cgg.chCompliance & Governance Generator

Privacy policy

Version: November 2026 · Translation; the German version is authoritative.

1. Controller

Hunkeler Digital Services, Richard Hunkeler, Im Storchen 1, 8212 Neuhausen am Rheinfall, Switzerland, info@cgg.ch. Data protection contact: datenschutz@cgg.ch. This privacy policy is based on the Swiss Federal Act on Data Protection (FADP) and, where applicable, on the EU General Data Protection Regulation (GDPR).

2. What data we process

  • Account: name of the organisation or first and last name, UID, legal form, address, billing address, e-mail addresses and names of users, language, role.
  • Login and security: password (only as a hash), key of the authenticator app (stored encrypted), recovery codes (only as a hash), trusted devices (browser and operating system, times), login times, IP addresses to protect against misuse, log of important actions.
  • Login via single sign-on (SSO), if the customer sets it up: identifier at the customer's identity provider (issuer and subject), e-mail address and name, information from the provider on the type of login (e.g. multi-factor), times; with OpenID Connect the customer's client secret (encrypted).
  • Information on the organisation: industry, number of employees, connection to the EU, desired approach, name or function and, voluntarily, e-mail address of the responsible person and of the person who approves new tools.
  • AI tools: recorded tools with provider, plan, purposes, types of data entered, additional information, responsible person and remarks.
  • Assessments: rating per tool with triggered rules and measures, recorded assessments with time and version of the rule set.
  • E-mails: recipient, subject and time of e-mails sent.
  • E-mails to cgg.ch addresses (e.g. support@, abuse@, disclosure@, admin@ or datenschutz@cgg.ch): sender, recipient, subject, text, attachments and headers as well as our replies; status, internal notes and assignment to a customer account or to a data protection request; for blocked senders the block list (e-mail address or domain, time, person who blocked).
  • Matching with the UID register of the Federal Statistical Office (public data on the UID provided).
  • Data processing agreement: version, time, name and e-mail address of the person concluding it, IP address; for a customer's own agreement the file deposited.
  • Eligible customers: country and type of customer; for companies from the EU and the United Kingdom the VAT identification number and every check via VIES or HMRC (result, officially confirmed name and address, checking service, time, triggering person); results of matching with the UID register and the sanctions list.
  • Activity: time of a user's last action (login, order, payment, change of data, own check) and time of a deletion notice.
  • Logo: if you upload a logo for the result package, we store a resized, re-encoded copy without embedded information; you can remove it at any time.
  • Training (bog.ch): with a subscription, we report to bog.ch – the course and exam offering of Hunkeler Digital Services under the brand Bureau of Governance – the organisation's name, country and language, number of seats and validity, and the module «Our rules» from the use policy (no questionnaire answers). From bog.ch we receive, for each invited person, name, e-mail address, scope, status, number of attempts and certificate expiry date for the training record (no answers, no scores). When switching via «Manage training», we pass the name and e-mail address of the logged-in person to bog.ch.
  • Data protection requests: type, scope, receipt, name, e-mail address, for a contribution to costs the address, process and result.
  • Contact form: name, company or organisation, e-mail address, telephone number (optional), topic, message, language, time, result of the spam check (score and reasons, including a DNS query as to whether the domain of the e-mail address can receive e-mails) and a truncated hash of the IP address.
  • Help requests from the customer area: subject, messages, attachments, requesting login, times and status; for expert help the quote, consent (wording, time, login, truncated hash of the IP address), effort and invoice. If we take over a message from the contact form as a help request or data protection request, it is continued there.

3. Purposes and legal bases

We process the data in order to provide the platform, to perform and invoice contracts, to ensure the security of the platform, to prevent misuse, to fulfil legal obligations and to communicate with you. The legal bases are the contract, our legitimate interests (security, protection against misuse, enforcement of claims) and legal obligations. To comply with sanctions, we match customer names against the SECO sanctions list (legal obligation and legitimate interest). We process e-mails to cgg.ch addresses in order to answer enquiries, reports (e.g. of misuse or security vulnerabilities) and requests and as evidence of the performance of contracts (contract, legitimate interests, legal obligations). We process enquiries via the contact form in order to answer them (legitimate interest or pre-contractual measures); to protect against spam, we check them automatically and count enquiries per IP address (only as a hash, for at most 24 hours). We process help requests to perform the contract and, for expert help, to handle and invoice the assignment.

4. Rating

The AI tools are rated automatically according to fixed, published rules based on your information and our tool catalogue. We do not use language models for this, and your information is not transmitted to providers of AI services. The rating concerns your organisation's tools and is not an automated individual decision about persons.

