Privacy policy

This privacy policy describes how Zerovia GmbH, Via Casti 52, 7151 Schluein, Switzerland ("ZEROvia", "we"), processes personal data when you use our websites or our platform. It applies to:

• the websites zerovia.ch, zerovia.academy and zerovia.ai,
• the platform zerovia.app with all modules,
• publicly published profiles and their embedding on customers' websites,
• data requests and data campaigns between buyers and suppliers.

We process personal data in accordance with the Swiss Data Protection Act (DSG) and, where applicable, the General Data Protection Regulation (GDPR).

1. Controller and EU representation

1.1 Controller

Zerovia GmbH, Via Casti 52, 7151 Schluein, Switzerland Email: privacy@zerovia.ch

1.2 EU representative under Art. 27 GDPR

iuro Rechtsanwälte GmbH t/a Prighter, Schellinggasse 3, 1010 Vienna, Austria Email: privacy@zerovia.ch · Portal for data subject requests: app.prighter.com/portal/zerovia

The EU representative accepts enquiries from data subjects and supervisory authorities and forwards them securely to us. For the portal, Prighter uses Hetzner Online GmbH (Germany) as its hosting provider.

2. Which data we process

2.1 Account and contact data

Name, business email address, telephone number, function, company affiliation, language, role in the account. When signing in with Google or Apple, we receive name, email address and a provider identifier.

2.2 Technical and usage data

IP address, log data, timestamps, browser and device information, two-factor settings, change log (audit log), release and consent logs.

2.3 Company and sustainability data

Company data (e.g. UID, VAT number, LEI, address, locations with coordinates, employees, industry), answers to baseline assessments and the ESG self-assessment, VSME information, carbon footprint, climate targets, product data and PCF, certificates, policies and other uploaded documents. This data is predominantly company data. Personal data is included to the extent that documents contain names, signatures or contact details.

The data comes from the customer itself or from public registers which the customer selects for import. ZEROvia does not issue scores, bands or maturity levels and is not a provider of ESG ratings within the meaning of Regulation (EU) 2024/3005.

2.4 Data in customer requests and data campaigns

When a buyer requests information from its suppliers via ZEROvia: name, email address, language and function of the supplier's contact persons whom the buyer imports; sending, opening and click events for invitations and reminders; status of the connection and of the releases.

2.5 Supplier data and screening

When customers record and screen their own suppliers: company and contact data of the suppliers, and findings from public web sources and registers, each with a quote and source. Findings may include names of officers or persons where these are named in public sources.

2.6 Contact person in the public profile

For publicly published profiles, the name, function and business email address of a contact person named by the customer may be published. The customer ensures that the person has been informed.

2.7 Communication and contract data

Email correspondence, support cases in the helpdesk, appointment bookings, enquiries via forms, contract and invoice data. Card payments are processed by Stripe; we do not receive complete card details.

2.8 AI-related data

Inputs to the AI functions, suggested texts and values, source references, logs for labelling AI-assisted content.

3. Purposes

3.1 Providing the platform

Accounts, roles and rights, operation of the modules, support, error diagnosis, security.

3.2 Profile and release per customer

Creating and maintaining the profile, connections with customers, release per customer and per section, revocation of releases, versioning of released data.

3.3 Public profile and automated indexing

If you publish a profile, the fields marked as public can be retrieved on zerovia.app and are made available as structured data (Schema.org) for search engines and AI answer engines. Fields marked as internal appear neither in the profile nor in the structured data. A distinction between individual indexing systems is not technically possible.

3.4 Data campaigns

Sending invitations and reminders in the name of the buyer ("Name of buyer via ZEROvia"), displaying progress, making the data released by the supplier available to the buyer, unsubscribing with one click.

3.5 Supplier screening

Recording, enriching and checking suppliers on behalf of the customer, with findings from public web sources and registers.

3.6 Partner access

Partners (e.g. fiduciaries, advisers) work in the client's account with the client's consent. The client releases areas and can withdraw the release with a 30-day notice period.

3.7 AI functions

Completion aids, answering questionnaires with source references, reading out certificates and evidence, profile texts and translations, supplier screening, the AI assistant ZAIA. Details in section 10.

3.8 Billing

Subscriptions, monthly or annual payment, billing of chargeable suppliers in the buyer plan.

