Privacy policy
How we handle your personal data — on this website and in our IoT platform.
A.1 Controller
The controller within the meaning of the General Data Protection Regulation (GDPR) is:
grovez GmbH
Weißer Weg 7b
32657 Lemgo
Germany
Email: info@grovez.io
Represented by the managing directors Manuel Behlen, Steffen Kraetzig and Nils Pletzinger. Registered with the commercial register of Lemgo Local Court under HRB 12006.
No data protection officer has been appointed, as the conditions of Art. 37 GDPR and Section 38 BDSG (German Federal Data Protection Act) are not met. For any data protection matter please contact us at info@grovez.io.
A.2 Scope of this policy
This privacy policy applies to
- our website grovez.io including all sub-pages (Part B),
- our cloud platform app.grovez.io, our LoRaWAN network server lpwan.grovez.io and our documentation portal docs.grovez.io (Part C),
- our mobile application for iOS and Android (Part D).
Our offering is addressed exclusively to companies, municipal utilities, municipalities and other organisations (B2B/B2G). It is not addressed to consumers and not to children or young people.
A.3 Our two roles
For part of the data we decide on the purposes and means of processing ourselves — there we act as controller. For another part we process data exclusively on our customers' instructions — there we act as processor under Art. 28 GDPR.
| Role | Data concerned |
|---|---|
| Controller | website use, contact enquiries, prospect and customer management, user accounts and sign-in, contract, quotation and invoicing data, system logs of our infrastructure |
| Processor | all content our customers manage in their tenant — in particular asset and device data, operating, energy and sensor data, and the functional change log |
The controller for the content of a tenant is always the organisation that has concluded the contract with us. For questions concerning such data, please contact that organisation; we forward any such request without delay (see G.3).
A.4 Contents
B.1 General information on processing
We process personal data only where this is necessary to provide a functioning website and our content and services, where we are legally permitted or obliged to do so, or where you have given your consent. The legal bases are in particular Art. 6(1)(a) GDPR (consent), (b) (contract and pre-contractual measures), (c) (legal obligation) and (f) (legitimate interests).
B.2 Hosting and delivery
This website is hosted with Amazon Web Services (AWS). The provider is Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg. Storage takes place in the AWS Europe (Frankfurt) region, eu-central-1, i.e. on servers within the European Union. A data processing agreement under Art. 28 GDPR is in place with AWS.
Delivery takes place via the content delivery network Amazon CloudFront. For technical reasons, your request may be processed by an edge location close to you; such locations exist worldwide. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in the secure, fast and uninterrupted provision of the website. Where this involves a transfer to a third country, it is based on appropriate safeguards under Art. 46 GDPR (EU standard contractual clauses within the AWS data processing agreement); AWS is additionally certified under the EU-US Data Privacy Framework.
B.3 Server log files
Each time the website is accessed, information transmitted by your browser is recorded automatically; it is technically necessary to display the website to you and to ensure its stability and security. This generally includes: IP address, date and time of access, file requested, volume of data transferred, referrer URL, browser type and operating system.
The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in the secure and uninterrupted operation of the website and in preventing and investigating attacks. This data is not combined with other data sources and is not used to create usage profiles. For retention periods see Part F.
B.4 Cookies and local storage
On this website we use no cookies and no analytics, tracking or marketing technologies. We embed no third-party content: fonts, images and scripts are loaded exclusively from our own servers. No reach measurement takes place, no usage profiles are created, and no consent banner is required.
We only store your language selection (DE/EN) in your browser's local storage (localStorage) under the key grovez-lang. This information remains on your device and is not transmitted to us. Storage is strictly necessary for the function you requested (Section 25(2) no. 2 TDDDG, formerly TTDSG); no consent is required. You can clear local storage at any time in your browser settings.
B.5 Contact and whitepaper requests
The forms on this website — both the contact form and the form for requesting our whitepaper — do not transmit your entries to our servers. Instead, they open your local email program with a prepared message. Transmission only takes place once you send that email yourself.
Once your message reaches us, we process the information it contains in order to handle your request. For the whitepaper this is typically first name, last name, email address, organisation and type of organisation; for other enquiries, the information you provide including the content of your message. The legal basis is Art. 6(1)(b) GDPR where your enquiry is aimed at concluding a contract, and otherwise Art. 6(1)(f) GDPR based on our legitimate interest in responding to enquiries.
