Privacy Policy

This English version is a translation for convenience. In the event of any discrepancy, the German version prevails.

This privacy policy explains how we process personal data on this website and in Varmo. It is based on the Swiss Federal Act on Data Protection (FADP) and, where applicable, on the EU General Data Protection Regulation (GDPR). Where the GDPR applies, the additional information in section 11 and in the notes on legal bases also applies.

1. Controller

miller IT-Solutions, Bahnhofstrasse 18, 3312 Fraubrunnen, Switzerland

Questions about data protection: info@varmo.ch

We are the controller within the meaning of the FADP and the GDPR for the processing described in this privacy policy, except for customer data in the application (section 2).

2. Customer data in the application

We process what our customers enter in Varmo (e.g. assets, risks, incidents, documents) on their behalf as a processor. The respective organisation is the controller; details are governed by the data processing agreement, which for customers subject to the GDPR meets the requirements of Art. 28 GDPR. The data of each organisation are strictly separated technically. We only see them if an administrator of the organisation explicitly grants us time-limited, read-only access for support purposes; this access is recorded in the organisation’s log.

We store support requests (by e-mail or directly in the application) with name, e-mail address, organisation and your description in order to answer them and track their progress. We delete closed requests after three years.

Legal basis under the GDPR: Art. 6(1)(b) GDPR (performance of the contract with the customer) and Art. 6(1)(f) GDPR (our legitimate interest in handling support requests properly and being able to trace them).

3. Visiting the website

When the website is accessed, the server processes technically necessary information (IP address, time, page accessed, browser) in order to deliver the page and to protect it against misuse. The website sets no cookies, uses no web analytics and loads no content from third parties; fonts are hosted on our own server.

Legal basis under the GDPR: Art. 6(1)(f) GDPR (our legitimate interest in delivering the website securely and reliably).

In the ISO 27001 self-assessment, your browser stores your answers locally (local storage) so that you can continue later; they are not transmitted to us. You delete them with “Start again” or via your browser settings. If you open an account in the same browser, you can import the result in the setup assistant; Varmo only stores what you explicitly import there. If you come from the self-assessment to the sign-up, we only record this origin at sign-up, not your answers.

Legal basis under the GDPR: Local storage takes place solely in your browser and only to provide the function you requested. If you import the result into Varmo, the legal basis is Art. 6(1)(b) GDPR; for recording the origin, it is Art. 6(1)(f) GDPR (our legitimate interest in knowing how users find us).

We operate a profile on the X platform (@Varmo_ISMS). If you visit it or interact with our posts, X processes your data under its own responsibility and privacy policy; data may also be transferred to the USA in the process. We only see what X displays publicly (e.g. replies, mentions, profile names) and aggregated statistics on our posts. Links from X to this website do not cause us to transfer any data to X; the website does not embed any content from X.

Legal basis under the GDPR: Art. 6(1)(f) GDPR (our legitimate interest in presenting our offering and communicating with interested parties).

If you request a demo, we store name, e-mail address, organisation, sector, number of employees and your message in order to arrange an appointment with you. To protect against misuse, we store your IP address only in a form that cannot be read (hash). We delete the request after 12 months at the latest, or earlier on request.

In the demo request and at sign-up you may voluntarily state how you heard about Varmo (e.g. search engine, blog post, recommendation), together with a short text. We store this information together with the request or sign-up and delete it with it. It is only evaluated as a count per source, to see how prospective customers find us.

If you submit a request via the “Custom solutions” page, we receive name, e-mail address, company or organisation and, if you provide them, telephone number, number of employees, preferred operating model, your interests and your message. We use this information only to answer your request and, where appropriate, to submit an offer. The request is not stored in Varmo, but only sent by e-mail to our mailbox info@varmo.ch and processed there (provider: Infomaniak Network SA, Geneva (Switzerland)). We send an acknowledgement of receipt to the address provided. We keep the request for as long as is necessary to process it and for any offer; on request, we delete it earlier. To protect against misuse, we limit the number of requests per IP address; for this purpose the IP address is only held briefly in the server’s memory and is not stored.

