Privacy Policy

This policy explains how Cyberesia SA, Rue de la Corraterie 5, 1204 Geneva, Switzerland, UID CHE-190.342.567 VAT (“Cyberesia”, “we”), processes personal data in connection with Organa, its websites and its services (the “Service”). It is based on the Federal Act on Data Protection (FADP) and, where it applies, the General Data Protection Regulation (GDPR).

Cyberesia is the controller for the account, billing, website usage and communication data described below. For the data that client firms and organisations enter into the Service (matters, documents, contacts, notes), the client is the controller and Cyberesia acts as processor, in accordance with the Terms of Service (section 8) or the agreement concluded with that client. Persons whose data appear in a matter should contact the firm concerned in the first instance.

Data we process

Purposes and legal bases

We process this data to perform the contract with the client, to ensure the security of the Service, to comply with our legal obligations, in particular accounting and tax obligations, and for our legitimate interest in operating, improving and protecting the Service. We send emails relating to the account and the Service. We do not sell personal data and do not use it for advertising purposes.

Client data and documents

Client data is hosted in Switzerland, in a separate database for each organisation. At the client’s choice, documents are kept either in its own storage (for example Google Drive, Microsoft 365, Dropbox, S3, WebDAV or kDrive), under the contract it has concluded with that provider, or in Organa storage, in Switzerland, encrypted with a key specific to the firm. Backups are encrypted and kept in Switzerland.

Artificial intelligence

When a user uses an AI feature, only the content necessary for the request (instruction, selected documents, matter context) is transmitted to the model provider chosen by the organisation: a provider offered by Organa, a provider for which the organisation supplies its own key, or a model hosted in Switzerland or by the organisation itself. When anonymisation is enabled, identifiers (email addresses, telephone numbers, IBANs, AHV and UID numbers and, depending on the setting, names) are replaced by placeholders before sending and restored in the response displayed.

Client data is not used to train AI models. We keep a log of calls (author, date, feature, model, consumption), without the content of the requests, for the organisation’s internal oversight.

Voice

Dictation can take place on the user’s device, without the audio being transmitted. When the organisation enables it, transcription is performed by a service hosted in Switzerland or by Gladia, in the European Union. A voice cannot be anonymised: the audio is transmitted as is to the chosen service.

Processors

We use the following processors. They are bound by confidentiality and data protection obligations. We publish any change to this list before entrusting data to a new processor.

The following services receive data only if the organisation enables them in its settings:

Providers that the organisation connects itself with its own credentials (document storage, AI model keys, bank, messaging) are not our processors: they act under the contract concluded between them and the organisation.

Transfers abroad

We disclose data outside Switzerland only in the cases described above. Where data is transferred to a country without a recognised adequate level of protection, in particular the United States, the transfer is based on the recipient’s certification under the Swiss-U.S. Data Privacy Framework or on recognised standard contractual clauses.

Security

We apply appropriate technical and organisational measures: encryption in transit and at rest, separation of data by organisation, two-factor authentication, access control and logging, encrypted backups in Switzerland.

Retention

Account data is deleted or anonymised within 90 days after the account is closed. Accounting records are retained for the statutory period of ten years. Client data is deleted in accordance with the Terms of Service (section 4.4). Technical logs are retained for a limited period, proportionate to their security purpose.

Cookies

The Service uses cookies necessary for its operation: session, security and language preferences. We do not use advertising cookies. If audience measurement is introduced, it will be described here and made subject to your consent where required by law.

Your rights

You may request access to your data, its rectification, erasure or handover, and object to certain processing, within the limits provided by law. Write to contact@cyberesia.com. You may also refer the matter to the Federal Data Protection and Information Commissioner (FDPIC) or, in the European Union, to the supervisory authority of your country.

Changes

We may amend this policy. The version published on this website is authoritative. We inform clients of material changes through the Service or by email.

Contact

Cyberesia SA, Rue de la Corraterie 5, 1204 Geneva, Switzerland. contact@cyberesia.com.