Privacy Policy

1. Controller

The controller responsible for the processing of personal data in connection with this website is:

2. Scope

This Privacy Policy applies to the publicly accessible websites of Ason AG and to related functions such as contact requests, demo requests and newsletter subscriptions. It also applies to the sending of our newsletters and mailings, including to contacts who were not registered through the website.

Supplementary privacy terms or contractual agreements may apply to the use of the Ason Payroll platform or to personal data that we process on behalf of our customers in the course of providing our services.

3. Visiting and using our website

When you visit our website, technically required information is processed. This may include in particular the following data:

• IP address
• Date and time of access
• Pages and resources accessed
• Volume of data transferred
• Browser type and version
• Operating system
• Referrer (the page from which you reached our website)
• Technical connection, security and error data

We process this data to provide our website securely, reliably and with good performance, to detect technical errors and to defend against abusive or harmful access.

Where the GDPR applies, we base this processing in particular on our legitimate interest in the secure and reliable operation of our website pursuant to Art. 6(1)(f) GDPR.

Our website currently does not use external font services (e.g. Google Fonts) or embedded videos, maps or social media plugins. Fonts and content are delivered directly through our own infrastructure and our hosting provider Cloudflare.

4. Hosting, content delivery network and security with Cloudflare

Our website is delivered using Cloudflare services. We use Cloudflare in particular for hosting via Cloudflare Pages, content delivery, performance optimisation and the protection of our website against abusive or harmful access.

When you access our website, Cloudflare may therefore process in particular IP addresses, technical connection data, information about your browser and device, and information about access to our website.

Cloudflare may use this information in particular to deliver content, manage traffic, detect technical disruptions, and identify and block automated, abusive or security-threatening access.

In connection with the services we use, Cloudflare generally processes such data as a processor on our behalf.

Cloudflare operates a global technical infrastructure. As a result, data may also be processed outside Switzerland and the European Economic Area (EEA). Where required, appropriate legal safeguards and contractual protection mechanisms are used.

5. Cloudflare Web Analytics

We use Cloudflare Web Analytics to obtain statistical and aggregated information about the use and technical performance of our website.

According to Cloudflare, Cloudflare Web Analytics operates without conventional analytics cookies and without storing information in local storage for analytics purposes. Cloudflare also does not use individual fingerprinting based on IP addresses, user-agent information or comparable characteristics for Web Analytics.

For example, information about page views, pages accessed, the origin of visits, countries, device types used, and technical performance and loading times may be evaluated statistically.

This information helps us to understand how our website is used and how it performs, and to continuously improve our content and technical delivery.

We do not use Cloudflare Web Analytics to track individual visitors across different websites or to create individual advertising profiles.

6. Cookies and similar technologies

Cookies are small pieces of information that are stored on your device or in your browser when you visit a website and that can be read again on later visits.

We currently do not use cookies for personalised advertising, marketing or cross-site tracking purposes.

In the standard configuration we use, Cloudflare Web Analytics does not use analytics cookies or local storage to collect usage statistics.

Technically necessary Cloudflare security functions

To secure and technically deliver our website, Cloudflare may use cookies or similar technologies where this is required for certain security functions.

This may include in particular the cookie __cf_bm.

__cf_bm is used by Cloudflare in connection with bot management and bot detection. It helps to distinguish automated access from legitimate human access, to improve bot scoring and to prevent legitimate users from being blocked in error.

According to Cloudflare, the cookie contains information used to calculate a bot score. Apart from time-related information, the information it contains is encrypted and can be decrypted by Cloudflare.

A separate __cf_bm cookie is created for each website visited. The cookie does not correspond to a user ID of our application and is not used by Cloudflare to track visitors across different websites or sessions.

According to Cloudflare, the cookie expires after approximately 30 minutes of continuous inactivity.

Depending on the Cloudflare security functions in use, further technically required cookies may be used, for example to store the successful completion of a security check or to protect our website against automated and abusive access.

We use such technologies only to the extent that they are necessary for the secure and reliable operation of our website. We do not use them for personalised advertising or marketing profiles.

Where consent is required under the applicable law for the use of a technology, it will be obtained before that technology is used.

Should we use additional analytics, marketing or tracking technologies in the future, we will update this Privacy Policy accordingly and, where legally required, obtain your consent before they are used.

