Privacy policy and personal data protection

This policy explains how TalentWide SA processes personal data in connection with the website and application DiagNow. It has been prepared in accordance with the Swiss Federal Act on Data Protection (FADP/revised FADP) and, where applicable, the GDPR.

1. Controller and contact details

TalentWide SA
Rue de Lausanne 127, 1202 Geneva, Switzerland
UID: CHE-260.347.514
Data protection contact: info@diagnow.ch

2. Respective roles

TalentWide SA is responsible for processing related to the website, user accounts, security, billing, support, product analytics and operation of the platform.

For business data entered into DiagNow by an organisation, including its customers, contacts, reports, photographs, plans, quotations, invoices, appointments and comments, the user organisation remains responsible for determining whether it is entitled to collect and process that data. TalentWide SA then acts as a technical service provider to host, process, display, export and secure that data as part of the service.

3. Data processed

Depending on how you use DiagNow, we may process the following categories:

Category	Examples
User account	Last name, first name, email address, hashed password, preferences, signature, professional title and security settings.
Organisation	Company name, address, billing email, company settings, members, roles, invitations, user quotas and storage quotas.
Subscription and billing	Selected plan, free trial, number of users, subscribed storage, subscription status, subscription history and billing portal.
Business data	Customers, contacts, quotations, invoices, payments, reminders, pollutant reports, VDI reports, plans, photographs, attachments, comments, appointments and PDF exports.
Potentially sensitive data	Photographs, signatures, documents or comments uploaded by users that may contain personal data, depending on their content.
Sending configuration	SMTP settings, host, port, username, encrypted password, recipients, subjects and bodies of scheduled emails.
Technical data	IP address, user agent, session identifiers, security logs, application errors, timestamps and metadata required for proper operation.
Product analytics	Pages viewed, clicks, forms submitted, registration journey, free trial, subscription and use of the CRM, reports, calendar and settings modules.
Contact and support	Name, email, organisation, message, any attachments, date and IP address at the time of submission.

4. Purposes of processing

Data is processed only for specified purposes, including:

• Creating and managing user accounts and organisations.
• Providing DiagNow modules: reports, CRM, quotations, invoices, calendar, PDF exports, client portal and settings.
• Ensuring security, authentication, abuse prevention and separation between organisations.
• Managing the free trial, subscriptions, payments, invoices and access to the service.
• Providing assistance, responding to contact requests and resolving technical issues.
• Measuring actual product use to understand user journeys, improve usability, prioritise development and identify underused features.
• Complying with legal obligations, including accounting, tax and security requirements.

5. Processors and recipients

We use a limited number of service providers that are necessary to operate the service:

Provider	Role	Primary location
Infomaniak Network SA	Application hosting, database, storage, backups and service emails.	Switzerland
Secure payment provider	Online payments, subscriptions, billing portal, payment methods, invoices and payment events.	European Union / United States, depending on the services used
PostHog	Product analytics, usage events, registration journey, subscription and application use.	European Union when PostHog EU hosting is configured
SMTP provider configured by the organisation	Sending emails from the organisation’s address when it configures its own SMTP server.	Depends on the provider selected by the organisation

No personal data is sold. Data is disclosed to third parties only when necessary to operate the service, process payments, ensure security, provide support, perform product analytics, send emails requested by the user, or when required by law.

6. Data location and transfers

The main application data is hosted by Infomaniak in Switzerland. Certain providers required for payments or product analytics may process data in the European Union or other countries. Where data is transferred to a country whose level of protection is not recognised as adequate, we rely on the contractual safeguards and measures provided by the relevant provider.

7. PostHog product analytics

With your consent, DiagNow uses PostHog to understand how the website and application are used: pages and routes viewed, types of clicks and forms, journeys towards the free trial, account creation, organisation creation, checkout and use of the main modules. The PostHog SDK and session replay are loaded only after you agree. Refusing consent does not prevent you from using the service.

Session replay retains enhanced protection: all input fields and sensitive business areas remain masked, while images, documents, canvases and media are blocked. Public text and the visual structure may remain visible so that user journeys can be understood. URLs are replaced with an analytics route without parameters, and analytics events exclude free text, content, labels, messages, detailed errors, tokens or other secrets. PostHog receives only internal identifiers for users and organisations, never their email address or name in analytics properties.

You can accept, refuse or change this choice at any time in our cookie policy. Your choice is stored in your browser’s local storage.

8. Payments

Payments and subscriptions are handled by a secure payment provider. When you access the checkout or billing portal, this provider may process the information required for payment, fraud prevention, billing and subscription management. DiagNow does not store complete payment card numbers.

9. Emails and SMTP

DiagNow allows an SMTP server to be connected so that quotations, invoices, reports and messages can be sent from the organisation’s address. SMTP credentials are stored in encrypted form. We do not read the user’s email inbox. For emails scheduled or sent through DiagNow, we process the recipients, subject, message content and attachments required for sending.

10. Retention periods

• Active account: for as long as the service is used.
• Deleted account: deleted or anonymised within a reasonable period, unless retention is required by law or for security purposes.
• Organisation data: retained for the term of the contract, then deleted or made available for export in accordance with the agreed arrangements.
• Accounting records: retained for 10 years in accordance with Swiss accounting requirements.
• Technical and security logs: retained for as long as necessary for security, diagnostics and abuse prevention.
• PostHog data: retained according to the tool’s configuration and product analytics needs.
• Contact/support requests: retained for as long as necessary to handle the request and provide sales or support follow-up.

11. Security

We implement appropriate technical and organisational measures, including:

• HTTPS encryption for communications.
• Passwords stored in hashed form.
• Two-factor authentication available.
• Encryption of sensitive secrets, such as SMTP passwords.
• Separation of organisations and access rights control.
• Backups and business continuity measures provided by the hosting provider.
• Internal access limited to operational, support and security needs.

12. Data subject rights

Under the FADP, you may request access to your personal data, its rectification or deletion where the applicable conditions are met, as well as information about how it is processed. You may also object to certain processing where permitted by law.

To exercise these rights, contact us at info@diagnow.ch and clearly state your request. We may ask for proof of identity where necessary. You may also contact the Federal Data Protection and Information Commissioner (FDPIC).

If your request concerns data entered into DiagNow by a user organisation, we may need to forward or coordinate the request with that organisation, as it remains responsible for its own business data.

13. Cookies

DiagNow uses cookies that are necessary to operate the service, including session, CSRF security and preference cookies. The payment provider may use cookies during checkout or when the billing portal is accessed. PostHog may use its cookies or similar technologies only after you have given explicit consent. No advertising cookies are placed. For more details or to change your choice, see our cookie policy.

14. Changes

This policy may be updated to reflect legal, technical or functional developments. The date of the latest update appears at the top of the page. If a material change is made, we may inform users by email, an in-application notification or a message on the website.