Certalo Privacy Policy

1. Data Controller and Contact Information

1.1 Data Controller

The data controller responsible for the processing of your personal data is:

CAVORA PARTNERS GmbH
Pestalozziweg 7
8952 Schlieren
Switzerland
Company Registration Number: CHE-283.646.749

1.2 Contact Information

General Inquiries:
Email: info@cavorapartners.com
Phone: +41 44 798 17 35
Website: https://cavorapartners.com

Data Protection Inquiries:
Email: legal@cavorapartners.com

2. Personal Data We Collect

2.1 Categories of Personal Data

We collect and process the following categories of personal data when you use the Certalo App:

2.2 Data Collection Methods

We collect personal data through the following methods:

• Direct Provision: When you create an account, upload certificates, contact support, or voluntarily provide information within the App.
• Automated Collection: Through analytics tools, software development kits (SDKs), and similar technologies that automatically collect device and usage data.
• Third-Party Sources: From Apple App Store, Apple Wallet, payment processors and other service providers.

2.3 Certificate and Credential Data

Certalo allows you to upload, store, and manage digital certificates and credentials. We process this data solely to provide the App's certificate management and verification features. You retain full ownership of your certificate data, and we do not claim any rights to your uploaded content.

2.4 Special Categories of Personal Data

We do not intentionally collect special categories of personal data (also known as "sensitive personal data") such as racial or ethnic origin, political opinions, religious beliefs, health data, biometric data, or data concerning sexual orientation. If you choose to provide such data voluntarily (e.g., through certificate uploads), you consent to its processing for the purposes disclosed in this Privacy Policy.

3. Legal Basis for Processing (GDPR / nDSG)

Under the GDPR and the Swiss nDSG (Art. 6 nDSG, Art. 31 nDSG), we process your personal data based on the following legal grounds:

3.1 Contractual Necessity (GDPR Article 6(1)(b))

Processing is necessary for the performance of our contract with you (i.e., the Terms of Service) or to take steps at your request before entering into a contract. This includes providing the Certalo App's core functionality, managing your account, storing and syncing your certificates, and delivering services you have requested.

3.2 Legitimate Interests (GDPR Article 6(1)(f))

Processing is necessary for our legitimate interests or those of a third party, provided such interests are not overridden by your fundamental rights and freedoms. Our legitimate interests include:

• Improving and optimizing the App's performance, features, and user experience
• Ensuring the security and integrity of the App and preventing fraud
• Conducting analytics and research to understand user behavior and preferences
• Detecting, preventing, and responding to security incidents or technical issues
• Enforcing our terms of service and protecting our legal rights
• Providing customer support and responding to inquiries

3.3 Consent (GDPR Article 6(1)(a) / Art. 6 para. 6 nDSG)

Where required by law, we process your personal data based on your explicit consent. This includes:

• Marketing communications and promotional materials (processed exclusively on the basis of your explicit opt-in consent; you may withdraw consent at any time)
• Analytics cookies and tracking technologies beyond essential cookies (opt-in required)
• Optional features that require additional data processing

You have the right to withdraw your consent at any time without affecting the lawfulness of processing based on consent before its withdrawal (Art. 7(3) GDPR).

3.4 Legal Obligation (GDPR Article 6(1)(c))

Processing is necessary to comply with legal obligations to which we are subject, such as tax laws, accounting requirements, regulatory compliance (including EU AI Act Article 4 compliance), or responding to lawful requests from public authorities.

3.5 Vital Interests (GDPR Article 6(1)(d))

In rare circumstances, processing may be necessary to protect the vital interests of you or another person (e.g., in emergency situations involving life-threatening risks).

