Remembering settings such as language.
Security, load balancing, storing your cookie choice.
Understanding how visitors use the Website so we can improve it (Google Analytics 4).
Legal
This policy explains how SightPulse AG handles personal data when you visit sightpulse.ai, talk to us, request a demo, buy or evaluate SightPulse, including through Microsoft Marketplace, or work with us as a customer or partner. Section 9 explains how the SightPulse platform handles the data our customers process with it.
At a glance
The controller for the processing described in this policy is:
SightPulse AG
Dammstrasse 19, 6300 Zug, Switzerland
UID: CHE-344.951.907
Email: privacy@sightpulse.ai
SightPulse AG is a majority-owned subsidiary of CBS Systems d.o.o., Karađorđeva 43, 11000 Belgrade, Serbia, which develops and operates the SightPulse platform and supports our website and business operations on our behalf.
This policy covers personal data we process as controller, about:
It does not cover data that our customers process in the SightPulse platform. For that data the customer is the controller. Section 9 explains how the platform handles it.
| Purpose | Data | Legal basis under GDPR |
|---|---|---|
| Operating and securing the Website | IP address, browser and device type, pages visited, date and time, referrer, server and security logs | Legitimate interest in a secure, functioning website (Art. 6(1)(f)) |
| Website analytics | Pseudonymous identifiers, pages and interactions, approximate location (city or country derived from IP), device and browser | Consent (Art. 6(1)(a)), given through the cookie banner |
| Answering demo requests and enquiries | Name, business email, company, role, industry, country, phone number if provided, and your message | Steps before a contract (Art. 6(1)(b)) or legitimate interest in answering business enquiries (Art. 6(1)(f)) |
| Microsoft Marketplace leads, private offers, acquisitions and demo invitations | Contact and company details Microsoft shares with us as publisher when you view, request or acquire our offer; the offer and plan selected; billing account, Azure tenant and subscription identifiers; Demo plan audience entries; private offer details; subscription status and records needed for billing and support | Steps before a contract and performance of the contract (Art. 6(1)(b)); legitimate interest in following up a Marketplace enquiry (Art. 6(1)(f)) |
| B2B outreach to prospective customers | Name, job title, employer, business email and phone, professional profile information, obtained from company websites, professional networks and B2B contact data providers | Legitimate interest in developing our business with relevant companies (Art. 6(1)(f)). You can object at any time. |
| Marketing communications | Name, business email, company, communication preferences, opens and clicks | Legitimate interest for existing business contacts, otherwise consent where required by law. Every email includes an opt-out. |
| Customer and partner relationships, contracts, support and billing | Contact details of your staff, contract documents, orders, invoices, payment records, support tickets and correspondence | Performance of the contract (Art. 6(1)(b)); legal obligations such as accounting and tax law (Art. 6(1)(c)) |
| Meetings and events | Name, company, role, attendance, dietary or access needs you choose to share | Legitimate interest (Art. 6(1)(f)); consent for any optional information |
| Security reports | Name, contact details and the content of a vulnerability report sent to security@sightpulse.ai | Legitimate interest in keeping our systems secure (Art. 6(1)(f)) |
| Legal compliance and claims | Any of the above, as needed | Legal obligation (Art. 6(1)(c)); legitimate interest in establishing or defending claims (Art. 6(1)(f)) |
Under the Swiss FADP, we process personal data in line with its processing principles and rely on the justifications the law provides, including your consent where required, our overriding legitimate interests and legal obligations.
We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects. We do not knowingly collect sensitive personal data through the Website.
We use cookies and similar technologies. Non-essential cookies are set only after you consent through our cookie banner, and you can change your choice at any time via “Cookie settings” in the footer of every page.
| Category | Purpose | Provider | Duration |
|---|---|---|---|
| Strictly necessary | Security, load balancing, storing your cookie choice | SightPulse | Session up to 12 months |
| Preferences | Remembering settings such as language | SightPulse | Up to 12 months |
| Analytics | Understanding how visitors use the Website so we can improve it (Google Analytics 4) | Google Ireland Ltd / Google LLC | Up to 14 months |
Google Analytics 4 does not log or store full IP addresses. We have set the data retention period in Google Analytics to 14 months. You can also block analytics with the Google Analytics opt-out browser add-on or your browser settings. Google’s handling of data is described at policies.google.com/technologies/partner-sites.
We share personal data only where needed for the purposes above:
Service providers act as our processors under written agreements and may use the data only to provide their services to us.