B.6 Reporting form under the Digital Services Act
On our Digital Services Act page we provide a reporting form. Unlike the other forms on this website, it transmits your entries directly from your browser to a workflow service operated by Microsoft Corporation (Microsoft Power Automate), which forwards the report to our internal team.
The following is transmitted: the URL or content you object to, your message or reasoning and — where provided by you — the name of the legal entity, first name, last name and email address, as well as your confirmation of accuracy, the language and the time of submission. As the transmission takes place directly from your browser, your IP address is also transmitted to Microsoft for technical reasons.
The legal basis is Art. 6(1)(c) GDPR in conjunction with our obligations under Regulation (EU) 2022/2065 (Digital Services Act), and otherwise Art. 6(1)(f) GDPR based on our legitimate interest in receiving and handling reports. The provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland; processing in third countries cannot be excluded and is safeguarded by EU standard contractual clauses and certification under the EU-US Data Privacy Framework.
Providing personal data in this form is voluntary unless otherwise required by law. If you wish to avoid this transmission, you may instead send your report informally by email to info@grovez.io.
B.7 Customer and prospect management (CRM)
To initiate, perform and manage business relationships we use the customer relationship management system Attio. The provider is Attio, Inc., 1111B South Governors Avenue, Dover, DE 19904, USA.
We process in particular: name, business contact details (email address, telephone number), company affiliation and position, communication content and history in the course of business interaction, and further information provided in the course of the business relationship.
The legal basis is Art. 6(1)(b) GDPR for initiating and performing contracts and Art. 6(1)(f) GDPR based on our legitimate interest in efficient and traceable customer and prospect management.
A data processing agreement under Art. 28 GDPR is in place with Attio. As the provider is based in the USA, a transfer to a third country takes place. This is safeguarded by the EU standard contractual clauses adopted by the European Commission pursuant to Art. 46(2)(c) GDPR; in addition, we have assessed the risks of the transfer and taken appropriate supplementary measures into account.
B.8 Our presence on LinkedIn
We maintain a company page on LinkedIn. The provider is LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland.
When you visit or interact with our page, LinkedIn processes data under its own responsibility in accordance with its own terms. With regard to the statistics on page usage provided to us ("page insights"), we are joint controllers with LinkedIn pursuant to Art. 26 GDPR. We receive aggregated evaluations only, which do not relate to individual persons; we cannot attribute them to individual profiles.
The legal basis is Art. 6(1)(f) GDPR based on our legitimate interest in effective external communication and in reaching professionals. You may exercise your rights both against us and against LinkedIn; for processing carried out by LinkedIn, exercising them there is most effective. Further information: linkedin.com/legal/privacy-policy.
We currently use neither web analytics nor advertising or retargeting technologies on this website, and we do not send a newsletter. Should this change, we will update this policy and — where required — obtain your consent in advance.
C.1 Purpose of the platform
Municipalities, municipal utilities and companies use our cloud platform to manage their luminaires and control cabinets, view operating and energy data, control dimming profiles and receive fault notifications. The platform is operated exclusively as software-as-a-service in the AWS Europe (Frankfurt) region, eu-central-1. No installation takes place on customer premises.
In addition, for customers who do not operate a LoRaWAN network server of their own, we provide one at lpwan.grovez.io with its own interface (see C.12).
As described in A.3, we process some of this data under our own responsibility (C.2 to C.8) and some on behalf of our customers (C.9).
Under our own responsibility
C.2 Registration and user account
You can register for a user account yourself. In doing so we process your first name, last name, email address and your password. Passwords are stored exclusively as a cryptographic hash, never in plain text.
User accounts are managed via the identity management system Keycloak, which we operate ourselves within our AWS environment; no disclosure to third parties takes place in this context.
The legal basis is Art. 6(1)(b) GDPR. Providing the above data is necessary to create the account; without it, registration cannot take place.
The platform provides graduated roles (system administration, organisation administration, service administration, user, process owner, viewer). Role assignment within an organisation is carried out by the customer.
C.3 Sign-in and two-factor authentication
You sign in with your email address and password. The use of a second factor by means of time-based one-time passwords (TOTP app) is mandatory for all accounts. For this purpose we store the corresponding secret; a telephone number is neither required nor collected.
