Privacy policy

1. Controller and contact

The controller within the meaning of Art. 5 let. j FADP and Art. 4(7) GDPR for the processing described in section 3 is:

Swyron GmbH
Dorfstrasse 16
8374 Oberwangen TG
Schweiz
UID: CHE-317.250.995
Email: support ät swyron punkt com

We have not appointed a data protection advisor under Art. 10 FADP, and we are not required to designate a data protection officer under Art. 37 GDPR. Please address any data protection enquiries to the address given above.

2. Scope and roles

This privacy policy applies to the website inventaris.ch, including the manual and help pages, the application at inventaris.ch/app, the Inventaris tab in Microsoft Teams, the e-mails sent from the application and correspondence with our support. For third-party services that an organisation connects to Inventaris (such as Microsoft 365, Intune, Jamf, Mosyle or UniFi), the privacy provisions of the respective provider and the rules of the organisation apply.

Inventaris processes personal data in two different roles. The role determines who must inform you about the processing and to whom you should address your requests.

2.1 Processing as controller

We are the controller for the processing of personal data in connection with the website, registration, the contractual relationship with our customers, billing, support and the security of our platform. This processing is described in section 3.

2.2 Processing on behalf of our customers

For the content that an organisation records in the application or imports via an interface – in particular user accounts, staff sheets, inventory, loans, reports, requests and logs – the respective organisation is the controller. We process these data as a processor under Art. 9 FADP and Art. 28 GDPR solely on the basis of the data processing agreement and in accordance with the organisation's instructions.

The organisation informs the data subjects, such as employees, teachers or pupils, about this processing in accordance with Art. 19 et seq. FADP and Art. 13 and 14 GDPR. Section 4 describes which data the application processes in this context and may serve the organisation as a basis for doing so. Our own obligations as a processor, in particular regarding data security, confidentiality and assistance with data subject requests, remain unaffected.

If you wish to obtain information about data that an organisation keeps about you in Inventaris, please contact that organisation. If we receive such a request, we forward it without delay to the organisation concerned, provided we can identify it, and inform you accordingly.

3. Processing as controller

For each processing activity, we set out below the data processed, the purpose and the legal basis. The retention period is set out in section 8. The legal bases are stated in accordance with the GDPR; under the FADP we rely, where necessary, on the corresponding grounds of justification under Art. 31 FADP.

3.1 Accessing the website and the application

Each time the website or application is accessed, the web server automatically stores the IP address, the date and time, the address requested, the status code, the amount of data transferred, the referring page and information about the browser and operating system. The purpose is to deliver the pages, to ensure stability and security, and to detect and prevent attacks. The legal basis is our legitimate interest in secure and proper operation (Art. 6(1)(f) GDPR). The logs are not combined with other data and are not used for profiling.

3.2 Cookies

We use only cookies that are technically necessary for the operation of the website and the application or that store a setting you have expressly chosen. They contain no information about your person, only a random identifier or a fixed value, cannot be read by scripts and are transmitted only over encrypted connections.

The legal basis is the performance of the contract or our legitimate interest in secure and user-friendly operation (Art. 6(1)(b) and (f) GDPR). As these cookies are strictly necessary or are set at your own choice, we do not obtain consent for them.

We do not use analytics, audience measurement or marketing cookies, tracking pixels or social media plugins. Fonts, images and scripts are loaded from our own server. With the exception of the form verification described in section 3.3, no third-party provider is contacted when our pages are accessed.

3.3 Protecting forms against misuse

On the forms for signing in, registering, resetting a password and registering for events we use Cloudflare Turnstile, a service of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Turnstile checks whether a form is submitted by a human or automatically. For this purpose, your browser loads a script from Cloudflare and transmits your IP address and technical information about your browser and device to Cloudflare. The event registration form appears on the home page and on the event pages while registration is open; your browser then loads Turnstile as soon as these pages are opened. Turnstile is not loaded on any other pages.

The purpose is to protect user accounts against automated attacks and abusive registrations or event sign-ups. The legal basis is our legitimate interest in this protection (Art. 6(1)(f) GDPR). For the transfer to the USA, see section 7; further information is available in Cloudflare's privacy policy (cloudflare.com/privacypolicy).

3.4 Registration and contractual relationship

When an organisation registers, we collect the name of the organisation, your name, your e-mail address and a password. In the course of the contractual relationship we also process the details of our customers' contact persons, the subscription chosen and correspondence relating to the contract. The purpose is the conclusion and performance of the contract. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR); if you act on behalf of an organisation, we rely on our legitimate interest in performing the contract with that organisation (Art. 6(1)(f) GDPR).

