PREAMBLE
This Cookie and Similar Technologies Policy (hereinafter the “Cookie Policy”) aims to describe, in a transparent and legally enforceable manner, the technical, organisational and legal conditions under which Nereva SA implements an audience measurement tool exempt from prior consent, as well as any similar technologies used on its interfaces.
Statutory corporate purpose of Nereva SA. In accordance with Article 3 of its articles of association entered in the commercial register of the canton of Vaud, the purpose of Nereva SA is the design, development, publishing, marketing, integration and operation, in Switzerland and abroad, of software and digital solutions for orchestrating and synchronising logistics flows operated by vehicles, in particular flows of materials, waste, machinery, equipment and skips linked to construction, civil engineering, recycling, construction-site transport and related sectors.
The company may in particular provide, in the form of software on demand (Software as a Service) or licences, platforms for planning, executing, documenting, tracing and archiving logistics operations, as well as associated configuration, integration, support, training and consulting services.
The company may acquire, hold, exploit, license and defend any intellectual property right, in particular patents, trademarks, designs, models, copyrights and know-how, directly or indirectly related to its main purpose.
The company may carry out, both in Switzerland and abroad, on its own behalf or on behalf of third parties, all administrative, technical, commercial, financial, movable and immovable transactions directly or indirectly related to its main purpose. It may establish branches and subsidiaries in Switzerland and abroad, acquire holdings in companies pursuing a similar or complementary purpose, and grant loans or guarantees to its subsidiaries and group companies.
The company does not carry out any transport activity and does not act as a commercial intermediary between principals and transport companies. It does not capture the commercial contractual relationship between its users.
Demonstration of compliance. This Policy aims to demonstrate the compliance of the configuration implemented by Nereva SA with Regulation (EU) 2016/679 of 27 April 2016 (“GDPR”), the Swiss Federal Act on Data Protection of 25 September 2020 (“FADP”) which entered into force on 1 September 2023, and the recommendations of the competent supervisory authorities, in particular the French Commission nationale de l'informatique et des libertés (CNIL) and the Swiss Federal Data Protection and Information Commissioner (FDPIC).
TABLE OF CONTENTS
Article 1 — Purpose and legal status of Nereva
Article 2 — Scope of the Services and nature of the obligations
Article 3 — Scope and field of application
Article 4 — Nature of the tool used
Article 5 — Data hosting and assessment of extraterritorial access
5.1 Assessment of extraterritorial access risks
Article 6 — Absence of advertising and third-party cookies
Article 7 — Technical configuration guaranteeing the consent exemption
7.1 Deactivation or limitation of cookies
7.2 IP address anonymisation
7.3 Absence of cross-site matching
7.4 Absence of profiling and automated decisions
7.5 Respect of the “Do Not Track” signal
Article 8 — Data collected
Article 9 — Legal basis of the processing and proportionality test
Article 10 — Objection mechanism (opt-out)
Article 11 — Data retention period
Article 12 — Security and confidentiality
Article 13 — Rights of data subjects
Article 14 — Data protection officer and point of contact
Article 15 — Relationship with confidentiality and trade secrets
Article 16 — Supervisory authorities
Article 17 — Amendment of the Policy
Article 18 — Applicable law and jurisdiction
Article 19 — Reference language
Article 20 — Contact
Article 1 — Purpose and legal status of Nereva
This Cookie Policy aims to describe the technical, organisational and legal conditions under which Nereva SA implements an audience measurement tool exempt from prior consent. The legal status of Nereva SA and the enforceable scope of its corporate purpose are set out in the preamble to this Policy.
Article 2 — Scope of the Services and nature of the obligations
The Services provided by Nereva consist exclusively of making available software functionalities allowing Clients and their Users to enter, structure, share and document information relating to their own logistics operations. Nereva does not perform, supervise or control any physical operation of transport, loading, unloading, sorting, waste treatment or handling. Responsibility for the compliance, execution, quality, safety and legality of physical operations lies exclusively with the Clients and their partners. Nereva's obligations under the Services are best-efforts obligations.
Article 3 — Scope and field of application
This Policy applies to all data processing carried out via the Matomo tool in the context of the use of (i) the Nereva website; (ii) the client areas (back office); (iii) the web and application interfaces linked to the Services.
This Policy is complementary to and consistent with the Terms and Conditions of Use of Nereva SA and with the Privacy Policy of Nereva SA. In the event of a contradiction, the Terms and Conditions of Use prevail.
