Privacy Policy

Note: This is a convenience translation. Only the German version of this Privacy Policy is legally binding. In case of any discrepancy, the German version prevails.

This Privacy Policy describes how Haus der Finanzen GmbH, under the Pontora brand, collects, processes and protects personal data. It applies to the Pontora website (pontora.ch), the Pontora platform, and to all user groups: trustees, SME Customers and their employees.

1. Responsible Entity

Responsible for the processing of personal data within the meaning of the Swiss Data Protection Act (revDSG — the revised Swiss Federal Act on Data Protection) and — where applicable — the EU General Data Protection Regulation (DSGVO / GDPR):

Company	Haus der Finanzen GmbH
Brand / Platform	Pontora — pontora.ch
Address	Freiburgstrasse 443, 3018 Bern, Switzerland
UID	CHE-462.314.248
Management	Besar Rexhepaj
Data protection e-mail	datenschutz@pontora.ch
General e-mail	info@pontora.ch

2. Applicable Law

This Privacy Policy is governed primarily by the revised Swiss Federal Act on Data Protection (revDSG) and the associated Data Protection Ordinance (DSV). Insofar as the EU General Data Protection Regulation (DSGVO / GDPR) applies to individual processing operations (in particular where persons resident in the EU are affected, or where employees of customers operating in the EU are processed), its provisions apply in addition.

3. What Data Is Collected — and For What Purpose?

3.1 When visiting the website pontora.ch

When visiting the public areas of pontora.ch, certain technical information is recorded automatically — as is customary for any website:

• IP address (truncated / pseudonymised);
• browser type and browser version;
• operating system;
• date and time of access;
• pages accessed;
• referrer URL (where the visitor comes from).

This data serves the technical provision of the website, security (protection against misuse) and aggregated statistics. It is not used to identify individual persons and is deleted or anonymised after a maximum of 90 days.

3.2 When using the Pontora platform

When using the platform, the following personal data is processed depending on the user group and module:

a) Trustee Customers

• identification and contact data of the trustee (name, company name, e-mail, telephone, UID);
• login and usage data (time of login, IP address, clients supervised);
• communication with the Provider (support requests, tickets).

b) SME Customers

• company master data (company, address, UID, industry, number of employees);
• contact data of the contracting parties and administrators;
• contract and billing data (subscription, payment information);
• login and usage data.

c) Employees of SME Customers

• personnel master data: first name, surname, date of birth, AHV number (Swiss social security number), marital status, address, contact data, photo;
• employment data: function, workload, start/end date, employment contracts, letters of termination, employment references;
• bank details for salary payment;
• salary and remuneration data, social insurance deductions;
• working time data, breaks, absences, holidays, overtime;
• sick notes and medical certificates (sensitive personal data);
• accident reports and accident records (sensitive personal data);
• uploaded documents (identity card/passport, residence permit, diplomas, further personnel-related documents).

d) Suppliers and creditors of the SME Customer

• company name, address, contact;
• invoice data and contents;
• bank details for payments;
• supporting documents (receipts, invoices, cash receipt images).

3.3 Who is the controller under data protection law?

With regard to the personal data that an SME Customer enters into the platform — in particular the data of its employees, suppliers and creditors — the SME Customer acts as the controller under data protection law. The Provider (Pontora / Haus der Finanzen GmbH) processes this data exclusively on behalf of the SME Customer on the basis of the Data Processing Agreement (DPA).

For the data directly related to the contractual relationship between the Provider and its Trustee Customers or SME Customers (e.g. account and billing data), the Provider is itself the controller.

Trustee Customers to whom an SME Customer grants access to its data process such data within the scope of their own mandate relationship with the SME Customer and are themselves responsible for it towards the SME Customer. The Provider merely provides the technical platform and is not responsible for the processing by the Trustee Customer.

4. Purposes of Data Processing and Legal Bases

The Provider processes personal data for the following purposes:

• provision, operation and further development of the Pontora platform;
• administration of user accounts, permissions and client structures (multi-tenant administration);
• provision of the OCR-supported receipt recognition (cash book, creditors) — see section 5;
• technical support and troubleshooting;
• billing and contract administration;
• compliance with legal obligations (in particular retention obligations under Art. 958f OR — Swiss Code of Obligations — and Art. 70 MWSTG — Swiss VAT Act);
• ensuring secure operation (detection of security incidents, prevention of misuse);
• information about product updates and service notifications to existing customers;
• anonymised statistical analyses for product improvement.

The legal bases are in particular:

• performance of contract (usage agreement) — for the provision and billing of the platform;
• legitimate interest — for ensuring operation, security and further development;
• legal obligation — for compliance with the retention obligations;
• instruction of the SME Customer — for the activation of optional AI functions (opt-in by the SME Customer).

