Join Us

AlpsGenAI GmbH — Privacy Policy (rev. 2025)

1. OVERVIEW

This Privacy Policy describes how AlpsGenAI GmbH (“AlpsGenAI”, “we”, “us”) collects, processes, stores, discloses and protects personal data in accordance with:

  • the Swiss Federal Act on Data Protection (FADP, 2023),

  • the EU General Data Protection Regulation (GDPR),

  • the UK General Data Protection Regulation (UK-GDPR),

  • applicable industry standards regarding security and confidentiality.

This policy applies to:

  • our website and digital platforms,

  • our AI and software services,

  • contractual relationships,

  • support interactions and operational activities.

AlpsGenAI applies data minimisation, purpose limitation, zero-retention unless required, and strict access controls across all processing environments.

2. DATA CONTROLLER

AlpsGenAI GmbH
Hertistrasse 23
8304 Wallisellen
Switzerland

Email: info@alpsgenai.com
Phone: +41 44 621 33 27

This is also the contact address for exercising data subject rights or raising data-protection-related concerns.

3. CATEGORIES OF PERSONAL DATA PROCESSED

AlpsGenAI processes only the data necessary to fulfil contractual, legal, and operational obligations.

We may process:

3.1 Identification & Contact Data

Name, email, phone, job title, business address, employer information.

3.2 Contractual and Commercial Data

Offers, contracts, invoices, billing information, purchase history, project documentation.

3.3 Communication Data

Email correspondence, meeting notes, support interactions, contact form submissions.

3.4 Technical & Usage Data

IP addresses, device identifiers, browser metadata, timestamps, authentication logs, access logs, telemetry.

3.5 AI/LLM Processing Data

Customer-provided text, prompts, files, data fragments or structured inputs processed through:

  • deterministic pipelines,

  • statistical AI systems,

  • large language models (LLMs), embeddings or vector stores,

  • cloud-based inference engines.

Note: We apply strict minimisation; see Section 6.

3.6 Compliance, Risk & Security Data

Audit logs, access control logs, fraud-prevention metrics, and data necessary for legal compliance.

4. LEGAL BASIS AND PURPOSES OF PROCESSING

4.1 Contract Performance

Processing required to:

  • provide AI and software services,

  • implement, maintain and support our solutions,

  • fulfil obligations under contracts and statements of work (SoWs).

4.2 Legitimate Interests

Including:

  • secure and reliable operation of our systems,

  • fraud detection and prevention,

  • network and information security,

  • internal analytics and service improvement (always aggregated or pseudonymised where feasible),

  • business operations, planning and risk management.

4.3 Legal Obligations

Compliance with:

  • accounting and retention obligations,

  • official orders, court decisions, regulatory requirements,

  • security investigations and legal processes.

4.4 Consent (where required)

For optional marketing communication or where law mandates explicit consent.

Consent can be withdrawn at any time.

5. AI, LLM AND CLOUD PROCESSING — ENTERPRISE TRANSPARENCY

AlpsGenAI provides AI-powered systems that may process Customer-provided inputs. We apply the following enterprise-grade safeguards:

5.1 No Training on Customer Data

Unless explicitly agreed in writing:

Customer data is never used to train, fine-tune, or enhance any foundation model or third-party model.

5.2 Zero Retention (Default)

We enforce:

  • no long-term retention of inference data by AI model providers,

  • no logging of prompt contents beyond what is required for security and support,

  • automatic deletion after predefined intervals.

5.3 Regional Processing

Where technically feasible, AI processing is conducted in:

  • Switzerland,

  • EU/EEA,

  • or other approved jurisdictions with adequate data-protection levels.

5.4 Encryption

Data in transit: TLS 1.2+
Data at rest: AES-256 or equivalent
Access-controls: MFA, least privilege, strict RBAC.

5.5 Purpose Limitation

AI inputs are used solely to fulfil the requested service (inference, classification, summarisation, etc.) and never for unrelated purposes.

5.6 External AI Providers

Where external AI or cloud services are used, they are bound by:

  • FADP/GDPR-compatible data processing agreements (DPAs),

  • EU Standard Contractual Clauses (SCCs), where required,

  • strict contractual restrictions on reuse or disclosure.

6. DATA TRANSFERS OUTSIDE SWITZERLAND/EU

Transfers occur only if:

  • the destination country has an adequacy decision, or

  • appropriate safeguards (SCCs, contractual provisions) are implemented, or

  • a statutory exception applies.

We ensure:

  • risk assessments for each transfer,

  • contractual guarantees from processors,

  • ongoing monitoring of compliance obligations.

7. COOKIES, ANALYTICS & TRACKING

We use cookies and analytics tools only for:

  • technical operation,

  • performance measurement,

  • security and error logging,

  • usage analytics to improve services.

Tools include (examples):

  • Google Analytics 4 (IP anonymisation enabled),

  • LinkedIn Insights,

  • WordPress,

  • SiteGround hosting.

Users may disable cookies via browser settings; essential cookies may be required for site functionality.

8. DISCLOSURE OF PERSONAL DATA

Data may be disclosed to:

  • IT hosting and cloud infrastructure providers,

  • AI model providers under strict contractual controls,

  • business partners and subcontractors under NDA and DPA,

  • auditors, accountants, legal advisors,

  • authorities or courts where required by law,

  • payment processors and financial institutions.

We do not sell or trade personal data.

All third parties undergo vendor risk assessment and are contractually bound to:

  • process data only under our instructions,

  • provide adequate security measures,

  • comply with FADP/GDPR.

9. DATA RETENTION

We retain personal data only as long as necessary for:

  • contractual obligations,

  • legal retention requirements, or

  • legitimate business interests (e.g., documentation and evidence).

After expiry of retention periods, data is deleted or irreversibly anonymised.

10. DATA SUBJECT RIGHTS

You have the right to:

  • access your personal data,

  • request correction of inaccurate data,

  • request deletion (where permitted),

  • request restriction of processing,

  • object to processing based on legitimate interests,

  • withdraw consent at any time,

  • request data portability (where applicable).

Requests should be sent to the contact provided in Section 2.
We may require ID verification.

You also have the right to lodge a complaint with the FDPIC or the relevant EU/UK supervisory authority.

11. SECURITY MEASURES

AlpsGenAI implements industry-standard and enterprise-grade controls, including:

  • role-based access control (RBAC),

  • multi-factor authentication (MFA),

  • encryption in transit and at rest,

  • network segmentation,

  • logging and intrusion detection,

  • regular penetration tests and code reviews,

  • zero-trust architecture principles,

  • continuous monitoring and audit trails.

12. UPDATES TO THIS PRIVACY POLICY

This Privacy Policy may be updated at any time. The latest version is published on our website. For material changes, we may notify users directly (e.g. by e-mail).

13. DATE

Last Updated: February 2025