PREAMBLE
This Data Privacy Policy aims to describe, in a transparent and legally enforceable manner, the conditions under which Nereva SA collects, processes, retains and protects the personal data of the users of its Services, in accordance with Regulation (EU) 2016/679 of 27 April 2016 (“GDPR”), the Swiss Federal Act on Data Protection of 25 September 2020 (“FADP”) which entered into force on 1 September 2023, and the recommendations of the competent supervisory authorities, in particular the Swiss Federal Data Protection and Information Commissioner (FDPIC) and the French Commission nationale de l'informatique et des libertés (CNIL).
Statutory corporate purpose of Nereva SA. In accordance with Article 3 of its articles of association entered in the commercial register of the canton of Vaud, the purpose of Nereva SA is the design, development, publishing, marketing, integration and operation, in Switzerland and abroad, of software and digital solutions for orchestrating and synchronising logistics flows operated by vehicles, in particular flows of materials, waste, machinery, equipment and skips linked to construction, civil engineering, recycling, construction-site transport and related sectors.
The company may in particular provide, in the form of software on demand (Software as a Service) or licences, platforms for planning, executing, documenting, tracing and archiving logistics operations, as well as associated configuration, integration, support, training and consulting services.
The company may acquire, hold, exploit, license and defend any intellectual property right, in particular patents, trademarks, designs, models, copyrights and know-how, directly or indirectly related to its main purpose.
The company may carry out, both in Switzerland and abroad, on its own behalf or on behalf of third parties, all administrative, technical, commercial, financial, movable and immovable transactions directly or indirectly related to its main purpose. It may establish branches and subsidiaries in Switzerland and abroad, acquire holdings in companies pursuing a similar or complementary purpose, and grant loans or guarantees to its subsidiaries and group companies.
The company does not carry out any transport activity and does not act as a commercial intermediary between principals and transport companies. It does not capture the commercial contractual relationship between its users.
Contractual relationship. This Data Privacy Policy is closely articulated with, on the one hand, the Terms and Conditions of Use and in particular their Article 14 bis relating to the geolocation functionality from the Drivers mobile application, their Article 10 relating to the ownership and exploitation of data, their Article 20 relating to security and their Article 25 bis relating to the indemnification of Nereva SA by the Client; on the other hand, the Data Processing Agreement (“DPA”) which governs the operational terms of the processing of personal data by Nereva SA as processor; then, the AI and Data Policy which specifically describes the operation of the data lake in two zones (Zone A pseudonymised for the current Services, Zone B anonymised and irreversible for the training of artificial intelligence models), the anonymisation processes and the conditions for training the Models; and finally the Acceptable Use Policy which governs in particular the Client's obligations regarding the protection of Drivers and the prohibition of any misuse of data.
Article 1 — Purpose and legal status of Nereva
This Data Privacy Policy aims to describe the conditions of collection and processing by Nereva SA of the personal data of the users of its Services. The legal status of Nereva SA and the enforceable scope of its corporate purpose are set out in the preamble to this Policy.
Nereva SA acts as controller for the data it collects when users browse its website and the non-client areas of the platform. When Nereva SA processes personal data on behalf of a professional Client that has subscribed to its Services, Nereva SA acts as processor within the meaning of Article 28 of the GDPR and Article 9 of the FADP, the Client being in that case the controller. The specific terms of this processing are governed by the Data Processing Agreement (DPA) concluded with the Client.
Article 2 — Controller
The controller of the data collected via the website and the non-client areas of the Nereva platform is Nereva SA, Rue de Rive 22D, CH-1260 Nyon, Switzerland, entered in the commercial register of the canton of Vaud under business identification number CHE-294.630.698, reachable at privacy@nereva.com.
Article 3 — Definitions
The terms used in this Policy have the following meaning.
Personal data: any information relating to an identified or identifiable natural person.
Processing: any operation performed on personal data, in particular collection, recording, storage, alteration, consultation, transmission and erasure.
Data subject: any natural person whose personal data is processed by Nereva SA.
Controller: the entity that determines the purposes and means of the processing.
Processor: the entity that processes personal data on behalf of the controller.
Services: all the software functionalities provided by Nereva SA via its platform.
Website: the official website of Nereva SA, accessible at www.nereva.com and on any associated subdomain.
Article 4 — Data collected
Nereva SA collects the categories of personal data described below.
4.1 Data provided directly by data subjects
The data provided directly by data subjects includes identification data (surname, first name, position, employer's company name), professional contact details (e-mail address, telephone number, professional postal address), account data (credentials, password in encrypted form) and the content communicated via contact forms or demo requests.