4. How We Use Your Personal Data

We use your personal data for the following purposes:

4.1 Certificate Management and Verification

• Storing, organizing, and synchronizing your digital certificates and credentials
• Verifying certificate authenticity using a cryptographic checksum
• Generating QR codes for certificate sharing and verification
• Integrating certificates with Apple Wallet
• Enabling certificate search, filtering, and categorization

4.2 Service Provision and Management

• Providing, operating, and maintaining the Certalo App and its features
• Creating and managing your user account
• Authenticating your identity and preventing unauthorized access
• Processing transactions and managing subscriptions
• Delivering personalized content and recommendations

4.3 Communication and Support

• Responding to your inquiries, support requests, and feedback
• Sending transactional communications (e.g., account notifications, security alerts, updates)
• Providing customer support and troubleshooting technical issues
• Conducting user surveys and collecting feedback

4.4 Analytics and Improvement

• Analyzing usage patterns, trends, and user behavior to improve the App
• Conducting research and development to enhance features and functionality
• Monitoring App performance, stability, and error rates
• Identifying and fixing bugs, crashes, and technical issues

4.5 Security and Fraud Prevention

• Detecting, preventing, and responding to security incidents, fraud, and abuse
• Verifying certificate authenticity and preventing fraudulent credentials
• Enforcing our terms of service and policies
• Protecting the rights, property, and safety of CAVORA PARTNERS, our users, and the public
• Investigating and addressing violations of our terms or applicable laws

4.6 Marketing and Advertising (Consent Only)

Legal Basis: Explicit Consent (Art. 6(1)(a) GDPR / Art. 6 para. 6 nDSG). We process personal data for marketing purposes exclusively on the basis of your explicit opt-in consent. We do not rely on legitimate interest for marketing communications.

• Sending promotional materials, newsletters, and marketing communications (only with your explicit opt-in consent)
• Conducting marketing campaigns and measuring their effectiveness (only with your consent)

Opt-Out: You may withdraw your consent and opt out of marketing communications at any time by clicking the "unsubscribe" link in our emails, adjusting your preferences in the App (Settings > Notifications > Marketing), or contacting us. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

4.7 Legal and Compliance

• Complying with legal obligations, regulatory requirements (including EU AI Act Article 4), and lawful requests from authorities
• Establishing, exercising, or defending legal claims
• Responding to court orders, subpoenas, or legal processes

5. Data Sharing and Disclosure

5.1 Third-Party Service Providers (Sub-Processors)

We may share your personal data with trusted third-party service providers (sub-processors) who assist us in operating the Certalo App, conducting our business, or providing services to you. All sub-processors are bound by Data Processing Agreements (DPAs) in compliance with Art. 28 GDPR and Art. 9 nDSG. Categories of service providers include:

• Google Firebase (Google): sign-in, database, file storage, server functions (Frankfurt) and remote configuration.
• Google AdMob (Google): banner advertising; personalised advertising only after your permission on iOS (App Tracking Transparency).
• Apple: App Store distribution, in-app purchases and receipt validation, Apple Wallet passes for certificates, Sign in with Apple, push notifications.

Certalo does not use an analytics service (Firebase Analytics is switched off).

5.2 Apple App Store and Apple Wallet

If you download the Certalo App from the Apple App Store or use Apple Wallet integration, certain data may be shared with Apple Inc. in accordance with their terms and privacy policies. We do not control Apple's data practices. Please review Apple's Privacy Policy for more information.

5.3 Certificate Sharing

When you choose to share certificates or credentials with third parties (e.g., employers, educational institutions), those third parties will have access to the certificate data you share. We are not responsible for how third parties use or protect your shared certificate data.

5.4 Business Transfers

In the event of a merger, acquisition, reorganization, sale of assets, bankruptcy, or other business transaction, your personal data may be transferred to the acquiring or successor entity. We will notify you of any such change in ownership or control of your personal data via email or prominent notice within the App.

