdWords online advertising programme. The provider is Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Within the scope of Google AdWords, the Provider uses what is known as conversion tracking. When the Customer clicks on an advertisement placed by Google, a cookie for conversion tracking is set. Cookies are small text files that the Customers’ Internet browser stores on their computer. These cookies expire after 30 days at the latest and are not used for identification purposes. If the Customer visits our website and the cookie has not yet expired, Google and the Provider can recognise that the Customer clicked on the advertisement and was redirected to this page.
The Provider learns from Google the total number of users who clicked on its advertisement and were redirected to its website equipped with a conversion tracking tag. However, the Provider does not receive any information that can be used to personally identify the Customer. The Customer can prevent cookies from being stored by selecting the appropriate settings in their browser software. However, the Provider informs the Customer that they may then not be able to use all functions of this website in full. The Customer may also prevent tracking by deactivating the Google Conversion Tracking cookie in their Internet browser under user settings.
For further information, reference is made to Google’s Privacy Policy:
The Provider’s website additionally uses the Facebook visitor action pixel, provided by Facebook Inc., 1601 S. California Ave, Palo Alto, CA 94304, USA. The Facebook Pixel can track the behaviour of page visitors after they have been redirected to the Provider’s website by clicking on a Facebook advertisement. This makes it possible to evaluate the effectiveness of Facebook advertisements for statistical and market research purposes and to optimise future advertising measures.
The data collected are anonymous to the Provider. The Provider cannot draw any conclusions about the identity of the Customers. However, the data are stored and processed by Facebook so that a connection to the respective user profile is possible and Facebook can use the data for its own advertising purposes in accordance with the Facebook Data Use Policy. This enables Facebook to place advertisements on Facebook pages and outside Facebook. The Provider cannot influence this use of the data.
The Customer may permanently object to remarketing by deactivating the “Custom Audiences” remarketing function in the advertising settings section via the following link. To do so, they must be logged in to Facebook:
For further information, reference is made to Facebook’s Privacy Policy:
Integration of Third-Party Offerings / Social Media
The Provider’s digital offerings are connected in various ways with functions and systems of third parties, for example through the integration of plug-ins from third-party social networks, in particular Facebook, Twitter, etc. If the Customer has a user account with these third parties, they may also be able to measure and evaluate use of the Provider’s digital offerings. Further personal data, such as IP address, browser settings and other parameters, may be transmitted to and stored by these third parties. The Provider has no control over the use of personal data collected by third parties in this manner and assumes no responsibility or liability. Furthermore, the Provider has no detailed knowledge of which data are transmitted to third-party providers, where they are transmitted or whether they are anonymised.
YouTube plug-ins are integrated on the Provider’s website. The provider is YouTube LLC, 901 Cherry Ave., San Bruno, CA 94066, USA. The YouTube plug-in establishes a connection to YouTube’s servers. The YouTube server is informed which of the Provider’s pages the Customer has visited. If the Customer is logged in to their YouTube account, YouTube can directly associate their browsing behaviour with their personal profile. The Customer can prevent this by logging out of their YouTube user account.
For further information, reference is made to YouTube’s Privacy Policy:
Other Tools
The Provider’s website uses the Google Maps mapping service via an API. The provider is Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. When the Customer uses Google Maps functions, the IP address is stored by Google and generally transmitted to a Google server in the USA. The Provider has no influence over this data transmission.
8. Data Security
The Provider uses technical and organisational security measures in accordance with recognised market standards to protect stored personal data against unintended, unlawful or unauthorised manipulation, deletion, alteration, access, disclosure or use, and against partial or complete loss. The Provider’s servers are located in Switzerland. Certain services may be processed via servers in other countries with an adequate level of data protection, whereby the requirements under revDSG and GDPR are complied with at all times. The connection to the servers is made using SSL encryption. The Provider regularly backs up Customer data. To prevent data loss even in extreme cases (e.g. destruction of a data centre by an earthquake), encrypted backups are stored in parallel in several data centres within Switzerland. Security measures are continuously adapted and improved in accordance with technological developments. Furthermore, the Provider cannot guarantee the security of data transmission over the Internet; in particular, there is a risk of third-party access when data are transmitted by email. However, access is protected by HTTPS. If explicitly requested by the Customer, the Customer may choose two-factor authentication at any time.
9. Profiling / Automated Decisions
We process your personal data partly by automated means in order to evaluate certain personal aspects (profiling). We use profiling in particular to provide you with targeted information and advice on products. In doing so, we use evaluation tools that enable us to communicate and advertise in a needs-based manner, including market and opinion research.
To ensure IT security, we use automated protective measures that can identify conspicuous data traffic (e.g. attack or abuse patterns) and automatically and temporarily block the relevant access. Such security-related blocks serve to protect operations and do not constitute an automated individual decision with significant legal consequences for the data subject.