3.5 Billing

For invoicing, we process the billing address, contact person, subscription details, invoices, payments received and any reminders. Payment is made on invoice; we do not use a payment service provider. The legal bases are the performance of the contract and our legitimate interest in complying with Swiss bookkeeping and record-keeping obligations (Art. 6(1)(b) and (f) GDPR, Art. 958f CO).

3.6 Support and contacting us

If you contact us by e-mail or by other means, we process your contact details, the content of your message and the information required to respond. Where a support request requires access to your organisation's data, such access takes place within the framework of the data processing agreement and is limited to what is necessary. The legal basis is the performance of the contract or our legitimate interest in responding to your enquiry (Art. 6(1)(b) and (f) GDPR).

3.7 Platform security

To protect against unauthorised access, we store: failed sign-in attempts with the e-mail address and IP address, to limit repeated attempts (1 day); for each signed-in session, the IP address, the browser identifier and the expiry time; and a sign-in log containing every sign-in and every failed attempt on an existing account (time, result, sign-in method, IP address and browser identifier, 90 days). The sign-in log is visible to the person concerned and to the owners and administrators of their organisation. To be able to warn by e-mail when someone signs in from a previously unknown device, we set a cookie with a random identifier and store only a hash of it; no device fingerprint is created. We also inform by e-mail about changes to the password and the second factor. New passwords are checked against the “Pwned Passwords” service to reject passwords already known from data breaches: only the first five characters of a hash of the password are transmitted, from which neither the password nor the person can be determined. For passkeys we store only the public key, a name and the times of creation and last use; the private key and any fingerprint or face data never leave the device. The purpose is to detect and repel attacks and to protect accounts. The legal basis is our legitimate interest in the security of the platform (Art. 6(1)(f) GDPR).

3.8 Data we do not collect from you

In the following cases we receive personal data processed under our own responsibility not from you but from third parties:

• contact details of contact persons and invoice recipients provided to us by a customer (name, position, e-mail address, telephone number, postal address);
• contact details provided to us by third parties in connection with an enquiry or when forwarding a message.

The purposes and legal bases are set out in sections 3.4 to 3.6. Data that organisations record in the application or import from their own systems are processed by us on their behalf (section 4); the respective organisation provides information about their source.

3.9 Registration for events

When you register on the website for a presentation or event, we store your name, email address, school or organisation, an optional comment and the time and IP address of the registration. The purpose is to run the event: confirmation, sending the link to the online session, notice of changes and limiting the number of participants. The legal basis is taking steps at your request prior to entering into a contract (Art. 6(1)(b) GDPR). You can cancel at any time via the link in the confirmation. The data is deleted 30 days after the event.

4. Processing in the application on behalf of our customers

The following overview shows which categories of personal data the application processes and where they come from. Which data are actually recorded is determined by the respective organisation.

We process these data solely to provide, operate, back up and maintain the application and to provide support. We do not use them for our own purposes, in particular not for advertising, profiling or training artificial intelligence systems, and we do not disclose them to third parties except in the cases set out in section 6.

4.1 Images

Uploaded images are reduced in size and saved anew. In the process, embedded metadata such as the location and time of capture and the camera model are removed.

4.2 Change log

The change log serves to make inventory management traceable and auditable. It is not intended for monitoring the performance or behaviour of employees. The organisation determines, by means of roles, who may view it.

4.3 Connecting the organisation's own systems

The following connections are optional and are set up by an authorised person of the organisation. Inventaris reads data from the connected systems; the only thing it writes back is the notifications in Microsoft Teams described below. Synchronisation runs once a day during the night and, where required, when triggered by an authorised person.

• Microsoft 365 (Entra ID, Microsoft Graph): sign-in with the Microsoft account and import of the members of specified security groups, with object ID, name, e-mail address, position, department, location, telephone number, personnel number and, where applicable, profile picture. When signing in via Microsoft, we do not receive a password.
• Microsoft Teams: in the Inventaris tab, people work with Inventaris as in the web application, with the same rights. Sign-in takes place with a token issued by Microsoft, the authenticity of which we verify. Loan reminders and notices as well as notices on tickets and damage reports can also appear as a notification in the Teams activity feed; for this we send Microsoft the person’s identifier, the inventory numbers, the date and, for tickets, the subject. The organisation can switch off these notifications in the settings.
• Device management (Microsoft Intune, Jamf Pro, Jamf School, Mosyle): import of the device inventory with serial number, model, operating system, device name, status and, depending on the provider, the assigned person. The account set up for this purpose requires read-only permissions.
• UniFi (Ubiquiti): import of network devices, ports and port assignments, including MAC addresses and device names of connected end devices. Depending on the set-up, the connection is made directly to the organisation's controller or via Ubiquiti's cloud interface (api.ui.com); in the latter case, the data are transmitted via Ubiquiti's servers.

