Privacy Policy
Version 2.0 · Last updated: 30 October 2026
Legal documents: Privacy Policy
In short
- This policy covers the website konsaro.com, including personal invitations, and the data we control on the Konsaro platform, such as user accounts, sign-in and security.
- Content that your organisation puts into Konsaro (Customer Data) is processed on its behalf. Your organisation is responsible for it (Data Processing Agreement).
- Website analytics run only with your consent. On a personal invitation page, they are linked to you as the invited person and help us plan our contact. You can object at any time.
- We never sell personal data and use no advertising cookies. Some services are provided from the United States, with recognised safeguards.
1.Who is responsible
Software Vision AG, Löwenstrasse 11, 8001 Zürich, Switzerland (“we”), is the controller for the processing described in this policy. For all data protection questions and requests, write to info@softwarevision.ch or to our postal address.
We have not appointed a data protection officer. We have no establishment in the EU and have not appointed a representative in the EU. People in the EU/EEA can contact us directly at the addresses above, in English or German.
2.What this policy covers
This policy explains how we process personal data:
- on the website konsaro.com: visits, cookies and analytics, forms, marketing emails, personal invitations and content from other providers (sections 3 to 8);
- on the Konsaro platform at app.konsaro.com, where we decide on the processing ourselves: user accounts, sign-in, two-factor authentication, security events, service emails, support, contracts and billing (section 9).
Content that organisations put into Konsaro is Customer Data. For Customer Data, the organisation that uses Konsaro (the Customer) is the controller, and we process it on its behalf as processor. Section 10 explains where the line falls. Sections 11 to 18 apply to all processing in this policy.
This policy is based on the Swiss Federal Act on Data Protection (FADP) and, where it applies, the EU General Data Protection Regulation (GDPR).
3.Visiting the website
When you visit konsaro.com, our server records your IP address, the date and time, the page requested, the page you came from, and your browser and operating system. We need this to deliver the website and to protect it against misuse and attacks. The website runs on servers in Germany.
If you are signed in to the Konsaro app, your browser also sends the app’s sign-in cookie to this website. The website uses it only to check whether you may read help articles reserved for customers, and renews it when needed. It does not use it for analytics.
4.Cookies and website analytics
We use a few cookies and browser entries that the website needs to work, for example to remember your language or your cookie choice. They need no consent. Website analytics run only if you allow them in the cookie banner. Rejecting is as easy as allowing, and closing the banner counts as rejecting. If your browser sends a “Do Not Track” or “Global Privacy Control” signal, we do not run analytics. Our server accepts no analytics data without your consent.
If you allow analytics, we record:
- the pages you visit, the links you click, how far you scroll, how long a page is active and how far you watch a video;
- where on a page you click and scroll, which we combine into click and scroll maps of our pages;
- which forms you start and send, but never what you type into them;
- the website you came from, campaign codes in the link you used, and technical details such as browser, operating system, device type, window size, language and your approximate location (country or region) derived from your IP address;
- a random browser identifier that connects your visits over time.
We do not record a replay of your visit. We use analytics to improve this website and to understand interest in Konsaro. On personal invitation pages, we also use them to plan our contact with you (section 7). The analytics tool runs on our own server in Germany. Analytics events are also stored in our sales system (section 13).
Each cookie and entry, with its purpose and duration, is listed in the Cookie Policy. There you can also change your choice at any time.
5.Forms and requests
When you send us a form, we use your details to handle your request. We receive demo, quote, contact and download requests by email in our mailbox and store them on our web server in Germany. Demo bookings are also stored in our sales system. Feedback on help articles is only stored on the web server.
| Form | Data | Purpose |
|---|---|---|
| Booking a demo | Name, work email, company, role, message, chosen time and time zone. If you book from a personal invitation page, the reference to that invitation | Arranging and holding the demo. Our sales system sets up an online meeting with a video-meeting service and sends you the invitation |
| Requesting a quote | Name, work email, company, phone number, message, and the numbers you entered in the price calculator | Preparing and sending your quote |
| Contact form | Name, email address, company, message | Answering your enquiry |
| Downloads | Work email, name, company, role, the material requested, the page and language, and whether you ticked the box for marketing emails | Sending you the material by email and, only if you ticked the box, marketing emails (section 6) |
| Feedback on help articles | The article, your rating, an optional comment and your browser type. We do not ask for your name | Improving our help pages |
After a demo, quote, contact or download request, we may write to you personally about that request. We do not send you marketing emails unless you consent to them (section 6).
6.Marketing emails
We send marketing emails only to people who have asked for them. Download forms have an unticked box: “Send me occasional emails about board work and Konsaro.” If you tick it, we store your consent with the time and the form you used. We may then send you occasional emails about board work, new material and Konsaro.
