Peerdom Privacy Notice - Data Protection & Your Rights

Peerdom respects your right to privacy when you use our services, visit our website, our product or communicate with us. We take all necessary measures to ensure that any personal data you give us is treated in compliance with data protection laws and with this Privacy Notice.

We are Peerdom AG (also “we”, “us”), a company incorporated under the laws of Switzerland, with its registered offices at Kirchstrasse 175, 3084 Wabern, Switzerland, also reachable at hello@peerdom.org. “Personal Data” is any information that relates to an identified or identifiable natural person, such as your name or e-mail address. In exchange for our services, when you visit our website, our product or communicate with us, we may process Personal Data related to you (“Your Personal Data”). In these cases, Peerdom is the controller of Your Personal Data.

When you upload or otherwise provide files or copy/paste information into our product, which may contain personal data related to you or others, and process such files and information using our services/ product (“User Files”), you remain fully responsible for such personal data contained in the User Files.

In the paragraphs below, we endeavor to provide you with information about our processing of Your Personal Data, your rights regarding Your Personal Data, and the measures we take to maintain the privacy and security of Your Personal Data.

If you provide us with personal data of other people (such as family members, friends or work colleagues) or provide us User Files which contain personal data related to other people, please make sure they are aware of this Privacy Notice and only provide us with their data if you are allowed to do so and such personal data is correct.

Our website, our product and communications may contain links to other websites. If you follow a link to any of those websites, please note that the personal information you submit will be processed according to their own privacy notices, and that Peerdom does not accept any responsibility or liability for those websites. Please make sure to check those privacy notices before you submit any personal information to those websites.

This Privacy Notice has been drafted to be in line with applicable privacy laws. Based on your location, this might, for example, be the Swiss Federal Data Protection Act, the California Consumer Privacy Act, or the EU General Data Protection Regulation (GDPR).

Key questions and answers

1. What personal data does Peerdom collect through its website or product, and for what purposes?

If you use our services/ product, regardless of whether you are a free or paying user, we will collect Your Personal Data as required to provide our services to you and/or help us improve our services for you.

1.1 Use of our website

If you visit any domain or subdomain of peerdom.com, peerdom.org or peerdom.app and do not register for or log into your account, we collect and process your Personal Data that is necessary to enable your informational use of these domains. We also use functional cookies and other technologies (see Section 8) to enable this functional use of our website/ product and to maintain the stability and security of our website. For these purposes, we process your IP address and other usage metrics along with the date and time of your access. We process Your Personal Data to provide our website to you (Art. 6 (1) (1) b GDPR) and based on our legitimate interest to maintain our website’s stability and security (Art. 6 (1) (1) f GDPR).

1.2 Use of our services via third-party services

You may be able to access our services via third-party services, such as Google Workspace or Microsoft Azure AD. For this purpose, you do not have to create a User Account with us or provide your login credentials for the third-party service or application. Rather, we will let you access our services with an authorization token (aka “OAuth token” or “SAML token”) from the third-party service provider confirming that you are a valid user of their service. We process this information to enable your use of our services (Art. 6 (1) (1) b GDPR).

1.4 User account

If you create a Peerdom account (including for a free trial of our services) via our website/ product, we process your e-mail address and the (encrypted) password you choose at registration.

You can also create a user account for our services using your pre-existing Google Workspace, Microsoft Azure AD accounts and use that third-party platform’s credentials to log in to your user account with us. If you choose this option, you allow us to request and use some of Your Personal Data from the third-party account.

For Google, this involves us processing your name, surname, email address, and public profile information (e.g. profile picture). The third-party platform may ask for your consent to share this data with us. As the personal data we may process under this option was originally collected by the third-party platform, the initial data processing and sharing of the data with us is governed by the privacy policy of such third-party platforms (thus, either Google, Microsoft). Please refer to the relevant third-party platform and/or its settings, if you want to deactivate the connection between the third-party platform and us.

We process Your Personal Data to set up your user account and, thus, form a contractual relationship (Art. 6 (1) (1) b GDPR).

