Privacy policy

The controller for the processing described here is:

Movena GmbH
Fassbindstrasse 10, 4310 Rheinfelden
Switzerland
E-mail: info@movena.ch

Please send questions about data protection and requests concerning your rights to info@movena.ch.

Movena processes personal data in accordance with the Swiss Federal Act on Data Protection, FADP (DSG), and the Data Protection Ordinance, DPO (DSV). The EU General Data Protection Regulation (GDPR) applies insofar as Movena offers services to persons in the EU or the EEA, for example with the location EU (Art. 3 para. 2 GDPR). For these cases, we also state the legal basis.

When a page is opened, our web server processes technically necessary information: IP address, date and time, the address requested, the amount of data transferred, status code, referring page and browser identifier. We use this information to deliver the website, find errors and fend off attacks. The logs are deleted after 14 days. Legal basis under the GDPR: legitimate interest in secure operation (Art. 6 para. 1 let. f).

• No analytics or tracking tool, no advertising pixels.
• The public pages of movena-suite.com do not set any cookies.
• No external resources: images, styles and scripts are hosted on our server. The photos come from Unsplash, are stored locally, and Unsplash is not contacted when a page is opened.

If you use the contact form or write to us, we process your name, your e-mail address, your message and, if provided, your organisation and your phone number. Name, e-mail address and message are mandatory. The form sends your details by e-mail to info@movena.ch; they are not stored on the web server itself. To prevent misuse of the form and duplicate requests, the server keeps your IP address and a checksum of your request in memory for one hour. We use this information to answer your request and to prepare a conversation.

We receive and send e-mails via our own mail server. We keep requests in our self-hosted CRM for as long as this is necessary for the request and any follow-up conversations. Legal basis under the GDPR: pre-contractual measures and legitimate interest in answering the request (Art. 6 para. 1 let. b and f).

Launch notification (“Stay tuned”): If you sign up, we process your e-mail address and, if provided, your organisation. Our web server sends this information as an e-mail to info@movena.ch and does not store it itself. To prevent misuse of the form, it keeps your IP address in memory for one hour and uses it to limit the number of sign-ups.

We use this information only to inform you about the launch of Movena Suite and delete it afterwards, at the latest twelve months after you signed up. You can withdraw your consent at any time by sending an e-mail to info@movena.ch. Legal basis under the GDPR: consent (Art. 6 para. 1 let. a).

For a free trial or a subscription, we process the organisation, name and e-mail address of the person placing the order, the desired address (for example meier.movena-suite.com), the location, the chosen scope, and the dates and status of the subscription. We use this to check the order, set up your workspace, manage the term, storage space and enabled features, and send you notices about the subscription.

You receive notices by e-mail, for example on day 30 of the trial; 15 days, 7 days and one day before it ends; after access has been suspended; and before deletion.

Movena keeps this account data centrally in Germany, even if your workspace is located in Switzerland. Legal basis under the GDPR: contract (Art. 6 para. 1 let. b).

You and your employees sign in via a central sign-in (Keycloak with oauth2-proxy in front of it). In doing so, we process user name, e-mail address, name, roles and groups, as well as the time and result of the sign-in. The central sign-in runs at Hetzner in Germany, also for workspaces with the location Switzerland.

After sign-in, the Suite sets technically necessary cookies: a session cookie that keeps you signed in, and a short-lived cookie that protects against forged requests. The cookies are only transmitted over encrypted connections and end when you sign out or when the session expires. Sign-in does not work without them. Legal basis under the GDPR: contract and legitimate interest in secure access (Art. 6 para. 1 let. b and f).

We retain invoices and accounting vouchers for 10 years because the law requires it (Art. 958f CO (OR)). Legal basis under the GDPR: contract and legal obligation (Art. 6 para. 1 let. b and c).

Movena processes what your organisation stores in the Suite only on your behalf and according to your instructions: for operation, backup and restore, support and deletion. Movena does not use this data for its own purposes or for training AI models. Movena only accesses data in your workspace insofar as this is necessary for operation, security or a support request.

Details on this, the sub-processors and the technical and organisational measures are set out in the DPA.

If, as a data subject, you have questions about data in a workspace, please contact the organisation that uses the workspace. If we receive such a request, we forward it to that organisation.

For data in your workspace, Movena also acts as processor here (see DPA, clause 10).

Movena operates e-mail (Mailcow), accounting (ERPNext), CRM and helpdesk itself on servers at Hetzner in Germany. Service providers for the data in your workspace are listed in Annex 2 of the DPA.

Authorities and courts only receive personal data if the law obliges us to provide it. Advisers such as fiduciaries or lawyers only receive data insofar as necessary and subject to a duty of confidentiality.

Germany and the other states of the EU and the EEA ensure adequate data protection according to Annex 1 of the DPO. For Switzerland, the European Commission has found that it provides adequate protection.

We only disclose personal data to the USA and to other states without adequate protection insofar as you use cloud AI features or choose card payment (Art. 16 and 19 para. 4 FADP, Art. 44 et seq. GDPR). For this, we rely on:

• Cloud AI (OpenRouter, xAI, Anthropic, hosting providers of the models, Exa): Data Privacy Framework, insofar as the recipient is certified (Swiss-U.S. DPF: Art. 16 para. 1 FADP with Annex 1 DPO; EU-U.S. DPF: Art. 45 GDPR), otherwise the European Commission’s standard contractual clauses, recognised by the FDPIC (EDÖB) (Art. 16 para. 2 let. d FADP, Art. 46 GDPR)
• Card payment (Stripe): Data Privacy Framework, insofar as the recipient is certified (Swiss-U.S. DPF: Art. 16 para. 1 FADP with Annex 1 DPO; EU-U.S. DPF: Art. 45 GDPR), otherwise the European Commission’s standard contractual clauses, recognised by the FDPIC (Art. 16 para. 2 let. d FADP, Art. 46 GDPR)

You can obtain a copy of the safeguards on request from info@movena.ch.

We protect personal data with technical and organisational measures, including: encrypted connections (HTTPS), central sign-in with roles checked on the server, a separate ERPNext database per workspace, encrypted backups, logging of important operations and credentials kept outside the source code. The list is set out in Annex 1 of the DPA. Nobody can guarantee complete security.

Under the FADP, you have in particular the right to:

• information about your personal data (Art. 25 FADP),
• handover or transfer of your data in a commonly used electronic format (Art. 28 FADP),
• rectification, erasure, prohibition of a processing operation or of disclosure to third parties, and a note that the accuracy of the data is disputed (Art. 32 FADP).

Insofar as the GDPR applies, you also have the rights under Art. 15 to 22 GDPR: access, rectification, erasure, restriction of processing, data portability and objection, in particular to processing based on legitimate interests (Art. 21 GDPR). You can withdraw consent at any time with effect for the future.

To do so, write to info@movena.ch. We may ask for proof of identity and generally reply within 30 days. The rights apply subject to the statutory restrictions, for example where a retention obligation prevents deletion. For data in a workspace, please contact the organisation that uses it.

You can contact the Federal Data Protection and Information Commissioner, FDPIC (EDÖB), Feldeggweg 1, 3003 Bern, www.edoeb.admin.ch. Insofar as the GDPR applies, you can also lodge a complaint with the supervisory authority at your place of habitual residence, your place of work or the place of the alleged infringement (Art. 77 GDPR).