Privacy Policy

Last updated: 16 October 2026

1. Who we are

Altius Group SNC publishes AltiusForms and runs the altiusforms.com website and customer area. For any question about your data: contact@altius-group.ch.

This policy is based on the Swiss Federal Act on Data Protection (FADP) and, where it applies, the EU General Data Protection Regulation (GDPR).

2. Who is responsible for which data

• Portal data (your customer account, subscriptions, messages): Altius Group SNC is the controller.
• Instance data (forms, answers, files, users of the instance): the customer running the instance is the controller. It decides what is collected and why.
• Instance hosted by us: we act as the customer's processor. We process this data only on the customer's instructions, to host, back up, update and maintain the instance.
• Self-hosted instance: we process none of the instance's data. Only licence verification takes place: the instance contacts our server with its licence key, and the portal records when it last did so.

If you filled in an AltiusForms form and want to exercise your rights over your answers, contact the organisation that asked you to fill it in.

3. Data processed by the portal

• Account: company name and address, VAT number if provided, first name, last name, email, phone, language.
• Billing: payments go through Stripe. We do not store card numbers; we keep the Stripe customer ID and the history of subscriptions and invoices.
• Instances: address and subdomain, plan, instance status, backups, licence key and last-contact time for self-hosted instances.
• Support and feedback: the name, email, platform, rating and message you send us.
• Technical data: server logs (IP address, time, requested page) for security and troubleshooting.

4. Cookies

The portal only uses necessary cookies: session cookie, CSRF protection and language cookie. It uses no advertising trackers or audience analytics.

5. Purposes and legal bases

We process this data to manage your account and subscriptions, create and run your instances, invoice, answer your requests and keep the service secure. The bases are performance of the contract, our legal obligations (in particular accounting) and our legitimate interest in securing the service.

6. Service providers

We use carefully selected providers: Stripe for payments, an email delivery provider for service messages, and the infrastructure providers hosting our servers. They process data only to provide their service to us. Where data is transferred to a country without adequate protection, appropriate safeguards such as standard contractual clauses apply.

7. Mobile app

The AltiusForms mobile app connects to the instance you enter. It sends to that instance the answers you enter, including photos, videos, audio recordings, signatures and your location when you fill in such questions. This data goes to the customer's instance, not to us — unless we host that instance, in which case we process it as a processor.

• Your credentials are stored in the device's secure keychain.
• Answers entered offline stay on the device until they are sent.
• Access to the camera, microphone and location is requested only when you need it.
• The app contains no advertising trackers.

8. Retention

• Account data: as long as the account is active.
• Accounting records and invoices: 10 years, as required by Swiss law (art. 958f CO), even after the account is deleted.
• Hosted instance data: deleted within a reasonable time after the subscription ends, once the backups have expired.
• Support messages: as long as needed to handle the request and follow up the customer relationship.

9. Security

Each instance has its own database and storage. Traffic is encrypted (HTTPS), access to our systems is restricted, and hosted instances are backed up every night.

10. Your rights

You can request access to your data, its correction or deletion, a copy in a common format, and object to certain processing. Write to contact@altius-group.ch. You may also contact the Federal Data Protection and Information Commissioner (FDPIC) or, where the GDPR applies, the supervisory authority in your country.

11. Changes

We may update this policy. The date at the top shows the current version.