Privacy Policy
1. Scope of this Privacy Policy
Data protection and data security are of utmost importance to us, Sereos GmbH ("Sereos", "we" or "us"). We process personal data responsibly and in compliance with the Swiss Federal Act on Data Protection (FADP) and the associated Data Protection Ordinance (DPO).
In this Privacy Policy, we inform you about the personal data we process, for what purposes, to whom we disclose it, and what rights you are entitled to. It applies whenever you:
visit one of our websites, in particular www.sereos.ch ("Website");
set up a customer or user account for our legal tech platform Sereos Legal AI at app.sereos.ch and log in there ("Platform");
enter into a contract with us, pay for our services, or interact with us as a customer, user, prospective customer, business partner, job applicant, or in any other capacity.
Personal data means any information relating to an identified or identifiable natural person. Processing means any handling of personal data, irrespective of the means and procedures applied, in particular the collection, storage, use, alteration, disclosure, archiving, and deletion of personal data.
For certain processing activities, our General Terms and Conditions (GTC), the Data Processing Agreement (DPA), or other contractual provisions may apply supplementary.
2. Controller and Contact
The controller responsible for the data processing activities described in this Privacy Policy is:
Sereos GmbH
Dufourstrasse 32
8008 Zurich
Switzerland
Email: info@sereos.ch
For questions regarding data protection and the exercise of your rights, you may contact us at this address.
3. Customer Content on the Platform is Not Subject to this Privacy Policy
Content and data entered, uploaded, or transmitted by our customers and their users when using the Platform, as well as the results generated thereby—specifically documents, dictations, inputs (prompts), chat histories, templates, and self-created skills and workflows ("Customer Content" within the meaning of our GTC)—are processed by us exclusively as a processor on the instructions of the respective customer. The controller responsible for this processing within the meaning of the FADP is the customer. This Privacy Policy does not apply to such data.
The processing of Customer Content is governed by the Data Processing Agreement (available at www.sereos.ch/abv) and the provisions on confidentiality and the preservation of professional secrecy, official secrecy, and other statutory duties of confidentiality in our GTC. The Data Processing Agreement also lists the sub-processors engaged for the processing of Customer Content.
In contrast, data that does not qualify as Customer Content and is covered by this Privacy Policy includes data concerning the customer and their users that we process for the establishment, administration, and billing of the contractual relationship (e.g., account, contact, payment, and billing data), as well as technical log, operational, and usage data and metadata relating to the use and operation of the Platform that does not contain Customer Content (e.g., information on platform availability and response times, as well as aggregated usage statistics). We process this data as a controller (Sections 4.4 and 4.5).
4. Which Personal Data We Process, When, and for What Purpose
4.1 Visiting Our Website
Hosting. Our Website is hosted by external service providers. When accessing the Website, the data required for delivery and secure operation is automatically processed, specifically your IP address, date and time of access, the page retrieved, the previously visited page (referrer), and information about the browser, operating system, and device. We require this data to provide the Website, ensure its functionality, and detect disruptions or attacks.
Audience Measurement. We use web analytics integrated into Framer (Framer Analytics) to understand how often our Website and individual subpages are visited, through which sources visitors reach us, and how content is used. According to the provider, Framer Analytics does not use cookies. We only receive aggregated statistics that do not permit the identification of individual visitors.
For hosting the Website and audience measurement, we specifically engage the following service providers:
Framer: Website creation and hosting, audience measurement (Framer Analytics); Provider: Framer B.V., Rozengracht 207B, 1016 LZ Amsterdam (Netherlands); Place of processing: Netherlands (EU), servers in the USA (Amazon Web Services) – Standard Contractual Clauses; Privacy information: Privacy Policy;
cyon: Hosting of subpages or landing pages; Provider: cyon AG, Brunngässlein 12, 4052 Basel (Switzerland); Place of processing: Switzerland; Privacy information: Privacy Policy.
4.2 Cookies and Similar Technologies
Cookies are small text files that are stored on your device when you visit a website. Similar technologies include, for example, pixels, tags, or local storage in the browser. We use the following cookies:
Technically Necessary Cookies: These are required for the operation of the Website and the Platform, for instance, to keep you logged in to the Platform after authentication (e.g., session cookies).
