Privacy policy

Private quotation presentations

For personal quotations, we retrieve selected contact and quotation data from bexio and store a published version in our private Appwrite backend. This includes the client name, confirmed recipient address, scope, terms and amounts. The purpose is preparing and communicating a business relationship (Article 6(1)(b) GDPR where applicable). bexio processes the source data as part of our use of that service; our website retrieves it exclusively on the server.

Anyone who holds a private link can access its quotation. Please share it only with authorised people. Links expire and can be revoked. Access uses a technically necessary session cookie limited to the particular quotation, lasting no more than eight hours. Access controls and abuse prevention serve our legitimate security interests (Article 6(1)(f) GDPR). These pages do not use Matomo audience measurement.

Link expiry does not automatically delete business records. The retention criteria below apply to stored quotations, original and order PDFs, acceptance evidence and technical access records. When a quotation is accepted, we record the signatory name, authority, time, confirmed statements and immutable quotation digest; an order PDF becomes available only after successful creation. Customer and office messages may be processed through Resend. You may submit privacy requests through our contact form. This notice describes the processing but is not a compliance guarantee.

When you decline online, we record your name, authority, time, confirmations, quotation digest and any reason you choose to provide. We submit the decline status to bexio and notify our office through Resend with these decision details. The same retention criteria apply to decline records.

When you accept a quotation with optional extras, we record your name, the selected optional positions, privacy and acceptance confirmations, time and quotation digest. We submit the acceptance to bexio, create the order including the selected extras and email the order confirmation. The purposes and retention criteria above also apply.

Chat with Consolto

When requested, calculations are verified on the server using the package selection, project area and optional integration details. This does not create a customer record or a Bexio quotation. A downloaded price snapshot is saved locally on your device. Normal technical server logs are unaffected.

Our website and valid private quotation pages offer optional chat and conversations through the chat icon at the bottom right, using Consolto at client.consolto.com. The widget is not offered in the admin area or quotation previews. The widget loads automatically when you visit the page. On private quotation pages, it loads only after access is verified and the access token has been removed from the page address. Consolto may then process your IP address, browser information, current page address and anything you enter, and may use cookies or local storage. Microphone and camera access additionally require browser permission.

We do not automatically submit the client name, recipient address, quotation amounts or secret access token as contact details. You choose which details to share in the chat. A quotation view does not reliably identify the actual visitor. Contact us through our contact form for access or deletion requests. Further information about the provider’s processing is available in Consolto’s privacy policy.

1. Controller

You can submit privacy requests through our contact form.

2. Scope and legal bases

This notice explains how we process personal data when you visit our website, contact us or book an appointment. We comply with the Swiss Federal Act on Data Protection (FADP). Where the General Data Protection Regulation (GDPR) applies, we rely in particular on performance of a contract or pre-contractual steps (Article 6(1)(b)), legitimate interests (Article 6(1)(f)), legal obligations (Article 6(1)(c)) or your consent (Article 6(1)(a)).

3. Website operation and server logs

We operate the website and its Appwrite backend on our own infrastructure in a server cluster of Vautron Rechenzentrum AG in Germany. A request may generate server logs containing your IP address, date and time, requested address, transferred data volume, referrer, browser, operating system and technical status information.

We process these data to provide the website securely and efficiently, diagnose errors and prevent misuse. Under the GDPR, the legal basis is our legitimate interest in secure website operation (Article 6(1)(f)).

4. Contact form and communications

When you use the contact form, we process your name, email address, optional organisation, selected project type, message and enquiry language. Technical address data are processed briefly to limit abusive submissions.

Your details are transmitted using Resend and then received and handled in Google Workspace. We use them to respond and, where relevant, prepare or manage a business relationship. The legal bases are pre-contractual steps or contract performance (Article 6(1)(b)) and our legitimate interest in handling business enquiries (Article 6(1)(f)).

5. Appointment booking with Google Calendar

Google Calendar is blocked on the booking page by default. A connection to Google is established only when you actively load the calendar or follow the external link. Google may then receive technical access data and use cookies or similar technologies. If you book an appointment, we process your booking and contact details in Google Workspace to organise the appointment and communicate with you.

The embedded calendar loads with your consent. Processing of booking details is based on pre-contractual steps, contract performance and our legitimate interest in efficient scheduling.

6. Audience measurement with Matomo

We host Matomo on our own infrastructure in Germany. Matomo loads only after you expressly allow analytics cookies. It may process an IP address, viewed pages, time, referrer, device and browser information, and random visitor identifiers. We use this information to understand website usage in aggregate and improve our services. Matomo respects your browser's Do Not Track setting.

The legal basis is your consent (Article 6(1)(a) GDPR). You can withdraw it at any time for the future through the cookie settings in the footer.

7. Recipients and international transfers

We use carefully selected processors and have entered into the required data processing agreements:

• Vautron Rechenzentrum AG, Germany: data centre and infrastructure services.
• Resend: transmission of contact form messages; Ireland is selected as the region, while Resend primarily processes data in the United States under its contractual terms.
• Google Workspace and Google Calendar: email communication, appointment management and bookings. Depending on configuration and service delivery, Google may process data outside Switzerland and the EEA.

For transfers to countries without an adequate level of data protection, we rely on recognised safeguards, particularly standard contractual clauses and applicable Swiss supplements, unless a statutory exception applies.

8. Retention

We retain personal data only for as long as required for the relevant purpose, system security, the establishment or defence of claims, and compliance with legal obligations. Relevant criteria include the duration of an enquiry or business relationship, technical security needs, limitation periods, and statutory documentation and retention duties. Business records may generally be retained for ten years under Swiss law.

Google Mail and Calendar data are also subject to the retention and deletion rules configured in our Google Workspace tenant. Under its terms, Resend deletes customer and usage data within 90 days after account termination. Backups on our infrastructure are continuously replaced by newer copies.

9. Your rights

Subject to applicable law, you may request access, rectification, erasure, restriction, disclosure or portability of your data, and object to processing. You may withdraw consent at any time for the future. To exercise your rights, use our contact form. We may request additional information to verify your identity.

You may also lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC). Where the GDPR applies, you may lodge a complaint with a competent supervisory authority in the EU or EEA.

10. Changes

We may update this notice if our processing activities or legal requirements change. The version published on this website applies.