5. AI-Supported Processing (OCR and Receipt Recognition)

5.1 The platform offers optional, AI-supported functions for the automatic recognition of receipt contents — in particular for the digital cash book and creditor receipt management. These functions are technically implemented via the AI model “Claude” of Anthropic, PBC, San Francisco/USA. The requests are routed to the model via the interface of OpenRouter, Inc., USA.

5.2 What happens: When a receipt is uploaded to the platform, the receipt image or PDF is transmitted via OpenRouter to the “Claude” model. Claude returns a structured recognition of the contents (e.g. date, supplier, amount, VAT). The return value is proposed within the platform; the definitive booking is made by the user.

5.3 Data protection aspects:

• the transmission to the USA is encrypted (TLS) and takes place on the basis of the Standard Contractual Clauses (SCC) of the EDÖB (the Swiss Federal Data Protection and Information Commissioner) or of the EU Commission;
• the requests are configured so that they are routed exclusively to model providers that do not use the transmitted data for training AI models and do not store it beyond the processing of the request;
• AI recognition is limited to cash and creditor receipts. Health data (e.g. medical certificates, accident reports) is not transmitted to AI functions;
• the AI function is deactivated by default and must be actively enabled by the SME Customer (opt-in).

5.4 No automated individual decision-making: The AI-supported recognition does not produce legal effects or significantly adverse effects for data subjects. It merely serves as a proposal; the final booking decision is always taken by a human (an employee of the SME Customer or its trustee). The conditions of an automated individual decision within the meaning of Art. 21 revDSG are therefore not met.

6. Data Exchange Between the User Groups

6.1 SME ↔ Trustee: An SME Customer may grant its trustee access to the platform. By activating trustee access, the SME Customer declares its consent that the Provider enables the corresponding data access for the trustee. The scope of access is governed by the permission concept of the platform; the SME Customer retains control and may restrict or withdraw access at any time.

6.2 SME → Employees: Employees of the SME Customer receive their own login and can access the functions released for them (self-service during onboarding, time recording, sickness/accident reporting). The data access of employees is limited to their own data.

6.3 Within the platform: No data transfer takes place between different SME Customers. The multi-tenant architecture technically isolates the data of the individual tenants from one another.

7. Disclosure of Personal Data to Third Parties

Personal data is disclosed to third parties only in the following cases:

7.1 Sub-processors (processors)

The Provider engages carefully selected sub-processors who are contractually bound to the same level of data protection:

Sub-processor	Purpose	Location	Data location	Basis for disclosure
Amazon Web Services EMEA SARL	Cloud hosting, data storage, compute	Luxembourg / EU	Zurich, CH (eu-central-2)	Switzerland; EU with adequate level of protection (Annex 1 DSV)
Supabase Inc.	Database platform, authentication, file storage	USA	Zurich, CH (on AWS)	Standard Contractual Clauses (SCC)
OpenRouter, Inc.	Routing of requests to the AI model (receipt recognition) — only where AI functions are activated	USA	USA	Standard Contractual Clauses (SCC)
Anthropic, PBC	AI model “Claude” for receipt recognition — only where AI functions are activated	USA	USA	Standard Contractual Clauses (SCC)
Zoho Corporation B.V. (ZeptoMail)	Sending of transactional e-mails (e.g. access credentials, notifications)	Netherlands / EU	EU	EU with adequate level of protection (Annex 1 DSV)
Stripe Payments Europe Ltd.	Processing of payments and subscriptions	Ireland / EU	EU and USA	EU with adequate level of protection; for onward transfers to the USA, Swiss-US Data Privacy Framework or SCC
Vercel Inc.	Hosting of the public marketing website (no platform data)	USA	EU (Frankfurt)	Standard Contractual Clauses (SCC)
Cloudflare Inc.	CDN, DDoS protection, DNS	USA	Global edge network	Standard Contractual Clauses (SCC)
EnacTon Infotech LLP	Software development — no access to productive personal data, exclusively anonymised test data	India	—	No disclosure of personal data

International data transfer: Personal data is disclosed abroad in accordance with Art. 16 et seq. revDSG. Disclosure to states with an adequate level of data protection pursuant to Annex 1 DSV (in particular the EU/EEA) takes place without additional safeguards. Disclosure to recipients in the USA takes place — insofar as productive personal data is affected at all — on the basis of the Standard Contractual Clauses (SCC) recognised by the EDÖB or of a certification under the Swiss-US Data Privacy Framework, supplemented by technical measures (encryption, access restriction, data minimisation). The relevant contractual documents can be requested from datenschutz@pontora.ch.

7.2 Legal obligations

The Provider discloses personal data to authorities or courts insofar as this is required by law or necessary for the establishment, exercise or defence of legal claims.

7.3 No disclosure for third-party marketing purposes

The Provider does not disclose personal data for marketing purposes or for commercial purposes of third parties. No data exchange takes place with affiliated companies or advertising networks.