For security reasons, we also process the time, browser, IP address of your last login, and the time of your last password reset. We have a legitimate interest to process this information to filter out suspicious login requests and to detect and prevent abuse of your user credentials (Art. 6 (1) (1) f GDPR).

1.5 Peerdom subscription

During registration of your user account or later on, you may provide Your Personal Data as part of your profile if you purchase any of our paid subscriptions. These types of personal data vary based on the payment method you choose. These types of data may generally include your name, address, which subscription plan you are on, your payment method (e.g. credit card, in the latter case including expiration date and certain digits of your credit card number), your VAT or other tax number, user settings, your company, role, and employee status.

We process Your Personal Data to suggest the right type of subscription for your needs to you and to complete your purchase. The data processing serves to conclude and fulfill the subscription contract between you and us (Art. 6 (1) (1) b GDPR).

a) Payment: We use payment data and information on your subscription and payment history (subscription plan, billing period, etc.) to process the regular payments for your Peerdom subscription and, thus, fulfill our contract (Art. 6 (1) (1) b GDPR). We accomplish this through third-party payment processors, such as Stripe (in case you choose credit card as your payment method). For further information on these providers, please visit section 4 below.

If you choose credit card as your payment method, your full credit card number is always sent directly to the payment provider and never reaches our server. We only receive the last four digits of any credit card.

b) Invoices: We process your account, subscription, and payment information to fulfill our legal obligations (legal data storage obligations, e.g. under tax law) (Art. 6 (1) (1) c GDPR) and provide you with invoices under our contract (Art. 6 (1) (1) b GDPR). For further information on this provider, please visit section 4 below.

1.6 Email communication, including customer support, newsletters, and other marketing emails

When you communicate with us via email, including for customer support, you provide us with your e-mail address and may provide us with your name, contact details, and other personal data, including the content of your email. We process this information to answer your request (Art. 6 (1) (1) b GDPR).

We may send you our newsletter or other marketing emails, generally only with your consent (Art. 6 (1) (1) a GDPR). However, where you have already purchased products and/or services from us, we may inform you about our similar products or services via email where we have informed you of such a possibility in advance and allowed you to refuse it. We do so under our legitimate interest to promote our business with existing customers (Art. 6 (1) (1) f GDPR). Please note that you can opt out of such email communication by clicking on the unsubscribe link at the end of each marketing email.

For information about third-party providers that we may use for the aforementioned purposes, please visit Section 4 below.

1.7 Service improvement and error detection

For our website/ product, we may process information on your default system language, your device, your usage of our services, and information on the pages of our website/ product which you have visited. For error detection, we aggregate this information by shortening your IP address, such that it is not directly attributable to specific users. We only use this information in this aggregated form. We generally use the same type of information, as well as file metadata, for analytical purposes to improve our services by identifying features our users like and how our services function with different devices. We have a legitimate interest to use this information for service improvement (Art. 6 (1) (1) f GDPR). For information on third-party providers that we use for these tasks, please visit Section 4 below.

1.8 Surveys & user feedback

We occasionally conduct voluntary surveys through our website, or other methods to collect user feedback. For some of these surveys, we may process Your Personal Data, such as your name, email, and IP address in addition to your feedback/answers. In other cases, we only collect aggregated information that is not directly attributed to specific users (e.g. yes or no answers through a survey field only). We process and store all of the aforementioned information to carry out the surveys (Art. 6 (1) (1) b GDPR) and under our legitimate interest to collect user feedback (Art 6 (1) (1) f GDPR). In some cases, we may also collect your consent (Art. 6 (1) (1) a GDPR). For more information on third-party providers we use for this purpose please visit Section 4 below.

2. How does Peerdom protect Your Personal Data?

Ensuring the safety and security of our service and Your Personal Data is a priority.