7. Contact and demo requests

If you contact us via a contact form, a demo form, by email or by other means, we process the data you provide.

This may include in particular:

• Name
• Business email address
• Telephone number
• Company
• Role
• Content of your enquiry
• Any other information you provide voluntarily

We use this data to handle your enquiry, to communicate with you, to prepare potential business relationships and to organise product presentations or demos.

Contact and prospect data collected through our website may be stored and processed in our own CRM.

Our CRM is operated in our own Microsoft Azure environment in Switzerland.

Contact form

If you use the contact form on our website, your details (name, company, email address, optionally telephone number and preferred appointment, and your message) are transmitted to a function on our website and sent from there as an email to our mailbox info@ason.ch. The time zone of your browser is also transmitted so that a preferred appointment can be interpreted correctly.

We use the email service Resend (Resend, Inc., USA) to send this email. We use the EU region of the service (Ireland). Resend processes the data as a processor on our behalf and only for the purpose of delivering the message.

To protect against spam and automated access, we use Cloudflare Turnstile on the contact form. In this context, technical information about your browser and device as well as your IP address may be transmitted to and evaluated by Cloudflare. The legal basis is our legitimate interest in the security of our website.

Where the GDPR applies, the processing takes place, depending on the nature of the enquiry, to take steps prior to entering into a contract pursuant to Art. 6(1)(b) GDPR, or on the basis of our legitimate interest in handling business enquiries and maintaining business relationships pursuant to Art. 6(1)(f) GDPR.

8. Newsletter and mailings

We send newsletters and other business mailings to inform about Ason, our products and services, industry topics, events and relevant company news.

If you subscribe to our newsletter, we process in particular your email address and, where provided, your name, your company and other information you provide voluntarily.

Mailmeteor

We use Mailmeteor to create, personalise, manage and control our newsletters and mailings. Mailmeteor is a service provided by:

When using Mailmeteor, the following data may in particular be processed:

• Recipient's email address
• Name and other details used for personalisation
• Company and role, where available
• Membership of contact or mailing lists
• Subject and content of messages sent
• Attachments or embedded content
• Time of sending
• Delivery and campaign information

Mailmeteor generally processes this data as a processor on our behalf in the course of our use of the service. Ason remains responsible for the selection of recipients, the content of the mailings and the lawfulness of the processing.

Mailmeteor may engage further sub-processors to provide its service. Data may also be processed outside Switzerland and the EEA in this context. Where required, appropriate data protection safeguards are used.

Sending via Microsoft 365

Our business email infrastructure is operated using Microsoft 365.

When Mailmeteor is used, our emails are actually sent through our Microsoft 365 or Exchange Online infrastructure. For this purpose, Mailmeteor is connected to our Microsoft 365 account and receives the permissions required for the agreed functions.

When emails are sent, Microsoft processes in particular:

• Email addresses of senders and recipients
• Subject and content of emails
• Attachments, where applicable
• Sending and delivery information
• Technical and security-related information

Microsoft processes this data in the course of providing Microsoft 365 and Exchange Online in accordance with the contractual and data protection terms applicable to our Microsoft services.

The specific geographic location of storage and processing may depend on the configuration of our Microsoft 365 tenant, the services used and Microsoft's applicable data residency commitments.

Subscribing and unsubscribing

Where legally required, we send our newsletter on the basis of your consent.

We may use a confirmation procedure in which you confirm your subscription via a link in an email. In that case, the date and time of subscription and confirmation, as well as technical evidence data, may be stored in order to document the consent given.

Where the GDPR applies, we base the sending of our newsletter in particular on Art. 6(1)(a) GDPR.

You may withdraw your consent at any time with effect for the future. To do so, you can in particular use the unsubscribe link in our newsletters or contact us using the contact details given in this Privacy Policy.

After you unsubscribe, we will no longer use your contact details to send the newsletter. Data required to prove consent previously given may nevertheless be retained for the period required by law or necessary to safeguard our legitimate interests.

Open and click tracking

Mailmeteor technically offers the ability to measure email opens and clicks on links contained in emails. Individual technical identifiers or tracking technologies may be used for this purpose.

We use personal open or click tracking only where there is a sufficient legal basis and, where legally required, the person concerned has consented beforehand.

Without such consent, we do not use personal open or click tracking for analytics or marketing purposes.