8. Cookies and Tracking

8.1 Pontora platform (logged-in area)

In the authenticated area of the platform, only technically necessary cookies and comparable technologies (local storage, session storage) are used. These serve to ensure login, session management and basic functionality. They cannot be deactivated without making use of the platform impossible.

8.2 Marketing website pontora.ch

On the public marketing website, the following categories of cookies are used — insofar as the Provider activates them:

• technically necessary cookies (session, security) — no consent required;
• statistics cookies for anonymised reach measurement — only with consent;
• functional cookies (e.g. for storing the selected language) — only with consent.

On the first visit to the marketing website, the user is informed about the cookies used by means of a cookie banner and can make their selection. The selection can be adjusted at any time via the “Cookie settings” link in the footer.

No third-party advertising or tracking cookies: The Provider does not use advertising cookies, no Google Analytics, no Facebook pixel and no comparable third-party tracking tools.

9. Retention Periods

The Provider stores personal data for as long as is necessary for the fulfilment of the contractual and legal obligations:

Data category	Retention period
Contract data / master data	Duration of the business relationship + 10 years (Art. 958f OR)
Employee data	Duration of the employment relationship + 10 years, insofar as required by law
Health data (sickness notifications, medical certificates, accident reports)	Duration of the employment relationship + 5 years (Art. 328b OR, limitation period under Art. 128 no. 3 OR), unless the SME Customer sets a shorter period
Salary and social insurance data	10 years (Art. 958f OR, social insurance law)
Cash book and receipt data	10 years (Art. 958f OR, Art. 70 MWSTG)
Log files / audit logs	Maximum 12 months
Server access logs (web server)	Maximum 90 days, thereafter anonymised or deleted
Data after contract end	30-day right to retrieval, thereafter deletion — except for statutory retention
Backups	Overwritten upon expiry of the backup cycle, at the latest after 12 months

10. Data Security

The Provider protects personal data by means of appropriate technical and organisational measures (TOM) in line with the current state of the art. The most important measures:

• all productive personal data is stored on AWS in Zurich (Switzerland); processing outside Switzerland takes place only by the sub-processors listed in section 7.1 (in particular AI receipt recognition, e-mail delivery, payment processing);
• encrypted data transmission (TLS 1.2 or higher);
• encryption of data at rest (AES-256);
• role-based permission concept applying the principle of least privilege;
• mandatory two-factor authentication for administrative accounts;
• deactivation by default of super-administrator access to productive customer data;
• multi-tenant isolation at database level;
• daily automated backups;
• strict separation of development, staging and production environments;
• regular training of employees on data protection and data security.

A complete description of the TOM can be found in Annex B of the Data Processing Agreement. However, complete security of data transmission over the internet cannot be guaranteed — as is the case with any online service.

11. Sensitive Personal Data

Within the scope of the HR and personnel functions, the platform processes sensitive personal data within the meaning of Art. 5 lit. c revDSG, in particular:

• health data (sick notes, medical certificates, accident reports);
• data on social assistance or on administrative or criminal proceedings and sanctions, insofar as such data is recorded in the platform by the SME Customer (e.g. wage garnishments).

This data is treated with particular care, protected by additional permission restrictions and made accessible exclusively to the persons expressly authorised by the SME Customer. Responsibility for the lawful collection and for informing the data subjects lies with the respective SME Customer.

12. Rights of Data Subjects

Every data subject has the following rights under revDSG (and additionally under DSGVO / GDPR, where applicable):

• right of access (Art. 25 revDSG): information about the processing of their own personal data;
• right to rectification: correction of inaccurate data;
• right to erasure: insofar as no statutory retention obligation exists;
• right to restriction: restriction of further processing;
• data portability: release of the data in a common, machine-readable format;
• right to object: objection to the processing on legitimate grounds.

Employees of SME Customers should address their requests primarily to their employer (the SME Customer), which is the controller under data protection law for the processing of their data. Requests addressed to the Provider are forwarded to the controller.

Requests can be submitted in writing to datenschutz@pontora.ch. Proof of identity may be requested in order to verify identity.

Right to lodge a complaint: Every data subject has the right to lodge a complaint with the competent data protection authority. In Switzerland this is the Federal Data Protection and Information Commissioner (EDÖB), www.edoeb.admin.ch.

13. Minors

The Pontora platform is aimed at companies and their employees. Insofar as an SME Customer employs apprentices or interns under the age of 16 and records their data in the platform, the SME Customer is responsible for compliance with the special requirements for the processing of minors’ data (in particular the involvement of legal representatives). The Provider itself does not collect personal data directly from minors.

14. Amendments to This Privacy Policy

The Provider may amend this Privacy Policy if and insofar as its processing practices change or legal requirements so demand. The version applicable at any given time is available at pontora.ch. In the event of material changes, registered users will be informed by e-mail or by in-app notification.

---

Pontora · a product of Haus der Finanzen GmbH · datenschutz@pontora.ch · pontora.ch · Version 1.1 · 27 October 2026