Article 4 — Nature of the tool used
Nereva SA uses the Matomo audience measurement tool in a configuration that is (i) self-hosted; (ii) entirely administered by Nereva SA; (iii) without recourse to a Matomo Cloud solution; (iv) without access by the publisher Matomo GmbH to the data collected.
Matomo is used exclusively for usage statistics, technical analysis and continuous improvement of the Services. No other third-party audience measurement technology is deployed on the interfaces of Nereva SA as at the date of the last update of this Policy.
Article 5 — Data hosting and assessment of extraterritorial access
As at the date of the last update of this Policy, the data collected via Matomo is (i) hosted exclusively in Switzerland; (ii) on cloud computing infrastructure operated by Amazon Web Services (AWS), “Switzerland (Zurich)” region (eu-central-2); (iii) within data centres physically located on Swiss territory.
No data collected via Matomo is transferred to a third country for processing purposes.
5.1 Assessment of extraterritorial access risks
Nereva SA has assessed the risks of extraterritorial access linked to the nationality of the hosting provider, in particular with regard to the Clarifying Lawful Overseas Use of Data Act (Cloud Act, United States), in accordance with the recommendations of the FDPIC and the European Data Protection Board (EDPB) following the Schrems II judgment of the Court of Justice of the European Union of 16 July 2020.
Taking into account (i) the exclusive physical location of the data in Switzerland; (ii) the irreversible anonymisation of IP addresses prior to storage (see Article 7.2); (iii) the non-identifying nature of the data collected (see Article 8); (iv) the absence of any commercial or behavioural purpose; the residual risk of extraterritorial access is deemed acceptable.
This assessment is documented in the processing register of Nereva SA and is reviewed annually, or immediately in the event of a significant regulatory or case-law development.
Article 6 — Absence of advertising and third-party cookies
The configuration implemented by Nereva SA strictly excludes (i) any advertising or targeting cookie; (ii) any third-party cookie; (iii) any cross-domain tracking mechanism; (iv) any profiling, commercial segmentation or behavioural marketing purpose.
The data collected is neither sold, nor shared, nor cross-referenced with third-party sources.
Article 7 — Technical configuration guaranteeing the consent exemption
The Matomo configuration implemented by Nereva SA cumulatively meets all the criteria required by the CNIL to benefit from the exemption from prior consent, as well as the corresponding principles applicable under Swiss law.
7.1 Deactivation or limitation of cookies
Matomo is configured so as not to use cookies that are not strictly necessary for the operation of audience measurement, or to completely disable the use of cookies where technically possible. This configuration aims to limit the footprint of trackers on the user's device to the strict minimum.
7.2 IP address anonymisation
Users' IP addresses are systematically anonymised before any storage, preventing any direct or indirect identification of the data subjects. This anonymisation is irreversible and takes place upon collection.
7.3 Absence of cross-site matching
The Matomo configuration expressly excludes any multi-site tracking functionality, any activation of cross-domain tracking, and any use of a persistent user identifier (User-ID).
Each visit is processed in isolation and cannot be cross-referenced.
7.4 Absence of profiling and automated decisions
No Matomo processing has as its object or effect the profiling of users, the production of automated decisions within the meaning of Article 22 of the GDPR, or the segmentation of behaviour for commercial or advertising purposes.
Analyses are carried out exclusively on the basis of aggregated and anonymised data.
7.5 Respect of the “Do Not Track” signal
The Matomo configuration respects the “Do Not Track” signal sent by users' browsers. When such a signal is detected, no audience measurement data is collected for the session concerned.
Article 8 — Data collected
The data collected via Matomo is strictly limited to the following elements: (i) anonymised IP address; (ii) pages viewed and actions performed on the Services; (iii) date and time of connections; (iv) general technical information (browser, operating system, screen resolution); (v) approximate geographical area (country, region, city) inferred from the IP address before anonymisation.
No sensitive data within the meaning of the GDPR or the FADP, no biometric, financial or directly identifying data is collected by Matomo.
Article 9 — Legal basis of the processing and proportionality test
The processing of data via Matomo is based on the legitimate interest of Nereva SA, in accordance with Article 6(1)(f) of the GDPR and the equivalent principles provided for in Articles 31 et seq. of the FADP.
The legitimate interest pursued consists in analysing the use of the Services in order to improve their performance, security, reliability and ergonomics. This legitimate interest has been the subject of a proportionality test documented by Nereva SA, in accordance with the guidelines of the European Data Protection Board (EDPB) and the position of the FDPIC, taking into account (i) the necessity of the processing in relation to the purpose pursued; (ii) the balancing of the interest pursued by Nereva SA against the fundamental rights and freedoms of the data subjects; (iii) the mitigating measures implemented, in particular the irreversible anonymisation of IP addresses, the absence of profiling and the possibility of objection provided for in Article 10.