Peerdom uses appropriate technical and organizational measures to protect Your Personal Data. Only authorized Peerdom staff or third-party company staff (i.e. service providers) have access to Your Personal Data. All such staff are required to adhere to our Privacy Notice. Additionally, all third-party employees who have access to Your Personal Data must sign non-disclosure agreements. In addition, Peerdom has contracts in place with third-party companies that have access to Your Personal Data in order to protect it. To protect Your Personal Data, Peerdom maintains a secure IT environment and has measures in place to prevent unauthorized access to it. All communication and file transfers to and from our server are encrypted with TLS. Passwords are only stored in encrypted (hashed) form, never in plain text.

3. How does Peerdom use Your Personal Data?

We use Your Personal Data to provide you with high-quality services. Your privacy is our priority. We would not use Your Personal Data for any unlawful purposes.

We process Your Personal Data for the purposes listed above.

In specific cases, Your Personal Data may also be processed for the following purposes:

• In case we partially or fully sell the company or buy another company in whole or in part. We have a legitimate interest to further the development of our company through mergers and acquisitions (Art. 6 (1) (1) f GDPR).

• To comply with our legal obligations, including participation in investigations and proceedings conducted by the government or public authorities (Art. 6 (1) (1) c GDPR).

• In case we have a legal obligation to this effect (Art. 6 (1) (1) c GDPR), we may process Your Personal Data to protect our rights and safety, as well as those of our customers and third parties. Although we may not have a legal obligation to do so, we may still process data for this purpose based on our legitimate interest or those of other affected persons in order to assert legal claims (Art. 6 (1) (1) f GDPR).

4. To whom does Peerdom disclose Your Personal Data, and why?

We share some of Your Personal Data with others in order to provide you with our services. Don’t worry, we do not sell Your Personal Data or give it to spammers.

Peerdom may share Your Personal Data with the following categories of recipients as necessary:

• External services providers (e.g. hosting providers, software and software as a service providers, development providers, email service, email verification and email analytics providers, providers for error logging and service development, customer support providers, survey and user feedback providers, payment providers, billing service providers, and marketing providers). We have a legitimate interest to use external providers to ensure that we can provide our services in a professional and user-friendly manner and with a high level of service quality (Art. 6 (1) (1) f GDPR). Data transfers to service providers are covered by data processing agreements between us and the respective provider (in connection with Art. 28 GDPR).

• In the event that we buy or sell our company in whole or in part, data may be transferred to our potential contractual partners. We have a legitimate interest to further the development of our company in this manner (Art. 6 (1) (1) f GDPR).

• To law enforcement agencies, public authorities, and courts in order to comply with legal obligations to participate in investigations and proceedings conducted by governments or public authorities (Art. 6 (1) (1) c GDPR).

• To other companies, individuals, or government agencies where it is required to disclose personal data by law (Art. 6 (1) (1) c GDPR) or based on legitimate interests to protect our rights or safety as well as those of our customers and third parties (Art. 6 (1) (1) f GDPR).

Some of the aforementioned providers may process Your Personal Data outside the EU/EEA. For more information on protective measures used to secure data transfers in countries outside the EU/EEA, please see Section 7 below.

Among other things, Peerdom may share Your Personal Data with the following third parties, but only in the circumstances set out below:

4.1 Essential providers

4.1.1 Stripe

To process credit card payments, we transfer Your Personal Data to Stripe, Inc. (354 Oyster Point Blvd, South San Francisco, California 94080, USA). We use an external provider for this payment method to enable you to make payments under our contract (Art. 6 (1) (1) b GDPR) and according to our legitimate interest to offer you extended payment options and to outsource payments (Art. 6 (1) (1) f GDPR). This transfer is based on our data processing agreement with Stripe (in connection with Art. 28 GDPR). Per this agreement, Stripe must process Your Personal Data only in accordance with our instructions and to the extent permitted by data protection law. Stripe may process personal data outside the EU/EEA. For more information on protective measures for securing data transfers to countries outside the EU/EEA, please see section 7 below.