3.9 Communication and sales

Responding to enquiries, arranging appointments, information about product changes, maintaining contacts in the CRM. Marketing emails only with consent or within existing business relationships, with the option to unsubscribe.

3.10 Website and improvement

Operation of the website, audience measurement pursuant to section 14, anonymous evaluations to improve the platform.

3.11 Applications

If you apply to us, we process your details and documents (contact details, CV, certificates, message) only for the application process. Applications submitted through the form on the Jobs page are stored on our website server and forwarded by email to jobs@zerovia.ch; applications sent by email go directly to jobs@zerovia.ch. They are not stored in the CRM and are only accessible to the people involved in the recruitment process. Once the process has concluded, we delete the documents no later than six months afterwards. With your consent, we keep them for up to twelve months for later positions; you can withdraw your consent at any time.

4. Legal bases

Where the GDPR applies, we rely on:

• Performance of a contract and pre-contractual measures (Art. 6(1)(b) GDPR): accounts, modules, profile, releases, data campaigns, billing, support, application process.
• Legitimate interest (Art. 6(1)(f) GDPR): IT security, abuse detection, further development, B2B communication, publication of the named contact person, screening of public sources in the customer's interest, audience measurement without cookies, AI assistant ZAIA on the website.
• Consent (Art. 6(1)(a) GDPR): publication of a profile, releases to third parties, partner access, newsletter, retention of applications for later positions. Consent can be withdrawn at any time with effect for the future.
• Legal obligation (Art. 6(1)(c) GDPR): retention obligations under the Swiss Code of Obligations (OR) and tax law.

Under the DSG, we process personal data in accordance with the processing principles of Art. 6 DSG; where necessary, we rely on the grounds of justification in Art. 31 DSG.

5. Profiles, releases and publication

• A profile is only public if you actively publish it. Visibility can be set for each field.
• Before a connection is confirmed, buyers see only public data. Afterwards, they see what the supplier releases per section.
• Releases can be withdrawn at any time; the withdrawal applies to future access. Data already downloaded remains the responsibility of the recipient.
• On unpublishing or deletion, we remove the profile page within 14 days and serve it with HTTP status 410. We endeavour to have indexed versions removed from search engines and AI answer engines, but cannot guarantee complete removal from their stores.

6. Disclosure to third parties

We only disclose personal data if you instruct us to (release per customer, partner access, publication), if it is necessary for the service (processors, section 8) or if we are legally obliged to do so. We do not check the legitimacy of recipients that you select yourself.

7. Roles

• ZEROvia is the controller for accounts, website, sales, billing, security and logs.
• ZEROvia is a processor to the extent that it processes personal data on behalf of a customer, in particular in uploaded documents, in imported supplier contacts of a data campaign and in supplier screening. In that case, the data processing agreement applies.
• In data campaigns, the buyer is responsible for the contact data it imports. The supplier is responsible for the data it records and releases.
• Partners are responsible for their own advice.

8. Processors and other recipients

The current list of processors, with registered office, purpose and transfer mechanism, is at Sub-processors. We announce changes there and by email to customers 30 days in advance.

For the website, sales and payments we also use:

Service	Purpose	Registered office / data location	Basis
cyon AG	Hosting zerovia.ch	Basel, Switzerland	Switzerland, no transfer to third countries
ZEROvia's own audience measurement, without third parties and without cookies	Audience measurement, objection possible at any time	Servers of zerovia.ch, no transfer to third countries	legitimate interest
CRM of Treibstoff Evolution GmbH, hosting Uvensys GmbH	Contacts, sales, partner billing	Germany	within the EU
Stripe Payments Europe, Ltd.	Payments, fraud prevention	Ireland; partly USA	SCC, Data Privacy Framework
Google Ireland Ltd. (Workspace)	Email, support	EU; partly USA	SCC, Data Privacy Framework
Calendly LLC	Appointment booking via the contact page	USA	Data Privacy Framework (EU-US and Swiss-US), SCC
Google, Apple	Sign-in with Google or Apple, only if you choose this	EU / USA	consent, Data Privacy Framework
Public registers (UID register, GLEIF, VIES)	Verification of company IDs	Switzerland, EU	public query
Anthropic PBC; from 01.12.2026 Mistral AI SAS	AI assistant ZAIA on zerovia.ch	USA; from 01.12.2026 France	SCC, TIA, technical protection measures; from 01.12.2026 within the EU