When the website contact form is sent, Nereva SA also records the subject selected, the address of the referring page transmitted by the browser (truncated) and, where applicable, the campaign parameters (utm_source, utm_medium, utm_campaign) present in the page address, in order to identify the origin of the request. This information is processed solely to reply to the request and to manage any resulting business relationship; it is transmitted to Nereva SA via Amazon Web Services infrastructure located in Switzerland (“Switzerland (Zurich)” region, eu-central-2).
4.2 Data collected in the context of the use of the Services
The data collected in the context of the use of the Services includes activity data (login logs, actions performed on the platform, timestamps), technical data (anonymised IP address for audience measurement where it has been accepted, information on the browser, operating system and device), operational data entered by the Client or its Users in the context of the Services (which may contain personal data relating to third parties, in particular drivers and operational contacts), and geolocation data from the Drivers mobile application when it is used by a Driver in the context of a transport mission.
Geolocation data includes GPS positions collected continuously from the acceptance of a mission until its closure, as well as the associated timestamps. It is processed by Nereva SA as processor on behalf of the Client employing the Driver, under the conditions specified in the DPA. On-board heavy-vehicle navigation is provided via the HERE API.
4.3 Data from third parties
Nereva SA may collect data from public sources or commercial partners for professional (B2B) prospecting purposes, under the conditions and within the limits provided for by the applicable regulations.
Article 5 — Purposes of the processing
Nereva SA processes personal data for the following purposes: (i) provision, operation, maintenance and improvement of the Services; (ii) on-board heavy-vehicle navigation, traceability of the execution of transport missions and provision of real-time operational visibility to the Client and, where applicable, to the principal designated by the Client, on the basis of geolocation data from the Drivers mobile application; (iii) management of the contractual and commercial relationship with Clients; (iv) invoicing, collection and payment management; (v) communication with Clients and prospects; (vi) responding to requests sent via contact forms; (vii) analysis of the use of the Services for aggregated statistics and continuous improvement; (viii) security of the Services and prevention of fraudulent use; (ix) compliance with applicable legal and regulatory obligations; (x) defence of the rights and legitimate interests of Nereva SA.
Article 6 — Legal bases of the processing
The processing of personal data implemented by Nereva SA rests, as the case may be, on one of the following legal bases within the meaning of Article 6 of the GDPR and Articles 31 et seq. of the FADP.
Contractual performance: processing necessary for the performance of a contract concluded with the Client or for the performance of pre-contractual measures taken at its request.
Legal obligation: processing necessary for compliance with a legal obligation to which Nereva SA is subject, in particular in accounting, tax and anti-money laundering matters.
Legitimate interest: processing necessary for the pursuit of the legitimate interests of Nereva SA, in particular regarding the security of the Services, continuous improvement, B2B professional prospecting and the defence of rights.
Consent: where applicable, processing based on the free, specific, informed and unambiguous consent of the data subject, which may be withdrawn at any time; this is in particular the case for the audience measurement of the website, under the conditions of the Cookie Policy.
Article 7 — Categories of data subjects
The data subjects concerned by the processing implemented by Nereva SA are in particular visitors to the website, prospects who have expressed an interest in the Services, the representatives, directors and points of contact of Clients, Users with access to the Services under a licence subscribed by a Client, and persons whose data is entered by the Client or its Users in the platform in the context of logistics operations, in particular drivers and operational contacts.
Article 8 — Categories of recipients
The personal data processed by Nereva SA may be communicated to the following recipients, to the strict extent necessary for the purposes pursued: (i) the authorised employees of Nereva SA, in the course of their duties; (ii) the technical sub-processors of Nereva SA under the conditions of Article 9; (iii) the third-party principals designated by the Client as recipients of operational visibility on the execution of transport missions, within the framework and under the conditions configured by the Client in the order form; (iv) the competent public authorities, on the basis of a legal obligation or an enforceable decision; (v) the legal, tax and accounting advisers of Nereva SA, bound by a confidentiality obligation; (vi) where applicable, the acquirers or successors of all or part of the business of Nereva SA, in the context of a merger, acquisition or business transfer, subject to the continuity of confidentiality commitments.
Where the user of the website www.nereva.com has accepted the “Marketing and advertising measurement” category of the consent banner, the pseudonymous browsing data described in Article 6 bis of the Cookie Policy is also processed by the advertising measurement provider(s) listed there (as at the date of the last update: Google Ireland Limited), as independent controllers, for the sole purpose of measuring the performance of Nereva SA's advertising.
