Privacy policy

1. Who is responsible

The controller within the meaning of the Swiss Federal Act on Data Protection (FADP) is Gallesis · Bireggstrasse 1 · 6003 Luzern, Switzerland (a sole proprietorship; the owner is named in the imprint). E-mail for data protection questions: datenschutz@gallesis.com

This policy applies to the website gallesis.com, to the Gallesis customer account, to logins to the fiduciary and supplier portals, to sales and referral partners, to contact persons of businesses that a partner names to us, to people who report a security vulnerability to us, and to contact with us by e-mail, phone or contact form.

It does not apply to the data a business processes with Gallesis about its own customers; that business is responsible for it. If you are a guest of a business, please contact that business; requests that reach us are passed on to it. The exception is the software's access logs (section 2), which we keep as controller to protect the platform.

2. Which data we process

• When you visit the website: the website gallesis.com keeps no access log.
• When you use the software, including the businesses' ordering and booking pages: we log the method, the address without personal links and without the query part, the time and the IP address. We need this to operate and secure the software; the logs are limited in size and reach back a few days.
• When you contact us: through the contact or enquiry form we collect your name, your business, your e-mail address, optionally your phone number and your business address, your message, the language and address of the page and the IP address of the submission. The information is voluntary; without it we cannot answer your request.
• When you become a customer: company, address, UID, contact persons with e-mail and phone, your team's user accounts (name, e-mail, role), booked packages and add-ons, discount codes, invoices, payment status, and your account's sign-in records and audit trail.
• Payment data: to pay, you are sent to the payment page of our payment service provider Stripe. We neither see nor store your full card number. For automatic charges, a reusable payment method stays stored with Stripe (for example a card, Link or Amazon Pay). We receive the type of payment method — for cards the brand, the last digits and the expiry date — and the status of the charge. If you choose another provider at Stripe (for example Link, Apple Pay, Google Pay or Amazon Pay), that provider processes your data under its own privacy policy.
• Support: the content of your support requests and, where needed to handle them, a logged access to your account.
• No advertising tracking, no cookies: we use no third-party analytics or advertising tools and embed no advertising or social-media networks. This website and the software set no cookies. On the pricing page your browser keeps an order in progress in this tab's session storage; it is deleted when you close the tab. The software and the ordering and booking pages keep your sign-in, your language setting and an offline cache in your browser's local storage. You can prevent this in your browser settings or delete what is stored there; ordering and the software then do not work, or work only in part. To pay, you are sent to Stripe's page, where Stripe's rules apply.
• From partners and portals: when a sales or referral partner recommends a business to us, we receive the business's name and the contact person's name, e-mail and phone. For logins to the fiduciary and supplier portals we process name, e-mail address, sign-in records and the log of downloads.

3. Purposes and legal basis

• Operating and securing the website, preventing abuse — overriding interest in secure operation
• Answering your request — pre-contractual measure at your request
• Concluding and performing the subscription, support — performance of the contract
• Invoicing, collection, bookkeeping — performance of the contract and legal obligation
• Information about changes to prices, terms and features — performance of the contract
• Product information to existing customers — overriding interest; you can unsubscribe at any time
• Protecting our partner programme from abuse: checking by the owner's UID, e-mail and phone and by company name and address whether a new business was already a customer before — overriding interest
• Improving the software on the basis of anonymised usage figures — overriding interest

4. Who receives data

We do not sell data. We pass data on only to:

• the operator of our data centre, to run the servers — Germany
• Infomaniak Network SA (Swiss Backup), for the encrypted backup copies — Switzerland
• Infomaniak Network SA, to send system e-mails and to host our mailboxes — Switzerland
• VADIAN.NET AG (ASPSMS), to send text messages (SMS) — Switzerland
• Stripe (Stripe Payments Europe, Ltd.), for the payment page, storing the payment method, collecting payments and invoices — Ireland / EU, group in the USA
• fiduciary and auditors, for bookkeeping and legal obligations — Switzerland
• authorities and courts, where we are legally obliged to — Switzerland

If our business is transferred or converted into a company, the data passes to the successor.

5. Disclosure abroad

Your data is processed in Germany (servers) and in Switzerland (backup copies, e-mail, text messages); Germany provides adequate data protection according to Annex 1 of the Swiss Data Protection Ordinance. Where data is disclosed to the USA, we rely on the recipient's certification under the Swiss-U.S. Data Privacy Framework or on the European Commission's standard contractual clauses in the version recognised by the Federal Data Protection and Information Commissioner (FDPIC).

6. How long we keep data

• Access logs of the software: limited in size, they reach back a few days; the website gallesis.com keeps no access log
• Details from the contact or enquiry form: we delete them 24 months after the last contact
• Other enquiries that did not lead to a contract, support requests and the owner's contact details: currently no fixed period; we delete them on request unless a retention obligation stands in the way
• Account and contract data: for the duration of the contract and afterwards, as long as a legal retention obligation applies or claims under the contract can be asserted
• Invoices, vouchers and accounting records: ten years (Art. 958f of the Swiss Code of Obligations)
• Backup copies (hourly): up to four weeks on our server and up to 90 days encrypted with Infomaniak in Switzerland; monthly copies up to 400 days (just over 13 months)

We keep all other data only as long as its purpose or a legal obligation requires; it is then deleted or anonymised.

7. Security

We take appropriate technical and organisational measures: encrypted transmission, passwords stored only as hashes, role-based permissions, two-factor sign-in (mandatory for Gallesis's own accounts, optional for the businesses' accounts), passwords of at least 12 characters, lock-out after failed attempts, hourly backups including an encrypted copy in Switzerland, and logging of changes. Nobody can guarantee absolute security for transmission over the internet.

8. Your rights

Within the FADP you have the right to information, rectification, erasure, surrender or transfer of your data, and the right to object to processing. Contact datenschutz@gallesis.com. We may ask for additional information to verify your identity. We usually answer within 30 days. If providing the information takes disproportionate effort, we may ask for a contribution to costs of at most CHF 300 (Art. 19 of the Data Protection Ordinance). You can withdraw consent at any time with effect for the future. You may also contact the Federal Data Protection and Information Commissioner (FDPIC).

Please note: where we are legally obliged to keep data (in particular accounting records), we do not delete it but block it from further use.

9. No automated individual decisions

We make no decisions with legal effect based solely on automated processing.

10. Changes

We may adapt this policy. The version published on gallesis.com applies. We inform our customers of significant changes by e-mail as well.