You can withdraw your consent at any time, with effect for the future: use the unsubscribe link in the email or write to info@softwarevision.ch. We then stop sending you marketing emails and keep only a record of your consent and its withdrawal.
If your organisation is our customer, we may also tell you by email about similar Konsaro services. You can refuse this at any time, free of charge; each such email tells you how.
7.Personal invitations (letters and invitation pages)
We send selected board members and executives a printed letter that invites them to a personal page prepared for them by name. For this we use your name, form of address, function, business contact details, and the name, industry and size of your company, together with public information about it. We obtain this data from public sources, such as the commercial register and company websites, and from providers of business contact data. This is direct marketing to business contacts, based on our legitimate interest (Art. 6(1)(f) GDPR; Art. 31(1) FADP).
Your access code protects the page; a cookie keeps it unlocked for 60 days. Only if you allow analytics do we link your visit to you, including other pages of this website you open. Our sales system then estimates your interest to decide whether and when to contact you again (profiling without legal effect). We keep invitation data for at most 24 months after our last contact with you, unless you become a customer.
Your right to object: you can object at any time, without giving reasons, including to the profiling. Write to info@softwarevision.ch. We then deactivate your page, stop contacting you and delete your data, keeping only a note that you objected so we do not contact you again.
8.Content from other providers
Some pages show content from other providers: an audio player from a streaming service on podcast pages and, on some personal invitation pages, a video player. If a video is stored on our own server, no other provider is involved. Otherwise, the player loads from a video platform.
This content loads when you open the page, without a separate consent step. Your browser then connects to the provider. The provider receives your IP address and may store cookies or similar data on your device. It decides on this processing itself, and its own privacy policy applies. Providers may process data outside Switzerland and the EU, including in the United States. Details are in section 5 of the Cookie Policy.
9.Konsaro platform: data we control
When you use Konsaro, we are the controller for the data described in this section. We need it to give you secure access to the platform and to manage our contract with the Customer.
9.1Accounts and sign-in
Your organisation creates your account or invites you, and gives us your name, email address and role. When you accept the invitation and use Konsaro, we process your account data: name, email address, profile picture if you add one, your sign-in method, the devices and sessions you use, and when you were last active.
You sign in with your email address and password, or with a sign-in link sent by email. We store passwords only in hashed form. Where your organisation offers it, you can sign in with your organisation’s Microsoft account. Microsoft then confirms your identity to us and sends us your name, email address and an account identifier. Microsoft acts under your organisation’s own agreement with Microsoft.
9.2Two-factor sign-in
You can protect your account with a second sign-in step: a code from an authenticator app or a code sent by SMS. For this we process your authenticator settings, your mobile phone number if you choose SMS, the codes we send and your recovery codes. SMS are sent by a provider in the United States (section 13).
9.3Sign-in and security events
To protect accounts and the platform, we record sign-in and security events: sign-ins and sign-outs, failed sign-in attempts, and changes to passwords and two-factor settings, each with the time, IP address, approximate country, browser, device and session. For failed attempts we also record the email address entered. We use these records to limit repeated attempts, detect misuse and investigate incidents.
The same events also appear in your organisation’s activity log. Your organisation controls that log as part of Customer Data (section 10).
9.4Service emails
We send the emails that the service needs, such as sign-in links, password resets and security notices. Emails are delivered by a provider based in the United States whose sending infrastructure is in Ireland. Invitations and meeting notifications that your organisation’s users trigger are sent on your organisation’s behalf; they are Customer Data.
9.5Support and error reports
If you send a support or bug report from the app, we receive your name, email address, your description, the page, the app version, device details and any screenshots you attach. The reports go to a support system that we run ourselves. Screenshots may show Customer Data; we use that content only to handle your report.
To find and fix errors, the app sends technical error reports to an error-monitoring service in Germany: the error message, the page address, and browser and operating system. We configure it not to attach cookies or IP addresses. We also use technical usage data, such as logs and performance metrics, to operate, secure and improve Konsaro. The app contains no advertising and no product analytics or tracking tools.
9.6Contract, billing and acceptance records
For the contract with the Customer, we process the names and contact details of its contact persons, such as the person who ordered Konsaro, administrators and billing contacts, together with contract, order and invoice data and our correspondence. We issue invoices ourselves and use no third-party payment provider.
If we ask you in the app to accept our Terms and Conditions and to confirm that you have read this policy, we record as evidence which versions this covered, when, for which organisation, and the IP address, browser and sign-in session you used.
10.Customer Data in the platform
Customer Data is everything your organisation and its users put into Konsaro or create in it: membership, roles and permissions, member details, meetings, agendas, board papers, annotations and notes, comments, votes, circular resolutions, minutes, decisions and tasks, content submitted to AI features and their results, invitations and meeting notifications, and the organisation’s activity log, which its administrators can view and export.