Nereva SA does not sell or rent personal data to third parties.
Article 9 — Sub-processors
Nereva SA uses technical sub-processors for the provision of its Services. The main categories of sub-processors include cloud infrastructure hosting (Amazon Web Services, Switzerland region), authentication and identity management services, monitoring and technical supervision services, payment services, communication and transactional messaging services, as well as the provider of the mapping, route calculation and on-board heavy-vehicle navigation API integrated into the Drivers mobile application (HERE Europe B.V., Netherlands).
Nereva SA concludes with each of its sub-processors a contract compliant with Article 28 of the GDPR and Article 9 of the FADP, imposing obligations of security, confidentiality and compliance with the instructions of Nereva SA. The complete and up-to-date list of significant sub-processors processing personal data is made available to Clients upon request sent to privacy@nereva.com.
Article 10 — International data transfers
Nereva SA hosts the personal data processed in the context of its Services exclusively on infrastructure located in Switzerland.
Where, in limited cases, personal data is transmitted to a sub-processor located outside Switzerland or outside the European Economic Area, Nereva SA implements the appropriate safeguards provided for by the GDPR and the FADP, and in particular (i) recourse to the Standard Contractual Clauses adopted by the European Commission or approved by the FDPIC; (ii) verification of the adequacy of the level of protection offered by the recipient country within the meaning of Article 16 of the FADP or Article 45 of the GDPR; (iii) the implementation of supplementary measures in accordance with the EDPB guidelines following the Schrems II judgment of 16 July 2020 (encryption, pseudonymisation, assessment of extraterritorial access risks).
Advertising performance measurement on the website www.nereva.com, which is activated only after the user has consented to the “Marketing and advertising measurement” category, may involve a transfer of pseudonymous browsing data outside Switzerland and the European Economic Area, currently to Google LLC in the United States; the safeguards applicable to this transfer are described in Article 6 bis.4 of the Cookie Policy. No data entered in the Nereva platform is concerned by this measurement.
Article 11 — Retention periods
Personal data is retained for a period not exceeding that necessary for the pursuit of the purposes for which it was collected, according to the following principles.
Prospect data: three (3) years from the last contact having expressed an interest in the Services.
Client data and User account data: duration of the contractual relationship, extended by the statutory limitation periods, unless otherwise instructed by the Client.
Invoicing and accounting data: ten (10) years from the end of the financial year concerned, in accordance with Article 958f of the Swiss Code of Obligations.
Technical and security logs: from six (6) to twelve (12) months from their recording, except in the event of a security incident requiring extended retention.
Geolocation data from the Drivers mobile application: twelve (12) months from its recording, for the purposes of execution traceability and the management of any service disputes, except where there is a proven evidentiary need in the context of a dispute or challenge, in which case retention may be extended for the time strictly necessary to resolve the dispute. The visibility of the journey history by the third-party principals designated by the Client is limited to thirty (30) days from the closure of the mission, unless configured otherwise in the order form. Beyond the aforementioned periods, only aggregated and irreversibly anonymised data may be retained, for the purposes provided for in Article 10 of the T&Cs.
Anonymised audience measurement data: twelve (12) months, in accordance with the Cookie Policy.
Upon expiry of the retention periods, the data is deleted or irreversibly anonymised, subject to legal retention obligations and the requirements of ongoing judicial or administrative proceedings.
Article 12 — Data security
Nereva SA implements appropriate technical and organisational measures having regard to the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing, in accordance with Article 32 of the GDPR and the equivalent principles of the FADP.
These measures include in particular the encryption of data in transit (TLS) and at rest, the limitation and control of access according to the principle of least privilege, strengthened authentication of administrative access, the logging of sensitive actions, regular data backups and the documentation of business recovery procedures, the awareness-raising and continuous training of employees, as well as the periodic performance of security tests.
No security measure can be considered absolute. Nereva SA's commitments regarding security constitute best-efforts obligations.
Article 13 — Notification of data breaches
In the event of a personal data breach likely to result in a high risk to the rights and freedoms of data subjects, Nereva SA implements the following notification obligations: (i) notification to the FDPIC as soon as possible, in accordance with Article 24 of the FADP; (ii) notification to the competent supervisory authority within seventy-two (72) hours of becoming aware, in accordance with Article 33 of the GDPR; (iii) communication to the data subjects under the conditions provided for in Article 34 of the GDPR; (iv) communication to the Client where Nereva SA acts as processor, under the conditions and within the deadlines provided for in the DPA.
Article 14 — Rights of data subjects
In accordance with the GDPR and the FADP, data subjects have the following rights relating to the personal data concerning them.
