Privacy Policy

In this privacy policy we, Expertiva AG (hereinafter “we” or “us”), as the operator of the taxiva.ch portal, describe how we collect and process personal data. This privacy policy is not an exhaustive description; other data protection statements may govern specific matters. For the purposes of this privacy policy, personal data means any information relating to an identified or identifiable person.

In brief, as regards this website: We ourselves set no cookies and use no analytics, advertising or tracking services. The website contains no forms. Exactly one third-party service is loaded automatically, namely the video player on the two home pages; it may set cookies of its own (section 4.5). Everything else — appointment booking, WhatsApp, the map view on Google Maps — is reached through a link and therefore only once you click on it.

1. Controller and contact

The controller for the processing described here is Expertiva AG, unless otherwise stated in an individual case:

Expertiva AG
Schaffhauserstrasse 550
8052 Zurich
Switzerland

Please address data protection inquiries, in particular the exercise of your rights under section 10, to hello@taxiva.ch or to the address above. Where there is reasonable doubt as to your identity, we may request additional information to identify you; we do not prescribe any particular form for this.

2. Collection and processing of personal data

We process personal data in particular in the following categories of processing:
• Client data of those for whom we render or have rendered services.
• Personal data that we have received indirectly from our clients in the course of rendering services.
• When you visit our website.
• When you book an appointment via our website.
• When you use our client portal.
• When you use our newsletter.
• When you take part in our referral program.
• When you attend an event organized by us.
• When we communicate with each other or a visit takes place.
• In any other contractual relationship, e.g. as a supplier, service provider or adviser.
• In connection with job applications.
• Where we are required to do so for legal or regulatory reasons.
• Where we exercise our duties of care or other legitimate interests, e.g. to avoid conflicts of interest, to prevent money laundering or other risks, to ensure the accuracy of data, to check creditworthiness, to ensure security or to enforce our rights.
More detailed information can be found in the description of the respective categories of processing in section 4.

3. Categories of personal data

Which personal data we process depends on your relationship with us and on the purpose for which we process it. In addition to your contact details, we also process further information about you or about persons related to you. This information may in some circumstances constitute sensitive personal data.

We collect the following categories of personal data, depending on the purpose for which we process it:
• Contact information (e.g. surname, first name, address, telephone number, email).
• Client information (e.g. date of birth, nationality, marital status, occupation, title, job title, passport/ID number, OASI/AHV number — the Swiss social insurance number).
• Risk assessment data (e.g. credit information, commercial register data).
• Financial information (e.g. bank account details).
• Engagement data, depending on the engagement (e.g. tax information, articles of association, minutes, projects, contracts, employee data such as salary and social insurance, accounting data, beneficial owners, ownership structures).
• Website data (e.g. IP address, device information, browser information, date and time of access, pages accessed).
• Application data (e.g. curriculum vitae, employment references).
• Marketing information (e.g. newsletter subscription).
• Security and network data (e.g. visitor lists, access controls, network and mail scanners, telephone call logs).

To the extent permitted, we also obtain certain data from publicly accessible sources (e.g. the debt enforcement register, land registers, the commercial register, the press, the internet), or receive such data from our clients and their employees, from authorities, (arbitral) courts and other third parties. In addition to the data you give us directly, the categories of personal data that we receive about you from third parties include, in particular, information from public registers, information we learn in connection with administrative and court proceedings, information relating to your professional functions and activities, information about you in correspondence and meetings with third parties, credit reports, information about you provided by persons in your circle (family, advisers, legal representatives, etc.) so that we can conclude or perform contracts with you or involving you (e.g. references, your delivery address, powers of attorney), information on compliance with statutory requirements such as anti-money-laundering rules, as well as information from banks, insurers and other contractual partners of ours concerning services used or rendered by you.

4. Purposes of processing and legal basis

4.1. Provision of services

We primarily process the personal data that we receive from our clients in the course of our engagement relationships, from business partners in the course of other contractual relationships, and from other persons involved.
The personal data of our clients consists in particular of the following information:
• Contact information (e.g. surname, first name, address, telephone number, email).
• Personal information (e.g. date of birth, nationality, marital status, occupation, title, job title, passport/ID number, OASI/AHV number, family circumstances).
• Risk assessment data (e.g. credit information, commercial register data, sanctions lists, specialized databases).
• Financial information (e.g. bank account details, investments or participations).
• Engagement data, depending on the engagement (e.g. tax information, articles of association, minutes, employee data such as salary and social insurance, accounting data).
• Sensitive personal data: this data may also include sensitive personal data, such as data on health, religious views or social assistance measures, in particular where we render services in the area of payroll processing or accounting.
We process this personal data for the purposes described on the following legal bases:
• Conclusion or performance of a contract with, or for the benefit of, the data subject, including pre-contractual steps and any enforcement (e.g. advice, fiduciary services).
• Compliance with a legal obligation.
• Safeguarding legitimate interests (e.g. for administrative purposes, to improve our quality, to ensure security, to manage risk, to enforce our rights, to defend ourselves against claims or to check for possible conflicts of interest).
• Consent (e.g. to send you marketing information).