For Customer Data, your organisation is the controller and we are its processor under the Data Processing Agreement. Your organisation decides whom it invites and what is stored, and its own privacy notice applies. This also applies to board members and guests whom an organisation invites: the organisation decides to invite them and controls their membership and contributions. We are the controller for their account, sign-in and security, as described in section 9.
Customer Data is stored in Switzerland (Zurich). The application runs on servers in Germany. AI features process content in the EU, with zero data retention, and Customer Data is never used to train AI models. Your organisation can have AI features switched off at any time. After the contract ends, Customer Data remains available for export for 14 days and is then deleted; backups are deleted within a further 14 days. Our providers are listed on the Sub-processors page.
If you have a request about Customer Data, contact your organisation. If you send it to us, we forward it to your organisation.
11.Legal bases
Under Swiss law, we process personal data in line with the principles of the FADP. Where a justification is needed, we rely on your consent, a contract with you or your organisation, a legal obligation, or our overriding private interests (Art. 31 FADP), in particular in operating, securing and marketing our services to businesses. Where the GDPR applies, our legal bases are:
| Processing | Legal basis (GDPR) |
|---|---|
| Server logs, security and protection against misuse of the website and the platform | Legitimate interest in secure operation (Art. 6(1)(f)) |
| Strictly necessary cookies and entries, and the sign-in check for customer help articles | Legitimate interest in providing the website as you request it (Art. 6(1)(f)); strictly necessary storage needs no consent |
| Website analytics, click and scroll maps, and linking activity on invitation pages to you | Consent (Art. 6(1)(a)) |
| Demo bookings, quotes, contact requests and downloads | Steps at your request before a contract (Art. 6(1)(b)); where you act for your company, our legitimate interest in answering business requests (Art. 6(1)(f)) |
| Marketing emails | Consent (Art. 6(1)(a)); for customers, legitimate interest in direct marketing (Art. 6(1)(f)) |
| Personal invitations, including the related profiling | Legitimate interest in direct marketing to business contacts (Art. 6(1)(f)); activity on invitation pages only with consent (Art. 6(1)(a)) |
| Feedback on help articles | Legitimate interest in improving our help pages (Art. 6(1)(f)) |
| Platform accounts, sign-in, two-factor authentication and service emails | Contract (Art. 6(1)(b)), as you use Konsaro under our Terms and Conditions; legitimate interest in providing Konsaro to the Customer and in securing it (Art. 6(1)(f)) |
| Sign-in and security events, error reports and technical usage data | Legitimate interest in secure and reliable operation (Art. 6(1)(f)) |
| Support reports | Contract (Art. 6(1)(b)) and legitimate interest in helping users (Art. 6(1)(f)) |
| Contract and billing data, acceptance records | Contract (Art. 6(1)(b)); legal obligations such as bookkeeping (Art. 6(1)(c)); legitimate interest in keeping evidence (Art. 6(1)(f)) |
Where we rely on legitimate interests, you can object (section 16). Where we rely on consent, you can withdraw it at any time, with effect for the future.
12.Who receives your data
We do not sell personal data. Within Software Vision AG, only staff who need the data for their work have access to it. We disclose personal data to the following categories of recipients:
- hosting providers for the website, our analytics, the platform and our sales system;
- an email delivery provider, an SMS provider and an error-monitoring service;
- a video-meeting service, to set up demo meetings;
- providers of business contact data and AI-based research tools, to prepare personal invitations;
- AI providers in the EU, for AI features in the platform (Customer Data only);
- postal services, to deliver our letters;
- our professional advisers, such as lawyers and auditors, and authorities or courts where the law requires it or where we need to protect our rights.
Our service providers process data on our behalf under written data processing agreements. Providers of embedded content (section 8), and Microsoft if you use Microsoft sign-in, act on their own responsibility. The providers for Customer Data are listed on the Sub-processors page, and our providers for the website in section 4 of that page.
13.Transfers abroad
We process personal data mainly in Switzerland and the EU/EEA. Switzerland recognises the EU/EEA countries as providing adequate data protection, and the EU recognises Switzerland. Some recipients are in the United States or can access data from there:
| Country | What | Safeguard |
|---|---|---|
| Switzerland | Platform database, file storage and sign-in (Zurich) | No disclosure abroad |
| Germany | Website hosting and analytics, platform application servers, backup copy of uploaded files, error monitoring | Adequacy (EU/EEA) |
| Ireland | Email sending infrastructure | Adequacy (EU/EEA) |
| EU/EEA | AI features in the platform | Adequacy (EU/EEA) |
| United States | Email delivery provider (based there); SMS sign-in codes; video meetings for demo bookings; hosting of our sales system (demo bookings, invitation data, analytics events), which may take place in the United States; business contact data and AI-based research tools for personal invitations | Certification of the recipient under the Swiss-U.S. and EU-U.S. Data Privacy Framework where it exists; otherwise the EU Standard Contractual Clauses with the amendments required by Swiss law |
Some providers that process data in Switzerland or the EU belong to groups based in the United States and may access data from there for support or operations. We apply the same safeguards to such access. You can ask us at info@softwarevision.ch for a copy of the safeguards, such as the EU Standard Contractual Clauses.
