Privacy
policy
How Travia processes personal data, on what basis, for how long, with whom, and which rights you can exercise.
1. Controller
The controller within the meaning of the Federal Act on Data Protection (FADP) and, where applicable, Regulation (EU) 2016/679 (GDPR) is:
NETZERO SWISS AG
Brandschenkestrasse 178, 8002 Zurich, Switzerland
UID CHE-112.851.175
Data protection contact: info@netzeroswiss.ch
Appointing a data protection advisor is optional for a private Swiss company (Art. 10 para. 1 FADP); NETZERO SWISS AG has not appointed one to date. Requests concerning data are handled by management at the address above.
NETZERO SWISS AG is established in Switzerland and its offer is aimed at businesses. When processing falls within the territorial scope of the GDPR, the appointment of a representative in the Union (Art. 27 GDPR) and the need for a data protection officer (Art. 37 GDPR) are examined with the customer concerned and documented in the data processing agreement. No representative has been appointed to date.
2. Scope and roles
This policy covers two distinct situations, with two different roles.
Public website and business relationship
For visits to the site, contact requests, demonstrations and the business relationship, NETZERO SWISS AG acts as controller: it alone determines the purposes and means.
Travia platform
For the data that the customer uploads or generates in the platform — assignments, drivers, vehicles, proofs of delivery, logs — NETZERO SWISS AG acts as processor on behalf of the customer, who remains the controller. The applicable framework is described on the Data processing page.
Current state of the public site: no audience measurement, no advertising cookie, no third-party analytics tool, no embedded social network, no font called from a third-party server during the visit. A single cookie is set, and only if you choose a language yourself: it stores “fr”, “en” or “de”, nothing else. Details are on the Cookies and trackers page.
3. Data processed
3.1 Site visitors
- Connection data processed by the host in the server logs: IP address, date and time of the request, resource requested, response code, volume transferred, referrer and user agent.
- Language preference: when you change language, a cookie keeps this choice for up to 182 days and is read when the home page opens to take you back to it. It contains no identifier, is accessible to no third party and allows no cross-site tracking. The Cookies and trackers page lets you refuse this storage in one click.
- Display language by canton: as long as you have not chosen a language, the server infers from your IP address the Swiss canton you are connecting from, to show you the site in French or German. This match is made on the site’s server using a built-in table (IP Geolocation by DB-IP, CC BY 4.0 licence), without calling any third-party service; the canton is neither recorded nor linked to a person, and nothing is stored on your device. Outside Switzerland, only your browser language is read, for the home page.
- Requests sent through the “Test a day” form: the answers entered (company, first name, last name, business email address, optional telephone, fleet size, sector, number of rounds, software used, main problem, details) are sent to the site’s server, recorded in a request register hosted with the site, and emailed to the site’s contact address (contact@travia-swiss.ch), a business mailbox hosted in Switzerland by Infomaniak Network SA, in order to reply. No copy is sent to any other mailbox. On the “Test a day” page, you may attach the file of a day of rounds (export, spreadsheet or photo of the planning, 20 MB maximum) with your explicit consent: this planning file is kept on the site’s server outside any public folder, attached to the email sent to the contact mailbox, used only to prepare the diagnosis and deleted thirty days after the report is sent, unless you request otherwise. This page also transmits, if present in the link you followed, campaign parameters (utm) and the name of the referring site, to know where the request comes from. An automatic acknowledgement is sent to the address given, and to it alone. The “Resources” page offers two documents (a guide and a round sheet) in exchange for a first name, an email address and a company name, recorded in the same register; the documents are sent to that address and nothing else follows, unless you ticked the “one tip a month” box, a consent you can withdraw by simply replying or writing to the contact mailbox. The IP address is not kept with the request. If the server does not respond, the site offers to send the same request from your email software; in that case, nothing is sent until you send it yourself.
- Requests sent through the contact form: first name, last name, company, email address, optional phone, request type and message are sent to the Travia team so that we can reply. Resend handles technical delivery, then the message arrives in the site’s professional mailbox at Infomaniak Network SA. It is not sent to other recipients. Submitting the form does not subscribe you to marketing messages.
3.2 Prospects and business contacts
- identity and role: last name, first name, position, company;
- business contact details: email address, telephone, postal address;
- content of exchanges: messages, meeting notes, needs expressed, scope envisaged;
- invoicing and contract data when the relationship materialises.
