Privacy Policy for the Use of the “Saley” App
1. Introduction
Protecting your privacy and data is important to us. This Privacy Policy explains how FirstMedia Solutions GmbH (hereinafter “Saley,” “we,” “us”) processes your personal data when you use our Software-as-a-Service platform “Saley” (hereinafter “App” or “Platform”).
This statement complies with the information requirements under the revised Swiss Data Protection Act (nDSG), which took effect on September 1, 2023, as well as—where applicable—Articles 13 and 14 of the EU GDPR. (kmu.admin.ch)
2. Data Controller
FirstMedia Solutions GmbH
Lerchenfeldstrasse 3
CH-9014 St. Gallen
Email: info@saley.ch
Phone: +41 71 230 10 30
3. Categories of Processed Data
| Data Category | Examples | Source |
|---|---|---|
| Registration & Contact Information | First Name, Company Name, Email Address, Phone Number | Directly from the user |
| Contract & Billing Information | Subscription type, billing address, Stripe token, payment status | Direct / Stripe |
| Usage Data | Log files, timestamps, IP addresses, browser information, API calls | Automatically |
| Table of Contents | Uploaded documents, images, comments, links | Directly from the user |
| Integration Data (optional) | Data records from Bexio (e.g., contacts, quote IDs) | Bexio API |
4. Purposes and Legal Bases
| Purpose | Legal Basis (nDSG / GDPR) |
| Deployment & Operation of the App | Performance of a Contract (Art. 31, para. 2, subpara. a nDSG / Art. 6, para. 1(b) GDPR) |
| Payment Processing via Stripe | Performance of the Contract |
| Safety & Abuse Prevention | Overriding legitimate interest (Art. 31, para. 1, nDSG / Art. 6, para. 1(f), GDPR) |
| Product Improvement & Error Analysis | Legitimate Interest |
| Marketing Communications (Newsletter) | Consent (Art. 31, para. 1, nDSG / Art. 6, para. 1, a GDPR) |
| Statutory Retention Requirements | Legal Obligation |
5. Disclosure to Third Parties & Data Processors
We only share data when it is necessary to fulfill a contract, based on a legitimate interest, or to comply with legal obligations.
| Recipient | Purpose | Location |
| Stripe Payments Europe Ltd. | Payment Processing (Tokenized Credit Card Data) | Ireland / U.S. (SCC) |
| Hosting Providers (AWS EU-West / Hetzner) | Cloud Hosting & Database | EU / Switzerland |
| Email provider (SendGrid) | Transactional emails, 2FA codes | United States (SCC) |
| Bexio AG (optional) | CRM/ERP Integration | Switzerland |
| Consultants & Auditors | Tax & Legal Consulting | Switzerland / EU |
Contracts have been entered into with all data processors in accordance with Art. 9 nDSG and Art. 28 GDPR.
6. Data Transfers to Third Countries
Data may be transferred to countries without adequate data protection (e.g., the U.S.). In such cases, we rely on EU Standard Contractual Clauses (SCCs) or other recognized safeguards to ensure an adequate level of data protection.
7. Retention Period
We store personal data only for as long as is necessary for the respective purpose.
8. Safety
TLS encryption for all connections
Data at rest (RDS snapshots, S3 storage) encrypted with AES-256
Two-Factor Authentication (optional)
Role-Based Authorization System
Regular Penetration Tests & Patch Management
Data breaches must be reported to the FDPIC within 72 hours if there is a high risk. (privacydesk.ch)
9. Rights of Data Subjects
You have the right to:
Information Regarding Processed Personal Data (Art. 25 nDSG)
Correction of Inaccurate Data
Deletion or anonymization (“right to be forgotten”), provided there is no legal obligation to retain the data
Restriction of Processing
Data Portability (Art. 28 nDSG)
Objection to Direct Marketing
Complaint to the supervisory authority. The competent authority is:
Federal Data Protection and Information Commissioner (FDPIC)
Feldeggweg 1, CH-3003 Bern
www.edoeb.admin.ch (edoeb.admin.ch)
10. Cookies & Tracking
The app uses session cookies (authentication tokens) and analytics cookies (Matomo, self-hosted). It does not use Google Analytics. You can disable cookies in your browser; the app will remain partially functional, but you will not be able to log in without a session cookie.
11. Automated Decision-Making
There is no exclusively automated decision-making with legal effects within the meaning of Art. 21 nDSG / Art. 22 GDPR.
12. Links & Document Sharing
The app generates a cryptographically random link for each document sent. The customer is responsible for ensuring that the link is shared only with authorized individuals. Links can optionally be password-protected or set with an expiration date (default: 12 months). Access is logged (timestamp, IP address, user agent).
13. Changes to This Privacy Policy
We may update this Privacy Policy at any time. In the event of significant changes, we will notify registered users by email at least 30 days before the changes take effect.
End of the Privacy Policy