Policies & Terms

Both. As a Swiss company, we are subject to the revised Data Protection Act (revDSG). As soon as we process personal data of people in the EU, the GDPR also applies. Our contracts, processes and systems are designed to comply with both sets of regulations.

The revised Data Protection Act has applied since 1 September 2023 and replaced the 1992 Act. It requires greater transparency when collecting data, data protection by design and by default, a register of processing activities, and notification to the FDPIC in the event of serious data breaches. Only data relating to natural persons is now protected. It is also commonly referred to as nDSG, meaning the new Data Protection Act.

The General Data Protection Regulation is the EU's data protection law and has applied since 25 May 2018. It defines the legal basis on which companies may process personal data, how they must inform people about this, and what rights affected individuals have. In English, it is called the General Data Protection Regulation, or GDPR for short.

The principles are the same: transparency, purpose limitation, data security and strong rights for affected individuals. The revDSG was deliberately aligned with the GDPR, but remains less strict in several respects.

• Permission: The revDSG generally permits processing, while the GDPR requires a legal basis for each processing activity.
• Data breach: Notification to the FDPIC as quickly as possible; in the EU, notification to the supervisory authority within 72 hours.
• Penalties: up to CHF 250,000 for the responsible individual; in the EU, up to EUR 20 million or 4% of turnover for the company.
• Register: Not required in Switzerland for companies with fewer than 250 employees and low risk; only narrowly exempted in the EU.
• Data protection advice: Voluntary in Switzerland; in the EU, a data protection officer is mandatory depending on the activity.
• Terminology: Switzerland refers to processing personal data, while the EU refers to processing personal data — both mean the same thing.

Usually both. The revDSG applies as soon as data processing has an effect in Switzerland. The GDPR is also relevant if you have an establishment in the EU, offer goods or services to people in the EU, or monitor their behaviour. For Swiss companies with customers in the EU: comply with both sets of regulations.

Personal data refers to any information relating to an identified or identifiable person: name, address, email, phone number, IP address, location or usage data. Particularly sensitive are health data, biometric and genetic data, as well as information about religion, worldview, or trade union membership. The GDPR refers to the same information as personal data.

You can request access to your data, correct incorrect data, and have unnecessary data deleted. Both laws also grant you the right to have your data transferred or disclosed and to object to processing. Sending an email to legal@ateso.ch is sufficient.

We stop the cause, document the incident, and inform you as soon as your data is affected. Where we are responsible ourselves, we report a security incident to the EDÖB as soon as possible; under the GDPR, the deadline for reporting to the supervisory authority is 72 hours. If we process data on your behalf, we report the incident to you — you are then responsible for reporting to the authority.

It regulates how a service provider processes personal data on behalf of its client: for what purpose, for how long, with which security measures, and with which subcontractors. The revDSG refers to this as commissioned processing, while the GDPR refers to it as data processing. In English, the contract is called a Data Processing Agreement (DPA).

Yes, as soon as we process personal data on your behalf — for example, when operating a cloud solution, during maintenance, or when providing support with access to your data. Both laws require a written contract for this. To avoid requiring you to sign an additional document, our DPA is integrated as an appendix into the Terms and Conditions.

Our cloud solutions are operated in data centers in Switzerland. Which other service providers we use, for what purpose, and where they process data is disclosed in our list of subcontractors. This list is updated regularly.

Yes. The EU Commission recognizes Switzerland as a country with an adequate level of data protection. Therefore, personal data may be transferred from the EU to Switzerland without the need for you to agree to additional safeguards such as Standard Contractual Clauses. Conversely, the same applies to transfers from Switzerland to the EEA.

Our contracts, processes, and systems are designed to meet both regulations: The order processing contract is an appendix to our T&Cs, the subcontractors used are publicly documented, and our cloud solutions run in Swiss data centers. How compliant a system is in operation also depends on the data you process within it—we will clarify this during the project.