GDPR and FADP

If your business is in Switzerland, the FADP applies (the revised Federal Act on Data Protection, in force since September 2023).

The European GDPR applies on top if you also serve customers established in the European Union — which is common in a border region such as Geneva. Both texts rest on the same principles, and meeting the stricter of the two puts you in order for both.

1. Tell the people who call you.

They must be able to know that their request is handled by an automated agent and that their contact details are saved. The agent introduces itself as your assistant and never passes itself off as a human. Add a note on your website and, if you have one, in your welcome booklet: a few lines are enough.

2. No audio recording.

Appela does not record calls: no audio file is kept. The written transcript and the summary are enough to find what was said. Art. 179^ter of the Swiss Criminal Code punishes recording a conversation without the participants’ knowledge: that risk does not exist with Appela.

3. Choose a retention period.

Keep data for as long as it is useful to you, no longer. The setting offers 30, 90, 180 or 365 days; deletion is then automatic. Thirty days suits most businesses.

4. Answer your customers’ requests.

A customer may ask what data you hold about them, and have it corrected or deleted. You can find their record and their call history from your account. If the request reaches us directly, we pass it on to you.

5. Keep a register, if you are required to.

Companies with fewer than 250 staff are largely exempt, except for high-risk processing. A salon or a restaurant using Appela to take appointments is in principle not concerned. If in doubt, ask your accountant.

• No audio recording of calls, ever.
• Automatic deletion at the deadline you chose, both here and at our telephony provider.
• Encryption of traffic and separation of data between accounts.
• The contractual framework binding our own sub-processors, including for transfers outside Switzerland and the European Union.
• Notification in the event of a data breach that presents a risk.

• Access: knowing what data is handled and obtaining a copy of it.
• Rectification: having inaccurate information corrected.
• Erasure: having data deleted once it is no longer necessary.
• Objection: objecting to processing based on a legitimate interest.
• Portability: receiving one’s data in a machine-readable format.
• Withdrawal of consent, at any time, for whatever depends on it.

These requests go to you first, as the controller. For your own account data, write to us at contact@appela.ai: we reply within thirty days.

The GDPR (art. 28) and the FADP require a written contract between controller and processor. Our terms and conditions and our privacy policy serve that purpose: they set out the subject matter, the duration, the nature of the processing, the categories of data and our obligations.

If your accountant or your adviser would like a separate processing agreement, write to us and we will provide one.

You may refer the matter to the Federal Data Protection and Information Commissioner (FDPIC) in Switzerland, or to the supervisory authority in your country if the GDPR applies to you. We would obviously rather you wrote to us first.

This page explains how Appela fits into your obligations. It does not replace legal advice: your situation may have particular features, depending on your customers and on the other data you handle. Where the stakes are high, have your arrangements reviewed by a professional.