For certain functions of the Platform, we also use the local storage of your browser (e.g., localStorage and sessionStorage).
According to the provider, no cookies are used for audience measurement with Framer Analytics (Section 4.1).
Independently of this, you can manage, block, or delete cookies in your browser settings. If technically necessary cookies are blocked, individual functions may no longer be available.
4.3 Contact, Appointment Scheduling, and Online Meetings
Contact. If you contact us by email, telephone, or any other means, we process your contact details (e.g., name, email address, telephone number, company, position) and the content of your message to respond to your inquiry and, if applicable, to initiate or perform a business relationship. We may also transfer your details to our customer relationship management system (Section 4.6).
Contact Form. If you write to us via the contact form on our Website, we process the information you provide in the form for the same purposes, specifically your name, email address, company, position, and the content of your message. Entries are stored with the form provider and in our customer relationship management system (Section 4.6).
Online Appointment Booking. If you book an appointment on our Website or via a link provided by us using our online booking tool, we process your name, your email address, the selected appointment, your time zone, and the information you provide in the booking form. This information is transferred to our calendar, and you receive a confirmation by email.
Online Meetings. We conduct audio and video conferences using a conference tool. In doing so, your name or display name, your email address (if you participate via an invitation), technical connection data (e.g., IP address, device and participation information), as well as audio, video, screen, and chat content transmitted during the meeting are processed. We only create recordings or transcripts after prior notice.
Email Communication. When communicating by email, we process your email address, your name (if provided), as well as the content of your messages and any attachments to answer your inquiries, correspond with you, inform you about important events, and clarify follow-up questions. Emails are stored on the servers of the service provider named below. There is a risk that unencrypted emails may be intercepted and read by unauthorized third parties during transit. Please use a secure communication channel for the transmission of confidential information or sensitive personal data.
For contact, appointment scheduling, online meetings, and email communication, we specifically engage the following service providers:
Microsoft 365: Email, calendar, and online meetings (Microsoft Teams); Provider: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18 (Ireland); Place of processing: Switzerland (data storage), access for support and operations also from third countries, in particular the USA – Swiss-U.S. Data Privacy Framework or Standard Contractual Clauses; Privacy information: Privacy Policy;
Cal.com: Online appointment scheduling; Provider: Cal.com, Inc., 2261 Market Street #4382, San Francisco, CA 94114 (USA); Place of processing: USA – Standard Contractual Clauses with adaptations for Switzerland; Privacy information: Privacy Policy;
Framer: Contact form on the Website (Framer Forms); Provider: see Section 4.1;
Brevo: Customer relationship management (CRM) for contact inquiries and Website contact form; Provider: see Section 4.6.
4.4 Customer Account, User Accounts, and Use of the Platform
Customer Account and User Accounts. We maintain a customer account for each customer and a personal user account for each user. For the customer account, we process in particular the name or company name and address of the customer, contact persons, and administrators, as well as details regarding the subscription, user licenses, and usage plans. For user accounts, we process in particular the name, email address, organization, role, and permissions, the assigned user license, and the usage plan. We receive the details for a user account from the user themselves or from the customer whose administrators set up the user account or invited the user. The customer and their administrators have insight into the details of the user accounts; users have insight into the details of their own user account. Users may modify their profile information at any time.
Authentication and Access Management. For login and the administration of access rights, we use open-source software that we operate ourselves on the infrastructure of our hosting provider in Switzerland. In this context, user identifiers, login credentials (passwords are not stored in plaintext), two-factor authentication details where applicable, session information, and the timestamp and IP address of logins are processed.
Technical Log, Operational, and Usage Data. During the operation of the Platform, we process technical information and metadata concerning its use and operation, e.g., access timestamps, features used, extent of usage, error messages, information on platform availability and response times, and system logs. We design logging in such a manner that it does not contain Customer Content (Section 3). We require this data to ensure secure and reliable operation, rectify errors, prevent misuse, and bill for usage. For statistical purposes and the ongoing development of the Platform, we use aggregated or anonymized usage statistics to the extent possible.
