In three sentences
What you record in Inventaris stays yours. We process it only to run the application for you, and only as you instruct. At the end you get it back, and then we delete it.
1. Parties and roles
This agreement is concluded between your organisation and us as soon as you use Inventaris. It applies in addition to the general terms and takes precedence over them in matters of data protection.
1.1 The processor
Swyron GmbH
Dorfstrasse 16
8374 Oberwangen TG
Schweiz
UID: CHE-317.250.995
Email:
datenschutz ät swyron punkt com
1.2 The controller
That is your organisation. It decides which data are recorded in Inventaris, for what purpose and how long they stay. It is also responsible for being entitled to collect those data and for having informed the data subjects.
1.3 What this agreement does not cover
For the data arising when you visit our website, create an account and receive invoices, we are the controller ourselves and not a processor. The privacy policy applies to those, not this agreement.
2. Subject matter, nature and purpose
The subject matter is the operation of Inventaris as software as a service: inventory, lending and the processes attached to them. In doing so we process, on your behalf, the personal data your organisation records in the application or takes over from a system you have connected.
The details — which people, which data, for what — are set out in Annex 1. It forms part of this agreement.
We process the data solely to provide the application, to back it up and to fix faults. We do not analyse them for our own purposes, do not pass them on and do not sell them.
3. Duration
This agreement applies for as long as the subscription runs, and beyond that for as long as we still hold data from the engagement — that is, until deletion under clause 12.
4. Instructions
We process the data only on your documented instructions. This agreement together with its annexes is the complete instruction at the time it is concluded.
The settings you make in the application are instructions too: which modules you switch on, which roles you assign, which systems you connect, how long you keep data. Further instructions go in text form to the address given above.
If we consider an instruction unlawful, we tell you and may suspend carrying it out until the point is settled.
5. Confidentiality
Everyone on our side who can access your data is bound in writing to confidentiality. The obligation continues after the collaboration ends.
Only those people who need it for operation and support have access to customer data, and only as far as the task requires.
6. Technical and organisational measures
We take the measures that, according to the state of the art, ensure a level of protection appropriate to the risk. They are set out in Annex 2 and form part of this agreement.
We may develop the measures further. The level of protection must not drop — security ages, and an agreement that freezes the measures freezes yesterday's state.
7. Sub-processing
You grant us general authorisation to engage sub-processors. Those engaged at the time of conclusion are listed in Annex 3.
If we add a new one or replace one, we announce it at least 30 days in advance by e-mail to the contact address on file. Within that period you may object for an important reason relating to data protection. If the matter remains unresolved, you may terminate the subscription as of the date of the change.
We contractually bind every sub-processor to the same obligations this agreement imposes on us, and we are liable to you for them as for our own conduct.
8. Place of processing
The application's data are processed and stored in Switzerland, backups included. Disclosure abroad under this agreement only takes place if the controller books the Swyron AI add-on: pseudonymised questions and inventory details are then sent to the sub-processor named for this purpose (Anthropic, USA), based on the standard contractual clauses.
If you connect a third-party system yourself — Microsoft 365, a device management system or a network controller — data flow to wherever that system takes them. That is your decision and your responsibility; we are not a processor for it.
9. Support with data subject rights
If a data subject approaches us rather than you, we do not answer the request ourselves but forward it to you without delay. We support you with access, rectification, deletion and portability where you cannot handle it yourself in the application, and respond to such a request within 10 working days.
Most of it you can do yourself: the application shows each person's data, lets you correct and delete them, and provides a CSV export at any time — without asking us.
10. Data security breaches
If we identify a data security breach affecting your data, we report it to you without delay, at the latest within 48 hours of becoming aware. The report contains, as far as known:
- what happened and when,
- which categories of data and how many people are affected,
- what consequences are to be expected,
- what we have done about it and are still doing.
Reporting to the supervisory authority and to the data subjects is your task — you are the controller. We give you what we have for it.
11. Evidence and audit
On request we demonstrate compliance with this agreement, as a rule by information in text form and by the details on our security page.
If that is not enough for you, you may require an audit — yourself or through an independent person bound to confidentiality who is not a competitor of ours. You announce it at least 30 days in advance, it takes place during business hours and must not disrupt operations. The cost is yours unless a material breach comes to light.
12. Return and deletion
While the agreement runs you reach your data yourself at any time: the CSV export is available in the application, without asking and without giving a reason.
After the subscription ends we delete the data within 30 days. Excepted are invoices and accounting records which we must keep for ten years under Art. 958f CO — they contain your address and billing details, but no content from the application.
The backups hold a special position. Deleted data do not vanish there immediately but with the backup's expiry: fourteen days daily, then monthly for a year. Until then they remain in the set — no longer reachable, but present. A backup you cut individual rows out of is no longer a backup.
13. Liability
The liability provisions of the general terms apply. Mandatory liability under data protection law towards data subjects and authorities remains unaffected; between the parties, each bears the share corresponding to its fault.
14. Governing law and venue
Swiss law applies, excluding its conflict-of-law rules. Venue is the processor's registered office, unless a mandatory venue takes precedence.
15. Conclusion and amendments
This agreement becomes part of the contractual relationship when the subscription is concluded; a separate signature is not required. The version published here, with the identifier shown below, is authoritative.
If you need a signed copy — many procurement processes require one — write to us; we will send it for countersignature.
If the agreement changes materially, we announce it at least 30 days in advance by e-mail. If you object, the previous version applies until the end of the current subscription period.