Given the configuration implemented, this processing does not require prior consent within the meaning of Directive 2002/58/EC (“ePrivacy”) and the CNIL recommendations applicable to audience measurement tools.
Article 10 — Objection mechanism (opt-out)
Nereva SA provides users with a simple, permanent and accessible mechanism to object to audience measurement, accessible from this Policy and from the cookie settings of the interfaces of Nereva SA.
Activating this mechanism immediately and permanently results in the exclusion of any collection of statistical data via Matomo for the device concerned, until the user themselves lifts this objection.
Article 11 — Data retention period
The data collected via Matomo is kept for a maximum period of twelve (12) months from its collection, then automatically deleted or irreversibly anonymised.
The technical logs attesting to the exercise of the right of objection (opt-out) are kept for a period strictly necessary to demonstrate compliance, not exceeding the duration of the objection exercised by the user.
Article 12 — Security and confidentiality
Nereva SA implements appropriate technical and organisational measures having regard to the state of the art, the cost of implementation and the nature, scope, context and purposes of the processing, in accordance with Article 32 of the GDPR and the equivalent principles of the FADP.
These measures include in particular the encryption of data in transit and at rest, the limitation and control of access, the logging of sensitive actions and the periodic performance of security tests. No security measure can however be considered absolute; Nereva SA's commitments regarding security constitute best-efforts obligations.
Article 13 — Rights of data subjects
Data subjects have, under the conditions provided for by the GDPR and the FADP, the right of access to data concerning them, the right to rectification, the right to erasure, the right to restriction of processing, the right to object to processing, and the right to portability where applicable.
Any request may be sent to privacy@nereva.com. Nereva SA responds to any request within one (1) month of its receipt, which may be extended by one (1) additional month in cases of particular complexity, in accordance with Article 12 of the GDPR.
The full terms for exercising rights, as well as the supporting documents required, are detailed in the Privacy Policy of Nereva SA.
Article 14 — Data protection officer and point of contact
Nereva SA has designated a point of contact for any question relating to the protection of personal data, reachable at the address privacy@nereva.com.
In accordance with the FADP, Nereva SA assesses the appropriateness of appointing a data protection adviser within the meaning of Article 10 of that Act. Where applicable, the appointment and contact details of the adviser will be communicated by way of an update to this Policy.
Article 15 — Relationship with confidentiality and trade secrets
The technical configurations, proprietary methods, internal indicators and architectures associated with the audience measurement implemented by Nereva SA are protected as know-how and trade secrets, within the meaning of the Federal Act against Unfair Competition (UCA) and applicable international conventions. Any unauthorised exploitation, reproduction or disclosure engages the liability of its author.
Article 16 — Supervisory authorities
The legal bases invoked in this Policy under the GDPR and the FADP are equivalent in their scope and application for the purposes of this document. Users have, regardless of the applicable regime, the same substantive rights of access, rectification, objection and erasure, exercisable according to the terms specified in Articles 13 and 14.
In the event of a question or complaint, users may refer, for Switzerland, to the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, CH-3003 Bern, www.edoeb.admin.ch ; for France, to the Commission nationale de l'informatique et des libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr ; for the other Member States of the European Union, to the competent national supervisory authority of the data subject's habitual residence, place of work or place of the alleged infringement, in accordance with Article 77 of the GDPR.
Article 17 — Amendment of the Policy
Nereva SA reserves the right to amend this Policy at any time to take account of technical, regulatory or case-law developments. Any substantial amendment will be brought to the attention of users by appropriate means.
Article 18 — Applicable law and jurisdiction
This document, as well as the contractual relationship it governs, are governed exclusively by Swiss law, to the exclusion of any conflict-of-laws rule and to the exclusion of the United Nations Convention on Contracts for the International Sale of Goods (CISG, Vienna, 1980).
Any dispute relating to the formation, validity, interpretation, performance or termination of this document falls within the exclusive jurisdiction of the ordinary courts of the canton of Vaud, place of the registered office of Nereva SA, subject to a mandatory appeal to the Swiss Federal Supreme Court.
Article 19 — Reference language
The French version of this Policy alone is legally authoritative. Any translation is provided for information purposes only and cannot bind Nereva SA.
Article 20 — Contact
Nereva SA, Rue de Rive 22D, CH-1260 Nyon, Switzerland.
Data protection : privacy@nereva.com.
Legal questions : legal@nereva.com.