9. CRM and Microsoft Azure

We use a CRM operated by us on Microsoft Azure to manage prospects, contacts and business relationships.

The primary data resources used for the CRM are operated in an Azure region in Switzerland.

Depending on the Microsoft services actually used, Microsoft or its sub-processors may process certain technical, support, security or diagnostic data. This processing takes place on the basis of the data protection and data processing terms applicable to the Microsoft services.

We take appropriate technical and organisational measures to protect the data stored in the CRM.

10. Content management system and GitHub

We use Sveltia CMS in conjunction with GitHub to manage the content of our website. Both are used exclusively by our authorised editors. Content is managed in a Git repository and delivered as a static website via Cloudflare; no visitor data is transmitted to Sveltia CMS or GitHub when you visit our public website.

11. External links

Our website may contain links to third-party websites and services, for example to LinkedIn or to technical documentation.

When you follow such a link, you leave our website. The respective operators are generally responsible for the processing of personal data on external websites. We have no influence on which data these providers process when you visit their websites.

12. Disclosure of data to third parties

We disclose personal data only where this is necessary for the purposes described in this Privacy Policy, where we are legally obliged to do so, or where you have consented.

Possible recipients include in particular:

• Cloudflare in connection with hosting, content delivery, IT security and web analytics
• Microsoft in connection with Microsoft Azure, Microsoft 365 and Exchange Online
• Mailmeteor SAS in connection with newsletter and mailing delivery
• Resend in connection with sending enquiries from the contact form by email
• Technical sub-processors engaged by these providers
• Other technical service providers, where necessary for the operation of our website or the handling of your enquiry

Service providers generally process personal data only for the agreed purposes and in accordance with the applicable data protection provisions.

13. Processing outside Switzerland and the EEA

Some of the service providers we use operate international infrastructure or have companies in several countries. It can therefore not be ruled out in all cases that personal data is processed outside Switzerland or the European Economic Area.

This applies in particular to globally operating infrastructure and cloud providers and to the sub-processors of our service providers.

Resend is based in the USA. To send enquiries from the contact form, we use the EU region of the service. Where data is nevertheless transferred to the USA, we rely on appropriate safeguards, in particular standard contractual clauses.

Mailmeteor is based in France but may engage sub-processors in other countries to provide its services.

Microsoft also operates international infrastructure. The storage location of certain Microsoft 365 and Azure data depends on the service used, the tenant configuration and the data residency arrangements agreed by contract.

Where personal data is transferred to a country that does not offer an adequate level of data protection, we or our processors use appropriate legal and contractual safeguards where required. These may include in particular recognised standard contractual clauses or other safeguards provided for by law.

14. Retention

We retain personal data only for as long as is necessary for the respective purpose of processing or as long as statutory or contractual retention obligations apply.

Technical data is generally retained only for as long as is necessary for operation, security, error analysis and the prevention of abuse.

We retain data from contact and demo requests for as long as is necessary to handle the request and to maintain a potential or existing business relationship.

Newsletter and mailing data is generally used for the relevant communication for as long as this is necessary for the purpose and legally permissible.

When you unsubscribe from a newsletter, we no longer use the relevant contact details to send the newsletter. Data required to prove consent previously given or an objection may nevertheless be retained.

15. Data security

We take appropriate technical and organisational security measures to protect personal data against loss, misuse, unauthorised access, unauthorised disclosure or alteration.

To this end, we use, among other things, security mechanisms at the level of our hosting, cloud and email infrastructure. These may include in particular measures to detect and defend against automated access, bots, abusive requests and other security-relevant activity.

Our security measures are reviewed and adapted on an ongoing basis in line with technical developments and the relevant risk.

16. Your rights

Within the scope of the applicable data protection law, you have in particular the right to request information about the personal data we process about you and to have inaccurate data rectified.

Where the statutory requirements are met, you may have further rights, in particular the right to erasure, restriction of processing, data portability, objection to certain processing, and withdrawal of any consent you have given.

Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

To exercise your rights, you can contact us using the contact details given in section 1.

Individuals in Switzerland may also contact the Federal Data Protection and Information Commissioner (FDPIC).

Where the GDPR applies, data subjects also have the right to lodge a complaint with a competent data protection supervisory authority in the European Union.

17. Changes to this Privacy Policy

We may amend this Privacy Policy if our website, our services, the technologies we use or legal requirements change.

The current version published on our website applies.