Controller
KMU base GmbH (in formation), represented by Susanne Egger, Fichtenweg 6, 4537 Wiedlisbach, Switzerland. Telephone +41 31 561 10 90, email datenschutz@hrbase.ch. Contact person for data protection: Andreas Toscan. KMU base GmbH (in formation) is the controller within the meaning of the Swiss Federal Act on Data Protection (FADP) and, where applicable, the GDPR. Until its entry in the commercial register, the controller is KMU base GmbH (in formation), represented by Susanne Egger; thereafter, the registered KMU base GmbH.
Scope
Websites of the product family (kmubase.ch, hrbase.ch, financebase.ch, qmsbase.ch, docubase.ch, salesbase.ch), the application (app.hrbase.ch) and the employee apps for iOS and Android. (a) We act as controller for websites, enquiries and customer accounts; (b) we act as processor for data that customer companies process in the application (e.g. personnel data in ) – the respective customer company is the controller in that case; the basis is a data processing agreement (Art. 9 FADP / Art. 28 GDPR).
Hosting and storage location
The application, websites and all backups run on our own virtual private server (VPS) at Infomaniak Network SA in Geneva, in data centres in Switzerland. Infomaniak is certified to ISO 27001 (information security), ISO 9001 (quality management), ISO 14001 (environmental management) and ISO 50001 (energy management). Application data is stored exclusively in Switzerland, as are the daily backups. The FADP and, where applicable, the GDPR apply.
Websites
Server log files (IP address, time, page accessed, browser) for security, retention period 14 days (Art. 6(1)(f) GDPR). No analytics or advertising trackers. We only set cookies on the websites when you change the language: a technically necessary cookie remembers the selected language (duration 12 months). Fonts are served locally, with no transmission to Google.
Contact, demo and quote enquiries
Name, company, email, telephone, message; purpose: processing the enquiry (Art. 6(1)(b) and (f) GDPR); storage until the enquiry is resolved, for a maximum of 24 months if no contract is concluded; protection against abuse through limits per IP address.
Demo to try out
For the demo to try, we process company, first name, last name, phone and email address, optionally industry and language, as well as the time of consent and the IP address (abuse protection). Purpose: to send you the link to the demo company, provide the demo and contact you about it. You receive the link by email; only with it do you get into the demo company. The demo company only contains made-up data and is deleted automatically after 7 days; you receive a reminder one day before. We keep your contact details as a prospect in our sales () until you request deletion (datenschutz@hrbase.ch). Please do not enter any real personal data in the demo.
Pre-registration and pre-order
You can pre-register for the launch on the website or pre-order apps with no obligation. We store your email address and, if you provide them, your name, company, number of employees, telephone number and message, for a pre-order also your address, UID, preferred start and your selection (apps, data transfer, referral code), as well as the time of consent and IP address (protection against abuse). Purpose: to contact you before launch, prioritise your setup and, for a pre-order, create your account with the chosen selection. The basis is your consent (Art. 6(1)(a) GDPR), which you confirm using the confirmation link in the email (double opt-in). Using the deletion link in each email or sending a message to datenschutz@hrbase.ch allows you to have all details deleted immediately. We delete unconfirmed entries within 90 days at the latest, and confirmed entries no later than 24 months after launch, unless a contract is concluded.
Application
Technically necessary cookies: session cookie (httpOnly, expires when the browser closes or after 12 hours of inactivity) and language cookie (selected language, 12 months). Login details (email, password only as an Argon2 hash), access log (who viewed or changed which personal data and when), retention in accordance with the customer company’s requirements. Applications: deletion after the period set by the customer company (default 6 months), talent pool only with consent.
Employee app
In the employee app and in the browser, we use your device’s features only for the stated purpose, only with your consent (prompt by the operating system) and – where noted – only if your employer switches the feature on: • Camera: scanning your QR badge and codes, photos of receipts, documents and business cards. At the clocking terminal your employer can switch on a verification photo when clocking: it shows the person clocking, is deleted after the period set by the company (30 days by default) and is only viewed by authorised persons under the four-eyes principle. • Microphone: only for dictation to the AI assistant; the recording is converted to text at Infomaniak (Switzerland) and not stored. • Location: only at the moment of clocking, if your employer switches this on – no background tracking. • Face ID, Touch ID or fingerprint: only for confirming on your device; biometric data never leaves the device and never reaches us. • NFC: reading your badge at the clocking terminal (badge identifier only). • Notifications: push via Apple Push Notification Service or Firebase Cloud Messaging (Google), without confidential content; SMS (invitation, sign-in code) via ASPSMS (Switzerland). Sign-in tokens are kept in the device’s protected storage. No trackers or advertising SDKs.