When you sign up on the website, we first store your e-mail address and send you a code (only an unreadable value of the code is stored; we delete codes after one day). After you enter the code, we store name, organisation and the time of your consent to this privacy policy; this creates your account and your organisation, and from then on section 5 applies. To protect against misuse, we store your IP address only in a form that cannot be read (hash). We delete the sign-up details after 30 days.

Every sign-up starts with a free trial. To ensure that there is only one trial per organisation within 12 months, we store the domain of your e-mail address (e.g. “company.com”) only in a form that cannot be read (hash) together with the date, but not the address itself; for addresses of general e-mail services (e.g. gmail.com), we store nothing. We delete the value after 12 months.

Varmo informs us by e-mail to our mailbox info@varmo.ch about a new sign-up (organisation, name, e-mail address, plan ordered), a termination and a change of plan, so that we can look after you. We delete the entries for this in Varmo after 90 days.

Legal basis under the GDPR: Demo requests, requests via “Custom solutions” and sign-up: Art. 6(1)(b) GDPR (steps prior to entering into a contract at your request, and conclusion of the contract). Hashed IP addresses, the request limit per IP address and the trial check by domain: Art. 6(1)(f) GDPR (our legitimate interest in protecting against misuse). The voluntary information on how you heard about us and the notifications on sign-up, termination and change of plan: Art. 6(1)(f) GDPR (our legitimate interest in understanding how prospective customers find us and in looking after our customers). Recording the time of consent: Art. 6(1)(f) GDPR (our legitimate interest in being able to prove the conclusion of the contract).

For persons with access to Varmo we process name, e-mail address, role and organisation. For security purposes, we record sign-ins (time, result, IP address, browser); we delete these entries after the period set by the organisation (2 years by default). From the IP address, we determine the country on our server using a local database in order to detect suspicious sign-in attempts; the address is not passed on to third parties for this purpose. To monitor performance, we measure response times of the application without reference to individuals (only the area accessed and the duration, 30 days). Changes to data are recorded in an immutable change log of the organisation for as long as the organisation exists. For sign-in, we use exclusively technically necessary session cookies.

Legal basis under the GDPR: Art. 6(1)(b) GDPR (provision of the Service under the contract with the organisation) and Art. 6(1)(f) GDPR (our legitimate interest, and that of the organisation, in the security of the Service and in traceable changes).

6. E-mails

You always receive e-mails that are necessary for the Service (e.g. invitation, password, confirmation of a termination, invoice, reply to a request). Persons with access to Varmo additionally receive tips on using it: a welcome e-mail, tips on setting up and on the functions that match their tasks, a reminder after a longer period without signing in and – for Tenant Admins – a monthly review. For this we use name, e-mail address, role, functional roles, the time of the last sign-in, the status of the setup and counts of entries (e.g. new risks in the previous month), never their content. We record which of these e-mails a person has received.

You can unsubscribe from these tips at any time via the link in each such e-mail or in the application in the user menu under “E-mails”. We use Infomaniak Network SA, Geneva (Switzerland) for sending e-mails.

Legal basis under the GDPR: E-mails necessary for the Service: Art. 6(1)(b) GDPR. Tips on use: Art. 6(1)(f) GDPR (our legitimate interest in helping customers use the Service); you may object at any time with effect for the future (section 11).

7. Error tracking

If a technical error occurs, we record an error message in a system we operate ourselves. In doing so, we remove cookies, request contents, parameters and personal details before the message is stored.

Legal basis under the GDPR: Art. 6(1)(f) GDPR (our legitimate interest in a stable and secure Service).

8. Storage location and disclosure

The data are stored at Infomaniak Network SA, Geneva (data centre in Switzerland). We disclose personal data only to service providers we need for operations (hosting, e-mail delivery) and whom we have contractually bound to data protection. We do not sell data and do not use them for third-party advertising.

If you pay by credit card, you enter the card details directly with our payment service provider Stripe Payments Europe Ltd., Dublin (Ireland); we do not receive complete card numbers. For this purpose Stripe receives the name, e-mail address and billing address of the account as well as the plan and amount, and may also process these data in the USA. When purchasing on invoice, no data are passed to Stripe.