4.1.2 Libracore (ERPNext)

To process invoices, we transfer Your Personal Data to the free open source software ERPNext, provided, managed and hosted by Libracore AG (Bodenwis 22c, 8493 Saland, Switzerland). We use an external provider for this payment method to enable you to make payments under our contract (Art. 6 (1) (1) b GDPR) and according to our legitimate interest to offer you extended payment options and to outsource payments (Art. 6 (1) (1) f GDPR). This transfer is based on our data processing agreement with Libracore (in connection with Art. 28 GDPR). Per this agreement, Libracore AG must process Your Personal Data only in accordance with our instructions and to the extent permitted by data protection law. Libracore AG processes personal data only in Switzerland.

4.2 Analytics providers

4.2.1 Matomo

We use the free open source software Matomo on our website and product to evaluate the use of our website and product in a data-saving manner and to obtain information for the purpose of improving our services, which we have a legitimate interest in. We operate Matomo on Exoscale (Bd de Grancy 19A, 1006 Lausanne, Switzerland), which is exclusively used by Peerdom AG. The purpose of Matomo is to analyze user behavior and, based on the results, help us make decisions relating to website or product optimization. We only use Matomo with IP anonymization activated. This means that IP addresses are processed in a shortened form and a direct reference to persons is excluded. Furthermore, Matomo will process online identifiers, device identifiers, and device information, e.g. browser type, version, device type, user behavior, e.g. pages visited, session duration, use of specific website functions, e-commerce activity) to evaluate your use of the website or product, compile reports on website or product activity.

5. What are my data protection rights and how can I exercise them?

You have certain rights over Your Personal Data under data protection laws, including, for example, the Swiss Federal Data Protection Act, the California Consumer Privacy Act, or the EU GDPR. Depending on the specific circumstances of the case and your place of residence, you may have some or all of the following rights:

• to withdraw your consent to the processing of Your Personal Data at any time. As a result, we may no longer process Your Personal Data based on the consent. But the withdrawal of your consent has no effect on the lawfulness of processing before the withdrawal;

• to access the personal data processed by us and/or request copies of this data. In particular, you can obtain information about the purposes of processing, categories of personal data, categories of recipients to whom your data has been or will be disclosed, planned retention period, and origin of your data if it was not collected directly from you;

• to request the rectification/correction, erasure, or restriction of processing of Your Personal Data;

• to request Your Personal Data, which you have provided to us, in a structured, commonly used, and machine-readable format and to transmit this data to another controller. You may also ask us to directly transmit this data to another controller, where technically feasible;

• to object to the processing of Your Personal Data on grounds relating to your particular situation, if we process Your Personal Data based on our legitimate interests. You may also object to the processing of Your Personal Data for direct marketing purposes at any time;

• to obtain information of the possibility of denying consent to the data processing and the consequences of the denial;

• to oppose the processing grounded on a legal basis other than consent;

• to request review, by a natural person, of decisions taken solely on the basis of automated processing of personal data that affects their interests, including decisions intended to define their personal, professional, consumer or credit profile, or aspects of their personality.

In general, exercising these rights requires you to be able to prove the account ownership. In order to assert these rights, please contact us at Peerdom AG, Kirchstrasse 175, 3084 Wabern, Switzerland or via email at privacy@peerdom.org. After you’ve contacted us, we may ask you for some information to prove your identity; what we ask for will depend upon whether or not you have an account with us. Once we have authenticated your identity, we will fulfill your request within one month unless we inform you otherwise. You may also contact our representatives in the EU and the UK as well as our Data Protection Officer as set out in section 10 below.

You can have an agent (your attorney or another person empowered to represent your interests) make one of these requests on your behalf. We will ask the agent to provide proof of your authorization and proof of both their and your identity.

In addition, every data subject has the right to enforce their rights in court or to lodge a complaint with the competent data protection authority. We will not discriminate against you for exercising your data rights in any way; however, please be aware that the erasure of certain essential data may prevent us from continuing to provide you with the same services.

6. How and for how long do we store Your Personal Data?

We keep Your Personal Data and the User Files you upload only as long as they are needed for the provision of our services or as required by law (most notably, IP logs at our hosting providers, listed as sub-processors in our Data Processing Agreement, Annex 2).