The organisation and the respective provider are responsible for the processing within the connected systems themselves; their contractual and privacy provisions apply. We store the access credentials for these systems in encrypted form.

4.4 Data of children and young people

Where a school uses Inventaris, personal data of minors is processed. Every loan is booked to a staff sheet; without a staff sheet, no loan is possible. For every pupil who borrows a device, a staff sheet is therefore stored in Inventaris: at least with first and last name, usually supplemented by class, personnel number and the e-mail address to which return reminders are sent. In addition, the loans are stored with devices and due dates. If the school uses the Microsoft 365 connection, the staff sheets are created from its directory and linked to the pupil’s Microsoft 365 account; the data taken over is as listed in section 4.3. Without this connection, the school enters the staff sheets itself. A user account with sign-in is only required if pupils are to use Inventaris themselves, for example to view their loans. The school is the controller of this data; we process it solely on its behalf and do not direct our service at children.

4.5 Library and teaching materials

If a school books the Library or Teaching materials add-ons, we additionally process, on its behalf, which books and teaching materials a person has borrowed, returned or placed on hold. What someone reads says a lot about them. This information is therefore visible only to the person themselves and to whoever runs the library at the school; students see only their own loans and holds. Students receive an account with the “Student” role only if the school provides for it, either through the group “SiGR-Inventaris-SuS” in its Microsoft 365 directory or by hand. With this account they can search the library catalogue and borrow and place holds on books themselves, nothing else. When a book on hold is returned, a message is sent to the stored email address. The history is subject to the same retention period as all loans (section 8): once it expires, the name is removed from loans and holds.

When a title is added by its ISBN, we look up the ISBN at ISBNdb (ISBNdb.com, USA), the German National Library (Germany) or Open Library (Internet Archive, USA). Only the ISBN is transmitted, no personal data and no indication of which school is asking. The cover image is downloaded once and stored with us in Switzerland; displaying the catalogue calls no third-party service.

Swyron AI (add-on)

If an organisation books the Swyron AI add-on, authorised persons can ask questions about the inventory in plain language. To answer them, we use a language model from Anthropic, PBC (USA) as a sub-processor. If the organisation also switches on reply suggestions for tickets, the subject, description and comments of the ticket concerned are sent as well, and when revising also the draft in the comment field; recognised personal names, email addresses and telephone numbers are replaced by placeholders beforehand. For questions about software that the organisation manages in Inventaris, the name, vendor, version, platforms, licence type and term are sent, together with the documents the organisation has released for this and, only if it allows it field by field, the account (user name or email address) and notes; recognised personal names, email addresses and telephone numbers in documents and notes are replaced by placeholders beforehand. Licence keys and passwords are never transmitted. For questions from administration about IT contracts, only contracts the organisation releases one by one are sent: title, partner, category, service, costs, term and deadlines; notes only with a separate release, contact persons never. Documents the organisation uploads under Documentation → Documents (such as instructions or procedures) are read by Swyron AI as long as the release is set on the individual document (set by default, can be switched off per document): the title and matching passages of the text are then sent during the conversation; recognised personal names, email addresses and telephone numbers are replaced by placeholders beforehand. We recommend not releasing documents containing confidential personal data, such as personnel files. Unless the add-on is booked or enabled for the trial, nothing is transmitted.

We transmit the question and the inventory details needed to answer it: inventory numbers, products, categories, rooms, states, dates and due dates. Persons appear only as a random placeholder (such as “P-4821”), assigned anew for each conversation. Names in the question that are recorded in the organisation’s staff records are replaced by this placeholder before sending.

Before a question is answered, a smaller language model from the same provider (Swyron Guard) checks whether it concerns Inventaris. For this, the pseudonymised question is sent, together with the previous question and answer from the same conversation and the names of the software managed and the titles of released documents, so that questions about them are recognised too; no other inventory data is sent. Questions that do not concern Inventaris are declined and do not reach the language model that writes the answer.

