Privacy
Translation. Only the German version is legally binding.
This notice applies to the website sbuero.ch and to the data for which SBüro itself is responsible (website, contact, invitation and registration, account and contract of the businesses, login, support, system e-mails). The business is responsible for the data that a business processes in SBüro about its own customers; SBüro processes them on its behalf (clause 7).
1. Controller
Swiss 3D Surface, Inh. Swirski (sole proprietorship, provider of SBüro)
Romanshornerstrasse 76b, 9320 Arbon
UID (enterprise identification number) CHE-429.712.336 · E-mail: post@sbuero.ch
No data protection advisor has been appointed.
2. Which data we process, for what purpose and for how long
| Area | Data | Purpose | Retention |
|---|---|---|---|
| Website | Server log: IP address, time, page accessed, browser identifier | Operation and security of the website | 14 days |
| The website does not set any cookies and does not load anything from third-party servers. | — | — | |
| Contact | Name, e-mail, content of your message | Responding | 2 years after the last message |
| Invitation and registration | Company name, UID, address, name of the owner, e-mail, language, package; result of the check in the public UID register | Conclusion of the contract; verification that the business exists | registrations not completed 90 days; otherwise as for the account |
| Account and contract | Company, UID, address, users (name, e-mail, role, language), subscription, subscription invoices and payments, security number for call-back, accepted version of the GTC and DPA | Performance of the contract, billing, protection of access | Term of the contract; subscription invoices and payment records 10 years (Art. 958f CO) |
| Login | Sessions (time, device class computer/telephone); second factor (secret encrypted, recovery codes only as a hash); necessary cookies of the app (session, protection against third-party forms, intermediate step of the two-factor login) | secure access | Session 12 hrs.; intermediate step 5 min. |
| Log of operator access | Time, reason and type of every access by SBüro to a business's data | Traceability towards the business | Term of the contract, in the business's export |
| Database connection log | Time and type of technical connections to the database | Security | 12 months |
| System e-mails | Recipient address, subject, content, delivery status of e-mails from the app (invitation, confirmation of a reply-to address, test message, security notices, subscription invoice, reminders and blocking of the subscription to the owner) | Delivery, error analysis, security | 12 months |
| Trial version | irreversible check values (hash, SHA-256) of UID, e-mail address and domain, without link to the business | protection against repeated use of the trial | 26 months from confirmation of the trial (about 24 months after deletion of the trial account) |
| Trial accounts without subscription | all data of the trial account | trial of SBüro | 30 days after the end of the trial read and export only, then announcement by e-mail and deletion after a further 14 days |
| Own AI key (only if entered) | the business's key with its AI provider, encrypted; usage counter without content | work of the characters with the business's AI | until the business removes it, at the latest end of contract |
| Business mailbox (only if connected) | incoming e-mails (read-only), access data encrypted | drafts of replies and quotes, sorting of mail | read e-mails like the business's other data; access data until disconnection |
| Voice | Text of answers read aloud; voice recordings from the connected phone | Reading aloud and voice input, on SBüro's server without any further service provider other than the server provider named in the data processing agreement | only during processing, not stored |
| Pilot (only with accepted pilot agreement) | Answers to the monthly survey (satisfaction, choice, short text) with user and month; chosen conversation appointments; anonymous usage statistics: counters per day and page without link to the business, without content and without data of the business's customers | Improvement of SBüro under the pilot agreement (consent by acceptance); not published, not passed on by name | Survey and appointments until the account is deleted; counters without personal reference |
We process these data to perform the contract with the business, for security and to fulfil legal obligations. We do not use them for advertising by third parties and not for training AI models.
3. Recipients
- Server provider (hosting of app and database) — Netherlands.
- E-mail provider (sending and receiving via post@sbuero.ch) — Italy.
- UID register of the Federal Statistical Office: query at registration (UID only).
- Authorities, only if we are legally obliged to do so.
- Only at the instigation of the business: If a business connects its own AI (via the interface or with its own key that the business enters in SBüro), the AI reads the areas released by the business; the data go to the AI provider chosen by the business (state depending on the provider). If a person of the business enters their calendar subscription into a calendar app, the appointments go to the provider of that app (state depending on the provider). The business is responsible for these disclosures.
- Payment provider (only if the business pays its subscription by card or TWINT): Stripe. Payment takes place on Stripe's payment page; SBüro never receives card or TWINT data, Stripe only tells SBüro whether and which amount was paid for which subscription invoice. Stripe processes the payment data as an independent controller under its privacy policy (stripe.com/en-ch/privacy). Payment by QR-bill remains possible.
- Business mailbox (only if the business connects it): SBüro reads incoming e-mails read-only to prepare drafts; the business is responsible for the content (clause 7).
4. Disclosure abroad
The data are stored on a server in the Netherlands; e-mails run via servers in Italy. The Federal Council has determined that both states provide adequate data protection (Annex 1 of the Data Protection Ordinance). Further disclosures abroad take place only via the AI or calendar app chosen by the business itself (clause 3). We will indicate a change of server provider in this notice in advance. Payments by card or TWINT: Stripe may disclose data to the USA; Stripe, LLC is certified under the Swiss-U.S. Data Privacy Framework (for certified companies the Federal Council has determined adequate data protection); standard contractual clauses apply in addition.
5. Data security
We protect the data with technical and organisational measures, including: separate data areas per business with automated tests, encrypted connections, access codes only as a hash, two-factor login for owners and fiduciaries/accountants, a visible log of operator access, and daily encrypted backup with restoration test. The overview is set out in the DPA (Annex A).
6. Your rights
- Access to your data (Art. 25 FADP), free of charge and generally within 30 days.
- Delivery or transfer of your data in a common electronic format (Art. 28 FADP).
- Rectification of inaccurate data (Art. 32 para. 1 FADP).
- Erasure and objection to processing, insofar as no retention obligation or contract precludes this (Art. 6 para. 4 and Art. 32 para. 2 FADP).
Requests to post@sbuero.ch; we may request proof of identity. You may contact the Federal Data Protection and Information Commissioner (FDPIC).
7. Customers of a business
If you have received a quote, invoice or e-mail from a business that uses SBüro, that business is responsible for your data. Please address any questions to it. SBüro processes these data only on its behalf (DPA) and does not use them for its own purposes.
8. Changes
We adapt this notice when our processing changes. The version published on sbuero.ch applies. Version of 30 October 2026.
The German version is authoritative.