Hosting. The infrastructure of the Platform, including the databases, is operated by a hosting provider exclusively in Switzerland.
For the operation of the Platform and the analysis of usage data, we specifically engage the following service providers:
Begasoft: Hosting and operation of the Platform infrastructure, including databases and user management, evaluation of technical log, operational, and usage data of the Platform (excluding Customer Content); Provider: BEGASOFT AG, Laupenstrasse 17, 3008 Bern (Switzerland); Place of processing: Switzerland; Privacy information: Privacy Policy;
Microsoft Azure: Evaluation of technical log, operational, and usage data of the Platform (excluding Customer Content); Provider: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18 (Ireland); Place of processing: Switzerland, access for support and operations also from third countries (Microsoft Customer Lockbox enabled), in particular the USA – Swiss-U.S. Data Privacy Framework or Standard Contractual Clauses; Privacy information: Privacy Policy.
4.5 Contract Execution, Invoicing, and Payment
For entering into and performing contracts, we process details regarding the booked services and subscriptions, billing addresses, contact persons, invoices, payment status, and payment history.
Accounting, Proposals, and Invoicing. We manage our accounting, proposals, and invoicing using accounting software.
Online Payments. We process online payments (e.g., by credit card) via an external payment service provider. The information required for payment, specifically name, billing details, amount, payment method, and transaction data, is collected and processed directly by the payment service provider. Card details are stored exclusively with the payment service provider. We do not receive complete card details, but only a token reference to the stored payment method, details such as card type, the last four digits, and the expiration date, as well as the information we require to allocate and confirm the payment, administer the subscription, and maintain our accounts. The payment service provider partially processes data under its own responsibility, for example, for fraud prevention and compliance with its own statutory obligations; in this respect, its privacy policy applies.
For accounting, invoicing, and payment processing, we specifically engage the following service providers:
bexio: Accounting, proposals, and invoicing; Provider: bexio AG, Alte Jonastrasse 24, 8640 Rapperswil (Switzerland); Place of processing: Switzerland; Privacy information: Privacy Policy;
Stripe: Processing of online payments; Provider: Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210 (Ireland); Place of processing: Ireland (EU) and USA (Stripe, Inc.) – Swiss-U.S. Data Privacy Framework; Privacy information: Privacy Policy.
4.6 Customer Relationships, Waitlist, Newsletter, and Marketing Emails
Customer Relationship Management (CRM). We use CRM software to manage our contacts and customer relationships. In doing so, we process contact details, company, and position, as well as details regarding our prior communication and business relationship, in order to respond to inquiries, maintain customer relationships, and inform you about our offerings.
Waitlist and Newsletter Registration. Prior to the general availability of the Platform, you may register for the waitlist via a form on our Website. Thereafter, you may register for our newsletter via a form on our Website. In doing so, we process the details you provide in the form, specifically your email address and, where applicable, name, law firm or company, position, and the timestamp of your registration. These details are invariably transferred to our customer relationship management system. By registering for the waitlist or subscribing to the newsletter, you will receive information about Sereos, in particular regarding our products, services, and updates (newsletter). We also inform individuals on the waitlist about the availability of the Platform and their access to it. Providing your email address is voluntary, but necessary for us to deliver this information to you. You may unsubscribe at any time (see "Unsubscribing").
Newsletter. We send newsletters and comparable mass emails via an email marketing provider, and only if you have consented or if you are already an existing customer. In doing so, we process your email address, name, and company where applicable, as well as details concerning your registration.
Engagement Measurement. Our emails may contain small image elements (tracking pixels) and specially formatted links. These allow us to recognize whether and when an email was opened and which links were clicked. Depending on the settings of the respective campaign, this information is either assigned to the individual recipient or evaluated solely on an aggregated basis. We use this to improve our communications and to better understand interest in our offerings. You can disable the loading of images in your email client.
Unsubscribing. You may unsubscribe from the newsletter and comparable mass emails at any time, either via the unsubscribe link contained in every such email or by sending a notice to info@sereos.ch. You can also object to the evaluation of your interactions using the same contact method.
