Datenschutzerklärung

Uniestro AG ("Uniestro", "we", "us", "our") is a Swiss Aktiengesellschaft registered in Zürich, Switzerland. We operate uniestro.com and all associated ecosystem products (Uniestro Pay, Uniestro Accounting, Uniestro UCG, and others).

Uniestro AG acts as the data controller for personal data processed through our corporate website and ecosystem products, unless a specific product specifies a different controller.

We collect personal data only to the extent necessary to provide our services and improve your experience. The categories of data we may process include:

We process personal data for the following purposes, each supported by an appropriate legal basis:

We do not sell your personal data. We may share data with trusted third parties only where necessary:

• Service providers who assist us in operating our platform (hosting, analytics, support tools) — bound by confidentiality and data processing agreements
• Payment processors for transaction processing — subject to their own PCI-DSS certified privacy practices
• Legal and compliance partners when required by law, court order, or to protect our rights
• Business partners with your explicit consent
• Successor entities in the event of a merger, acquisition, or asset sale

Where data is transferred outside Switzerland or the EEA, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) or adequacy decisions.

Our website uses cookies and similar technologies. You can control cookie preferences through your browser settings.

You can opt out of non-essential cookies at any time. Disabling essential cookies may affect your ability to use certain features of our platform.

We retain personal data for as long as necessary to fulfil the purposes for which it was collected, unless a longer retention period is required by law:

• Account data: retained for the duration of the account plus 3 years after closure
• Transaction records: 10 years (Swiss commercial law obligation)
• Communication logs: 2 years
• Analytics data: 26 months (anonymised)
• Marketing consent records: 3 years from last interaction

Under Swiss nDSG and the GDPR (where applicable), you have the following rights regarding your personal data:

• Right of access — obtain confirmation of whether we process your data and receive a copy
• Right to rectification — request correction of inaccurate or incomplete data
• Right to erasure — request deletion of your data ("right to be forgotten") under certain conditions
• Right to restriction — request limited processing of your data
• Right to data portability — receive your data in a structured, machine-readable format
• Right to object — object to processing based on legitimate interest, including direct marketing
• Right to withdraw consent — withdraw consent at any time without affecting prior processing
• Right to lodge a complaint — with the Federal Data Protection and Information Commissioner (FDPIC) in Switzerland or the supervisory authority in your country

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include:

• AES-256 encryption for data at rest
• TLS 1.3 for all data in transit
• Role-based access controls and least-privilege principles
• Regular security audits and penetration testing
• SOC 2 Type II compliance for applicable products
• Multi-factor authentication for platform access
• Incident response procedures with 72-hour breach notification

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or services. When we make material changes, we will notify you by email (if you have an account) or by posting a prominent notice on our website at least 30 days before the changes take effect.

Your continued use of our services after the effective date of the updated policy constitutes your acceptance of the revised terms.