PRIVACY POLICY – TARELIO 1. Tarelio's Roles in Data Processing This Privacy Policy describes how personal data is collected and processed in connection with the use of the Tarelio website and Service. Tarelio acts as data controller where it processes personal data for its own purposes, including in connection with: use of its website; management of its commercial relationships with Clients and prospects; management of accounts and users; billing and administration; security of its systems and prevention of misuse; analysis of usage and improvement of its services; compliance with its legal obligations. For such processing, the data controller is: Tarelio Sàrl Chemin de Clamogne 27 1170 Aubonne Switzerland Email: info@tarelio.com Where the Client uses the Service to process personal data for its own purposes, including data relating to its employees, staff members, customers, prospects, suppliers or other third parties, the Client acts as data controller and Tarelio acts as data processor. Processing carried out by Tarelio on behalf of the Client is governed by the applicable Data Processing Agreement (“DPA”). 2. Scope This Privacy Policy applies to: the Tarelio website; the Tarelio software (the "Service"); all interactions between users and Tarelio. 3. Data Collected Tarelio may collect and process the following categories of personal data: 3.1 Data provided directly contact data (name, surname, email address); information submitted via contact forms or demo requests; information provided during account creation. 3.2 Data generated through use of the Service data related to use of the Service (activities, logs, interactions); professional data (role, company); operational and administrative data entered into the Service; financial data (invoices, payments); data contained in documents uploaded (for example files stored via storage services). The collection of certain usage data is necessary for the proper functioning of the Service and for improving the user experience. 3.3 Technical and browsing data IP address; browser and device information; navigation data collected through analytics tools. 4. Purposes of Processing Personal data is processed for the following purposes: provision and operation of the Service; user account management; customer relationship management; communication with users (including support); improvement of the Service and user experience; analysis of Service usage; compliance with legal and regulatory obligations. 5. Legal Basis The processing of personal data is based in particular on: the performance of the contract between the Client and Tarelio; Tarelio's legitimate interest in improving and securing its Service; compliance with legal obligations; the user's consent where required (in particular for non-essential cookies). 6. Cookies and Analytics Tools The website uses cookies and similar technologies. Tarelio uses in particular: Google Analytics to analyze the use of the website and the Service; a cookie consent management tool based on Klaro (self-hosted). Non-essential cookies are used only after obtaining the user's consent. Users can manage their preferences via the cookie management tool. 7. Hosting and Service Providers Personal data is processed using technical service providers, including in particular: Amazon Web Services (AWS), including for file storage (S3); Microsoft Azure; Vercel; artificial intelligence service providers such as OpenAI; email delivery services (in particular Plunk); Neon - database. These providers may have access to personal data to the extent necessary to perform their services. 8. International Transfers Personal data may be transferred to and processed outside Switzerland or the European Economic Area. In such cases, Tarelio ensures that appropriate safeguards are implemented, including: adequacy decisions; standard contractual clauses; or other recognized mechanisms. 9. Data Sharing Tarelio does not sell personal data. Personal data may be shared only: with technical service providers necessary for the provision of the Service; where required by law; to protect the rights, security, or integrity of Tarelio or its users. 10. Data Retention Personal data is retained: for the duration of the contractual relationship; then for a maximum period of sixty (60) days after termination, unless otherwise required by law. Users may request early deletion of their data. Once deleted, data cannot be recovered. 11. Data Security Tarelio implements appropriate technical and organizational measures to protect personal data, including: encryption of data in transit (HTTPS / TLS); access control; logging of access; securing infrastructure. 12. Data Subject Rights In accordance with applicable law, data subjects have in particular the following rights: right of access to their data; right to rectification; right to erasure; right to restriction of processing; right to object; right to data portability, where applicable. Requests may be sent to: info@tarelio.com Proof of identity may be required. 13. Minors The Service is not intended for children under the age of 15. However, in a professional context, the Service may be used by individuals aged 15 or older, in particular apprentices. The Client is responsible for ensuring that the use of the Service complies with applicable laws regarding the protection of minors. 14. Modifications Tarelio reserves the right to modify this Privacy Policy at any time. Users will be informed in the event of material changes. 15. Governing Law This Privacy Policy is governed by Swiss law.