Privacy Policy

1. Controller

The controller responsible for processing your personal data within the meaning of the Swiss Federal Act on Data Protection (FADP) is Your Ultimate Workspace by Marco Jucker ("we", "us" or "Zytbox"), Eigerstrasse 2, 3007 Bern, Switzerland. For any data protection questions, you can reach us at hello@yuw.ch.

2. Personal data we process

We collect and process the following categories of personal data:

  • Account data: name, email address and password (stored only as a cryptographic hash)
  • Time tracking data: time entries, projects, tasks and notes you create in Zytbox
  • Contract and payment data: your subscription plan, billing details and payment status (card details are processed exclusively by our payment provider)
  • Usage data: features used, settings and timestamps
  • Technical data: IP address, browser and device type, and server log data

3. Mobile apps

The Zytbox apps for iPhone and Android process the same data as the web version. In addition, the following applies:

  • Camera: the camera is used only to scan the QR code of a time clock terminal or a pairing code. Images are processed on your device and are neither stored nor sent to us. Access requires your permission, which you can withdraw at any time in the system settings.
  • NFC: when you hold your phone to a Zytbox NFC tag, the operating system opens the app with the link stored on the tag. The app sends only the information contained in that link to record your clock in or clock out.
  • Sign in with Apple or Google: if you choose this option, we receive your name, your email address and an account identifier from Apple or Google. Apple and Google process your sign in under their own privacy policies.
  • Passkeys: if you use a passkey, only a public key is stored on our servers. The private key stays on your device or in your password manager.
  • Data on the device: your sign in token is kept in the encrypted storage of the operating system. So that the app starts faster, recently loaded data is cached on the device. Both are deleted when you sign out.
  • No tracking: the apps contain no advertising and no analytics or tracking tools, and we do not share data from the apps with advertisers or data brokers.

4. Purposes and legal bases

We process your data to perform our contract with you (providing and operating Zytbox), to process payments and manage subscriptions, to send transactional messages such as invoices, password resets and important service notices, to operate the service securely, resolve issues and improve it, and to comply with legal obligations. Where the EU General Data Protection Regulation (GDPR) applies to users in the EU or EEA, we base our processing on the performance of the contract (Art. 6(1)(b) GDPR), our legitimate interest in secure and improved operation (Art. 6(1)(f) GDPR), separately obtained consent (Art. 6(1)(a) GDPR), and legal obligations (Art. 6(1)(c) GDPR).

5. Processors and recipients

To operate Zytbox we use carefully selected service providers that process personal data only on our instructions and under data processing agreements. We do not share your data with third parties for advertising purposes. Specifically, these are:

  • Hosting and infrastructure: servers and data storage with a provider located within the EU or EEA
  • Payment processing: Stripe (Stripe Payments Europe, Ltd. and Stripe, Inc.) for the paid plans
  • Email delivery: an external provider for sending transactional emails
  • Web analytics: the cookieless audience and page speed measurement of our hosting provider, on our behalf and with aggregated data only. Any transfer to the USA is based on the Swiss-U.S. Data Privacy Framework or on standard contractual clauses
  • Web analytics: Google Analytics (Google Ireland Ltd.), only where you have given your consent

6. Disclosure abroad

Your personal data is generally processed on servers in Switzerland or the EEA. In connection with payment processing via Stripe, with email delivery, and with the web analytics services named above, data may be transferred to countries outside Switzerland and the EEA, in particular the United States. Where data is disclosed to a country without an adequate level of data protection, we ensure appropriate safeguards through contractual guarantees (standard contractual clauses) or other bases permitted under Art. 16 f. FADP and Art. 44 et seq. GDPR.

7. Retention period

We retain your personal data for as long as your account is active and this is necessary for the purposes described. After you delete your account, your data is deleted or anonymised within 90 days. Statutory retention obligations remain reserved, in particular the ten-year retention of invoicing and business records under Art. 958f of the Swiss Code of Obligations.

8. Data security

We take appropriate technical and organisational measures to protect your data against unauthorised access, loss or misuse. These include encrypted transmission (TLS), hashed storage of passwords and restrictive access controls.

9. Cookies

To operate the website we use strictly necessary cookies, for example for session management and authentication. These are required for the service to function. To analyse and improve our offering we use the cookieless audience and page speed measurement of our hosting provider, which collects only aggregated usage statistics on our behalf, without cookies and without cross-site tracking. In addition we use Google Analytics (Google Ireland Ltd.), but only with your prior consent. This sets cookies and data may be transferred to the USA. The legal basis is your consent, which you can withdraw at any time with future effect via the cookie settings in the footer. We do not use advertising cookies.

10. Your rights

Under applicable data protection law, you have in particular the following rights. To exercise them, a message to hello@yuw.ch is sufficient:

  • access to the data processed about you (Art. 25 FADP)
  • rectification of inaccurate data
  • erasure or restriction of processing
  • release or transfer of your data in a common format (data portability)
  • withdrawal of a given consent and objection to certain processing

11. Automated decisions

We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you.

12. Changes to this privacy policy

We may update this privacy policy, for example when the service or the legal situation changes. The version published on this page is the one that applies. We will inform you of material changes by email or through a notice in the app.

13. Contact and supervisory authority

For questions, requests or to exercise your rights, you can reach us at hello@yuw.ch. You also have the right to lodge a complaint with a supervisory authority, in Switzerland with the Federal Data Protection and Information Commissioner (FDPIC, www.edoeb.admin.ch).