Privacy policy
The German version is authoritative. Deutsch
Version: 21 September 2026 · in accordance with the revised Swiss Federal Act on Data Protection (revFADP)
The protection of your personal data is important to us. Below we inform you about which data we process in connection with this website (pruvia.ch), the public system tour (demo.pruvia.ch), the application (app.pruvia.ch) and our information and campaign e-mails.
1. Controller
2. Data processed
a) When visiting the website
When the website is accessed, technically necessary data is recorded by our hosting provider in server log files (e.g. truncated IP address, date/time, page accessed, browser type). This serves secure and stable operation and is based on our legitimate interest.
b) pruvia assistant on the website
On the website you can ask questions about the software via a chat assistant. Your input is transmitted to an AI service for answering (see section 4). No sign-in is required for use. To limit requests (protection against misuse and cost cap), we hold your IP address briefly – for at most one hour – in the server’s working memory; it is neither stored permanently nor linked to your questions.
c) Contacting us
If you contact us by e-mail, we process the information you provide in order to handle your enquiry.
d) Use of the application (app.pruvia.ch)
A user account is required for the application. In this context we process account and usage data as well as the engagement and audit data you enter. With regard to the engagement data you enter, we act as a processor; you remain the controller as auditor/customer. The application keeps an activity log (who performed which action and when, e.g. sign-in, approval, deletion) with IP address and browser identifier; it serves traceability and the security of your firm. For retention, see section 11.
3. Purposes and principles
We process personal data in good faith, proportionately and for specified purposes – for the operation, security and further development of the website and application and for answering enquiries.
4. Disclosure to third parties / processors
We use carefully selected service providers that process data on our behalf:
- Hosting: server infrastructure in Switzerland (Exoscale).
- AI service (assistant): Amazon Web Services (AWS) – requests run via AWS Bedrock, processing within the EU (Zurich endpoint, eu-central-2) on Anthropic Claude models. Processing takes place within the EU (model inference EU-wide, Zurich endpoint); the data does not leave the EU area and is not used to train models. For text-based requests, identifying details are pseudonymised before sending; for documents (PDF/image) this is not possible, as they must be read in the original.
- E-mail dispatch: Amazon Web Services (Amazon SES) in the Zurich region (eu-central-2). Bounce and complaint notifications from the receiving system are assigned to the e-mail address and block further mailings.
- Digital signature: Skribble (Switzerland), if you use the signature function; for qualified signatures, the certificate service of Swisscom (Switzerland) is involved. Alternatively DeepSign/DeepBox (Switzerland), if your firm has connected this provider.
- Demo appointments (website): if you book a demo appointment via our website, we transmit your name, e-mail address and appointment time to Zoom Communications (USA) to create the video conference appointment. Zoom’s EU standard contractual clauses apply. To determine available slots, our system checks the free/busy times of our staff’s calendars at Google (Google Ireland Ltd.); no visitor data is transmitted to Google and no appointment content is read.
- Own storage (optional): if your firm connects its own document storage (WebDAV/DeepBox), documents are transferred directly there – to the provider chosen by your firm.
Retrievals without personal reference or from authorities: the application retrieves exchange rates from the FTA and – as a fallback source – from the public service frankfurter.app (ECB data); no personal data is transmitted. For company queries (commercial register Zefix, FAOA register, OASI/FTA information sheets), the company name is transmitted to the respective authority.
Disclosure to other third parties takes place only where required by law or necessary for the performance of the contract.
5. Support and assistant in the software
In the application, you can submit a support request via the help area or ask the assistant about operating the software. In doing so, we process:
- Context of the request: the route (page) accessed in the software, help area, software version and browser engine – so that we can classify your question and reproduce errors.
- Text of the request: pseudonymised – names of engagements and persons, OASI numbers, IBANs, e-mail addresses and telephone numbers are replaced by placeholders before processing.
- Screenshots: only if you expressly confirm that they are to be sent along.
Purpose and basis: performance of the contract – support is part of the software service. Access is restricted to the support team of fastview ag. For the automatic pre-processing of requests and the assistant’s answers, AI processing takes place within the EU (AWS Bedrock, Zurich endpoint, eu-central-2, see section 4); your input is not used to train models.
Retention: support requests (tickets) are deleted 24 months after closure, screenshots after 90 days. Access and deletion: gruezi@pruvia.ch.
6. Cookies and tracking
This website (pruvia.ch) uses no analytics, marketing or tracking cookies and does not embed any external analytics services (e.g. Google Analytics).
Technically necessary cookies are set by the application (app.pruvia.ch): a session cookie to maintain the signed-in session, a cookie to protect against request forgery (CSRF) and a cookie with the chosen area (fiduciary/audit, one year). The client portal sets a cookie with the case identifier. Without these cookies, sign-in or use is not possible; they contain no profile or advertising data.
