Last updated: 24 August 2026
This privacy policy explains how we process personal data on bilanzo.ch. It is governed by the revised Swiss Federal Act on Data Protection (revFADP) and, where applicable, the European General Data Protection Regulation (GDPR).
1. Controller
Mediaquotes Jones Schibli
Blegistrasse 11A
6340 Baar
Switzerland
UID/MWST: CHE-143.058.451 MWST
E-mail: [email protected]
Bilanzo is a brand of the company named above. Further details are available in the legal notice. As we have no establishment in the EU, no representative under Art. 27 GDPR has been appointed.
2. Data we process
2.1 Server log files
When you access the website we automatically record your IP address, date and time, the URL requested, the referrer and browser and operating system details. Purpose: operation, security and error analysis. Basis: our overriding legitimate interest in secure operation (Art. 31 para. 1 revFADP, Art. 6 para. 1 lit. f GDPR). Retention: normally 14 days, security logs up to 30 days.
2.2 User account and licences
To operate the customer account, provide downloads and manage licence keys we process your name, e-mail address, company details, password hash, licence and activation data and download logs. Purpose and basis: performance of the contract (Art. 31 para. 2 lit. a revFADP, Art. 6 para. 1 lit. b GDPR).
2.3 Orders and payments
When you place an order we process billing and contact details, the services ordered, subscription status and payment status. Card details are collected and processed exclusively by the payment service provider; we never receive full card numbers. Retention: ten years under Swiss commercial and tax law (Art. 958f CO).
2.4 Contact, support and tickets
We process enquiries submitted via forms, e-mail or the support portal in order to answer and document them. This involves your name, e-mail address, the content of the enquiry and technical details. Retention: up to two years after the matter is closed.
2.5 Support chat
A support chat is available on selected pages. It is not an AI assistant and does not answer anything by itself. Your input is recorded as a support request and created as a ticket in our support system (Atlassian Jira Service Management, see section 4), where a person on our team reads and answers it. No transmission to an AI provider takes place. We process your name, your e-mail address and the content of your request. Purpose and basis: handling your request, overriding legitimate interest in operating support (Art. 31 para. 1 revFADP). Retention as in section 2.4. Please do not enter sensitive personal data or client data into the chat.
2.6 E-mails and product information
We send transactional e-mails (order confirmations, licence and security notices, support replies). We send informational or promotional e-mails only within an existing business relationship or with your consent. You may object to receiving such messages at any time at no cost other than transmission costs.
3. Cookies and consent
We use strictly necessary cookies and, only with your explicit consent, cookies for statistics and preferences. The cookie policy lists every cookie, its purpose and its storage period. You may withdraw your consent at any time with effect for the future:
4. Service providers and processors
We use the following providers. Data processing agreements are in place with all of them. Transfers abroad are based on an adequacy decision, the Swiss-U.S. Data Privacy Framework or the EU standard contractual clauses with supplementary safeguards.
- MediaVault (mediavault.ch), Switzerland: our own web hosting and agentic hosting offering, running on our own server in Gossau SG, Switzerland. Operation of the website, databases and backups.
- Cloudflare, Inc. (USA / EU): content delivery network, DNS and web application firewall in front of the website, plus object storage (R2, storage region Western Europe) for delivering software downloads. Processes IP addresses and connection data. Transfer basis: Swiss-U.S. Data Privacy Framework and EU standard contractual clauses.
- Hostpoint AG, Switzerland: delivery of our e-mails via its SMTP service.
- Payrexx AG, Thun, Switzerland: processing of card and other payments. Payrexx receives the data required for the payment and is a controller in its own right for that processing.
- Google Ireland Ltd. / Google LLC (Google Analytics 4): audience measurement with IP anonymisation. Loaded only after you consent to the statistics category. Withdrawal at any time via section 3.
- Atlassian (Jira Service Management): handling and documentation of support requests, including requests from the support chat under section 2.5. Your name, your e-mail address and the content of your request are transmitted.
- bexio AG, Rapperswil, Switzerland: only if you actively connect Bilanzo to your bexio account. The connection uses OAuth; we store only the access tokens, never your bexio password.
- Wordfence (Defiant, Inc., USA): protection against attacks and abuse. Processes IP addresses and access patterns.
- cdnjs (Cloudflare): delivery of individual programming libraries used to render the website. Your IP address is transmitted to Cloudflare in the process.
- Complianz: consent management. Consent is stored locally in your browser and is not transmitted to third parties.
5. Data inside the Bilanzo software
The Bilanzo application is installed and operated on your own infrastructure. Accounting documents and client data you process in the application are not stored on this website. Any transmissions the application makes to third parties are governed by the product documentation and the data processing agreement for the software. This privacy policy covers the bilanzo.ch website and the customer account only.
6. Disclosure to third parties
We disclose data only to the processors listed in section 4, to authorities where legally required, and to our fiduciary and auditing bodies in the context of statutory bookkeeping duties. We do not sell personal data.
7. Data security
We apply appropriate technical and organisational measures: end-to-end TLS encryption, a web application firewall, least-privilege access control, two-factor authentication for administrative access and regular encrypted backups.
8. Your rights
Within the limits of applicable law you have the right to access, rectification, erasure and restriction of processing, the right to receive or transfer your data, and the right to withdraw consent and to object to processing at any time. Please send your request to [email protected]. We may request additional details in order to verify your identity.
You may also lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern. Individuals in the EU may contact their competent supervisory authority.
9. No automated individual decision-making
No automated individual decision-making within the meaning of Art. 21 revFADP or Art. 22 GDPR takes place on this website.
10. Changes
We may amend this privacy policy at any time. The version published on this page applies.