PRIVACY NOTICE
ProximA-i LegalTech SA (“ProximA-i”, “we”) develops and operates SovIA, a legal and analytical artificial intelligence assistant running on its own infrastructure in Switzerland.
This notice describes how we process personal data on our own account: account and access management, the contractual relationship and invoicing, support, website and recruitment. It is addressed to our clients and their staff, to our prospects and partners, to visitors to our website, and to job applicants (hereinafter “data subjects”).
It is drawn up in accordance with the Federal Act of 25 September 2020 on Data Protection (FADP; SR 235.1) and its Ordinance (DPO; SR 235.11).
1. What this notice does not cover
The content submitted in SovIA — conversations, uploaded documents and voice recordings of our clients and their users — does not fall within the scope of this notice.
For this data, we do not act on our own account: we process it solely on the instructions of our client, who alone determines its purpose. Our client is the controller (Art. 5 let. j FADP) and we are its processor (Art. 5 let. k FADP). This relationship is governed by a separate contract, the Data Processing Agreement (“DPA”), concluded with each client and published on our website. This data is processed exclusively in Switzerland, on our own infrastructure, without any third-party provider processing it or having access to it, subject to the Internet searches that SovIA may carry out to supplement its answers: they transmit only keywords to public search engines, through a relay that does not reveal to them who is carrying out the search, and our clients may have them disabled (Art. 4 para. 2 DPA).
Practical consequence for persons whose data appears in a file or document submitted to SovIA by one of our clients — a principal, an opposing party, a witness, an employee: their rights are to be exercised with that client, not with us. Any request addressed directly to us will be forwarded to that client, without our responding to it on the merits.
2. Controller
For the processing described below, the controller within the meaning of Art. 5 let. j FADP is:
ProximA-i LegalTech SA, Rue Centrale 6, 3960 Sierre, Switzerland — CHE-232.823.797 — info@proxima-i.ch.
3. Data we process
Identification and contact data: surname, first name, position, company name, business address, e-mail address, telephone number.
Account data: user ID, two-factor authentication method, configuration preferences, dates of creation and of last login.
Contractual and invoicing data: contract, correspondence, payment details, VAT number, history of invoices and payments.
Support data: content of requests (e-mails, tickets) and the follow-up given to them.
Technical and security data: IP address, browser type, timestamps, access and audit logs, usage volumes measured in processing units (Tokens).
Application data: application file and information on professional background.
We only process the data that data subjects provide to us, the data that our clients’ use of the service generates technically, and the data that reaches us from third parties where this is necessary for payment, debt collection or compliance with a legal obligation. We do not buy personal data and do not collect it from brokers.
4. Purposes and legal bases
We process this data for the following purposes, on the basis of the performance of the contracts concluded with our clients, compliance with our legal obligations, an overriding private interest within the meaning of Art. 31 FADP or, where we ask for it, the consent of the data subject.
Provision of the service: creating and managing accounts, authenticating users, ensuring the technical operation of SovIA.
Contract management and invoicing: concluding and performing the contract, issuing invoices, collecting payments, recovering debts.
Support and assistance: handling requests, documenting incidents, improving the quality of the service.
Security: detecting and preventing unauthorised access, fraud and abusive use, tracing access.
Service-related communications: informing clients of maintenance, developments and contractual amendments.
Marketing and information: sending our clients and prospects invitations and information about our activities. Each client or prospect may object to this at any time, free of charge, by simple message or via the unsubscribe link.
Recruitment: assessing applications from future employees. If the application is unsuccessful, the file is deleted within three months.
Compliance with our legal obligations: accounting, archiving, responding to valid demands from authorities.
5. Cookies
Our presentation websites do not use any audience measurement, advertising or tracking cookies.
The SovIA application sets a strictly technical session cookie, necessary to maintain the authenticated session after login. It does not allow any tracking of browsing and expires when the session is closed or when it times out.
Should we one day introduce cookies that are not necessary for the operation of the service, we would only do so with the prior consent of the data subjects, obtained through a dedicated mechanism.