What this text is not
It is written by us and has not been reviewed by a lawyer. It reflects what we actually do and matches the privacy policy and the security page. If your procurement needs a reviewed version or your own contract template, tell us — we will work with it.
Annex 1: processing activities
Categories of data subjects
- Staff, teachers and other members of your organisation who have an account or a personnel record.
- Learners and other borrowers, in so far as your organisation records them.
- Contact persons at suppliers, in so far as they are recorded on a device or a request.
Categories of personal data
| What | What for |
|---|---|
| Master data: name, e-mail, telephone, department or class, personnel number, start and leaving date | Assigning a loan to a person and being able to reach them |
| Account data: role, password as a hash, second step, passkeys (public key), sign-in times, sign-in log and known devices | Sign-in and permissions |
| Transaction data: loans, returns, reservations, tickets, damage reports, requests | The actual purpose of the application: who has what, since when and until when |
| Log data: who changed what and when, with the previous state | Traceability — the evidence an audit asks for |
| Profile picture, only if you have connected Microsoft 365 | Recognition at the issue counter |
| Swyron AI usage data: number of questions asked and declined per account and hour, anomalies with account, day and number, without the wording of the questions (only with the module booked) | Keeping to the limits per person set by the organisation and detecting misuse of Swyron AI |
Sensitive personal data are not provided for. The application has no field for them. What your organisation writes into a free-text field is its own decision — and its own responsibility.
Nature and purpose of the processing
- Storing and providing, through the application, the data you record
- Sending the e-mails the application triggers: invitations, return reminders, notifications about transactions
- Synchronisation with systems you connect, in so far as you set one up
- Backup, fault finding and restoration in case of failure
Annex 2: technical and organisational measures
The full account is on the security page. What follows is the contractually assured core.
| Area | Measure |
|---|---|
| Access control | Sign-in with a password that is never stored in plain text and never appears in any log. New passwords must meet minimum requirements and are checked against known data breaches; only five characters of a hash leave the platform, no personal data. Second step according to RFC 6238, mandatory for owners and administrators and, at the organisation’s request, for all accounts. Sign-in is also possible with a passkey (device plus fingerprint, face or PIN); only the public key is stored. Sessions end after 15 minutes of inactivity; signed-in devices can be reviewed and signed out, and an e-mail is sent to the account when someone signs in from a new device and when the password or second step changes. Optional sign-in with Microsoft 365, in which case the directory revokes access when someone leaves. |
| Authorisation control | Seven roles, from owner to kiosk terminal, plus SuS with the library. Whoever lacks a function does not even see it. In addition, every write action is checked, not just the interface. |
| Separation of organisations | Every organisation works in its own data space. The separation is enforced centrally: a query without an organisation check is rejected before it reaches the database. |
| Transmission | Encrypted only; unencrypted calls are redirected. Attachments lie outside the publicly reachable directory and are delivered only through a tenant-checked address. |
| Traceability | Changes to inventory, loans and accounts are logged with the person, the time and the previous state. Sign-ins and failed attempts are logged per account and visible to the person themselves and to owners and administrators. Every access by our staff to the operator area is also logged and kept for twelve months. |
| Availability and restoration | A full backup of database and attachments every night, checked for completeness before an old one is removed. Fourteen days daily, then monthly for a year. The backups are encrypted (AES-256), the decryption key is not on the server, and they lie outside the web directory. |
| Data minimisation | Photos are reduced in size on upload and stripped of capture metadata. Sign-in attempts used for rate limiting are deleted after one day, the sign-in log after 90 days, server logs after six months at most, one-time links seven days after expiry. Known devices are stored only as a hash of a random identifier. The count of questions to Swyron AI per account is deleted after 30 days, anomalies that have been dealt with after twelve months; the wording of the questions is not stored for this. |
| Verification | Before every release an automated test run covers permissions, separation of organisations and security headers. Vulnerability reports are received at the address given on the security page. |
Annex 3: sub-processors
This list is exhaustive and matches the privacy policy. Everyone listed is contractually bound to confidentiality and may process the data solely for the stated task.
| What for | Where | Which data |
|---|---|---|
| operating the servers and database | Data centre in Brazil | all data in the application |
| sending the emails from the application | Brazil | recipient address and content of the respective message |
| Language model for the Swyron AI add-on (only if the add-on is booked or enabled for the trial) | Anthropic, PBC, USA | Questions and inventory details; persons only as placeholders, no names or contact details; free texts from tickets only if reply suggestions are switched on, with names replaced by placeholders; for software only the documents, notes and accounts released by the organisation field by field, never licence keys or passwords; for IT contracts only contracts released one by one, without contact persons; from the documentation only the text of documents released one by one, with recognised names and contact details replaced by placeholders |
| Language model for suggesting the manufacturer model of devices without a number (product images), only with the Swyron AI add-on booked | Anthropic, PBC, USA | Product name, brand and category without the organisation; names and contact details replaced by placeholders |
We do not name the data centre publicly here; that belongs to operations. As part of a procurement we name it on request, together with its certifications.
What is not a sub-processor
The spam protection on the public forms (Cloudflare Turnstile) sees IP address and browser details — but only on the website, before sign-in. It does not touch the data in the application and is therefore not a sub-processor within the meaning of this agreement.
The systems you connect yourself — Microsoft 365, Intune, Jamf, Mosyle, UniFi — are your systems. We read from them if you set that up, and never write back. They are not our sub-processors but your own processing operations.