When you sign in we also process the time, outcome and IP address of the sign-in attempt. The legal basis is Art. 6(1)(b) GDPR for providing access and Art. 6(1)(f) GDPR based on our legitimate interest in detecting and preventing unauthorised access.
C.4 Contracts, quotations and invoices
For quotations and invoices we additionally process: organisation, email address, telephone number, VAT identification number, street, postal code, city and country. We issue invoices for payment by bank transfer; we do not collect payment data such as card or account details, and no payment service provider is involved.
For this purpose we use the Medusa software, which we operate ourselves within our AWS environment. Accounting is carried out with Lexware; accounting records are transmitted to our tax adviser within the scope of statutory obligations.
The legal basis is Art. 6(1)(b) GDPR for the performance of the contract and Art. 6(1)(c) GDPR in conjunction with commercial and tax retention obligations (Section 147 AO, Section 257 HGB).
C.5 Sending system emails
For messages such as registration confirmations, password resets, fault notifications and invoices we use Amazon Simple Email Service (SES) in the eu-central-1 region and Microsoft 365. The legal basis is Art. 6(1)(b) GDPR.
C.6 Support
We provide support exclusively by email. No ticketing system, chat, screen recording or remote access to your devices is used. We process the information you provide in order to handle your request; the legal basis is Art. 6(1)(b) GDPR and otherwise Art. 6(1)(f) GDPR.
C.7 Log data of the platform
We keep logs in order to ensure operation, analyse faults and detect unauthorised access:
- Server and access logs — IP address, time, resource requested, browser type, response status. Legal basis: Art. 6(1)(f) GDPR.
- Sign-in logs — successful and failed sign-ins, two-factor authentication events. Legal basis: Art. 6(1)(f) GDPR.
- Functional change log — which user made which change and when, for example creating a device or changing a dimming profile. We maintain this log on behalf of our customers for their record-keeping purposes (see C.9).
Technical monitoring is carried out via Amazon CloudWatch within our AWS environment. No evaluation of user behaviour for analytics or marketing purposes takes place; we use no third-party product analytics, tracking or error reporting services in the platform.
C.8 Cookies and local storage in the platform
The platform uses strictly necessary cookies and local storage entries only. No consent is required for these under Section 25(2) no. 2 TDDDG; no consent banner is used.
| Name | Type | Purpose |
|---|---|---|
| AUTH_SESSION_ID | Cookie | assignment of the sign-in session |
| KC_AUTH_SESSION_HASH | Cookie | protection of the sign-in session |
| KEYCLOAK_IDENTITY | Cookie | identification of the signed-in user |
| KEYCLOAK_SESSION | Cookie | persistence of the sign-in session |
| recentRealms | Cookie | most recently used tenant |
| cartId | Cookie | assignment of the shopping cart during orders |
| nuxt-color-mode | Cookie | light or dark appearance |
| billing_token | localStorage | access to the invoicing functions |
| locale | localStorage | language selection |
| organizationId, tenantId | localStorage | active organisation or tenant |
| sorting, zoom, showMissingFeedback | localStorage | interface display settings |
| token | localStorage (network server) | session token of the LoRaWAN network server interface |
| tenantId | localStorage (network server) | active tenant in the LoRaWAN network server |
The LoRaWAN network server interface at lpwan.grovez.io sets no cookies of its own; it uses only the two local storage entries listed above. During sign-in, the cookies of our identity management system listed above apply.
A persistent sign-in ("remember me") is not offered. You can delete cookies and local storage entries at any time in your browser settings; the platform may then only be usable to a limited extent.
On behalf of our customers
C.9 Processing of asset, operating and sensor data
Our customers manage their assets within a tenant. We process this data exclusively on their instructions as a processor under Art. 28 GDPR. The following are processed in particular:
- Device master data — designation, device EUI, key material for the radio connection, geographic coordinates, firmware version, device type, manufacturer and the network integration used;
- Operating and telemetry data — energy consumption, dimming value, on/off state, connection quality (SNR, RSSI), battery level;
- Sensor data — depending on the sensor deployed, among others brightness, temperature, humidity and further environmental values as well as motion events;
- Free-text entries — designations, notes and fault descriptions entered by customers themselves.
