Cookie Policy

PREAMBLE

This Cookie Policy aims to describe, in a transparent and legally enforceable manner, the technical, organisational and legal conditions under which Nereva SA uses cookies and local storage technologies on its interfaces, and implements audience measurement subject to the prior consent of the user.

Statutory corporate purpose of Nereva SA. In accordance with Article 3 of its articles of association entered in the commercial register of the canton of Vaud, the purpose of Nereva SA is the design, development, publishing, marketing, integration and operation, in Switzerland and abroad, of software and digital solutions for orchestrating and synchronising logistics flows operated by vehicles, in particular flows of materials, waste, machinery, equipment and skips linked to construction, civil engineering, recycling, construction-site transport and related sectors.

The company may in particular provide, in the form of software on demand (Software as a Service) or licences, platforms for planning, executing, documenting, tracing and archiving logistics operations, as well as associated configuration, integration, support, training and consulting services.

The company may acquire, hold, exploit, license and defend any intellectual property right, in particular patents, trademarks, designs, models, copyrights and know-how, directly or indirectly related to its main purpose.

The company may carry out, both in Switzerland and abroad, on its own behalf or on behalf of third parties, all administrative, technical, commercial, financial, movable and immovable transactions directly or indirectly related to its main purpose. It may establish branches and subsidiaries in Switzerland and abroad, acquire holdings in companies pursuing a similar or complementary purpose, and grant loans or guarantees to its subsidiaries and group companies.

The company does not carry out any transport activity and does not act as a commercial intermediary between principals and transport companies. It does not capture the commercial contractual relationship between its users.

Demonstration of compliance. This Policy aims to demonstrate the compliance of the configuration implemented by Nereva SA with Regulation (EU) 2016/679 of 27 April 2016 (“GDPR”), Directive 2002/58/EC (“ePrivacy”), the Swiss Federal Act on Data Protection of 25 September 2020 (“FADP”) which entered into force on 1 September 2023, and the recommendations of the competent supervisory authorities, in particular the French Commission nationale de l'informatique et des libertés (CNIL) and the Swiss Federal Data Protection and Information Commissioner (FDPIC).

Article 1 — Purpose and legal status of Nereva

This Cookie Policy aims to describe the technical, organisational and legal conditions under which Nereva SA uses cookies and local storage technologies, and implements audience measurement subject to the prior consent of the user. The legal status of Nereva SA and the enforceable scope of its corporate purpose are set out in the preamble to this Policy.

Article 2 — Scope of the Services and nature of the obligations

The Services provided by Nereva consist exclusively of making available software functionalities allowing Clients and their Users to enter, structure, share and document information relating to their own logistics operations. Nereva does not perform, supervise or control any physical operation of transport, loading, unloading, sorting, waste treatment or handling. Responsibility for the compliance, execution, quality, safety and legality of physical operations lies exclusively with the Clients and their partners. Nereva's obligations under the Services are best-efforts obligations.

Article 3 — Scope and field of application

This Policy applies to the cookies and local storage technologies read or written by Nereva SA, as well as to the audience measurement processing carried out via the Matomo tool, in the context of the use of (i) the Nereva website; (ii) the client areas (back office); (iii) the web and application interfaces linked to the Services, insofar as these interfaces implement the same mechanisms.

This Policy is complementary to and consistent with the Terms and Conditions of Use of Nereva SA and with the Data Privacy Policy of Nereva SA. In the event of a contradiction, the Terms and Conditions of Use prevail.

Article 4 — Nature of the tool used

Nereva SA uses the Matomo audience measurement tool in a configuration that is (i) self-hosted; (ii) entirely administered by Nereva SA; (iii) without recourse to a Matomo Cloud solution; (iv) without access by the publisher Matomo GmbH to the data collected.

Matomo is used exclusively for usage statistics, technical analysis and continuous improvement of the Services. It is loaded and performs measurement only after the “Statistics” category has been accepted in the consent banner, under the conditions of Article 7. No other third-party audience measurement technology is deployed on the interfaces of Nereva SA as at the date of the last update of this Policy. Advertising performance measurement (currently by means of Google Ads), which is distinct from audience measurement and subject to its own consent, is described in Article 6 bis.

