Privacy policy

In brief

• The platform's database is hosted in Switzerland, in Zurich.
• We only collect what is necessary to train your employees and follow their progress.
• No advertising, no audience measurement tool, no tracking, no resale of data.
• Passwords are never visible, neither to us nor to your company's administrator.

Who is responsible?

For the public website and the contact form, the controller is the publisher of the website, presented in the legal notice. Contact for any question about your data: formation@datalys.ch.

For employee accounts on the platform, it is the client company that decides to train its employees and that is responsible for this processing. We process this data on its behalf, as a processor, solely to provide the service.

What data do we process?

Visiting the website

Our hosting provider may record technical information related to your visit (IP address, date and time, page viewed, browser type) to ensure the operation and security of the website.

We do not use any audience measurement or advertising tool.

Contact form

Your name, your email address, the name of your company (optional) and your message. They are sent to us by email, solely to reply to you.

Account of the company and its administrator

The name of the company, the approximate number of employees indicated at registration, and the name and email address of the administrator.

Payment of the subscription

Payment is made on a page of our provider Stripe, which collects the card and billing details and applies its own privacy policy. We never have access to the card number: we only keep the customer and subscription identifiers provided by Stripe, the number of employee accounts purchased and the status of the subscription.

Employee accounts

• The name (optional) and the email address, entered or imported by the administrator.
• Progress in the modules: status (started, completed), final test score, dates of completion and last activity, modules made mandatory and their deadline.
• Messages sent with the "Report a problem" function: the message, the name, the email address, the role, the company, the page concerned and the browser type, so that the request can be handled.

Passwords are stored in an encrypted form that does not allow them to be read back. Passwords entered in the "Hacker challenge" exercise are analysed only in your browser: they are neither sent nor stored.

Why?

• To provide the platform: create accounts, send access details, display the modules.
• To collect the subscription and keep the number of employee accounts purchased up to date.
• To allow the company's administrator to see who has completed which modules, and to send reminders if needed. They see neither the computer activity, nor the mailbox, nor the passwords.
• To reply to your messages and handle reported problems.
• To ensure the security of the service.

Cookies and storage in the browser

• A session cookie, essential to stay logged in to the platform.
• A cookie that remembers the chosen language (kept for one year).
• Progress within a module (current step, exercises already done) is saved in your browser, on your device, so that you can resume where you left off.

No advertising or audience measurement cookies, and no third-party trackers.

Who has access?

Within the client company, only its administrator sees the progress of its employees. Each company's data is isolated from that of the others at database level. We use the following providers, who process the data solely to provide us with their service:

• Infomaniak Network SA (Geneva, Switzerland): Hosting of the website and the application.
• Supabase, Inc. (United States; data hosted in the Zurich region, Switzerland): Platform database and account authentication.
• Brevo (Sendinblue SAS) (Paris, France): Sending emails: account access, forgotten password, contact form messages.
• Stripe Payments Europe, Limited (Dublin, Ireland): Payment of the subscription by card: card details are entered at Stripe, we never have access to them.
• Hostinger International Limited (Larnaca, Cyprus): Mailbox of the contact address: receipt of contact form messages and reported problems.

We neither sell nor rent any data.

For how long?

Account data is kept as long as the company uses the platform, then deleted at the end of the contract, unless there is a legal obligation to retain it. Messages received through the contact form are kept for as long as needed to handle the request.

Security

Exchanges with the website are encrypted (HTTPS), each company's data is segregated, and two-step verification is available for all accounts.

Your rights

In accordance with the Swiss Federal Act on Data Protection (FADP), you can request access to your data, have it corrected or deleted, object to its processing or obtain a copy of it. Write to formation@datalys.ch.

If you are an employee of a client company, please contact your employer first, as it is responsible for this processing: we will help it respond to your request.

You can also contact the Federal Data Protection and Information Commissioner (FDPIC).

Changes

This policy may change along with the service. The date of the last update is shown at the top of this page.