Motion sensors and personal reference. Presence and radar sensors are deployed in some installations. These report only that motion has been detected. No image or audio recordings are made; no persons are counted, classified, distinguished or recognised, and no mobile device identifiers (such as Wi-Fi or Bluetooth addresses) are captured. The data serves exclusively to control lighting according to demand. Identification of individuals is therefore neither intended nor possible with the means available to us.
Our contractual terms prohibit connecting camera-based or biometric sensors via the platform, and prohibit using data to assess, track or monitor the behaviour of individuals. Where a customer intends any use going beyond this, that customer is obliged as controller to carry out a prior assessment — including, where applicable, a data protection impact assessment under Art. 35 GDPR; we support them in doing so pursuant to Art. 28(3)(f) GDPR.
Sensor data reaches us via LoRaWAN. Where a customer uses its own network operator or one commissioned by it (for example Swisscom), that contractual relationship exists directly between the customer and the operator; we receive the data from there. Where a customer has no network server of its own, we operate one within our AWS environment.
On the customer's instructions we make data available to their own systems via interfaces (API, webhook). The customer is responsible for further processing within those systems.
No automated individual decision-making, including profiling, within the meaning of Art. 22 GDPR takes place. Automated control affects lighting only and produces no legal effects concerning individuals.
Note for installations on company premises. Where sensors are deployed in areas in which employees are present, the responsible customer must observe the requirements of employee data protection (Section 26 BDSG) and, where applicable, the works council's co-determination rights under Section 87(1) no. 6 BetrVG.
C.10 Access by our administrators
For maintenance, fault analysis and support, administrators at grovez may access tenants. Such access takes place exclusively for these purposes and within the scope of the customer's contractual instructions. Changes are logged and attributed to the acting account. We keep the group of authorised persons as small as possible; at present two individuals hold production administration rights. We are working to make administrative access additionally subject to explicit approval by the customer in future.
C.11 Documentation portal
Our documentation portal docs.grovez.io provides technical documentation. It is operated within our AWS environment; no analytics or tracking services and no third-party content are embedded. The information in B.2 to B.4 applies accordingly.
C.12 LoRaWAN network server (lpwan.grovez.io)
Where a customer does not operate a LoRaWAN network server of its own, we provide one at lpwan.grovez.io. It connects the sensors to the platform and has its own interface in which customers can manage their gateways and devices.
We use the open-source software ChirpStack, which we operate ourselves within our AWS environment in the Europe (Frankfurt) region, eu-central-1. No service provider is involved; beyond the recipients named in Part E, no data is disclosed.
Sign-in uses the same identity management system as the platform (see C.2 and C.3). There are no separate user accounts held locally in the network server; mandatory two-factor authentication therefore applies here without exception. We are the controller for account and sign-in data and the processor for the content of the respective tenant (see A.3).
The following are processed in the network server:
- Gateway data — designation, gateway identifier (EUI) and location of the gateways operated by the customer, and their connection status;
- Device data — device identifier (DevEUI), key material for the radio connection and assignment to the respective tenant;
- Frame and event logs — technical records of radio communication including device identifier, timestamp, connection quality and gateway reference. They serve to troubleshoot sensor connectivity and, for technical reasons, are retained only briefly;
- Server and access logs as described in C.7.
Gateways are operated by the respective customer. Location details relate to technical installations, not to persons. We use no analytics, tracking or advertising technologies in this interface either.
D.1 Purpose and sign-in
Our mobile application supports the on-site commissioning of sensors: devices are located, tested and assigned to an installation. Sign-in uses the same identity management system as the platform (see C.2 and C.3).
D.2 Access to location
When a sensor is created, the app accesses your device's location in order to determine the position of the device. The location is transmitted to us solely in relation to the respective device and stored there as its position. No continuous location tracking, no recording of movement profiles and no background transmission of location take place.
Access to your device requires your consent (Section 25(1) TDDDG), which you give via your operating system's permission prompt. You may withdraw this consent at any time with effect for the future in your device settings; positioning must then be carried out manually. The subsequent storage of the device position is based on Art. 6(1)(b) GDPR on behalf of the respective customer.
D.3 Further processing in the app
The app uses no analytics, tracking or advertising services, no third-party crash reporting and no push notifications. Sign-in credentials are stored in the operating system's secure storage (iOS Keychain, Android Keystore).