4.2. Indirect processing in the course of service provision

When we render services for our clients, we may also process personal data that we have not collected directly from the data subjects, or personal data of third parties. These third parties are as a rule employees, contact persons, family members or persons who are otherwise related to the clients or the data subjects. We need this personal data in order to perform contracts with our clients. We receive this personal data from our clients or from third parties instructed by our clients. Third parties whose information we process for this purpose are informed by our clients that we process their data. For this purpose, our clients may refer to this privacy policy.
The personal data of persons related to our clients consists in particular of contact information, personal information, financial information and engagement data within the meaning of section 4.1; it may likewise include sensitive personal data.
We process this personal data for the purposes described on the following legal bases:
• Conclusion or performance of a contract with, or for the benefit of, the data subject.
• Compliance with a legal obligation.
• Safeguarding legitimate interests, in particular our interest in rendering the best possible service to our clients.

4.3. Use of our website

You do not have to disclose any personal data in order to use our website. The website contains no forms and no input fields. However, with each access the server records a range of technical information which is stored in the server log files. Recording this information is technically necessary in order to deliver the website and to ensure its stability and security.

This concerns in particular the following information:
• IP address of the requesting device.
• Date and time of access.
• Name and URL of the file retrieved.
• Volume of data transferred and whether the retrieval was successful.
• Browser and operating system used and, where applicable, the referring website.
This data is not combined with other data sources and is not evaluated for marketing purposes. The legal basis is the safeguarding of legitimate interests, namely the secure and stable operation of the website.

Our website is hosted by service providers located in Switzerland and Germany. The website’s fonts are delivered from our own server; no connection to a third-party provider is established in the process.

At several points the website offers you the option of sending us a pre-filled email or WhatsApp message with a single click, for instance to request access to the client portal, to register as an ambassador or to order the tax report. You compose and send these messages in your own mail or messenger program; we process the details you provide in them in accordance with section 4.8 or section 4.12, as applicable.

4.4. Appointment booking via our website

For arranging appointments we use the booking tool provided by HubSpot (HubSpot, Inc., 2 Canal Park, Cambridge, MA 02141, USA; for the EEA, HubSpot Ireland Limited). It is available at the address go.expertiva.ch.

The booking tool is not embedded in our website. A connection to HubSpot is established only once you click an appointment link and thereby move to the booking page. There, HubSpot processes on our behalf the details you provide for the booking (in particular name, email address, telephone number, the appointment selected and your message), as well as technical access data. Cookies may be set on the booking page; HubSpot provides information about this there.

The legal bases are pre-contractual steps and our legitimate interest in a straightforward way of arranging appointments. A data processing agreement is in place with HubSpot. For transfers to the USA we rely on the EU Standard Contractual Clauses. Further information can be found in HubSpot’s privacy policy.

4.5. Video on our website

On both home pages we embed a video using the service Wistia (Wistia, Inc., 17 Tudor Street, Cambridge, MA 02139, USA).

Contact with Wistia is established while the page is still loading: a preconnect hint in the page head instructs the browser to open the connection in advance. The player itself is then loaded automatically — on desktop devices immediately after the page has loaded, on mobile devices at your first scroll or touch, and after five seconds at the latest. Both happen before you start the video. In the process your browser establishes a direct connection to Wistia’s servers and transmits in particular your IP address, information about your browser and operating system, and the page accessed. Once the video starts, information about playback behavior is added. Wistia may set cookies or use comparable technologies within the player.

The legal basis is the safeguarding of our legitimate interests in presenting our services in a comprehensible way. Wistia is based in the USA; for the transfer we rely on the EU Standard Contractual Clauses. Details of the processing carried out by Wistia can be found in that provider’s privacy policy.

If you wish to avoid this connection, please use a script or content blocker. Simply disabling JavaScript is not sufficient, because the preconnect hint already takes effect as the page loads. The rest of the website remains usable.

4.6. Client portal

We operate a client portal for exchanging documents with our clients. It is not part of this website but is available at its own address; it is operated by Expertiva AG in its own cloud environment, and the data is held in Switzerland and Germany. There is no direct link from taxiva.ch into the portal; you can request access by email.

Within the portal we process the access credentials of the authorized person as well as the documents and messages exchanged in the course of the engagement. The legal basis is the performance of the contract with you. Access is limited to the persons responsible for your engagement and, to the extent necessary for operation and maintenance, to our IT service providers.