Article 5 — Data hosting and assessment of extraterritorial access

As at the date of the last update of this Policy, the data collected via Matomo is (i) hosted exclusively in Switzerland; (ii) on cloud computing infrastructure operated by Amazon Web Services (AWS), “Switzerland (Zurich)” region (eu-central-2); (iii) within data centres physically located on Swiss territory.

No data collected via Matomo is transferred to a third country for processing purposes.

5.1 — Assessment of extraterritorial access risks

Nereva SA has assessed the risks of extraterritorial access linked to the nationality of the hosting provider, in particular with regard to the Clarifying Lawful Overseas Use of Data Act (Cloud Act, United States), in accordance with the recommendations of the FDPIC and the European Data Protection Board (EDPB) following the Schrems II judgment of the Court of Justice of the European Union of 16 July 2020.

Taking into account (i) the exclusive physical location of the data in Switzerland; (ii) the irreversible anonymisation of IP addresses prior to storage (see Article 7.3); (iii) the non-identifying nature of the data collected (see Article 8); (iv) the absence of any commercial or behavioural purpose; the residual risk of extraterritorial access is deemed acceptable.

This assessment is documented in the processing register of Nereva SA and is reviewed annually, or immediately in the event of a significant regulatory or case-law development.

Article 6 — Absence of advertising and third-party cookies

Subject only to the advertising performance measurement described in Article 6 bis, which is activated only with the user's prior consent to the “Marketing and advertising measurement” category, the configuration implemented by Nereva SA strictly excludes (i) any advertising or targeting cookie; (ii) any third-party cookie; (iii) any cross-domain tracking mechanism; (iv) any profiling, commercial segmentation or behavioural marketing purpose.

The data collected is neither sold, nor shared, nor cross-referenced with third-party sources.

The demonstration videos on the website are delivered by the Amazon CloudFront content delivery network. When a page containing a video is viewed, the browser loads the video from the point of presence closest to the user, which may be located outside Switzerland; no cookie is set on this occasion.

Article 6 bis — Advertising performance measurement

6 bis.1 — Purpose

Nereva SA runs advertising campaigns on third-party platforms (as at the date of the last update of this Policy, the Google search engine). In order to know whether a visit originating from one of these campaigns results in one of the following two actions, (i) a click on a free-trial registration button, which leads to the backoffice.nereva.com platform, or (ii) the sending of the contact form, materialised by the display of the confirmation page, Nereva SA uses, with the user's prior consent, advertising performance measurement tools provided by the platforms concerned. The sole purpose of this measurement is to evaluate and adjust Nereva SA's advertising campaigns. It is used neither for personalised advertising, nor for remarketing, nor to build audience lists, nor to profile users.

6 bis.2 — Strict prior consent

No advertising performance measurement tool is loaded or executed until the “Marketing and advertising measurement” category has been accepted in the consent banner. Before that acceptance, no request is sent to the provider, no cookie is set and no signal, even without a cookie, is transmitted. Refusal, the absence of a choice and the browser's “Do Not Track” signal have the same effect. Withdrawal of consent, under the conditions of Article 10, immediately stops the measurement and deletes the cookies and the local storage entry set for this purpose.

6 bis.3 — Common configuration principles

Whatever the provider, advertising performance measurement tools are configured by Nereva SA according to the following principles: (i) measurement limited to the two actions described in Article 6 bis.1; (ii) no ad personalisation, no remarketing and no audience lists built from browsing on the website; (iii) no transmission by the website of data entered by the user in a form; (iv) pseudonymous browsing data, linked to an advertising click identifier and not to the user's identity; (v) nothing is loaded before consent and all measurement stops when consent is withdrawn.

6 bis.4 — Tools and providers actually in use

As at the date of the last update of this Policy, a single advertising performance measurement tool is active on the website www.nereva.com: the Google Ads conversion measurement tag, described below. No other advertising measurement tool or provider is active as at that date.