14.How long we keep data
We keep personal data only as long as we need it for the purpose for which we collected it, or as long as the law requires. The maximum periods are:
| Data | How long we keep it |
|---|---|
| Server logs of the website and the platform | 30 days; longer only while we investigate a specific security incident |
| Website analytics data, including click and scroll maps | 14 months |
| Demo bookings, quotes, contact requests and downloads | 24 months after our last contact with you; if you become a customer, for the duration of the business relationship |
| Consent to marketing emails | As long as you receive our emails; after you unsubscribe, a record of your consent and its withdrawal for 3 years as evidence |
| Personal invitation data | 24 months after our last contact with you, unless you become a customer; after an objection, only the entry that prevents further contact |
| Access cookie for an invitation page | 60 days |
| Feedback on help articles | 24 months |
| Platform account data | As long as you have access to at least one organisation; deleted within 30 days after your last access ends, except security records (next row) |
| Sign-in and security events (our own records) | 12 months. The copy in your organisation’s activity log is kept for the period your organisation sets (section 10) |
| SMS sign-in codes | 30 days |
| Phone number for SMS sign-in, recovery codes | Until you remove SMS sign-in or your account is deleted |
| Support reports | 24 months after the report is closed |
| Error reports | 90 days |
| Acceptance records | As long as the contract with your organisation runs, and 10 years after it ends |
| Contracts, invoices and business correspondence | 10 years (Art. 958f of the Swiss Code of Obligations) |
| Customer Data | As set by your organisation and the Data Processing Agreement: export for 14 days after the contract ends, then deletion; backups within a further 14 days |
| Cookies and browser entries | As listed in the Cookie Policy |
When a period ends, we delete or anonymise the data. We keep it longer only where the law requires it or where we need it to establish, exercise or defend legal claims. You can ask us to delete your data earlier (section 16).
15.Security
We protect personal data with technical and organisational measures appropriate to the risk. These include encryption in transit (TLS), encryption at rest of the platform database and file storage (provided by our hosting platform), role-based access rights, optional two-factor sign-in, limits on repeated sign-in attempts, security logging and restricted staff access. No system is completely secure. If a breach of data security is likely to put you at risk, we inform you as the law requires.
16.Your rights
Within the limits of the applicable law, you have the right to:
- find out whether we process your personal data and receive a copy of it (access);
- have incorrect or incomplete data corrected;
- have data deleted or its processing restricted;
- object to processing based on our legitimate interests;
- receive data you gave us, which we process with your consent or for a contract, in a common electronic format, or have it sent to another controller;
- withdraw your consent at any time, with effect for the future.
Your right to object: you can object at any time to the use of your personal data for direct marketing, including the related profiling, for example for personal invitations or marketing emails. We then stop this use. You can also object to other processing based on our legitimate interests for reasons relating to your particular situation. We then stop, unless we have compelling legitimate grounds or need the data to establish, exercise or defend legal claims.
To exercise your rights, write to info@softwarevision.ch. We answer within 30 days. If a request is complex, we may extend this period as the law allows and tell you why. Requests are free of charge, unless they are manifestly unfounded or excessive. We may ask you to confirm your identity. We may restrict a right where the law allows it, for example where we must keep data.
If you use Konsaro through an organisation, requests about Customer Data are handled by your organisation (section 10).
You can lodge a complaint with a supervisory authority. In Switzerland, this is the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, www.edoeb.admin.ch. In the EU/EEA, you can complain to the authority in the country where you live or work, or where the alleged infringement took place.
17.Automated decisions and profiling
We do not make decisions based solely on automated processing that have legal effects for you or similarly significantly affect you (automated individual decisions under Art. 21 FADP and Art. 22 GDPR).
We use profiling only for personal invitations: with your consent to analytics, our sales system assesses your interest based on your activity on your invitation page and on this website (section 7). The result helps us decide whether and when to contact you. You can object to this at any time.
18.Changes to this policy
We update this policy when our processing changes. The current version is published on this page with its date. If we make material changes that affect platform users, we inform them in the app or by email. If the German and English versions differ, the German version prevails.