5. Processing on behalf of customers

We process personal data that customers record about third parties (e.g. responsible persons) on behalf of the customer. The customer is the controller; data subjects contact the customer to exercise their rights. We support the customer in this. The details are governed by the data processing agreement. Customers conclude it electronically when registering; it is available as a PDF under «Account → Data protection».

6. Cookies and web analytics

We only use cookies that are necessary for operation or that you trigger yourself with a setting. We do not use web analytics, advertising or third-party content (e.g. fonts or scripts). All cookies apply only to cgg.ch and cannot be read by scripts (HttpOnly).

  • «eam» (session): keeps you logged in. It ends when the browser is closed or after the selected period of inactivity (15 minutes to 7 days; from one day, the login persists beyond closing the browser). SameSite=Lax; when accessed via HTTPS, only transmitted encrypted (Secure).
  • «cgg_td_…» (trusted device): only if you choose it; on this device you then do not need to enter the code. Each login receives its own cookie; the name ends with a string that does not allow any conclusions about you. Term 1 to 90 days (default 30), revocable at any time under «Account → Security». SameSite=Lax; when accessed via HTTPS, only transmitted encrypted (Secure).
  • «cgg_sso» (ongoing login via SSO): at most 10 minutes or until the return from the identity provider. When accessed via HTTPS, SameSite=None and Secure, because the identity provider sends the login back to cgg.ch.
  • «cgg_theme» (display): only if you expressly choose the light or dark display; stores this choice for one year. It is deleted with «Automatic». SameSite=Lax; when accessed via HTTPS, only transmitted encrypted (Secure).

7. Storage location and disclosure

The data is stored on a server of Server4You GmbH (Hanau, Germany) in a data centre in Strasbourg (France). The e-mail dispatch and the mailboxes of cgg.ch also run on this server; the platform stores the text, headers and attachments of incoming e-mails encrypted. France and Germany are considered countries with adequate data protection under the FADP. We transfer invoices and credit notes (with billing address, e-mail address, amounts and payment status) to our own accounting software cash.simples.ch; it is also operated by Hunkeler Digital Services on a server of Server4You GmbH in the Strasbourg data centre. Encrypted backup copies are also kept on a separate computer of our own in Switzerland. There is currently no separate data processing agreement under Art. 9 FADP with Server4You. We have assessed the associated risks and accepted them internally. We aim to conclude such an agreement by 31.03.2027.

Recipients or categories of recipients:

  • Processor: Server4You GmbH (hosting of cgg.ch and cash.simples.ch, e-mail dispatch, mailboxes).
  • Customers' identity providers for SSO (e.g. Microsoft Entra ID, Google, Okta): we receive the login information from them; they act on behalf of the customer and are not our processors.
  • European Commission (VIES): the VAT identification number provided by companies from the EU, for checking.
  • UK tax authority HMRC (service «Check a UK VAT number»): the VAT identification number provided by companies from the United Kingdom, for checking. The United Kingdom is considered a country with adequate data protection under the FADP.
  • Federal Statistical Office (UID register): the UID provided, for checking.
  • bog.ch (also Hunkeler Digital Services): entitlement information and module «Our rules» as described in section 2, for your employees' course and exam.
  • Recipients' mail providers: e-mails are delivered via their own mail providers.
  • Authorities, if we are legally obliged to do so.

We do not disclose data to third parties beyond this. We download the sanctions list from SECO; no personal data is transmitted in the process.