For customer management, waitlists, newsletters, and marketing emails, we specifically engage the following service providers:
Brevo: Customer relationship management (CRM), waitlist administration, forms for waitlist and newsletter registration, dispatch of newsletters and marketing emails, engagement measurement; Provider: Brevo GmbH, Köpenicker Str. 126, 10179 Berlin (Germany); Place of processing: EU (storage in France and Belgium), access for support and operations also from the USA and India; sub-processors partly located in the USA
Standard Contractual Clauses; Privacy information: Privacy Policy;
Framer: Forms for waitlist and newsletter registration (Framer Forms); Provider: see Section 4.1.
4.7 Internal Organization and Document Management
We store records from our business activities, e.g., correspondence, contracts, and meeting notes, in a cloud-based document management system. For internal collaboration and team knowledge management, we use knowledge management software. For internal communication, we use messaging and collaboration services. In this context, personal data of customers, prospective customers, and business partners may be processed to the extent contained in such documents, notes, and messages. Our Microsoft 365 environment is maintained by an external IT service provider who, for this purpose, may have access to the data stored therein.
For document management, internal collaboration, and the administration of our Microsoft 365 environment, we specifically engage the following service providers:
Microsoft 365 (SharePoint, OneDrive, Teams): Document management and internal communication; Provider: see Section 4.3;
kite: Administration and management of our Microsoft 365 environment; Provider: KITE AG, Englischviertelstrasse 24, 8032 Zurich (Switzerland); Place of processing: Switzerland; Privacy information: Privacy Policy;
Nuclino: Internal collaboration and knowledge management; Provider: Nuclino GmbH, Nördliche Münchner Str. 47, 82031 Grünwald (Germany); Place of processing: Germany (EU); Privacy information: Privacy Policy;
WhatsApp: Internal communication; Provider: WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5 (Ireland); Place of processing: Ireland (EU) and USA (WhatsApp LLC) – Swiss-U.S. Data Privacy Framework; message content is end-to-end encrypted; Privacy information: Privacy Policy.
4.8 Social Media and Advertising
LinkedIn Company Page. We maintain a company page on LinkedIn. When you visit it or interact with our posts, LinkedIn processes your data according to its own privacy policy. We receive aggregated statistics from LinkedIn regarding the use of our page (Page Insights), for the creation of which we may be joint controllers with LinkedIn. To the extent you send us messages via LinkedIn or are connected with us, we process the corresponding data as described in Sections 4.3 and 4.6.
Advertising on LinkedIn and Google. We place advertisements on LinkedIn and via Google Ads (e.g., in Google search results). In doing so, we define target audiences based on general criteria (e.g., industry, position, region, search terms) and receive aggregated reports from the providers regarding the performance of the ads. When you view or click an ad, LinkedIn or Google processes your data under its own responsibility.
For our company page and advertisements, we specifically engage the following service providers:
LinkedIn: Company page, advertisements; Provider: LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2 (Ireland); Place of processing: Ireland (EU) and USA (LinkedIn Corporation) – Swiss-U.S. Data Privacy Framework; Privacy information: Privacy Policy;
Google Ads: Advertisements; Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4 (Ireland); Place of processing: Ireland (EU) and USA (Google LLC) – Swiss-U.S. Data Privacy Framework; Privacy information: Privacy Policy.
4.9 Job Applications
If you apply for a position with us, we process the details and documents you submit to us, as well as information we obtain during the recruitment process, such as from interviews or, with your consent, from references. We process this data to assess your suitability for the position, conduct the application process, and, if applicable, enter into an employment relationship. For the application process and communication with you, we may use the service providers listed in Sections 4.3 and 4.7.
5. Additional Purposes
Beyond the purposes mentioned in Section 4, we process personal data, to the extent necessary, to:
ensure the security, availability, and integrity of our systems, and to detect and prevent misuse;
comply with statutory and regulatory obligations, in particular record-keeping and accounting obligations;
assert, exercise, or defend legal claims;
improve and further develop our offerings, using anonymized or aggregated data wherever possible.
