Privacy policy

1. Who is responsible?

The controller responsible for processing personal data in connection with the website ryvo.ch and the software Ryvo (app.ryvo.ch) is:

This privacy policy is based on the Swiss Federal Act on Data Protection (FADP).

2. Data dealers enter in Ryvo

Dealers enter data of their own customers in Ryvo, for example names, addresses, phone numbers, vehicle data, contracts and signatures. The respective dealer is responsible for this data. We only process it on the dealer's behalf to operate Ryvo (processing on behalf under Art. 9 FADP) and do not use it for our own purposes.

If you are a customer of a dealer and have questions about your data, please contact the dealer directly.

3. What data we process

• Visiting the website and the app: The server stores technically necessary information such as IP address, time, page requested and browser identifier in log files.
• User account: Name, e-mail address, company, role, time of last sign-in and your password – the latter only in irreversibly encrypted form.
• Registration: Company name, name and e-mail address and acceptance of the terms of use.
• E-mails sent from Ryvo: Recipient, subject and time are logged to prevent misuse.
• Digital signature: Name, image of the signature, time, IP address and browser identifier, as evidence of the signature.
• Security: Failed sign-in attempts with IP address, to prevent password guessing.
• Contact: Information you send us by e-mail.

4. Why we process the data

We process personal data to provide and operate Ryvo, manage your account, send you system e-mails (e.g. e-mail confirmation, invitations, password reset), answer enquiries, ensure security, issue invoices and meet legal obligations. We do not use your data for advertising and do not sell it.

5. Cookies and browser storage

Ryvo uses a single, technically necessary cookie so that you stay signed in after signing in. It is deleted when you sign out or close the browser. In addition, Ryvo stores a few display settings in your browser's storage, such as the last company selected and the language.

We do not use analytics, tracking or advertising cookies and do not embed Google Analytics, Google Fonts or social media plugins. Fonts and most program components are loaded directly from our server. Exceptions are listed in the next section.

6. Where data is stored and who receives it

The website, database and e-mail sending are operated for us by Infomaniak Network SA in Geneva. The data is stored in data centres in Switzerland. Infomaniak processes the data exclusively on our behalf.

For certain features we also use the following services:

• Online payment (Stripe): If you pay for your subscription online (card, TWINT, Klarna, Apple Pay, Google Pay), you enter your payment details directly with Stripe Payments Europe Ltd., Ireland. We only receive confirmation of the payment, never your card details. Stripe may also process data in the USA; for this Stripe relies on standard contractual clauses recognised by Switzerland.
• Reading documents (e.g. registration document): For text recognition, your browser loads a program and language data once from the jsDelivr service (none of your data). The document itself is analysed only in your browser and is not sent to jsDelivr. Technically, jsDelivr can see your IP address.
• Euro exchange rate: To convert euro amounts, Ryvo requests the daily rate from the public Frankfurter service. Only the date requested is sent; your IP address is technically visible in the process.

Beyond this, we only pass on personal data with your consent (e.g. when you send an e-mail from Ryvo to a customer or a bank) or where we are legally obliged to do so.

7. How long we keep data

• Account data and content: as long as the account exists. After the contract ends, the dealer can still download its data for 30 days; it is then deleted.
• Unconfirmed registrations: deleted automatically after 7 days.
• Links in e-mails: “reset password” valid for 1 hour, “confirm e-mail” 48 hours, invitations 7 days.
• Failed sign-in attempts: 15 minutes.
• Invoices and accounting records: in accordance with statutory retention periods (usually 10 years).

8. Data security

We protect personal data with technical and organisational measures: connections are encrypted (HTTPS), passwords are only stored as an irreversible hash, each dealer's data is strictly separated and every request checks that access is authorised. Repeated failed sign-in attempts are slowed down.

9. Your rights

You have the right to request information about your personal data, to have incorrect data corrected and data deleted, to object to processing and to request your data in a common electronic format. To do so, send us an e-mail at the address above. We may ask you to prove your identity.

If you believe that we are not processing your data correctly, you can lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC).

10. Changes

We update this privacy policy when Ryvo or the legal requirements change. The version published on this page applies.