Distribution takes place via the Apple App Store and Google Play. When downloading and updating, Apple and Google respectively process data under their own responsibility; we have no influence over this. The privacy terms of the respective provider apply.
E.1 Recipients of personal data
Within our company, only those persons who need it to perform their duties have access to your data. Beyond that, we disclose data to the following recipients:
| Recipient | Purpose | Role |
|---|---|---|
| Amazon Web Services EMEA SARL, Luxembourg | hosting, delivery, email dispatch, operational monitoring | processor |
| Attio, Inc., USA | customer and prospect management | processor |
| Microsoft Ireland Operations Ltd., Ireland | email, collaboration, reporting form per B.6 | processor |
| Haufe-Lexware GmbH & Co. KG, Germany | accounting | processor |
| Tax adviser | tax obligations | separate controller |
| Apple Inc. / Google Ireland Ltd. | provision of the app | separate controllers |
| LinkedIn Ireland Unlimited Company | company page | joint controller |
| Customers' own systems | provision of data via interfaces | on the customer's instructions |
| Public authorities and courts | statutory obligations | separate controllers |
Disclosure to public authorities takes place only where we are legally obliged to do so. We examine each request for its legal basis. Where a request concerns data within a customer's tenant, we refer the requesting body to that customer and inform the customer where legally permitted.
In the event of a restructuring, a sale of the company or the admission of investors, personal data may be transferred to acquirers or their advisers to the extent necessary. The legal basis is Art. 6(1)(f) GDPR based on our legitimate interest in the economic development of the company.
We do not sell data. We do not carry out credit checks.
E.2 Transfers to third countries
Storage and processing generally take place within the European Union, in particular in the AWS Frankfurt region. This also applies to data of customers from Switzerland, Austria and Italy.
A transfer to a third country may take place in the following cases:
- Attio (USA) — safeguarded by EU standard contractual clauses under Art. 46(2)(c) GDPR on the basis of the existing data processing agreement, supplemented by an assessment of transfer risks.
- Amazon CloudFront — delivery via edge locations distributed worldwide; safeguarded by the EU standard contractual clauses of the AWS data processing agreement. AWS is certified under the EU-US Data Privacy Framework.
- Microsoft — residual processing in the context of support and operations; safeguarded by EU standard contractual clauses. Microsoft is certified under the EU-US Data Privacy Framework.
- Apple and Google — in the context of app distribution, under the providers' own responsibility.
You may request a copy of the standard contractual clauses from us.
F.1 Principle
We store personal data only for as long as is necessary for the respective purposes or as statutory retention obligations require. Thereafter the data is deleted or anonymised.
| Data | Period |
|---|---|
| User account (name, email, password hash, second factor) | until the account is deleted |
| Organisation and contract data | end of contract plus three years (limitation periods) |
| Invoices and accounting records | ten years (Section 147 AO, Section 257 HGB) |
| Quotations and other business letters | six years (Section 257(4) HGB) |
| Operating, telemetry and sensor data | one year |
| Frame and event logs of the network server | brief retention only, for technical reasons |
| Device master data | for the duration of the contractual relationship |
| Functional change log | as instructed by the customer, at most for the duration of the contractual relationship |
| Server, access and sign-in logs | see F.2 |
| CRM data on prospects without a contract | up to three years after the last contact |
| Email correspondence | until the matter is concluded, unless retention obligations apply |
| Backups | see F.3 |
F.2 Log data
Server, access and sign-in logs are currently retained until further notice and used exclusively for the purposes set out in B.3 and C.7. We are in the process of implementing a deletion concept that provides fixed and considerably shorter periods for these logs. This policy will be updated as soon as those periods take effect.
F.3 Backups
We create daily backups, which are stored in encrypted form. They are kept for five days in immediate access and for a further 30 days in lower-cost archive storage. Where a record is deleted, deletion takes place immediately in the production system; in backups it lapses when they expire in the ordinary course. We do not restore deleted data from backups.
F.4 Deletion of a user account
On request we delete your user account including your account and profile data. Entries in the functional change log are not affected and continue to be retained so that changes to our customers' installations remain traceable. The legal basis for this is Art. 17(3)(e) GDPR and the instruction of the respective customer.
G.1 Your rights at a glance
- Access (Art. 15 GDPR) — whether and which data we process about you.
