Privacy policy

Draft — this page is built but not in force. Part C and some details in Parts A and B are with our lawyers. Everything still missing is marked as a placeholder.

This English page is a translation for convenience. It has not been reviewed by a lawyer. The German version at tourlio.ch/datenschutz is the binding one; in case of any difference, the German wording applies.

This policy explains which personal data is processed in connection with Tourlio, for what purpose and for how long. {{EU_KUNDEN_JA_NEIN}}

Part A — This website. Tourlio is the controller for the data that arises when you visit and use this website.

Part B — The application. The customer — the courier company — is the controller for its drivers’ data; Tourlio is the processor. The details are governed by the data processing agreement (Auftragsbearbeitungsvertrag), not by this page.

Reading aid: the line “In short” at the start of a section summarises it. What counts is the full text below it.

Part A — This website

A1 Server logs

In short: Visiting the site produces technical log data.

When you visit this website, our servers automatically record {{LOG_FELDER}}. This data serves the technical delivery of the website and troubleshooting. It is deleted after {{LOG_AUFBEWAHRUNG}}.

A2 Cookies

In short: We set no cookies.

This website sets no cookies and therefore needs no consent banner. {{COOKIES}}

A3 External resources

In short: We load nothing from third-party servers.

This website loads no fonts, scripts or images from third-party servers. Everything is delivered from our own domain. Simply opening a page therefore sends no data to third parties.

A4 Contact by email

In short: Emails are kept for as long as your enquiry is being handled.

If you write to us, we store your email address, the content of your message and anything else you choose to tell us. We use it solely to deal with your enquiry and keep it for as long as that requires.

A5 Trial access (30 days)

In short: For a trial we store your name, your email and your company name.

If you request 30-day trial access, we collect your name, your email address and the name of your company in order to set up the account. If the trial is not converted into a subscription after the 30 days, we delete this account data.

A6 Web analytics

Part B — The application

B1 Roles and contract

In short: You decide about your drivers’ data; we only process it on your instructions.

If you use Tourlio as your software, you are the controller for all data that you and your drivers enter. Tourlio acts solely as a processor. This is governed by a separate data processing agreement (Auftragsbearbeitungsvertrag), not by this policy.

B2 Categories of data

In short: We store what route planning and payroll in your company actually need.

On the customer’s instructions, Tourlio processes these categories:

Company account: Email, password (stored only as a hash), sign-in log including failed attempts — the latter to protect against unauthorised access.
Drivers: Master data, payroll model and deduction configuration.
Operations: Tours, assignments, schedules.
Capture: Quantities per category, receipt photos, the driver’s note for the day.
Absences: Period, approval — and medical certificates.
Payroll: Monthly statements, corrections, released versions, PDFs.
Audit log: Corrections to captured figures, with time and author.

B3 Particularly sensitive personal data

In short: Medical certificates are health data and therefore particularly sensitive.

Medical certificates filed to document sick leave are health data. Tourlio processes them as part of absence management. They are strictly separated per company, visible only to that company’s administrators, and retained as follows: {{ATTEST_AUFBEWAHRUNG}}.

B4 Disclosure to third parties

In short: We never send anything to your Treuhänder — a Swiss fiduciary who does the payroll. You do.

Tourlio passes no data to third parties on its own initiative, not even to a Treuhänder or tax adviser. We provide the finished CSV file for you to download. You decide who receives it.

B5 Sub-processors

In short: We rely on service providers for hosting, sending email and invoicing you.

To operate the application, we work with:

Hosting: Infomaniak Network SA
Sending email, for example password resets: {{MAIL_VERSAND}}
Payment provider for subscription fees: {{ZAHLUNGSDIENSTLEISTER}}

B6 Storage location and transfers abroad

In short: The data is held at Infomaniak Network SA in Switzerland.

The application and its data are held at Infomaniak Network SA, server location Switzerland. Whether any data leaves Switzerland at all, and on what basis, is set out in C4.

B7 Retention and deletion

In short: 90 days after cancellation the company data is deleted.

After a cancellation, the CSV export of your historical data stays available for 90 days. After that, the company and all associated operational and personal data are deleted from our systems.

B8 Security

In short: What we do to protect the data is written down openly.

How data is kept separate, what is logged and what a release freezes is described in detail.

See Data security and architecture.

Part C — Legal

Legal review pending: sections C1 to C6 will be added once our lawyers have approved them. No boilerplate is generated for these points — it could not be verified and would probably be wrong.