To manage the business relationship, we use automated procedures, in particular the automatic generation and delivery of invoices, the automatic sending of payment reminders (dunning notices) and, in the event of non-payment or after expiry of the right of use, the automated blocking of access to the account. Invoicing and reminders serve the performance of the contract. Where an automated measure has a legal or similarly significant effect on you—this applies in particular to the blocking of account access—you have the right to state your position and request a review of the decision by a natural person (Art. 21 revDSG; Art. 22 GDPR for EU data subjects). Please contact legal@ateso.ch for this purpose. Beyond this, we do not make any automated individual decisions with legal or similarly significant effects.
10. Communication by Email and/or Newsletter
If the Customer wishes to subscribe to a newsletter offered on the Provider’s website, the Provider requires an email address and other information that makes it possible to verify that the email address provided is correct and that the Customer agrees to receive the newsletter (“double opt-in” procedure).
Through the newsletter, the Customer regularly receives recommendations and offers that may be of interest to them. For this purpose, the Provider collects and processes personal data relating to the Customer’s usage behaviour on the website, in the ATESO Solution and in relation to use of the newsletter (e.g. whether the Customer opens the newsletter or which web URL links they click). The Provider evaluates these data for statistical purposes in order to better tailor the content of the newsletters to the Customers’ interests.
The processing of personal data entered in the newsletter registration form is based on the Customer’s consent, which they may withdraw at any time with effect for the future. Withdrawal is carried out via the “unsubscribe” link in the newsletter. The collected personal data are used for the content design and distribution of the newsletters. The Provider stores the personal data provided by Customers for the purpose of receiving the newsletter until the Customer unsubscribes from the newsletter.
11. Duration of Storage
We process and store your personal data for as long as necessary to fulfil our contractual and legal obligations or otherwise for the purposes pursued by the processing, i.e. for example for the duration of the entire business relationship (from initiation and execution to termination of a contract) and beyond that in accordance with statutory retention and documentation obligations. It is possible that personal data may be retained for the period during which claims may be asserted against our company and insofar as we are otherwise legally obliged to do so or legitimate business interests require it (e.g. for evidentiary and documentation purposes). As soon as your personal data are no longer required for the above-mentioned purposes, they will generally be deleted or anonymised where possible. Shorter retention periods of twelve months or less generally apply to operational data (e.g. system logs, logs).
12. Access, Rectification, Erasure, Restriction, Consent
With regard to personal data, Customers have the following rights under the DSG (in particular Art. 25 et seq. DSG) and the GDPR (in particular Art. 12–23 GDPR). In principle, the Provider also grants Swiss Customers the rights contained in the GDPR. However, the Provider reserves the right to make a different assessment in individual cases.
- The right of access;
- The right to rectification;
- The right to erasure;
- The right to restriction of processing;
- The right to data portability; and
- The right to object.
Please note, however, that we reserve the right to invoke the statutory restrictions on our part, for example where we are obliged to retain or process certain data, have an overriding interest in doing so (where we are entitled to rely on it) or require them for the assertion of claims. If costs are incurred for you, we will inform you in advance. Please note that exercising these rights may conflict with contractual agreements and may have consequences such as early termination of the contract or cost implications. Where this is not already regulated contractually, we will inform you in advance in such cases.
The exercise of such rights generally requires that you clearly prove your identity (e.g. by means of a copy of an identity document where your identity is not otherwise clear or cannot be verified). To assert your rights, you may contact us at the address stated in section 1.
Every data subject also has the right to enforce their claims in court or to lodge a complaint with the competent data protection authority. The competent Swiss data protection authority is the Federal Data Protection and Information Commissioner (FDPIC). The Provider is, of course, happy to address Customers’ questions and requests before a complaint is filed. For this purpose, the Customer may contact the Provider in writing or by email (legal@ateso.ch).
Federal Data Protection and Information Commissioner (FDPIC)
Where the Customer is asked to give consent in connection with the Provider’s services, they give this consent by clicking the relevant checkbox or button. The Provider is then entitled to collect, process, use and disclose the Customer’s personal data accordingly.
The Customer may of course withdraw their consent at any time without affecting the lawfulness of processing carried out on the basis of consent before its withdrawal. The withdrawal may be sent in writing to the Provider’s address mentioned at the beginning. However, an email to legal@ateso.ch is also sufficient. Some of the services and functions will then no longer be available to the Customer.
13. Links to Other Websites
The Provider’s website contains hyperlinks to third-party websites that are not operated or controlled by the Provider. The Provider is not responsible for their content or data protection practices.
14. Amendments
We may amend this Privacy Policy at any time without prior notice. The current version published on our website shall apply. Where the Privacy Policy forms part of an agreement with you, we will inform you of the change in the event of an update by email, via the ATESO Solution account or in another appropriate manner.
Last version: December 2025