- Rectification (Art. 16 GDPR) — correction of inaccurate and completion of incomplete data.
- Erasure (Art. 17 GDPR) — unless retention obligations or other grounds preclude it.
- Restriction of processing (Art. 18 GDPR).
- Data portability (Art. 20 GDPR) — provision of the data you supplied in a common format.
- Withdrawal of consent (Art. 7(3) GDPR) — at any time with effect for the future, without affecting the lawfulness of processing carried out until then.
- Complaint to a supervisory authority (Art. 77 GDPR).
A message to info@grovez.io is sufficient to exercise these rights. We respond within one month; for complex requests this period may be extended by up to two months, of which we will inform you. To protect your data we may request additional information to confirm your identity before providing access.
G.2 Right to object under Art. 21 GDPR
You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is carried out on the basis of a legitimate interest pursuant to Art. 6(1)(f) GDPR. This concerns in particular the processing described in B.2, B.3, B.7, B.8, C.3 and C.7.
If you object, we will no longer process your data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.
Where your data is processed for direct marketing purposes, you have the right to object at any time and without giving reasons; your data will then no longer be processed for that purpose. An informal message to info@grovez.io is sufficient.
G.3 Requests concerning data in the platform
Where your request concerns data that a customer manages in its tenant, that customer is the controller. We may neither provide access to nor delete such data on our own initiative. In that case please address your request directly to the organisation concerned. If such a request nevertheless reaches us, we forward it to the customer without delay and support them in responding.
G.4 Right to lodge a complaint
Without prejudice to any other remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your residence, place of work or of the alleged infringement. The authority responsible for us is:
Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW)
Kavalleriestraße 2–4
40213 Düsseldorf
Germany
H.1 Technical and organisational measures
We take appropriate technical and organisational measures to ensure a level of protection appropriate to the risk (Art. 32 GDPR). These include in particular:
- encrypted transmission of all connections via TLS as well as encryption of stored data and backups;
- mandatory two-factor authentication for all platform user accounts and for administrative access to our infrastructure;
- role-based permissions following the principle of least privilege; production administration rights are limited to those who need them;
- logical separation of tenants, so that customers can view data of their own organisation only;
- operation of databases in network segments that are not publicly reachable;
- logging of administrative and functional changes;
- daily encrypted backups with restoration exercised annually; target recovery time and maximum data loss of 24 hours each;
- continuous updating of the components and dependencies in use;
- end-to-end encryption of radio transmission in accordance with the LoRaWAN standard;
- obligation of employees to maintain confidentiality.
We provide a detailed description to customers and prospective customers on request.
H.2 Notification of personal data breaches
In the event of a personal data breach, we notify the competent supervisory authority pursuant to Art. 33 GDPR and inform the data subjects pursuant to Art. 34 GDPR where the statutory conditions are met. Where the incident concerns data we process on behalf of a customer, we inform that customer without undue delay pursuant to Art. 33(2) GDPR.
I.1 Additional information for Switzerland
Insofar as our offering is addressed to persons in Switzerland, the Swiss Federal Act on Data Protection (revFADP) applies in addition. The terms used in this policy are to be understood accordingly: "personal data" corresponds to "personal data", "processing" corresponds to "processing", "controller" corresponds to "controller" and "processor" corresponds to "processor" within the meaning of the revFADP.
Under Swiss law, the processing of personal data is based on the justifications set out in Art. 31 revFADP, in particular performance of a contract, an overriding private interest or your consent.
I.2 Disclosure abroad
Personal data from Switzerland is processed in the European Union, in particular in Germany and the AWS Frankfurt region. The Swiss Federal Council has recognised an adequate level of data protection for the states of the European Economic Area; disclosure is therefore permitted under Art. 16(1) revFADP. For disclosures to further states, the safeguards set out in E.2 apply accordingly (Art. 16(2) revFADP).
I.3 Competent authorities
The Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, is competent for complaints.
For Swiss municipalities, cities and other public bodies, the data protection law of the respective canton applies instead of the revFADP. In such cases the cantonal data protection supervisory authority is competent. Where we process data on behalf of such a public body, our obligations are governed by the applicable cantonal law.
I.4 Changes to this policy
We adapt this privacy policy when our processing activities or the legal framework change. The version published on this page applies in each case.
Last updated: August 2026 · grovez GmbH