3.3 Platform users
- account identifiers, role, organisation, site and activity of assignment;
- usage and security data: login timestamps, IP address, significant actions recorded in the log;
- operational data entered in the course of work: assignments, statuses, visit times, forms, photographs, signatures, reservations, incidents;
- location data linked to vehicles and assignments, when the customer activates these functions and within the scope it defines.
Sensitive personal data within the meaning of Art. 5 let. c FADP is neither required nor expected by the platform. The customer refrains from uploading such data when it is not necessary for the purpose pursued.
4. Purposes and grounds
The table below covers the processing for which NETZERO SWISS AG is controller. Data uploaded to the platform by a customer falls under section 2 and the Data processing page.
The FADP does not make processing by private persons subject to a legal basis: it is lawful in principle, with Art. 31 FADP only serving as a justification in the event of a breach of privacy within the meaning of Art. 30 FADP. The column below therefore shows the GDPR ground where it applies, and the Swiss justification that may be invoked where relevant.
| Purpose | Data | Ground |
|---|---|---|
| Provision and security of the site | Server logs | Overriding interest in operating a secure and available service (justification, Art. 31 FADP; Art. 6(1)(f) GDPR) |
| Display language by canton | IP address, only at the time of the request | Overriding interest in presenting the site in the region’s language (Art. 31 FADP; Art. 6(1)(f) GDPR) |
| Replying to contact requests | Identity, contact details, content of the message | Pre-contractual measures and legitimate interest (Art. 6(1)(b) and (f) GDPR) |
| Demonstration, offer and commercial follow-up | Contacts, needs, scope | Pre-contractual measures and legitimate interest |
| Performance of the subscription contract | Accounts, invoicing, support | Performance of the contract (Art. 6(1)(b) GDPR) |
| Security, traceability and prevention of abuse | Access and action logs | Data security obligation (Art. 8 FADP; Art. 32 GDPR) |
| Accounting and tax obligations | Invoices and supporting documents | Legal obligation (Art. 958f Code of Obligations) |
| Information about service developments | Business email address | Consent or existing customer relationship, with unsubscribe at any time |
Where processing is based on consent, it may be withdrawn at any time, without affecting the lawfulness of processing already carried out.
5. Source of the data
The data comes from the data subjects themselves, from the customer who opens access for its staff, from the systems the customer connects to the platform — ERP, TMS, telematics, HR — and, for connection data only, from the technical infrastructure. NETZERO SWISS AG does not buy any prospect lists.
6. Recipients
The data is neither sold, rented nor exchanged. It is accessible only to the people who need it:
- NETZERO SWISS AG staff in charge of the service, security and customer relations;
- the technical processors listed on the Data processing page, bound by contract and by a confidentiality obligation;
- the host OVH SAS (OVHcloud), for the provision of the infrastructure;
- the email provider Infomaniak Network SA, for routing and storing emails;
- Resend, for technical delivery of contact-form requests;
- authorities, courts or authorised third parties, where a legal obligation or an enforceable decision so requires.
7. Transfers abroad
The site infrastructure is provided by OVH SAS (OVHcloud), a company governed by French law. The data is hosted in France, a destination country disclosed here in accordance with Art. 19 para. 4 FADP. A transfer of personal data outside Switzerland therefore takes place.
Emails sent directly to the site’s contact address are routed and stored in Switzerland by Infomaniak Network SA, a Swiss company based in Geneva. For contact-form requests, Resend also handles delivery and stores message content and delivery records in the United States, even when a European sending region is used.
France, like the other member states of the European Union and the European Economic Area, is listed in Annex 1 of the Data Protection Ordinance (DPO) among the states providing adequate protection within the meaning of Art. 16 para. 1 FADP. For any recipient in a state without adequate protection, transfer only takes place with appropriate safeguards within the meaning of Art. 16 para. 2 FADP, in particular the standard contractual clauses recognised by the FDPIC, supplemented where necessary by additional measures.