We are based in Switzerland. We may transfer personal data to:
Switzerland is recognised by the European Commission as providing adequate protection, so data you send us from the EU or EEA does not need additional safeguards to reach us. You can request a copy of the relevant safeguards by writing to privacy@sightpulse.ai.
| Data | Retention |
|---|---|
| Enquiries and demo requests with no further relationship | Up to 24 months after our last contact |
| Microsoft Marketplace leads with no further relationship | Up to 24 months after our last contact |
| B2B prospecting records | Up to 24 months after our last interaction, or earlier if you object |
| Marketing preferences and opt-outs | Opt-outs are kept as long as needed to respect them |
| Contracts, orders, private offers, invoices and accounting records | 10 years, as required by Swiss law |
| Support tickets and correspondence | Up to 24 months after closure, longer if needed for an ongoing contract or claim |
| Server and security logs | Up to 12 months |
| Google Analytics data | 14 months |
We may keep data longer where required by law or to establish or defend legal claims. Residual copies in encrypted backups are deleted in the normal backup cycle. When data is no longer needed, we delete or anonymise it.
We protect personal data with technical and organisational measures appropriate to the risk, including encryption in transit, role-based access with multi-factor authentication, logging and monitoring, supplier due diligence and staff confidentiality obligations. The SightPulse platform is developed and operated by CBS Systems d.o.o. under an information security management system certified to ISO/IEC 27001:2022 and a quality management system certified to ISO 9001:2015 by TÜV NORD CERT GmbH. See the Information Security Policy, the Quality Policy and our Trust & Data Protection page.
This section is for our customers and for individuals whose data our customers process. It describes how the platform is built and operated. The binding terms are in each customer’s agreement and in our Data Processing Agreement (DPA).
SightPulse is deployed as an Azure Managed Application in the customer’s own Azure subscription and Microsoft Entra ID tenant, in the Azure region the customer chooses. The platform connects to the customer’s data in place, for example in its data warehouse or lakehouse. By default, customer data is not copied to systems operated by SightPulse AG or CBS Systems. Where a customer’s order selects processing outside its tenant, or the customer instructs it in writing, we use our dedicated EU Processing Environment on virtual servers in Germany. Data from customer datasets is not stored in Serbia. Microsoft provides the underlying cloud infrastructure to the customer under the customer’s own agreement with Microsoft. A paid deployment processes customer data only after we have activated it under the customer’s accepted private offer or order. The Demo plan runs on synthetic data only.
Depending on the plan and the data sources a customer connects:
Personal data in a customer’s datasets is processed only where the customer’s private offer or order puts it in scope. We recommend that customers connect personal data only where a use case needs it, and use pseudonymised identifiers where possible. Most use cases do not need direct identifiers such as names or contact details of consumers. Where a customer uses the platform to link or match consumer records across its own sources, the customer decides whether that processing is lawful and carries out any data protection impact assessment required; we assist under the DPA.
Our operations personnel can access only the platform’s managed resource group in the customer’s subscription. The customer chooses either standard operational access for named personnel, or just-in-time access where each request is time-limited and approved by the customer. Access requires multi-factor authentication, and control-plane operations are recorded in the customer’s Azure Activity Log. Personal data in customer datasets is processed in pseudonymised form by default, wherever the use case allows; our personnel view direct identifiers, such as names or email addresses, only where needed to debug, provide support or resolve an incident. Our engineers in Serbia work by remote access only.
When a customer deletes the managed application, the managed resource group and the platform resources in it are deleted. Data in the customer’s own source systems is not affected. Customer data in our EU Processing Environment, and any other copy we hold under a written instruction, is deleted within 30 days after the end of the contract, unless law requires retention.
The current list of our sub-processors, their locations and the safeguards we use is published on our Trust & Data Protection page. We notify customers in advance of changes as set out in the DPA.
If you are, for example, a loyalty member, shopper or survey respondent of one of our customers, please send requests about your data to that company, as it is the controller. If you contact us, we will forward your request to the relevant customer and support it in responding.
Subject to the conditions of applicable law, you have the right to:
To exercise your rights, write to privacy@sightpulse.ai. We may need to verify your identity. We respond within 30 days.
You can lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC, www.edoeb.admin.ch) or, if you are in the EU or EEA, with the data protection authority where you live or work.
Children. Our services are for businesses. We do not knowingly collect data from anyone under 16.
Third-party websites. Links to other websites, including Microsoft Marketplace and social networks, are governed by those operators’ privacy policies.
Changes. We may update this policy. The “Last updated” date shows the latest version. If a change significantly affects how we use your data, we will inform you through the Website or by email before it takes effect.
SightPulse AG
Dammstrasse 19
6300 Zug, Switzerland
Privacy: privacy@sightpulse.ai
Security: security@sightpulse.ai