Staff numbers are not transmitted, nor are names, email addresses and telephone numbers insofar as they are recognised; these are replaced by placeholders. Free texts from the inventory, such as descriptions, notes and subjects, are only sent in shortened form and with the same placeholders where a question requires them. In addition, the content listed above that the organisation itself switches on or releases is sent: reply suggestions for tickets, information on software, documents and IT contracts. The mapping of placeholders to persons stays in the session on our server in Switzerland; Inventaris only inserts the names into the answer there. We do not store questions or answers beyond the session. We record the number of questions per month for billing, in the log of transmitted data which areas and fields a query covered, and, per account and hour, how many questions were asked and how many were declined by the preliminary check; in each case without the wording of the questions. The count per account serves the limits per person set by the organisation and the detection of misuse. Under its terms for business customers, Anthropic does not use the transmitted content to train its models.

Pseudonymisation recognises the names recorded in the organisation, common first names in Switzerland (list of the Federal Statistical Office), names after a form of address or a greeting, a surname after a first name, e-mail addresses, phone numbers and the name of the organisation. All of these are replaced by placeholders and are not transmitted. We recommend including in questions only the information needed for the answer.

Every answer is marked as created by Swyron AI and should be checked before use. We only store a question and answer beyond the session if someone reports the answer, for example because it is incorrect or inappropriate: we then keep the question and answer in the version with placeholders, together with the chosen reason, the organisation and the reporting account, so that we can follow up on the report. They contain no names, e-mail addresses or phone numbers. We delete handled reports after twelve months, and all of them together with the organisation.

If an account is declined unusually often in one day, or an organisation asks many times its usual number of questions in one day, we record this with the organisation, account, day and number, and receive an email notification that includes the email address of the account concerned. This lets us check whether Swyron AI is being misused. The wording of the questions is not included.

Swyron AI for product images

So that devices without an EAN or manufacturer number also get a product image, we ask Swyron AI to suggest the matching manufacturer model for organisations that have booked the Swyron AI add-on. This is at our expense and does not count against the organisation’s quota. Only the product name, brand and category are transmitted, without the organisation; names of people and contact details in them are replaced by placeholders. We check the suggestion against the product catalogue and confirm it manually before an image is assigned. We do not change the organisation’s product data.

5. Obligation to provide data

You are under no statutory or contractual obligation to provide us with personal data. However, without the information required for registration, the contract and billing, we cannot conclude or perform a contract, and without the technically necessary data, such as the IP address and the session cookies, the website and the application cannot be used. Whether employees are obliged to provide data to their organisation is governed by the organisation's own rules.

6. Recipients

Within our company, only those persons who need access to personal data for operation, support or billing are granted it. In addition, the following categories of recipients receive personal data:

The hosting provider and the e-mail service provider process the data as our processors in accordance with our instructions and are contractually bound to confidentiality and data security.

We disclose personal data to other parties only where we are legally obliged to do so, for example on the basis of a lawful order of an authority or a court, or where this is necessary for the establishment, exercise or defence of legal claims. If an official order concerns a customer's data, we inform that customer to the extent legally permissible.

We do not sell personal data and do not disclose them to third parties for advertising purposes.

7. Disclosure abroad

The data of the website and the application are stored in Switzerland. Switzerland is covered by an adequacy decision of the European Commission; the transfer to Switzerland is therefore permitted for persons in the EU (Art. 45 GDPR).

Personal data are transferred abroad in the following cases:

• Cloudflare Turnstile (section 3.3): Cloudflare, Inc. is certified under the EU-U.S. Data Privacy Framework and its Swiss extension (Swiss-U.S. Data Privacy Framework). For certified companies, Switzerland (Annex 1 DPO) and the EU (Art. 45 GDPR) recognise an adequate level of data protection. In addition, the European Commission's standard contractual clauses apply.
• Connections of the organisation (section 4.3): Microsoft, Jamf, Mosyle and Ubiquiti may also process data outside Switzerland and the EU. The organisation's contracts with these providers are authoritative.
• Password check (section 3.7): only a fragment of a hash is sent to the “Pwned Passwords” service, from which neither the password nor the person can be determined. No personal data is transferred abroad in the process.
• Anthropic (USA), only for the Swyron AI add-on: pseudonymised questions and inventory details including shortened free texts, with placeholders instead of recognised names, email addresses and telephone numbers, ticket texts with placeholders instead of names if reply suggestions are switched on, for software the documents, notes and accounts released by the organisation, for IT contracts those released individually without contact persons, from the documentation the released documents with placeholders instead of recognised names, based on the standard contractual clauses in the provider’s data processing agreement.

You may obtain a copy of the respective safeguards by sending a request to the address given in section 1.