5.5 Legal Requirements and Protection of Rights

We may disclose your personal data if required to do so by law or in response to valid legal requests, including to:

• Comply with legal obligations, court orders, subpoenas, or regulatory requirements
• Enforce our terms of service, policies, or contracts
• Protect the rights, property, or safety of CAVORA PARTNERS, our users, or the public
• Investigate, prevent, or take action regarding illegal activities, fraud, or security threats

5.6 Aggregated and Anonymized Data

We may share aggregated, anonymized, or de-identified data that does not identify you personally with third parties for research, analytics, or other purposes. Such data is not considered personal data under applicable data protection laws.

5.7 No Sale of Personal Data

We do not sell, rent, or trade your personal data to third parties for monetary consideration.

6. International Data Transfers

6.1 Cross-Border Transfers

Your personal data may be transferred to, processed, and stored in countries outside your country of residence, including Switzerland, the European Union, the United States, and other jurisdictions where our service providers operate. These countries may have data protection laws that differ from those in your jurisdiction.

6.2 Safeguards for EU/EEA Data Transfers

For transfers of personal data from the European Economic Area (EEA) to countries not recognized by the European Commission as providing an adequate level of data protection, we implement appropriate safeguards in compliance with Art. 46 GDPR, including:

• Standard Contractual Clauses (SCCs): We use the European Commission's Standard Contractual Clauses approved under GDPR Article 46(2)(c) with all sub-processors located outside the EEA.
• Adequacy Decisions: We transfer data to countries recognized by the European Commission as providing adequate data protection (e.g., Switzerland, UK, Canada).
• Supplementary Measures (Schrems II): In accordance with the CJEU ruling in Case C-311/18 (Schrems II), we implement supplementary technical measures (encryption in transit and at rest, pseudonymization) and organizational measures (access controls, security audits) to ensure the security and confidentiality of transferred data.

6.3 Swiss Data Transfers

For transfers of personal data from Switzerland, we comply with the Swiss Federal Act on Data Protection (nDSG/FADP, Art. 16-17 nDSG) and use appropriate safeguards recognized by the Swiss Federal Data Protection and Information Commissioner (FDPIC).

6.4 Your Rights Regarding International Transfers

You have the right to obtain information about the safeguards we have implemented for international data transfers and to request copies of relevant documentation (e.g., Standard Contractual Clauses). Please contact us for more information.

7. Data Retention

7.1 Retention Periods

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, comply with legal obligations, resolve disputes, and enforce our agreements. Specific retention periods depend on the type of data and the purpose of processing:

7.2 Deletion and Anonymization

After the applicable retention period expires, we will delete or anonymize your personal data in accordance with our data retention policy and applicable laws. Anonymized data that no longer identifies you may be retained indefinitely for research, analytics, and statistical purposes.

7.4 Legal Holds

In certain circumstances, we may be required to retain your personal data for longer periods due to legal holds, pending litigation, regulatory investigations, or other legal obligations, even after you request deletion.

8. Data Security

8.1 Security Measures

We implement industry-standard technical and organizational security measures to protect your personal data against unauthorized access, disclosure, alteration, destruction, or loss. Our security measures include:

• Encryption: Data in transit is encrypted using TLS. Data at rest is encrypted by our cloud provider (Google Cloud) using AES-256.
• Certificate integrity: Each certificate carries a SHA-256 checksum over its data, so that changes to a certificate can be detected during verification.
• Access Controls: Role-based access controls (RBAC), multi-factor authentication (MFA), and least-privilege principles to restrict access to personal data.
• Network Security: Firewalls, intrusion detection/prevention systems (IDS/IPS), DDoS protection, and regular security monitoring.
• Secure Development: Secure coding practices, code reviews, vulnerability assessments, and penetration testing.
• Incident Response: Documented incident response procedures, breach notification protocols, and regular security audits.
• Employee Training: Regular security awareness training for employees and contractors with access to personal data.
• Third-Party Security: Contractual obligations requiring service providers to implement appropriate security measures and undergo periodic security assessments.

