Privacy policy

Part A — This website

A1 Server logs

In short: Visiting the site produces technical log data.

When you visit this website the server automatically records the IP address, date and time, the page requested, the browser identification and the referring page. These logs serve to deliver the website technically, to troubleshoot and to fend off attacks. They stay with the hosting provider in Switzerland, are not linked with other data, and are deleted once they are no longer needed for those purposes.

A2 Cookies

In short: We set no cookies.

This website sets no cookies and stores nothing in your browser. That is why there is no cookie banner.

A3 External resources

In short: We load nothing from third-party servers.

This website loads no fonts, scripts or images from third-party servers; everything is served from our own domain. The one exception is the contact form: there the Cloudflare Turnstile check protects against automated requests and loads from challenges.cloudflare.com (A4). On every other page, simply opening it sends no data to third parties.

A4 Contacting us by email

In short: Emails are kept for as long as the request is being handled.

If you write to us — by email or through the contact form — we store your email address, the content of the message and whatever you volunteer (such as company, phone number or the size of your business). We use it solely to handle your request and keep it for as long as that takes. The form delivers your input to us as an email; nothing is stored on the web server.

To fend off automated requests, the contact form uses the Cloudflare Turnstile check. Cloudflare, Inc. (USA) processes technical connection data of your browser for it; the check sets no cookies. If you prefer not to, write to us directly by email.

A5 Trial access (until the first month-end, at most 45 days)

In short: For the trial we store the business name, an email address and a password.

When you set up a trial we collect the name and address of your business, your email address and a password — the latter is stored only as a hash. Trial access ends with your first released monthly statement, at the latest after 45 days. If the trial is not turned into a subscription, the data of the business stays downloadable as a complete archive for another 90 days, and is then deleted (B7).

A6 Analytics

In short: There are none.

We use no analytics or tracking services and measure no audience. Everything we know about the use of this website is in A1.

Part B — The application

B1 Roles and contract

In short: You decide about your drivers’ data; we process it only on your behalf.

If you use Tourlio as software, you are the controller for all data you and your drivers enter. Tourlio acts solely as a processor. This is governed by the data processing agreement, not by this policy.

B2 Data categories

In short: We store what tour planning and payroll in your business need.

On the customer’s behalf, Tourlio processes the following categories:

• Accounts: Email, password (stored only as a hash), login log including failed attempts — the latter to protect against unauthorised access.
• Drivers: Master data, joining and leaving dates, pay model and deduction configuration.
• Assignments: Tours, assignments, schedules, start and end times.
• Vehicles: Plate, name, drive type, keeper and odometer readings per assignment.
• Tracking: Position data of the phone during an assignment — only if the driver has accepted the privacy notice in the app; they can switch tracking off themselves at any time. Nothing is recorded outside the assignment window. Raw points are deleted after a fixed period; the condensed trip (route, duration) stays with the assignment.
• Capture: Counts per category, receipt photos, the driver’s note on the day.
• Absences: Period, approval — and medical certificates.
• Statements: Monthly statements, corrections, released states, PDF.
• Log: Corrections to recorded figures, with time and author.

B3 Sensitive personal data

In short: Medical certificates are health data and therefore sensitive.

Medical certificates uploaded to document sick leave are health data. Tourlio processes them solely for absence management. They are stored outside the database in a secured file store, strictly separated per business, and visible only to that business’s administrators. They are kept for as long as the related absence exists in the system and are removed at the latest when the business is deleted (B7).

B4 Disclosure to third parties

In short: We send nothing to your fiduciary — you do that.

Tourlio passes no data to third parties of its own accord, not even to fiduciaries or tax advisers. We provide the finished export for you to download. Who you hand it to is your decision.

B5 Sub-processors

In short: We rely on providers for hosting, email delivery and billing you.

To run the application we work with:

• Hosting of application, database and file store: Infomaniak Network SA, Switzerland.
• Email delivery, for example invitations and password resets: Infomaniak Network SA (Mailhosting, Schweiz)
• Payment provider for the subscription fees: PostFinance Checkout (PostFinance AG). Your card details go directly to the payment provider; Tourlio never sees or stores them.

B6 Storage location

In short: The data is held by Infomaniak Network SA in Switzerland.

Application, database and file store are hosted by Infomaniak Network SA, with servers in Switzerland. No data is transferred abroad (C4).

B7 Retention and deletion

In short: Once 90 days have passed since the subscription ended, the business data is deleted.

The subscription ends on the day your cancellation takes effect, or — where a trial is not turned into a subscription — with the trial. If a payment is not made and the subscription is not cancelled, we end the contract ourselves; it then ends on the day we do so. The same applies if we end it for good cause (clause 5 of the terms and conditions).

After the subscription ends, your data stays downloadable as a complete archive for another 90 days, so you can take the export for your fiduciary and your receipts with you. We point this out to you 30, 7 and one day before that period expires. After that, the business and all related transactional and personal data — including receipt photos and medical certificates — are deleted from our systems.

B8 Security

In short: What we do to protect the data is stated openly.

How data is kept separated, what is logged and what a release freezes is described in detail.

See Data security and architecture.

Part C — Legal

C1 Legal basis

Swiss data protection law (DSG) applies. We process personal data to perform our contracts (trial, subscription, support), to meet legal obligations and to run the website and application securely. For drivers’ data inside the application, the respective business is the controller (B1).

C2 Your rights

You can ask what data we process about you, have it corrected or deleted, and request a copy in a common format. Write to info@tourlio.ch; we answer within 30 days. Drivers of a business that uses Tourlio should contact their employer — the employer is the controller, and we support them.

C3 Supervisory authority

The supervisory authority is the Swiss Federal Data Protection and Information Commissioner (FDPIC / EDÖB), Feldeggweg 1, 3003 Bern.

C4 Transfers abroad

All data is stored and processed in Switzerland. The one touchpoint abroad is the contact form’s security check (Cloudflare Turnstile, A4): Cloudflare, Inc. processes technical connection data in the USA, on the basis of the Swiss-U.S. Data Privacy Framework, under which Cloudflare is certified. Beyond that nothing is transferred abroad — and should that ever change, this policy will be updated first.

C5 Changes to this policy

The version published here applies; the date at the end of the page states its status. If anything substantial changes — a sub-processor, for example — we update this page before the change takes effect.

C6 Contact for privacy matters

For any question about data protection: info@tourlio.ch, or by post to Tourlio Yükseldi, Brunaustrasse 181, 8951 Fahrweid, Switzerland.