AI assistant
The AI assistant is only active if your company has switched it on and expressly consented to the data processing. It works exclusively with your permissions. Your question, the application data needed for it and dictations are transmitted to Infomaniak AI Services (Infomaniak Network SA, Switzerland) and processed there; according to the provider, requests are neither recorded nor used for training, temporary storage for processing is possible. Your data is never used for training. Every AI action is logged; conversation histories are deleted after the period set by the company.
app (iOS and Android)
The app (package name ch.kmubase.app) is distributed via the Apple App Store and Google Play. Apple and Google are responsible for the download, your store account and any crash reports from the operating system; their privacy policies apply. Push notifications are delivered via the Apple Push Notification service (APNs) or Firebase Cloud Messaging (FCM, Google) and contain no confidential content. The app does not track you across other companies’ apps or websites (no tracking) and contains no advertising and no advertising or analytics SDKs. It uses the camera, microphone, location, Face ID or fingerprint, NFC and notifications only as described in the sections “Employee app” and “AI assistant” and only with your consent. The section “Deleting data” explains how to have your account and data deleted.
Deleting data
How to request deletion: • Employees and applicants: your data in the application and the app is managed by your employer as the controller. Please contact your employer first; they delete or anonymise your data in . You can also write directly to datenschutz@hrbase.ch – we will forward your request to your employer. • Company accounts (customers): an authorised person requests cancellation or deletion of the entire account by email to info@kmubase.ch or datenschutz@hrbase.ch. • Pre-registration and enquiries: via the link in every email or by email to datenschutz@hrbase.ch – we delete immediately. What is deleted and what is retained: we delete your personal and account data. Documents subject to statutory retention – in particular payslips and accounting records – are kept for the statutory period of 10 years (Art. 958f Swiss Code of Obligations, GeBüV) and deleted afterwards. How long it takes: after the contract ends, company accounts can still export their data for 30 days; we then delete it. Local backups are retained for 14 days. A full external backup is created daily; daily copies are retained for 30 days and monthly copies for 12 months. Deleted data may remain in backups for up to 12 months. They are used exclusively for recovery, access is restricted and they are deleted again after a restoration.
Sending emails
To send system messages (e.g. invitations, password links, notifications) we use a specialised email delivery provider as processor, contractually bound to confidentiality. Emails contain no confidential personnel data, only notices with a link to the application. If your employer sets this up, emails are sent via their own mail server or Microsoft-365 account.
Recipients and processors
Infomaniak Network SA (hosting, backups as well as AI assistant and dictation, Switzerland); a specialised email delivery provider (sending system emails); ASPSMS (SMS delivery, Switzerland); Apple Inc. and Google Ireland Ltd. (push notifications, technical identifiers only); for billing customer companies: Invoice Ninja (self-hosted instance) and PayPal (for payment via PayPal); at the customer company’s request: SwissSalary/Microsoft Business Central (payroll), JobCloud AG (job advertisements). Pingen GmbH (Switzerland): printing and postal delivery of letters on behalf of the customer company; document contents and recipient address are transmitted. Servers are located in Switzerland; international deliveries also use printing centres abroad.
Third countries
Application data is stored and processed in Switzerland; development, operation and support are provided from Switzerland. Disclosure abroad is limited to the services listed above (email delivery, push notifications, payment) and to countries with adequate data protection or on the basis of standard contractual clauses (Art. 16 FADP / Art. 46 GDPR).
Security
TLS encryption in transit, encrypted document storage and encrypted secrets, two-factor authentication (TOTP, can be enabled per customer), a roles and permissions framework, an access log and daily backups in Switzerland; hosting in Infomaniak data centres certified to ISO 27001.
Your rights
Access, rectification, erasure, restriction, data portability, objection, withdrawal of consent (Art. 25 et seq. FADP, Arts. 15–21 GDPR). Employees and applicants should first contact their employer regarding data in the application.
Complaints
In Switzerland, to the Federal Data Protection and Information Commissioner (FDPIC); in the EU, to a data protection supervisory authority.
Last updated
October 2026.