8. Retention

  • We keep account data and all content of an account (information on the organisation, AI tools, assessments, logo) for the duration of the contract. We delete it 90 days after the end of the subscription or after an interruption due to non-payment; before that, we send a reminder by e-mail every 10 days. Until then, you can download all data as a ZIP.
  • We delete accounts without a contract after 180 days without activity or, for companies from the EU and the United Kingdom, after 180 days without a successful check of the VAT identification number; we announce the deletion beforehand by e-mail. We delete registrations with an e-mail address that was never confirmed after 180 days without notice. After deletion we send a confirmation; we keep the address for this for at most 72 hours.
  • We keep invoices, payments and other accounting records for ten years.
  • We delete e-mail dispatch logs after 180 days, expired login and invitation links after 30 days.
  • We delete messages from the contact form 12 months after receipt, those classified as spam after 30 days. We delete the copy sent by e-mail to info@cgg.ch after the same period. If a contract or a data protection request results from it, its periods apply. We do not store rejected enquiries (e.g. automated spam); we only record the reason without personal data.
  • Help requests belong to the account: we keep them for the duration of the contract and delete them with the account. Expert help invoiced remains as an invoice item during the retention period for accounting records (ten years).
  • We keep e-mails to cgg.ch addresses and our replies for 24 months from the last message in a thread. If they relate to a customer's assignment (assignment to the customer account), we keep them for 5 years from the last message, including after the account is closed and in the event of a deletion request. We keep e-mails relating to a data protection request for as long as the case. After expiry, we delete them in the platform and in the mailbox on the mail server. We may delete unwanted e-mails, such as advertising, earlier. We place e-mails from blocked senders in quarantine and delete them there after 20 days in the platform and in the mailbox on the mail server; e-mails relating to a data protection request are exempt from this. The block on an address or domain remains in place until it is lifted, including in the event of a deletion request, so that it remains effective. In the event of a deletion request, we immediately delete your e-mails that are unrelated to an assignment; we keep our replies to you (quoting your message) until their period expires.
  • Checks of the VAT identification number (VIES, HMRC): failed checks without a connection to an order for at most 12 months; successful checks without a connection to an order until the account is deleted; checks connected to an order or invoice for ten years from the end of the calendar year.
  • We keep the results of matching with the sanctions list for the duration of the contract and thereafter as evidence for up to ten years.
  • Backup copies are kept for at most 6 months; deleted data may still be contained in backups until then.
  • We record deletions on request and the closing of accounts in a deletion log. If a backup has to be restored after an outage, we carry out these deletions again using the deletion log; the platform repeats automatic deletions after expiry of the periods itself. We do not list individual deletions of content by customers (e.g. a recorded AI tool) separately (no deletion journal); they may be present again after a restore, usually at most those of the last 12 hours. We inform the customers concerned in this case.
  • We keep the action log of an account (time, action, e-mail address of the acting person) for as long as the account exists and for 2 years after it is closed as evidence in the event of claims. The e-mail address remains there even after a login has been deleted.
  • We keep cases relating to data protection requests and the deletion log for 2 years after completion; we check copies of identity documents and do not store them.
  • We log access to the platform's interfaces (accounting, payment service) with IP address for 6 months.
  • We delete the link between a login and the identity provider (SSO) together with the login or the SSO settings; identifiers of logins already used (replay protection) after their expiry.

9. Data security

We protect the data with technical and organisational measures, in particular encrypted transmission (HTTPS), storage of files outside the web directory, logging and an authorisation concept. For login we require a second factor (code from an authenticator app) in addition to the password. Exceptions: on a device that you have marked as trusted, the code is not required during the selected term (at most 90 days). For login via SSO, the customer determines how the second factor is checked: via the multi-factor proof of its identity provider, additionally with a separate code at cgg.ch or by trusting its identity provider; in the latter case cgg.ch does not check a second factor itself. We store passwords and recovery codes only as a hash; we store the keys of the second factor (authenticator app), the mailbox credentials as well as texts and attachments of incoming e-mails, messages from the contact form and help requests including attachments encrypted. The database and files are backed up encrypted at least every 12 hours. The details are set out in Annex 2 of the data processing agreement.

10. Your rights

You have the right to access, rectification, erasure, restriction, release or portability of your data as well as the right to object and to withdraw consent.

You can request information about the personal data we process about you. The information includes the details provided for by law, in particular the purposes of processing, the personal data processed, the recipients or categories of recipients, the retention period and, where provided for, the origin of the data.

You can request part of the information automatically via the platform. Insofar as the automatic extract does not contain all the information subject to disclosure, you can request supplementary information via our data protection contact. We examine the request and provide the information to the extent and within the periods prescribed by law. Legally permissible restrictions remain reserved.

  • With a login, you submit requests for access and erasure directly under «Account → My data». You receive the automatic extract by e-mail; it is possible once every 12 months and contains, among other things, your e-mails to cgg.ch and our replies (attachments with name and size) as well as any block on your address. You delete a login with your password and the code from the authenticator app. If the last main user closes the account, content and logins are deleted immediately; amounts already paid are not refunded.
  • Without a login or for further requests, contact our data protection contact datenschutz@cgg.ch. Where necessary to prevent unauthorised disclosure of data, we may request additional information to verify your identity. We only request a copy of an identity document if identity cannot be adequately verified by less intrusive means. We check the copy and do not store it.
  • The information is free of charge. In exceptional cases (disproportionate effort, manifestly unfounded or excessive requests), we request a contribution to costs of at most CHF 300 in advance.
  • A request via cgg.ch only concerns the data of this platform. On request, we carry it out for all services of Hunkeler Digital Services.
  • Data that we process on behalf of customers (section 5) concerns the respective customer; we forward your request to them.

You can lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC); in the EU with the competent supervisory authority.

11. Changes

We amend this privacy policy when the platform or the law changes. The version published on cgg.ch applies.