Google Ads (Google tag, account identifier AW-16802779503). Provider and recipient: Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), which acts as an independent controller for conversion measurement in accordance with the data protection terms applicable to the Google Ads service. Google Ireland Limited may rely on Google LLC (United States) and other Google group entities to provide the service.

Configuration (Google consent mode, version 2). After acceptance, the tag is loaded with the following consent signals: advertising storage (ad_storage) and advertising user data (ad_user_data) granted, for the sole purpose of conversion measurement; ad personalisation (ad_personalization) and analytics storage (analytics_storage) permanently denied, so that no remarketing list is built and no personalised ad is served on the basis of browsing on the website. Ads data redaction (ads_data_redaction) and the deactivation of personalisation signals (allow_ad_personalization_signals) are enabled.

Data processed. When the measurement is active, Google processes the advertising click identifier (GCLID) present in the address of the landing page, the first-party cookies described in Article 7.7, the address of the page viewed, the date and time, the type of action measured (trial registration click or form sent), as well as the browser's technical information and the IP address, under the conditions of Google's privacy policy. Nereva SA receives from Google only aggregated statistics (number of conversions per campaign, keyword and advertisement); Google does not transmit to it any data allowing a user to be directly identified.

Transfer outside Switzerland and the European Economic Area. The data processed by Google for this purpose may be transferred to the United States. This transfer relies, as at the date of the last update of this Policy, on Google LLC's participation in the EU-U.S. Data Privacy Framework and its Swiss extension (Swiss-U.S. Data Privacy Framework), recognised by the Swiss Federal Council with effect from 15 September 2024, and, in the alternative, on the standard contractual clauses incorporated in the data protection terms of the Google Ads service. Nereva SA records this transfer in its record of processing activities before the measurement is put into service; the measurement relates only to pseudonymous browsing data and does not concern any data entered in the Nereva platform.

Cookies and retention periods. The first-party cookies set for this purpose, as well as the “_gcl_ls” local storage entry in which the tag keeps the same click identifiers, are described in Article 7.7; according to Google's documentation as at the date of the last update of this Policy, these cookies expire at the latest ninety (90) days after they are set. Cookies that Google may read or write on its own domains are governed by its privacy policy. The conversion data transmitted to Google is retained by Google in accordance with its own privacy policy; Nereva SA retains only aggregated statistics, without any user identifier.

6 bis.5 — Addition of a tool or provider

Acceptance of the “Marketing and advertising measurement” category applies only to the tools and providers listed in Article 6 bis.4 as at the date of the last update of this Policy. Before any new advertising measurement tool or provider is put into service, Nereva SA updates this Policy (identity of the provider, purposes, data processed, retention periods, any transfers) and asks the user again for consent for this category, the choices expressed for the other categories being retained. No personalised advertising or remarketing tool may be added under this category without specific information and separate consent.

Article 7 — Prior consent and technical configuration

Audience measurement is subject to the prior, free, specific and informed consent of the user. The Matomo configuration implemented by Nereva SA also complies with the technical criteria recommended by the CNIL and the FDPIC in order to limit the footprint of audience measurement on the user's device to the strict minimum.

7.1 — Consent banner

On the first visit, a banner offers the user three choices: “Accept all”, “Decline” and “Customise”. The “Customise” choice allows the “Statistics” (Matomo audience measurement) and “Marketing and advertising measurement” (advertising performance measurement, Article 6 bis) categories to be enabled or not, separately. The “Necessary” category covers only the elements essential to the operation of the website, described in Article 7.7, and cannot be disabled. As long as no choice has been recorded, no audience measurement or advertising performance measurement script is loaded and no data is collected for those purposes. When a new category is added to the banner, the choice is requested again for that category, the choice previously made for the other categories being kept.

7.2 — Effect of refusal

Refusal, like the absence of a choice, means that no audience measurement is carried out: the Matomo script is not loaded, no request is sent to the audience measurement server and no measurement cookie or identifier is set. Refusal is remembered under the same conditions as acceptance (Article 11).