Legal basis under the GDPR: Art. 6(1)(b) GDPR (performance of the contract, payment processing) and Art. 6(1)(f) GDPR (our legitimate interest in reliable operations through specialised service providers).

Transfers (GDPR): We process data in Switzerland. The European Commission has recognised that Switzerland provides an adequate level of data protection (adequacy decision under Art. 45 GDPR); transfers from the EU to us therefore require no additional safeguards. Stripe Payments Europe Ltd. is established in the EU. Where Stripe or X process data in the USA, they are responsible for this under their own privacy policies and the safeguards provided for under Chapter V GDPR. We do not transfer personal data to any other third countries.

9. Retention and deletion

We keep data only for as long as is necessary for the purpose or required by law. After a termination, the account remains usable until the end of the current billing interval; thereafter all of the organisation’s data are permanently deleted once the agreed deletion period (30 days by default) has expired, including uploaded files. You can export your data beforehand. We keep backups for 7 days (daily backup on the server and a daily copy of the data storage at the hosting provider, both in Switzerland).

Overview of retention periods

Server data when visiting the website: only as long as necessary for delivery and protection
Demo requests: 12 months at the latest, earlier on request
Requests via “Custom solutions”: as long as necessary for processing and any offer
Sign-up details (code, hash of the IP address): codes 1 day, sign-up details 30 days
Hash of the e-mail domain (trial): 12 months
Notifications on sign-up, termination, plan change: 90 days
Sign-ins (time, result, IP address, browser): period set by the organisation, 2 years by default
Response time measurements: 30 days
Change log: as long as the organisation exists
Account and organisation data after termination: end of the billing interval plus deletion period (default 30 days)
Backups: 7 days
Closed support requests: 3 years
Data subject requests and our reply: 3 years after completion

Where statutory retention obligations apply (e.g. for accounting records under Swiss law), we keep the relevant data for the period required by law.

10. Data security

We protect the data with technical and organisational measures, including encrypted transmission, strict separation of organisations in the database, permissions according to the need-to-know principle, a second factor for administrators, blocking after repeated failed sign-ins and regular backups.

11. Your rights

You may request access to your data, have incorrect data rectified and have data deleted or handed over, unless a statutory obligation prevents this, and object to the processing. Write to us at info@varmo.ch. If your request concerns data that an organisation has entered in Varmo, we forward it to that organisation. We record your request and our reply as evidence and delete them 3 years after completion. You may also lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC) or with the competent supervisory authority in the EU.

Additional rights under the GDPR. Where the GDPR applies, you have the following rights in particular:

Access (Art. 15 GDPR): confirmation as to whether we process your data, and information about them;
Rectification (Art. 16 GDPR) of inaccurate or incomplete data;
Erasure (Art. 17 GDPR), unless we are required or entitled to retain the data;
Restriction of processing (Art. 18 GDPR);
Data portability (Art. 20 GDPR): receiving the data you have provided to us in a structured, commonly used and machine-readable format, where the processing is based on a contract or consent;
Objection (Art. 21 GDPR): you may object at any time, on grounds relating to your particular situation, to processing based on Art. 6(1)(f) GDPR; we then no longer process the data unless we can demonstrate compelling legitimate grounds or the processing serves the establishment, exercise or defence of legal claims. You may object to tips on use (section 6) at any time without giving reasons;
Notification (Art. 19 GDPR): we inform recipients to whom data have been disclosed of any rectification, erasure or restriction, unless this proves impossible or involves disproportionate effort.

We respond to requests without undue delay, and in any event within one month (Art. 12(3) GDPR). We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

Right to lodge a complaint (Art. 77 GDPR): You have the right to lodge a complaint with a supervisory authority, in particular in the EU Member State of your habitual residence, place of work or the place of the alleged infringement.

Obligation to provide data: Providing the data marked as mandatory is necessary for a request, sign-up or use of Varmo; without these data we cannot process the request or conclude or perform the contract. All other information is voluntary.

12. Changes

We adapt this privacy policy when our offering changes. The version published here applies.