9. Transfers abroad

The platform and database run in Switzerland (Infomaniak, Geneva). Transfers to the EU and the EEA are based on the mutually recognised adequate level of protection. Transfers to other countries only take place with suitable safeguards, in particular the EU Commission's standard contractual clauses with the adjustments recognised by the FDPIC, supplemented by a transfer impact assessment and technical protective measures, or, for certified recipients, based on the Swiss-U.S. Data Privacy Framework.

10. AI-powered functions

10.1 What the AI does

The AI reads and suggests: answers to questionnaires with source references, values from invoices and evidence, details from certificates, profile texts and translations, findings in supplier screening, answers from the ZAIA assistant. You decide and approve. There is no automated individual decision with legal effect within the meaning of Art. 22 GDPR.

10.2 Providers

From 01.12.2026, we use Mistral AI (France, EU) for generative AI, with a contractual exclusion of the use of your data for training. Until 30.11.2026, we use OpenAI Ireland Ltd. and Anthropic PBC (USA).

10.3 Labelling

We label AI-assisted content in public profiles visibly and in a machine-readable form, in line with Art. 50 of Regulation (EU) 2024/1689.

10.4 Training

Customer data is not used to train publicly accessible AI models. We use anonymised aggregate data for internal improvement only after an explicit opt-in.

10.5 ZAIA on the website

On zerovia.ch you can ask the AI assistant ZAIA questions or have the current page summarised. In doing so, we process your inputs, the conversation so far (at most the last eight messages) and the language of the page; if you ask for a summary, also the text of the current page. We forward this data via our server to the AI provider: until 30.11.2026 to Anthropic PBC (USA) on the basis of standard contractual clauses, from 01.12.2026 to Mistral AI SAS (France). Your inputs are not used to train AI models.

We do not store the conversations. We use your IP address only briefly in working memory to limit misuse (at most 25 requests in 10 minutes), and do not pass it on to the AI provider. ZAIA does not set any cookies. Please do not enter confidential or especially sensitive personal data in the chat. Use is voluntary; the legal basis is our legitimate interest in answering questions about ZEROvia quickly.

11. Retention period

We store personal data for as long as an account exists, as long as it is necessary for the purpose, as long as statutory retention obligations apply (10 years for business books and records under Art. 958f OR), or until a permissible deletion is requested. After the end of the contract, we delete customer data within 30 days or return it, as set out in the DPA. We delete free accounts that have not been signed in to for 24 months; we inform you by email 30 days beforehand.

12. Security

We protect data with technical and organisational measures, including: encryption in transit and at rest, two-factor sign-in as standard, role-based access, support access to customer data only with a reason, a time limit and a log, change log, backups, monitoring. Certification to ISO 27001 is in preparation.

13. Your rights

Depending on the applicable law, you have the right to information, rectification, deletion, restriction, data portability and transfer, objection, and withdrawal of consent.

Requests to privacy@zerovia.ch. People in the EU can also contact the Prighter portal. You can lodge a complaint with the FDPIC or with the competent supervisory authority in the EU.

14. Cookies and audience measurement

The website zerovia.ch uses technically necessary cookies. For audience measurement we do not set any cookies: we count page views on our own server with an anonymous identifier that is recalculated every day, without third parties. You can object at any time: Turn off measurement. We do not set marketing or advertising cookies. The platform zerovia.app only sets technically necessary cookies for sign-in and session. Details in the cookie policy.

15. Data processing agreement

Where we process personal data on behalf of business customers, the data processing agreement forms part of the contract.

16. Embedding on customers' websites

• Static code with structured data: there is no connection to ZEROvia; we do not process any data of visitors.
• JavaScript embedding: visitors load a resource from zerovia.app. In doing so, we process technically necessary data (IP address, browser information, time) for delivery, without tracking cookies.

The customer informs the visitors to its website in its own privacy policy.

17. Changes

We amend this policy if the product, service providers or the law change. For material changes, we inform customers in advance. The current version is available at zerovia.ch/datenschutzerklaerung/.