Right of access: to obtain confirmation as to whether or not data concerning them is being processed and, where applicable, to obtain its communication.
Right to rectification: to obtain the rectification of inaccurate or incomplete data.
Right to erasure: to obtain the erasure of data in the cases provided for by the regulations.
Right to restriction: to obtain the restriction of processing in the cases provided for by the regulations.
Right to object: to object to processing on grounds relating to the data subject's particular situation, where the processing is based on the legitimate interest of Nereva SA.
Right to portability: to receive, where technically possible, personal data in a structured, commonly used and machine-readable format.
Right to withdraw consent: to withdraw consent given at any time, without such withdrawal affecting the lawfulness of prior processing.
Right to lodge a complaint: to lodge a complaint with the competent supervisory authority under the conditions of Article 19.
Right relating to the fate of data after death: to define directives relating to the fate of data after death, under the conditions provided for by the applicable regulations.
Article 15 — Terms for exercising rights
Data subjects may exercise their rights by sending a request to privacy@nereva.com or by post to the address mentioned in Article 23.
Nereva SA may ask the data subject for any element reasonably necessary to verify their identity, in order to prevent any fraudulent communication of data. Where the data is processed by Nereva SA as processor on behalf of a Client, the request is forwarded to the Client, which is responsible for responding to the data subjects.
Nereva SA responds to requests within one (1) month of their receipt, which may be extended by two (2) additional months in cases of particular complexity or a high number of requests, in accordance with Article 12 of the GDPR.
Article 16 — Automated decisions and profiling
Nereva SA does not implement, in the context of its Services intended for website visitors and non-client areas, automated decisions within the meaning of Article 22 of the GDPR producing legal effects or significantly affecting data subjects.
The analytics and operational intelligence functionalities offered within the Services produce indications, recommendations or suggestions of an exclusively indicative nature, which do not relieve the Client of the exercise of its own judgement and do not constitute automated decisions within the aforementioned meaning.
Article 17 — Cookies and similar technologies
The terms of data collection via cookies and similar technologies are governed by the Cookie Policy of Nereva SA, accessible from the website. The audience measurement of the website (“Statistics” category) and advertising performance measurement (“Marketing and advertising measurement” category, described in Article 6 bis of the Cookie Policy, currently by means of Google Ads) are only activated with the user's consent, which may be changed or withdrawn at any time via the “Manage cookies” link in the footer. The website's question-and-answer assistant runs locally in the browser: the questions asked are neither transmitted to Nereva SA nor retained.
Article 18 — Data protection officer
Nereva SA has designated a point of contact for any question relating to the protection of personal data, reachable at the address privacy@nereva.com.
In accordance with the FADP, Nereva SA assesses the appropriateness of appointing a data protection adviser within the meaning of Article 10 of that Act. Where applicable, the appointment and contact details of the adviser will be communicated by way of an update to this Policy and published on the website.
Article 19 — Supervisory authorities
The legal bases invoked under the GDPR and the FADP are equivalent in scope for the purposes of this Policy. Data subjects have, regardless of the applicable regime, the same substantive rights.
In the event of a complaint, data subjects may refer, for Switzerland, to the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, CH-3003 Bern, www.edoeb.admin.ch ; for France, to the Commission nationale de l'informatique et des libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr ; for the other Member States of the European Union, to the competent national supervisory authority, in accordance with Article 77 of the GDPR.
Article 20 — Amendment of the Policy
Nereva SA reserves the right to amend this Policy at any time to take account of technical, regulatory or case-law developments. Any substantial amendment will be brought to the attention of data subjects by appropriate means, in particular by publication on the website.
Article 21 — Applicable law and jurisdiction
This document, as well as the contractual relationship it governs, are governed exclusively by Swiss law, to the exclusion of any conflict-of-laws rule and to the exclusion of the United Nations Convention on Contracts for the International Sale of Goods (CISG, Vienna, 1980).
Any dispute relating to the formation, validity, interpretation, performance or termination of this document falls within the exclusive jurisdiction of the ordinary courts of the canton of Vaud, place of the registered office of Nereva SA, subject to any mandatory right of appeal to the Swiss Federal Supreme Court.
Article 22 — Reference language
The French version of this Policy alone is legally authoritative. Any translation is provided for information purposes only and cannot bind Nereva SA.
Article 23 — Contact
Nereva SA, Rue de Rive 22D, CH-1260 Nyon, Switzerland.
Data protection: privacy@nereva.com.
Legal questions: legal@nereva.com.