We will only retain Your Personal Data and User Files you upload for as long as necessary to fulfill the purpose for which it was collected or to comply with legal requirements. To help us, we apply criteria to determine the appropriate periods for retaining Your Personal Data depending on its purpose, such as account maintenance, facilitating client relationship management, and responding to legal claims or requests from authorities.

If you do not have a User Account (see Section 1.4 above) or are not logged in when using our services, we will generally delete User Files within 14 days after the last time they were opened. Please note that this retention period is extended by another 14 days every time you reopen the respective User File. Please note that if you use third-party services to access our services, data retention of User Files by the respective provider may differ.

If you access our services via a User Account, we delete User Files within one hour unless you save them to your file storage. When you choose to delete saved User Files, we generally delete them within 14 days.

7. Which data transfers outside the EU/EEA take place?

In some cases, we may transfer Your Personal Data outside of Switzerland and will ensure that Your Personal Data is well protected irrespective of its location.

We are located in Switzerland, which has been recognized as a safe third country in an adequacy decision of the European Commission. When you use our services, Your Personal Data may be transferred to recipients located in other countries, including outside the EU/EEA.

Where such a recipient country does not provide for an adequate level of data protection according to the European Commission, we will only transfer Your Personal Data to the recipient country on the basis of appropriate safeguards, such as binding corporate rules, standard contractual clauses (European Commission decision 2010/87/EU), or when another exception under Art. 49 GDPR applies. Please contact us (see “Contact us” section) to request information on the specific safeguards that are in use for the recipients of Your Personal Data.

8. How and why does Peerdom use cookies?

We may use cookies for functional purposes without your consent, or for analytical or advertising-related purposes, if you consent to this.

A cookie is a small piece of data placed on your computer’s hard drive that permits identifying a specific device or browser. We may place our own cookies (first-party cookies) or third-party services integrated on our website may place cookies on your device (third-party cookies). Cookies may typically process personal data, such as your IP address, device information, date and time of your visit to our website, information on your activities on our website, settings you make when visiting our website, and unique identification numbers. There are different types of cookies, such as session cookies (which expire at the end of your browsing session) or persistent cookies (which are stored on your device for a longer period of time and between sessions and can enable the entity that placed the cookie to recognize your device or browser between sessions).

We use cookies for different purposes:

8.1 Cookies for functional purposes

We use cookies or similar technologies that are technically necessary to operate our website and product or provide its basic functions, such as our payments or keeping you logged in (if you want that). These cookies allow us to operate our website and product, maintain its security, and provide its key functions. We process Your Personal Data to provide our website and product to you (Art. 6 (1) (1) b GDPR) and based on our legitimate interest to ensure its security, a smooth user experience, and smooth access to these key functions (Art. 6 (1) (1) f GDPR).

9. Does Peerdom knowingly handle the data of minors?

Peerdom does not knowingly collect or retain Personal Data of minors under the age of sixteen. Such persons are not permitted to use this website or product except where enabled by a school that has contracted with us, in which case the school is the Controller and is responsible for the respective Processing affecting minors. If you discover that a minor has been using our website or product, please let us know via the contact information in Section 11 and we will delete their information.

10. Can Peerdom change the terms of this Privacy Notice?

Changes to this Privacy Notice may occur and will be made available to you.

Peerdom may occasionally make changes and corrections to this Privacy Notice. Please check this Privacy Notice regularly to see the changes and how they may affect you.

11. Contact us

Please let us know if you have any questions; we’re here to listen to you.

If you have any requests concerning our processing of Your Personal Data or any queries with regard to these practices, please contact Peerdom at the contact data given above, including via email at privacy@peerdom.org.

Individuals and data protection supervisory authorities in the EU and the UK may contact our data protection representatives according to Art. 27 GDPR. For the EU, please reach out to VGS Datenschutzpartner GmbH, Hamburg, Germany. For the UK, please reach out to Swiss GRC Ltd, Northampton, UK.

You can also contact our data protection officer (DPO) at any time at our postal address or the following e-mail address: privacy@peerdom.org.