Your data is safe with us

Last updated: 26 August 2026

Data Controller

Data Processing Principles

We process your personal data in accordance with the provisions of the Swiss Federal Data Protection Act (nDPA, in force since September 1, 2023). Insofar as we provide services for persons in the EU or specifically target EU citizens, we additionally apply the European General Data Protection Regulation (GDPR).

We observe the following principles:

• Lawfulness, fair processing and transparency
• Purpose limitation
• Data minimization
• Accuracy
• Storage limitation
• Integrity and confidentiality

Types of Data Processed

We process the following categories of personal data in connection with our services:

• Contact data: Name, address, phone number, email address
• Consultation data: Information in the context of administrative assistance
• Technical data: IP address, browser information, access times
• Usage data: Pages requested (from the server logs)

Purposes and Legal Bases for Data Processing

Contact and Consultation

Purpose: Processing of inquiries, appointment scheduling, provision of administrative services such as debt counseling, budget advice and assistance with official procedures

Legal basis: Switzerland (nDPA): we process the data to initiate and perform the engagement, in compliance with the processing principles (Art. 6 nDPA); where a justification is required, it is based on your consent or the performance of the contract (Art. 31 nDPA). EU (GDPR, where applicable): Art. 6(1)(b) (contract performance), (a) (consent) and (f) (legitimate interest).

Retention period: Until complete completion of the assignment, minimum 10 years due to legal retention requirements

Website Operation and Optimization

Purpose: Provision of the website, a simple count of page views, improvement of user experience

Legal basis: Switzerland (nDPA): our overriding legitimate interest in the secure operation and optimisation of the website, in compliance with the processing principles (Art. 6 nDPA; justification under Art. 31 nDPA). EU (GDPR, where applicable): Art. 6(1)(f) (legitimate interest).

Retention period: See specific sections on individual technologies

Web Analytics and Server Logs

This website does not use any third-party analytics services. Google Analytics was in use until 26 August 2026. It has been removed completely; no data is transmitted to Google any more.

As with any web server, our host Infomaniak (Switzerland) records technical access data: IP address, time of access, page requested, amount of data transferred, browser type and operating system. These logs serve secure operation, troubleshooting and a simple count of page views. They are not combined with other data sources and are not used to identify individual visitors.

Legal basis: Switzerland (nDPA): overriding legitimate interest in the secure operation of the website, observing the processing principles (Art. 6 nDPA; justification under Art. 31 nDPA). EU (GDPR, where applicable): Art. 6(1)(f) (legitimate interest).

Retention period: Access logs are retained and automatically deleted according to our host's rules.

Clicks on contact options — phone number, email address, WhatsApp and SMS — are counted on our own server. Only the date, the hour, the type of link, the page requested and the language are recorded. No cookie, no identifier and no IP address is created; two clicks by the same person cannot be linked to one another. These figures serve us solely to judge whether the contact options are being found. The monthly count files remain on our server and contain no personal data.

Cookies

This website sets no cookies. Nor does it use comparable techniques that store or read data on your device — no local storage, no tracking pixels, no recognition identifiers.

Opening a page establishes no connections to third parties. Fonts and styling files are hosted on our own server. A connection to LinkedIn or WhatsApp is only established if you click the corresponding link yourself.

If you visited our website earlier, while Google Analytics was still in use, cookies from that time may remain on your device. They will be deleted automatically on your next visit.

“Administrative Help” Portal (assistent.administrative-hilfe.ch)

Description

In addition to this website, we operate a protected portal. There, deputies (Beistände) and their clients upload documents, organise them and keep track of deadlines. Access is only possible with a personal account. Anyone using the portal as a deputy on behalf of their clients additionally concludes a data processing agreement with us; the list of service providers below forms part of that agreement.

Where the Data is Stored

All documents, case files, the database and every backup copy are stored exclusively in Switzerland, with Infomaniak Network SA in Geneva and Winterthur.

Service Providers Engaged

We work with the following service providers to operate the portal. There are no other service providers that receive your clients' data.

What Leaves Switzerland — and What Does Not

• Text recognition (Mistral AI, France): the pages of an uploaded document and the text extracted from it. This is the only route by which document contents leave Switzerland.
• Error reports (Sentry, Frankfurt): technical details about a program error. Before dispatch, the portal automatically removes the details relating to the person, the content of the request and all values from the error trace. If that cannot be carried out, the report is discarded instead of sent.
• Push notifications (Google, worldwide): a device identifier of your mobile device, a short notice text and an internal document number. The notice texts are deliberately kept general, for example “A document has been processed.” or “You have 3 overdue documents”. You can switch push notifications off in the settings; the portal then transmits no further push notifications to Google. Your device's registration with the push service persists until you sign out of the app.
• Calendar synchronisation (Apple, worldwide): the title, description and location of your appointments. This route only arises if you connect your Apple calendar yourself in the settings and store your own credentials for it. If you connect no calendar, nothing is transmitted to Apple; you can delete the connection again at any time.

Not transmitted to Google and Sentry: document contents, file names, names of individuals, addresses, AHV social security numbers and health data.

Embedded Design Elements

The four connections named above are established by the portal itself. To be distinguished from these are requests triggered by your browser: on individual public pages — among them sign-in, registration and password reset — as well as in internal administration tools, fonts and design libraries from content delivery networks are embedded (Tailwind, Bunny Fonts, jsDelivr, d3js). In doing so, your IP address becomes visible to the network concerned. No documents, case files or master data are transmitted in the process. We are working on delivering these files from our own server as well.

Legal Basis and Retention Period

Legal basis: Switzerland (nDPA): processing for the fulfilment of the mandate relationship, observing the processing principles (Art. 6 nDPA), where necessary based on your consent or the performance of the contract (Art. 31 nDPA). EU (GDPR, where applicable): Art. 6(1)(b) and (f). Where we act on the mandate of a deputy, we process their clients' data as a processor pursuant to Art. 9 nDPA.

Retention period: For as long as the account exists. After it is closed, 90 days are available for export, after which the data is irreversibly deleted — with the exception of records subject to a statutory retention obligation (in particular accounting records, 10 years under Art. 958f CO).

Your Rights

You have the following rights regarding your personal data:

Right of Access (Art. 25 nDPA / Art. 15 GDPR)

You can request information about the personal data we process about you.

Right to Rectification (Art. 32 nDPA / Art. 16 GDPR)

You can request the correction of inaccurate data or the completion of incomplete data.

Right to Erasure (Art. 32 nDPA / Art. 17 GDPR)

You can request the deletion of your personal data, provided no legal retention obligations exist.

Right to Object (Art. 30 nDPA / Art. 21 GDPR)

You can object to the processing of your personal data insofar as it is based on legitimate interests.

Data Security

We take appropriate technical and organizational measures to protect your personal data:

• SSL/TLS encryption of the website
• Regular security updates
• Access restrictions to data
• Employee training in data protection
• Secure storage of physical documents

Right to Complain

You have the right to complain to a data protection supervisory authority about the processing of your personal data:

Switzerland

Federal Data Protection and Information Commissioner (FDPIC)
Feldeggweg 1, 3003 Bern
Phone: +41 58 462 43 95
Email: info@edoeb.admin.ch

Special Notes for Administrative Services

Updates and Changes to this Privacy Policy

This privacy policy is currently valid. Due to the further development of our website and services, it may become necessary to change this privacy policy.

The current privacy policy can always be accessed on the website at www.administrative-hilfe.ch/en/privacy.