Attribution cookie with a personal link: if you open the system tour (demo.pruvia.ch) via a personal link – from an information or campaign e-mail, an invitation or from our sales team – we set a cookie there (crm_lead, readable server-side only, 90 days). It assigns your visits in the tour to your e-mail address (section 7). Without a personal link, this cookie is not set. Objection: use the unsubscribe link in the e-mail or delete the cookie in your browser; no further attribution takes place thereafter.
To improve our offering, we carry out our own, anonymous reach measurement (“first-party”): we record, in aggregate, page views, buttons clicked, scroll depth and dwell time as well as the origin (referrer/campaign parameters). In doing so, no cookies are set and no IP addresses are stored in plain text – the session is anonymised server-side to a daily changing, non-reversible key. There is no cross-device recognition and no profiling, and the data is not passed on to third parties. If you send a “Do Not Track” signal, we collect nothing at all.
7. System tour and demo
The system tour (demo.pruvia.ch) can be used without registration. If you access it via a personal link, your e-mail address and – where known to us – your name and company are embedded in it (signed, valid for 90 days). We then record which functional areas (modules) you access in the tour and note this as an interest signal in our customer relationship system (section 10). Purpose: preparation of a conversation by our sales team and improvement of the product. Content you enter in the tour is sample data and is not evaluated.
End of attribution: attribution ends when the link and the cookie expire after 90 days, or earlier via the unsubscribe link in our e-mails or by deleting the cookie. If you open the tour directly via the website, no personal attribution takes place.
8. Information and campaign e-mails
Prospective customers who have contacted us, booked a demo, registered for an event or given us their address receive information and campaign e-mails about pruvia. These e-mails contain a tracking pixel (measures whether the e-mail was opened) and measured links (clicks run via a short redirect). Opens and clicks are assigned to your e-mail address; the measured links are valid for 90 days. Purpose: measuring the success of the campaign and follow-up by our sales team. If your e-mail program blocks the loading of images, no open measurement takes place.
Recipients with an address in a country domain of the EU or the EEA (e.g. .de, .at, .fr, .it, .eu) receive our e-mails without tracking pixel and without click measurement; the links lead directly to the destination.
Unsubscribing: every e-mail contains an unsubscribe link (“Receive no further e-mails”) and the standard unsubscribe mechanism of e-mail programs (List-Unsubscribe). Unsubscribing ends the mailings and the further attribution of opens, clicks and tour signals to your address.
9. Events
We invite you to events by e-mail with a personal link. A click on the invitation link is assigned to your e-mail address and noted in our customer relationship system. If you register, we create a contact (name, company, e-mail address, participation details) and list you on the event’s guest list; the details serve the organisation and running of the event and follow-up by our sales team. The unsubscribe link (section 8) also applies to invitations.
10. Usage signals in the customer relationship system (CRM)
We store contact details and the signals described in sections 7–9 (e-mail opens and clicks, modules accessed in the system tour, appointment booking, event click and registration, contact form) in our own customer relationship system in a database in Switzerland (Exoscale); we do not use a third-party CRM. Access is restricted to the sales and operations team of fastview ag. From the signals, the system derives a rating of interest; it is a pointer for our staff and does not lead to any automated decision with legal effect. The basis is our legitimate interest in approaching business customers; you may object to the processing at any time.
Retention: we retain usage signals for at most 24 months after the last signal; thereafter we automatically anonymise the personal reference. Access and deletion: gruezi@pruvia.ch.
11. Retention
We retain personal data only for as long as is necessary for the stated purposes or due to statutory retention obligations, and delete or anonymise it thereafter. In particular, the following periods apply:
- Activity log of the application (section 2 d): entries are deleted after 3 years; IP address and browser identifier are removed from the entry after 12 months already (the entry itself remains until deletion).
- Support requests: 24 months after closure, screenshots 90 days (section 5).
- Usage signals in the CRM: at most 24 months after the last signal (section 10).
- Personal links and attribution cookie: 90 days; unsubscribe links remain valid for one year.
- Engagement and audit data: in accordance with your firm’s requirements and statutory retention obligations (generally ten years).
12. Data security
We take appropriate technical and organisational measures: encryption in transit (TLS/HTTPS), mandatory two-factor sign-in, strict data separation – each customer firm receives its own, physically separate database, supplemented by access controls at database level – and regular backups.
13. Your rights
Within the scope of the applicable law, you have in particular the right to access, rectification and erasure and the right to object to processing. To exercise these rights, contact gruezi@pruvia.ch. You also have the right to lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC).
14. Amendments
We may amend this privacy policy at any time. The version published on this page is authoritative.