8.2 Limitations of Security

While we strive to protect your personal data, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security, and you acknowledge that you provide your personal data at your own risk. You are responsible for maintaining the confidentiality of your account credentials and for any activities that occur under your account.

8.3 Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify you and relevant supervisory authorities in accordance with applicable data protection laws (e.g., within 72 hours under GDPR Article 33). We will provide information about the nature of the breach, the likely consequences, and the measures taken to address the breach and mitigate harm.

9. Your Data Protection Rights

9.1 Rights Under GDPR (EU/EEA Residents)

If you are located in the European Economic Area (EEA), you have the following rights under the GDPR:

• Right of Access (Article 15): You have the right to obtain confirmation as to whether we process your personal data and, if so, to access such data and receive information about the processing.
• Right to Rectification (Article 16): You have the right to request correction of inaccurate or incomplete personal data.
• Right to Erasure / "Right to be Forgotten" (Article 17): You have the right to request deletion of your personal data under certain circumstances (e.g., data no longer necessary, consent withdrawn, unlawful processing).
• Right to Restriction of Processing (Article 18): You have the right to request restriction of processing under certain circumstances (e.g., accuracy contested, processing unlawful but you oppose erasure).
• Right to Data Portability (Article 20): You have the right to receive your personal data in a structured, commonly used, machine-readable format and to transmit such data to another controller.
• Right to Object (Article 21): You have the right to object to processing based on legitimate interests or for direct marketing purposes. We will cease processing unless we demonstrate compelling legitimate grounds that override your interests.
• Right Not to be Subject to Automated Decision-Making (Article 22): You have the right not to be subject to decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects, unless certain exceptions apply.
• Right to Withdraw Consent: Where processing is based on consent, you have the right to withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.
• Right to Lodge a Complaint: You have the right to lodge a complaint with a supervisory authority, in particular in the EU member state of your habitual residence, place of work, or place of alleged infringement.

9.2 Rights Under Swiss FADP (Swiss Residents)

If you are located in Switzerland, you have similar rights under the Swiss Federal Act on Data Protection (FADP), including the right to access, rectify, delete, restrict processing, object to processing, and data portability. You also have the right to lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC).

9.3 Rights Under California Privacy Laws (California Residents)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

• Right to Know: You have the right to request information about the categories and specific pieces of personal information we have collected, the sources from which it was collected, the purposes for collection, and the categories of third parties with whom we share it.
• Right to Delete: You have the right to request deletion of your personal information, subject to certain exceptions.
• Right to Correct: You have the right to request correction of inaccurate personal information.
• Right to Opt-Out of Sale/Sharing: You have the right to opt out of the "sale" or "sharing" of your personal information for cross-context behavioral advertising. Note: We do not sell your personal information.
• Right to Non-Discrimination: You have the right not to receive discriminatory treatment for exercising your privacy rights.

To exercise these rights, please contact us or use the "Data Rights Request" feature in the App (Settings > Privacy > Data Rights Request).

9.4 How to Exercise Your Rights

To exercise any of the above rights, please submit a request by:

• Email: legal@cavorapartners.com
• In-App: Navigate to Settings > Privacy > Data Rights Request
• Mail: CAVORA PARTNERS GmbH, Pestalozziweg 7, 8952 Schlieren, Switzerland

We will respond to your request within the timeframes required by applicable law (e.g., 30 days under GDPR, 45 days under CCPA). We may request additional information to verify your identity before processing your request.

9.5 Verification Process

To protect your privacy and security, we will verify your identity before fulfilling data subject requests. Verification may require you to provide information such as your email address, account details, or government-issued identification. If we cannot verify your identity, we may deny your request.

10. Children's Privacy

10.1 Age Restrictions

We do not knowingly process personal data of minors. The Certalo App is not intended for use by children under the age of 16 (GDPR Art. 8 / nDSG) or under the age of 13 (COPPA, for U.S. users). We do not knowingly collect, process, or store personal data from children under these age thresholds without verifiable parental consent. If you are under 16 (or under 13 in the U.S.), you must not use the App or provide any personal data to us.