6. Location of processing
SovIA. The content that our clients submit in SovIA is processed exclusively in Switzerland, on ProximA-i’s infrastructure, without any third-party provider processing it or having access to it, subject to the Internet searches described in section 1. Account data and technical data relating to the use of SovIA are also processed in Switzerland, on that same infrastructure.
7. Transmission to third parties
We do not sell personal data and do not transmit it for advertising purposes.
A transmission only takes place in the following cases: to our advisers bound by professional secrecy (external auditors, lawyers, fiduciary), to the extent strictly necessary; to our payment and debt collection providers, only for the data necessary for collecting payment; to an authority, where a valid legal obligation compels us to do so.
Any transmission complies with Arts 30 and 31 FADP and, where it is made abroad, with Arts 16 and 17 FADP.
Where data covered by the professional secrecy of our clients is the subject of a demand from an authority, we apply the procedure provided for in the DPA: immediate information of the client, unless prohibited by law, including on the possibility of requesting sealing (Art. 248 paras 1 and 2 CrimPC); invocation of the protected secrets; compliance with the client’s decision and, failing instructions from the client before the expiry of the three-day time limit available to us as holder, a request for sealing on our part; no handing over of data of our own accord.
8. Retention period
We retain data for as long as the purpose pursued requires, then delete it, subject to statutory time limits.
Account data: for the term of the contract, then deleted at the end of the 30-day export window following its end.
Contractual data and accounting vouchers: ten years from the end of the financial year concerned (Art. 958f CO).
Support data: until the request is resolved, then 24 months for traceability purposes.
Access and audit logs: at least twelve months, the minimum period laid down in Art. 4 para. 5 DPO.
Application files: three months after the close of the process.
Marketing data: for as long as the interest persists. In the event of an objection, we stop the processing and retain only the contact details necessary to respect that objection permanently.
9. Security
We implement the appropriate technical and organisational measures required by Art. 8 FADP and Arts 1 to 3 DPO, in order to ensure the confidentiality, availability, integrity and traceability of data.
These measures include in particular encryption of data in transit and at rest, two-factor authentication, logical and physical access control, infrastructure monitoring and anomaly detection, regular backups and security updates of systems. They are reassessed regularly and adapted to changing risks and to the state of the art.
No IT system can, however, be considered free of all risk.
10. Automated individual decision
SovIA produces analyses, translations, transcriptions and drafting proposals intended to assist a professional. This content constitutes neither legal advice nor a decision: it must be verified and taken over by a professional who assumes responsibility for it.
We do not take any decision that produces legal effects or significantly affects data subjects and that would be based exclusively on automated processing (Art. 21 FADP).
11. Rights of data subjects
Within the limits of applicable law, any person whose data we process may:
- obtain access to their personal data and to information about its processing (Art. 25 FADP);
- obtain the correction of inaccurate data (Art. 32 para. 1 FADP);
- obtain the delivery or transfer of the data they have disclosed to us, in a conventional electronic format (Art. 28 FADP);
- object to processing, in particular to marketing;
- request the deletion or destruction of their data, as well as the prohibition of a specific processing activity or of a specific disclosure (Art. 32 para. 2 FADP).
We may have to refuse, restrict or defer a request in the cases provided for by law, in particular where professional secrecy or the overriding interests of a third party so require (Arts 26 and 29 FADP); we then indicate the reason to the data subject.
Requests must be addressed to info@proxima-i.ch. We respond to them free of charge, as a rule within 30 days — the time limit that the law lays down for the right of access and the right to data portability (Art. 25 paras 6 and 7 and Art. 28 para. 3 FADP; Arts 18 and 22 DPO), and which we apply to all requests. We may ask the persons who contact us to prove their identity.
Any data subject may at any time refer a matter to the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern.
12. Business succession
In the event of a merger, acquisition or transfer of business, data may be transmitted to the acquirer, on condition that it takes over all the confidentiality and data protection undertakings. Our clients are informed of this within 30 days; the termination rights provided for in the GTC remain open to them.
13. Changes
We may adapt this notice to changes in the law, in our activities or in our systems. The version in force is the one published on our website, which is authoritative.
Amendments to the DPA and the GTC, which are contractual, follow the procedure provided for in Art. 13 GTC and cannot be made by means of this notice.
Last updated: 21 October 2026.