7.3 — Effect of acceptance and measurement configuration

If the “Statistics” category is accepted, the Matomo script is loaded and audience measurement is activated in the following configuration: (i) no Matomo cookie is set, the measurement operating without any persistent identifier on the device; (ii) the IP address is anonymised before any storage, irreversibly and as soon as it is collected, preventing any direct or indirect identification of data subjects; (iii) the “Do Not Track” signal is respected under the conditions of Article 7.6.

7.4 — Absence of cross-site matching

The Matomo configuration expressly excludes any multi-site tracking functionality, any activation of cross-domain tracking, and any use of a persistent user identifier (User-ID).

Each visit is processed in isolation and cannot be cross-referenced.

7.5 — Absence of profiling and automated decisions

No Matomo processing has the purpose or effect of profiling users, producing automated decisions within the meaning of Article 22 of the GDPR, or segmenting behaviour for commercial or advertising purposes.

Analyses are carried out exclusively on the basis of aggregated and anonymised data.

7.6 — Respect for the “Do Not Track” signal

The Matomo configuration respects the “Do Not Track” signal sent by users' browsers, including when the “Statistics” category has been accepted. When such a signal is detected, no audience measurement data is collected for the session concerned.

7.7 — Cookies and local storage used

As at the date of the last update of this Policy, the following elements are read or written on the user's device by the website www.nereva.com. No third-party cookie is set by the website itself; the cookies relating to advertising performance measurement are set only after acceptance of the “Marketing and advertising measurement” category (Article 6 bis). The website's question-and-answer assistant runs locally in the browser and sets no cookie or identifier.

Article 8 — Data collected

When the “Statistics” category has been accepted, the data collected via Matomo is strictly limited to the following elements: (i) anonymised IP address; (ii) pages viewed and actions performed on the Services; (iii) date and time of connections; (iv) general technical information (browser, operating system, screen resolution); (v) approximate geographical area (country, region, city) inferred from the IP address before anonymisation.

No sensitive data within the meaning of the GDPR or the FADP, no biometric, financial or directly identifying data is collected by Matomo.

When the “Marketing and advertising measurement” category has been accepted, the data processed for advertising performance measurement is that described in Article 6 bis.4; it is processed by the provider listed there (currently Google), not by the Matomo tool, and is not cross-referenced with the audience measurement data.

Article 9 — Legal basis of the processing

The processing of audience measurement data via Matomo is based on the user's consent, in accordance with Article 6(1)(a) of the GDPR, Article 5(3) of Directive 2002/58/EC (“ePrivacy”) and the principles applicable under Swiss law (Articles 6 and 31 of the FADP). Consent is collected through the banner described in Article 7; it may be withdrawn at any time under the conditions of Article 10, without such withdrawal affecting the lawfulness of the processing carried out before the withdrawal.

The elements strictly necessary to the operation of the website described in Article 7.7 are used without consent, in accordance with Article 5(3) of Directive 2002/58/EC, on the basis of the legitimate interest of Nereva SA in providing a functional website that complies with the user's choices (Article 6(1)(f) of the GDPR). They do not allow any identification of the user and are not transmitted to Nereva SA.

Article 10 — Changing and withdrawing consent

The user may at any time change or withdraw their choice, as easily as they expressed it, (i) from this Policy, by means of the button below; (ii) from the “Manage cookies” link in the footer of every page of the website.

Manage my cookie choices

Withdrawal of consent to the “Statistics” category immediately stops audience measurement for the browser concerned. The data already collected, anonymised and not attributable to the user, is retained under the conditions of Article 11. Without JavaScript, no audience measurement is carried out.

Withdrawal of consent to the “Marketing and advertising measurement” category immediately stops advertising performance measurement for the browser concerned and deletes the corresponding cookies described in Article 7.7.

Article 11 — Data retention period

The choice made in the consent banner (acceptance or refusal) is kept for twelve (12) months in the browser's local storage, then requested again. It is recorded only on the user's device.