8. Retention periods
| Category | Period | Details |
|---|---|---|
| Web server logs | 6 months at most | From the request |
| Contact requests not followed up | 12 months | From the last exchange; also applies to the site’s request register |
| Commercial files and offers | 3 years | From the last relevant contact |
| User accounts | Term of the subscription | Export possible for 30 days, then deletion or anonymisation within 90 days |
| Platform security logs | 12 months | Period set under the security obligation, not changeable by the customer |
| Customer operational data | According to the customer’s settings | Return then deletion at the end of the contract |
| Encrypted backups | 35 days | Each backup is kept for 35 days from its creation, then destroyed by rotation |
| Accounting records | 10 years | From the end of the financial year concerned (Art. 958f Code of Obligations) |
When these periods expire, the data is irreversibly deleted or anonymised, subject to a longer legal retention obligation or pending litigation.
9. Security
NETZERO SWISS AG implements the appropriate technical and organisational measures required by Art. 8 FADP and Art. 32 GDPR: encrypted traffic, segregated environments, named access management, logging, encrypted backups and an incident management procedure. Details are on the Data security page.
In the event of a data security breach affecting processing for which NETZERO SWISS AG is controller — site, prospecting, contractual relationship — that is likely to result in a high risk to the personality or fundamental rights of the data subjects, NETZERO SWISS AG notifies the FDPIC as soon as possible in accordance with Art. 24 para. 1 FADP and, where the law requires, informs the data subjects.
Where the breach affects platform data, for which NETZERO SWISS AG acts as processor, it notifies the customer as soon as possible in accordance with Art. 24 para. 3 FADP and, where the GDPR applies, without undue delay within the meaning of Art. 33(2) GDPR. Notifying the authority and informing the data subjects is then the customer’s responsibility as controller.
10. Record of processing activities
NETZERO SWISS AG keeps a record of its processing activities within the meaning of Art. 12 FADP and, where applicable, Art. 30 GDPR. It lists the purposes pursued, the categories of data and recipients, transfers abroad and security measures. It is kept up to date and provided to the FDPIC on request.
11. Automated decisions
The platform produces round proposals, estimated arrival times, alerts and indicators. These are decision aids: assignment, evaluation and any measure concerning a person are a human decision taken by the customer.
NETZERO SWISS AG takes no automated individual decision within the meaning of Art. 21 FADP or Art. 22 GDPR producing legal effects or significantly affecting a person, and carries out no high-risk profiling.
12. Data of the customer’s staff
When a person uses the platform as an employee of a customer, that customer is the controller: it decides the purposes, informs its teams and responds to requests to exercise rights. NETZERO SWISS AG acts as processor and assists it in that context.
Any request sent directly to NETZERO SWISS AG by a customer’s employee is forwarded to that customer without delay, unless it instructs otherwise or a legal obligation applies.
Reminder for Swiss customers. Art. 26 of Ordinance 3 to the Labour Act (ArGV 3) prohibits systems intended to monitor workers’ behaviour at their workplace, and Art. 328b of the Code of Obligations limits the processing of employee data to what is necessary to perform the contract or assess their suitability. Configuring the location and individual indicator functions is the customer’s responsibility.
13. Your rights
Under the FADP, any data subject may in particular:
- ask whether data concerning them is processed and obtain it (Art. 25 FADP);
- request the correction of inaccurate data (Art. 32 FADP);
- request the erasure or destruction of the data and object to specific processing; these claims arise from Art. 32 para. 2 FADP, which refers to Art. 28 et seq. of the Civil Code, and require an unlawful breach of privacy not covered by a justification;
- request the release or transfer of their data in a common electronic format, where the conditions of Art. 28 FADP are met;
- withdraw consent given, for the future.
Where the GDPR applies, the right to restriction of processing, the right to object under Art. 21 GDPR and the right to data portability under Art. 20 GDPR are added.
Requests are sent to info@netzeroswiss.ch. Proportionate identity verification may be requested. The reply is given as quickly as possible and in principle within thirty (30) days; for complex requests, this period may be extended, with the data subject being informed. Disclosure is free of charge, subject to the exceptions provided by law.
14. Complaints
Anyone who considers that their rights are not being respected may contact the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, Switzerland — www.edoeb.admin.ch (new window). Where the GDPR applies, a complaint may be lodged with the supervisory authority of the state of habitual residence, place of work or place of the alleged infringement.
A prior exchange with info@netzeroswiss.ch often resolves the matter faster.
15. Changes to this policy
This policy is adapted when processing changes: adding audience measurement, online appointment booking, a new processor or a third-party service. The version in force is the one published on this page, with its update date.
This page is a translation; in case of discrepancy, the French version prevails. For any question: info@netzeroswiss.ch.