10.2 Detection and Immediate Deletion

If we become aware or reasonably suspect that we have collected personal data from a child below the applicable age threshold without verifiable parental consent, we will take immediate steps to delete such data without undue delay. If you are a parent or guardian and believe that your child has provided personal data to us without your consent, please contact us immediately at legal@cavorapartners.com.

11. Certificate Verification

Each Certalo certificate carries a cryptographic checksum (SHA-256) calculated from the certificate data; the App shows it as "blockchain token". The checksum is stored in our database together with the certificate. It is not written to any blockchain or other public ledger. Anyone with the certificate link can check on our verification page whether a certificate exists and is unchanged.

The checksum is deleted together with the certificate or your account. Your right to erasure therefore applies in full.

12. Cookies and Tracking Technologies

12.1 Types of Technologies Used

The Certalo App uses software development kits (SDKs), analytics tools, and similar tracking technologies to collect usage data, enhance your experience, and provide analytics. These technologies may be provided by us or by third-party service providers.

12.2 Categories of Tracking Technologies

We categorize tracking technologies as follows:

• Essential Technologies (No consent required): Strictly necessary for the App to function properly (e.g., authentication, security, session management). These are set automatically and cannot be disabled without impairing core functionality. Legal basis: Art. 6(1)(b) GDPR / legitimate interest under Art. 6(1)(f) GDPR.
• Analytics Technologies (Opt-in required): Provided by third-party analytics services (e.g., Google Analytics, Firebase) to measure and analyze usage patterns. These are only set after you provide explicit consent via our consent mechanism. Legal basis: Art. 6(1)(a) GDPR (consent).

12.3 Third-Party Analytics

We use third-party analytics services that may collect data about your use of the App. Examples include:

• Google Analytics: Privacy Policy | Opt-Out
• Firebase Analytics: Privacy Policy

12.4 Your Choices Regarding Tracking

You can control tracking through your device settings. You may also opt out of certain analytics tracking by enabling "Limit Ad Tracking" (iOS) in your device settings. Please note that disabling tracking may limit your ability to use certain features of the App.

13. Changes to This Privacy Policy

13.1 Updates and Amendments

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or for other operational, legal, or regulatory reasons. The "Effective Date" at the top of this Privacy Policy indicates when it was last revised. We encourage you to review this Privacy Policy periodically.

13.2 Notification of Material Changes

If we make material changes to this Privacy Policy that significantly affect your rights or the way we process your personal data, we will notify you by:

• Posting a prominent notice within the App
• Sending an email notification to the email address associated with your account
• Requesting your consent if required by applicable law

13.3 Continued Use After Changes

Your continued use of the Certalo App after any changes to this Privacy Policy constitutes your acceptance of the revised Privacy Policy. If you do not agree to the changes, you must stop using the App and may request deletion of your account and personal data.

14. Contact Us and Complaints

14.1 General Inquiries

If you have any questions, concerns, or complaints about this Privacy Policy or our data processing practices, please contact us at:

CAVORA PARTNERS GmbH
Pestalozziweg 7
8952 Schlieren
Switzerland

Email: legal@cavorapartners.com
Phone: +41 44 798 17 35

14.2 Supervisory Authorities

If you are located in the European Economic Area (EEA) or Switzerland and believe that we have not adequately addressed your concerns, you have the right to lodge a complaint with your local data protection supervisory authority:

• EU Residents: Contact your national data protection authority. A list of EU data protection authorities is available at https://edpb.europa.eu/about-edpb/board/members_en.
• Swiss Residents: Swiss Federal Data Protection and Information Commissioner (FDPIC) - https://www.edoeb.admin.ch

14.3 California Residents

California residents may also contact the California Attorney General's Office regarding privacy complaints: https://oag.ca.gov/contact