Data
processing
The framework that applies when Travia processes personal data on behalf of a customer, and the list of sub-processors involved.
1. Roles of the parties
When a customer uploads or generates personal data in the platform, it remains the controller. NETZERO SWISS AG acts as processor within the meaning of Art. 9 of the Federal Act on Data Protection (FADP) and, where applicable, Art. 28 of Regulation (EU) 2016/679 (GDPR).
This page constitutes the data processing agreement of the subscription contract. It forms an integral part of it, together with the Data security page to which it refers. Its version and update date are shown at the top of the page; the version applicable to a contract is the one in force on the date it is signed, and any earlier version is provided on request. Any change that would significantly lower the level of protection is notified sixty (60) days in advance. A separate agreement, signed and tailored to the customer’s context, may replace it.
2. Subject of processing
| Item | Description |
|---|---|
| Subject | Provision of the fleet control and field operations platform |
| Nature | Collection, recording, structuring, storage, consultation, retrieval and erasure |
| Purpose | Performance of the subscription contract and the customer’s instructions |
| Duration | Term of the contract, plus the return and deletion periods |
| Data subjects | The customer’s employees, drivers, technicians, contacts of its customers and partners |
| Categories of data | Identity and business contact details, account and role data, operational data (assignments, statuses, times, proofs, incidents), location data linked to vehicles and assignments, access logs |
| Sensitive data | None is required by the platform; the customer refrains from uploading any without need |
3. Instructions
NETZERO SWISS AG processes the data only on the customer’s documented instructions. The contract, the platform configuration and the customer’s written requests constitute instructions.
Producing aggregated and anonymised statistics to improve the platform is a separate operation, carried out on the basis of the customer’s contractual authorisation. The customer may refuse it in writing without any effect on the service; once anonymised, the statistics no longer allow the customer or any person to be identified.
If an instruction appears to breach applicable law, NETZERO SWISS AG informs the customer without delay and may suspend its execution. Processing imposed by a legal obligation is reported to the customer before execution, unless the law prohibits doing so.
4. Staff confidentiality
The people authorised to process the data are identified by name, trained in data protection requirements and bound by a contractual confidentiality obligation that survives the end of their duties. Access is limited to what their task requires.
5. Security
NETZERO SWISS AG implements the appropriate technical and organisational measures required by Art. 8 FADP, Art. 1 to 5 of the Data Protection Ordinance (DPO) and Art. 32 GDPR. Details are published and kept up to date on the Data security page.
6. Sub-processors
The customer authorises the use of the sub-processors listed below. Each is bound by protection obligations at least equivalent to those described here.
| Sub-processor | Service | Location |
|---|---|---|
| OVH SAS (OVHcloud) | Hosting of the platform infrastructure, storage and backups | France |
| Infomaniak Network SA | Routing and storage of emails sent to the site’s contact address: requests sent through the “Test a day” form, demonstration requests and requests to exercise rights | Switzerland |
| Plus Five Five, Inc. (Resend) | Technical delivery of sign-in links and contact-form requests | United States |
Full identity of the sub-processors: OVH SAS (OVHcloud), 2 rue Kellermann, 59100 Roubaix, France, RCS Lille Métropole 424 761 419; Infomaniak Network SA, Rue Eugène-Marziano 25, 1227 Les Acacias (Genève), Suisse, CHE-103.167.648, Registre du commerce du canton de Genève; Plus Five Five, Inc. (Resend), 2261 Market Street #5039, San Francisco, CA 94114, United States.
Any addition or replacement of a sub-processor is notified to the customer at least thirty (30) days before it takes effect. The customer may object on serious data protection grounds; if no alternative is found, it may terminate the part of the service concerned without penalty.
7. Transfers abroad
The destination countries are disclosed here in accordance with Art. 19 para. 4 FADP. The platform infrastructure is hosted in France by OVH SAS (OVHcloud). Emails sent directly to the site’s contact address are routed and stored in Switzerland by Infomaniak Network SA. Sign-in links and contact-form requests also pass through Resend, which stores message content and delivery records in the United States, even when a European sending region is used.
France, like the other member states of the European Union and the European Economic Area, is listed in Annex 1 DPO among the states providing adequate protection within the meaning of Art. 16 para. 1 FADP.
Any transfer to a state without adequate protection may only take place with appropriate safeguards within the meaning of Art. 16 para. 2 FADP — in particular the standard contractual clauses recognised by the FDPIC — with additional measures where needed, and after informing the customer.
8. Assistance to the controller
NETZERO SWISS AG assists the customer, as far as reasonable and taking into account the nature of the processing:
- in responding to requests from data subjects exercising their rights; requests received directly by NETZERO SWISS AG are forwarded to the customer without being answered on the merits;
- in carrying out a data protection impact assessment under Art. 22 FADP or Art. 35 GDPR, and a prior consultation of the authority;
- in documenting security measures and maintaining the record of processing activities;
- in handling a data security breach.
9. Security breach
NETZERO SWISS AG informs the customer without undue delay after becoming aware of a data security breach affecting its data, and provides the nature of the breach, the categories and approximate volume of data and people concerned, the likely consequences and the measures taken or proposed.
Notification to the FDPIC under Art. 24 FADP, or to the competent supervisory authority under Art. 33 GDPR, and informing the data subjects are the customer’s responsibility as controller. NETZERO SWISS AG provides the necessary information.
10. Review and audit
On reasonable written request, NETZERO SWISS AG provides the customer with the information needed to demonstrate compliance with the obligations described here: description of the measures, answers to a security questionnaire, available audit reports.
An on-site audit, carried out by the customer or an independent auditor bound by confidentiality who is not a competitor, is possible at most once a year, with thirty (30) days’ notice, during business hours, without disrupting operations and without access to other customers’ data. Costs are borne by the customer, unless the audit reveals a significant breach.
11. End of processing
At the end of the contract, the customer has thirty (30) days to export its data. After that period, NETZERO SWISS AG deletes or anonymises the data within ninety (90) days, subject to legal retention obligations.
Copies in the encrypted backups disappear through automatic rotation: each backup is kept for thirty-five (35) days from its creation, so the last copy containing the data disappears no later than thirty-five (35) days after deletion in production. A certificate of deletion is issued on request.
Contact for any question about data processing: info@netzeroswiss.ch.
This page is a translation. In case of discrepancy, the French version prevails.