4.7. Newsletter

Expertiva AG sends a newsletter. It is not possible to subscribe via taxiva.ch; subscription is handled centrally by Expertiva AG. Where you have subscribed to the newsletter, we use your name and email address in order to send it to you. The legal basis is your consent. You may withdraw that consent at any time and unsubscribe from the newsletter; every issue contains a notice to that effect. We use Brevo as a processor for the dispatch (Brevo SAS, 106 boulevard Haussmann, 75008 Paris, France). The data is therefore processed within the EU.

4.8. Direct communication and visits

When you contact us (e.g. by telephone, email, WhatsApp or Threema) or we contact you, we process the personal data necessary for that purpose. We also process this personal data when you visit us. In that case you may be asked to leave your contact details before your visit or at reception. We retain these for a certain period in order to protect our infrastructure and our information.

For telephone conferences, online meetings and video conferences we use the service “Zoom”. For exchanging messages, “WhatsApp” and “Threema” are additionally available. These services are not embedded in our website; a connection is established only when you use the service yourself or click a link to it. Further information about the processing of personal data by these providers can be found in their privacy policies.

In this context we process in particular the following information:
• Contact information (e.g. surname, first name, address, telephone number, email).
• Communication metadata (e.g. IP address, duration of the communication, communication channel).
• Recordings of conversations, e.g. in the case of video conferences.
• Other information uploaded, provided or created during the use of a video conferencing service, as well as metadata used for maintaining the service.
• Personal information (e.g. occupation, function, title, employer).
• Time of and reason for the visit.
We process this personal data on the basis of the performance of a contractual obligation and the safeguarding of legitimate interests (e.g. security, traceability and the handling and administration of client relationships).

4.9. Attendance at events

If you attend an event organized by us, we collect personal data in order to organise and hold the event and, where applicable, to send you additional information afterwards. You may be photographed or filmed at such events and we may publish this material internally or externally.

This concerns in particular contact information, personal information (e.g. occupation, function, title, employer, dietary requirements), images or videos, and payment information. The legal bases are the performance of a contractual obligation, the safeguarding of legitimate interests and your consent (e.g. for marketing information or image material).

4.10. Job applications

You may submit your application for a position with us by post or to the email address stated on our website. Application documents and all personal data disclosed to us with them are treated in strict confidence, are not disclosed to any third party and are processed solely for the purpose of handling your application. Unless you consent otherwise, your application file will, after the conclusion of the application procedure, either be returned to you or deleted, unless it is subject to a statutory retention obligation. The legal bases are your consent, pre-contractual steps and our legitimate interests.

4.11. Suppliers, service providers, other contractual partners

Where we conclude a contract with you for you to render a service to us, we process personal data of you or your employees. We need this in order to communicate with you and to make use of your services. We may also process this personal data in order to check whether a conflict of interest could arise in connection with our activities, and to ensure that our cooperation does not expose us to unwanted risks, for example in relation to money laundering or sanctions. The legal bases are the conclusion or performance of a contract and the safeguarding of legitimate interests.

4.12. Referral program

Existing clients may register as an ambassador and recommend us to others. In this context we process the name, email address and telephone number of the registered person, the link between the person referred and the person referring, and the details required to award and send the reward. The link is created by the person referred naming the referring person in the initial consultation or, at the latest, by the time the engagement is completed. The legal bases are the performance of the agreement on participation in the program, your consent, and our legitimate interest in the correct attribution and settlement of rewards. The data is deleted once the program has been completed for you and the reward has been settled, subject to statutory retention obligations.

5. Cookies and local storage

We ourselves set no cookies on this website. We use no analytics, statistics, advertising or re-targeting services and do not create usage profiles.

So that the website remembers your choice of color scheme (light, dark or system setting), we store a single value under the key theme in your browser’s local storage. This value remains on your device, is not transmitted to us or to any third party and does not allow any conclusions to be drawn about you as a person. You can delete it at any time via your browser settings.

The video player on the two home pages (section 4.5) is, by contrast, not strictly necessary: it is loaded without your consent and may set cookies of its own or use comparable technologies. If you do not want this, block it with a script or content blocker. We do not use a consent banner.

If you move to the booking page (section 4.4), its provider may likewise set cookies of its own. We have no influence over this; the privacy policies of those providers apply.

6. Disclosure and transfer of data

We disclose your data to third parties only where this is necessary in order to render our services, where those third parties render a service for us, where we are required to do so by law or by an authority, or where we have an overriding interest in the disclosure. We will also disclose personal data to third parties where you have given your consent or have asked us to do so. We do not sell personal data and do not pass it on to third parties for advertising purposes.