We process personal data in accordance with the principles of the FADP, in particular lawfully, in good faith, proportionately, and solely for purposes that are evident at the time of collection. Insofar as we request your consent, you may revoke it at any time with effect for the future.
6. Service Providers and Other Recipients
6.1 Service Providers
We cooperate with service providers that we select carefully. With service providers that process personal data on our behalf, we enter into data processing agreements or agree to their standard terms for data processing. Therein, they undertake to process data only on our instructions and to protect it adequately. Service providers only receive the data they require for their respective service. Insofar as a service provider processes data for its own purposes, this is done under its own responsibility.
Which service providers we engage, where they have their registered office, in which state they process data, and which safeguards we rely on in this context are indicated for the respective processing activity in Section 4.
6.2 Other Recipients
In individual cases, we may disclose personal data to external advisors (e.g., attorneys, fiduciaries, auditors), to public authorities and courts, to the extent we are obligated or entitled to do so or where necessary to safeguard our rights, as well as to acquirers in the context of a corporate transaction.
We do not sell personal data.
7. Disclosure Abroad
Some of our service providers have their registered offices or servers outside Switzerland. Personal data may therefore be disclosed to the countries specified in Section 4, specifically to countries within the EU (Netherlands, Ireland, France, Belgium, Germany), the USA, and India.
According to Annex 1 of the DPO, the states of the EU and the EEA provide an adequate level of data protection. The same applies to recipients in the USA certified under the Swiss-U.S. Data Privacy Framework. In the event of a disclosure to other states or to non-certified recipients, we ensure protection through standard data protection clauses recognized by the Federal Data Protection and Information Commissioner (FDPIC) (Art. 16 para. 2 let. d FADP), supplemented by further protective measures where necessary. In exceptional cases, disclosure may be based on Art. 17 FADP, for example, where it is necessary for the conclusion or performance of a contract with you.
8. Retention and Deletion
We retain personal data only for as long as necessary for the respective purpose, as long as statutory retention obligations exist (e.g., ten years for business records and accounting records pursuant to Art. 958f of the Swiss Code of Obligations), or as long as we have a legitimate interest in retaining it, for example, for evidentiary purposes or to assert or defend legal claims. Thereafter, we delete or anonymize the personal data.
The retention and deletion of Customer Content are governed by the GTC and the Data Processing Agreement (Section 3).
9. Data Security
We take appropriate technical and organizational measures to protect personal data against unauthorized access, loss, misuse, alteration, and disclosure. In doing so, we take into account the nature of the data, the associated risks, and the state of the art.
Detailed information on our security measures can be found at www.sereos.ch/sicherheit.
10. Automated Individual Decision-Making and Profiling
We do not make any automated individual decisions within the meaning of Art. 21 FADP. The evaluation of interactions with our marketing emails (Section 4.6) may constitute profiling; we do not engage in high-risk profiling.
11. Obligation to Provide Personal Data
You are not obligated to disclose personal data to us. Without certain information, however, we cannot enter into a contract, set up a customer or user account, or process your inquiry. When visiting the Website, the processing of technical data is unavoidable.
12. Your Rights
Under the FADP, you have, in particular, the right to:
request access as to whether and which personal data we process concerning you (Art. 25 FADP);
request the rectification of incorrect personal data;
request the erasure of your personal data or object to its processing;
request the delivery or transfer of personal data that you have disclosed to us in a conventional electronic format (Art. 28 FADP);
revoke any consent granted at any time with effect for the future.
These rights are not absolute. We may restrict them to the extent permitted by law, for example, where statutory retention obligations exist or overriding interests preclude it.
To exercise your rights, please contact info@sereos.ch. We may require proof of identity to the extent necessary to examine your request.
You may also enforce your claims through the courts or file a complaint with the Federal Data Protection and Information Commissioner (FDPIC) (www.edoeb.admin.ch).
13. Third-Party Websites
Our Website may contain links to websites and services of third parties. The respective operators are responsible for their processing of personal data; their respective privacy policies apply.
14. Amendments
We may amend this Privacy Policy at any time, for instance, when we further develop our offerings, engage new service providers, or if legal requirements change. The current version published on our Website is authoritative.
—
As of: November 10, 2026