The audience measurement data collected via Matomo is kept for a maximum period of twelve (12) months from its collection, then automatically deleted or irreversibly anonymised.

First-party advertising performance measurement cookies and the corresponding local storage entry are kept for a maximum of ninety (90) days for the active tool (Article 6 bis.4) and deleted if consent is withdrawn. The conversion data transmitted to the provider (currently Google) is retained by the provider in accordance with its privacy policy; Nereva SA retains only aggregated statistics, without any user identifier.

Article 12 — Security and confidentiality

Nereva SA implements appropriate technical and organisational measures having regard to the state of the art, the cost of implementation and the nature, scope, context and purposes of the processing, in accordance with Article 32 of the GDPR and the equivalent principles of the FADP.

These measures include in particular the encryption of data in transit and at rest, the limitation and control of access, the logging of sensitive actions and the periodic performance of security tests. No security measure can however be considered absolute; Nereva SA's commitments regarding security constitute best-efforts obligations.

Article 13 — Rights of data subjects

Data subjects have, under the conditions provided for by the GDPR and the FADP, the right of access to data concerning them, the right to rectification, the right to erasure, the right to restriction of processing, the right to object to processing, and the right to portability where applicable.

Any request may be sent to privacy@nereva.com. Nereva SA responds to any request within one (1) month of its receipt, which may be extended by two (2) additional months in cases of particular complexity or a high number of requests, in accordance with Article 12 of the GDPR.

The full terms for exercising rights, as well as the supporting documents required, are detailed in the Data Privacy Policy of Nereva SA.

Article 14 — Data protection officer and point of contact

Nereva SA has designated a point of contact for any question relating to the protection of personal data, reachable at the address privacy@nereva.com.

In accordance with the FADP, Nereva SA assesses the appropriateness of appointing a data protection adviser within the meaning of Article 10 of that Act. Where applicable, the appointment and contact details of the adviser will be communicated by way of an update to this Policy.

Article 15 — Relationship with confidentiality and trade secrets

The technical configurations, proprietary methods, internal indicators and architectures associated with the audience measurement implemented by Nereva SA are protected as know-how and trade secrets, within the meaning of the Federal Act against Unfair Competition (UCA) and applicable international conventions. Any unauthorised exploitation, reproduction or disclosure engages the liability of its author.

Article 16 — Supervisory authorities

The legal bases invoked in this Policy under the GDPR and the FADP are equivalent in their scope and application for the purposes of this document. Users have, regardless of the applicable regime, the same substantive rights of access, rectification, objection and erasure, exercisable according to the terms specified in Articles 13 and 14.

In the event of a question or complaint, users may refer, for Switzerland, to the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, CH-3003 Bern, www.edoeb.admin.ch ; for France, to the Commission nationale de l'informatique et des libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr ; for the other Member States of the European Union, to the competent national supervisory authority of the data subject's habitual residence, place of work or place of the alleged infringement, in accordance with Article 77 of the GDPR.

Article 17 — Amendment of the Policy

Nereva SA reserves the right to amend this Policy at any time to take account of technical, regulatory or case-law developments. Any substantial amendment will be brought to the attention of users by appropriate means.

Article 18 — Applicable law and jurisdiction

This document, as well as the contractual relationship it governs, are governed exclusively by Swiss law, to the exclusion of any conflict-of-laws rule and to the exclusion of the United Nations Convention on Contracts for the International Sale of Goods (CISG, Vienna, 1980).

Any dispute relating to the formation, validity, interpretation, performance or termination of this document falls within the exclusive jurisdiction of the ordinary courts of the canton of Vaud, place of the registered office of Nereva SA, subject to any mandatory right of appeal to the Swiss Federal Supreme Court.

Article 19 — Reference language

The French version of this Policy alone is legally authoritative. Any translation is provided for information purposes only and cannot bind Nereva SA.

Article 20 — Contact

Nereva SA, Rue de Rive 22D, CH-1260 Nyon, Switzerland.

Data protection: privacy@nereva.com.

Legal questions: legal@nereva.com.