The following categories of recipients may receive personal data from us:
• Tax authorities, social insurance compensation offices, courts and other authorities, to the extent necessary for the performance of your engagement or where we are required to do so by law.
• Service providers who process data on our behalf (e.g. IT service providers, hosting providers, the provider of the booking tool and of the newsletter dispatch).
• Advisers, lawyers, auditors and insurers, to the extent necessary.

Disclosure abroad. Our service providers are predominantly located in Switzerland or in the EU/EEA. These countries offer an adequate level of data protection. A disclosure to the USA takes place in connection with the booking tool (HubSpot, section 4.4) and the video player (Wistia, section 4.5) and, where you choose those channels, with Zoom and WhatsApp (section 4.8). Where a recipient country does not offer an adequate level of data protection, we base the transfer on the EU Standard Contractual Clauses, on other appropriate safeguards or on a statutory exception.

Encryption. Our website and our client portal are delivered exclusively over an encrypted connection (TLS), and the data in the client portal is stored in encrypted form. Email, by contrast, is not a secure means of transmission: unless expressly agreed otherwise with you, messages and attachments are transmitted unencrypted. For tax documents, bank and contract documents, accounting and payroll data we therefore recommend the client portal or Threema; for security reasons we pass our Threema ID directly to our clients only. On request we will agree another protected channel of transmission with you.

7. Retention of personal data

We process and store your personal data for as long as is necessary to fulfill our contractual and statutory obligations or otherwise to achieve the purposes pursued with the processing, that is, for example, for the duration of the entire business relationship and beyond that in accordance with statutory retention and documentation obligations. Business records are subject to the statutory retention period of ten years (Art. 958f of the Swiss Code of Obligations, CO). Personal data may also be retained for the period during which claims can be brought against our company, and to the extent that we are otherwise required to do so by law or that legitimate business interests require it. As soon as your personal data is no longer required for the purposes stated, it is in principle deleted or anonymised as far as possible. Shorter periods, as a rule twelve months or less, apply to operational data such as system logs and server log files.

8. Data security

We take appropriate technical and organisational security measures to protect your personal data against unauthorized access and misuse, such as issuing internal directives, providing training, IT and network security solutions, access controls and restrictions, the encryption of data storage media and transmissions, pseudonymization and checks. Regarding encryption in transmission, please note the information in section 6.

9. Obligation to provide personal data

Within the scope of our business relationship you must provide the personal data required to enter into and carry out a business relationship and to fulfill the associated contractual obligations; as a rule you are under no statutory obligation to provide us with data. Without this data we will not be in a position to conclude or perform a contract with you (or with the entity or person you represent). You can use the website itself without providing any personal data; the only technically necessary transmission is that of your IP address.

10. Your rights

In connection with our processing of personal data you have the following rights:
• Right to information (access) regarding the personal data stored about you by us, the purpose of the processing, its origin, and the recipients or categories of recipients to whom personal data is disclosed.
• Right to rectification if your data is incorrect or incomplete.
• Right to erasure of the personal data processed.
• Right to restriction of the processing of your personal data.
• Right to data portability, that is, to the release or transfer of your data in a common electronic format.
• Right to object to processing or to withdraw consent at any time and without giving reasons.
• Right to lodge a complaint with a competent supervisory authority, where provided for by law. In Switzerland you may contact the Federal Data Protection and Information Commissioner (FDPIC). Where a processing operation is subject to the GDPR, you may additionally lodge a complaint with the supervisory authority of your place of residence or work.

No automated individual decisions. We do not take decisions based solely on automated processing that produce legal effects concerning you or significantly affect you. We do not carry out profiling.

To exercise these rights, simply contact us at the address given in section 1; no particular form is required. Exercising them is in principle free of charge for you. Please note, however, that we reserve the right to invoke the restrictions provided for by law, for example where we are obliged to retain or process certain data, where we have an overriding interest in doing so, or where we need the data to assert claims. Should costs exceptionally arise, we will inform you in advance.

11. Applicable data protection law

Our processing of data is governed primarily by the Swiss Federal Act on Data Protection (FADP) and its implementing ordinance. Where the European General Data Protection Regulation (GDPR) applies to a processing operation — for example because you are located in the EU or the EEA at the time of the processing — you additionally have the rights provided for there; you can exercise them using the contact details in section 1. Where this privacy policy states a legal basis, this corresponds to the relevant basis under the FADP or under Art. 6 GDPR, as applicable.

12. Amendments to this privacy policy

We expressly reserve the right to amend this privacy policy at any time. The version published on this page at the relevant time applies.
Last amended: July 2026

13. Language

This privacy policy is an English translation provided for convenience. The legally binding version is the German original, available at Datenschutzerklärung. In the event of any discrepancy, the German version prevails.