8. Retention period

Deleted data are removed from the application immediately but remain contained in the backups until the respective backup expires, for no longer than twelve months. We use backups solely for restoration after an outage.

A user account that is no longer needed is first disabled, as transactions such as loans or reports are linked to it. Once the retention period has expired, the staff sheet and the account are deleted and the name is replaced in the transactions. If a data subject requests deletion earlier, the organisation decides as the controller; we carry out its instructions.

9. Data security

Inventaris is developed according to the principles of Privacy by Design and Privacy by Default (Art. 7 FADP, Art. 25 GDPR). We take appropriate technical and organisational measures in accordance with Art. 8 FADP and Art. 32 GDPR, in particular:

• transmission exclusively over encrypted connections (HTTPS);
• minimum requirements for new passwords and a check against known data breaches, storage only as an irreversible hash;
• encrypted storage of the access credentials for connected systems, with the key kept outside the database;
• sign-in with a second factor, mandatory for owners and administrators with local sign-in and, at the organisation’s request, for all accounts; plus passkeys for all accounts with a password;
• e-mail notification when someone signs in from a new device and when the password or second factor changes, plus an overview of signed-in devices that can be signed out individually;
• separation of the data of different organisations in every database query;
• access by our staff to customer data only to the extent required for operation, troubleshooting and support; every request to the operator area is logged and kept for twelve months;
• daily backup of database and attachments with a completeness check, encrypted (AES-256) and stored outside the publicly accessible area; the decryption key is not on the server;
• automatic deletion of former persons after a period the organisation can set, twelve months by default (section 8).

Further information is available under Security and operations.

10. Your rights

Within the scope of the applicable law (Art. 25 et seq. and 32 FADP, Art. 15 to 21 GDPR), you have the following rights:

• Access to information on whether and which personal data we process about you;
• Rectification of inaccurate or incomplete data;
• Erasure of your data, unless a retention obligation or an overriding interest prevents this;
• Restriction of processing;
• Delivery and transfer of the data you have provided to us in a commonly used electronic format;
• Withdrawal of consent with effect for the future, where processing is based on your consent.

Please send your request to the address given in section 1. To prevent misuse, we may require reasonable proof of identity. We respond to requests free of charge and, as a rule, within 30 days. If this is exceptionally not possible, we will inform you within that period of when you will receive a response.

If your request concerns data that an organisation keeps in the application, please contact that organisation (section 2.2). We assist it in responding.

You also have the right to lodge a complaint with a data protection supervisory authority: in Switzerland with the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, www.edoeb.admin.ch; in the EU in particular with the supervisory authority of your habitual residence, your place of work or the place of the alleged infringement.

11. Automated individual decisions and profiling

We do not make any decisions based solely on automated processing within the meaning of Art. 21 FADP and Art. 22 GDPR, and we do not carry out profiling. The application calculates deadlines, stock levels and current values; decisions about persons, for example on requests, are made by humans. We use an artificial intelligence system only in the Swyron AI add-on, and only if an organisation has booked it (section 4, “Swyron AI”). It answers questions about the inventory and makes no decisions about persons.

12. Data security breaches

If a data security breach concerns data for which we are the controller, we report it to the FDPIC as soon as possible if it is likely to result in a high risk for the data subjects (Art. 24 FADP). Where the GDPR applies, we report it to the competent supervisory authority, where feasible, within 72 hours, unless it is unlikely to result in a risk for the data subjects (Art. 33 GDPR). Where a high risk is likely, we also notify the data subjects (Art. 34 GDPR).

If a breach concerns data that we process on behalf of an organisation, we inform the organisation concerned without delay (Art. 24(3) FADP, Art. 33(2) GDPR) and assist it in fulfilling its reporting and notification obligations.

We welcome reports of security vulnerabilities; contact details are available under Security and operations.

13. Data processing agreement

To use Inventaris, the organisation concludes a data processing agreement with us under Art. 9 FADP and Art. 28 GDPR. It governs in particular the subject matter and duration of the processing, instructions, confidentiality, technical and organisational measures, sub-processors, assistance with data subject requests, and the return and deletion of the data at the end of the contract.

The agreement, including its annexes, is available at inventaris.ch/avv. We provide a signed copy on request. We announce the engagement of new sub-processors in advance; the organisation may object to it.

14. Changes to this privacy policy

We amend this privacy policy when our processing activities or the legal situation change. The version published on this page at any given time is authoritative. We additionally inform our customers by e-mail of material changes, such as new purposes or new sub-processors.