Privacy Policy

We are aware that offering services in a virtual environment involves particular challenges in terms of security and personal data protection. We therefore treat data protection as one of the key aspects of our business.

The purpose of this Privacy Policy is to set out the rules for processing your personal data in connection with the use of the Alterland website and Platform, including virtual office space services.

In particular, we explain:

• the situations in which we process your data,
• what data we collect,
• the purpose and legal basis for processing,
• how long we store it,
• what rights you have in connection with the processing of your personal data.

WHO IS THE DATA CONTROLLER AND HOW IS YOUR DATA KEPT SECURE

The controller of the personal data described in this Privacy Policy is ALTERLAND SA, Via Frasca 3, 6900 Lugano, Switzerland.

The Controller collects and processes your personal data in compliance with applicable law, in particular the Swiss New Federal Act on Data Protection (nFADP) and the EU General Data Protection Regulation (GDPR). We aim to ensure transparency in the processing of your personal data by informing you of the purpose and legal basis for processing at the point of collection.

We do not collect data in excess of what is necessary — only to the extent required to achieve the defined purpose — and we process it only for as long as necessary. We also restrict access to your data for our employees and cooperating entities. We have implemented appropriate technical and organisational measures to ensure the security and confidentiality of your data.

DATA PROCESSING MODEL

We operate a digital services model in which:

• we are the controller of Platform users' data, including yours,
• in certain areas we use processors (e.g. hosting, AI),
• some providers (e.g. META – VR, payment operators) act as independent data controllers.

When using the Platform within an organisation or team, it should also be noted that the organisation using the Platform may itself be the controller of its users' data, and we may act as a processor on its behalf — to the extent resulting from the cooperation model and arrangements in place.

SOURCES OF PERSONAL DATA

We receive personal data from the following sources:

• directly from you,
• from the administrator of your organisation,
• automatically in connection with your use of the website or Platform,
• from tools supporting authentication, security and the operation of our services.

COOKIES AND SIMILAR TECHNOLOGIES

Some personal data may also be collected automatically via cookies and similar technologies used on the website and Platform.

Detailed rules regarding the use of cookies and similar technologies, including their purposes and how to manage settings, are set out in a separate Cookie Policy available on the Alterland website.

SPECIFIC SITUATIONS IN WHICH WE PROCESS YOUR PERSONAL DATA

Account Registration

When you register (create) an account on our Platform, we process your basic identification data in the form of your email address and password. This data is used to create the account and provide access to the Alterland HUB functionalities. You provide this data voluntarily, but it is necessary in order to create an account.

The legal basis for processing is the performance of a contract (Art. 6(1)(b) GDPR).

You may also provide additional information in your profile panel, such as your name and a personal biography.

Data is stored for the duration of account use and, following closure of the account, for the period necessary for the establishment, exercise or defence of legal claims.

Organisation Profile Administration and User Management

We enable the creation and management of an organisation profile (workspace), within which designated users (e.g. organisation administrators) can add, remove and manage other users' accounts.

In this connection, the following data is processed:

• email address,
• account identifier,
• assignment to organisation, team or project,
• role and permissions within the Platform,
• invitation history (sent, accepted, declined),
• data relating to account activity within the organisation.

This data is processed for the purpose of creating and maintaining the organisational structure within the Platform, enabling administrators to manage user access and permissions, and ensuring secure access to the organisation's resources.

The legal basis for processing is:

• Art. 6(1)(b) GDPR – performance of a contract, to the extent necessary for the provision of Platform services to the organisation,
• Art. 6(1)(f) GDPR – the controller's legitimate interest in ensuring security, access control and permissions management (the legitimate interest of the controller and the organisation using the Platform).

In the case of users invited to the organisation by its administrator, data (in particular email address) may be provided by the organisation. In such cases, the organisation may act as an independent data controller in respect of introducing user data to the Platform and administering the organisation.

Data is stored for the period of active use of the Platform within the given organisation, and thereafter for the period necessary to ensure accountability for actions taken and for the establishment, exercise or defence of legal claims.

Access to user data within the organisation is restricted to authorised persons only (e.g. organisation administrators), to the extent resulting from their assigned permissions.

Subscriptions and Payments

In order to use the Platform services, it is necessary to purchase a subscription and provide data required to process payment. This includes in particular identification data and billing data. Providing this data is necessary in order to make a payment.

Payment card data is not processed by Alterland — it is handled by a specialist payment operator (Stripe), which acts as an independent data controller or as a processor in this regard, in accordance with its own service model and legal documentation.

We receive information about completed payments from the operator and process it for the purpose of enabling access to Platform functionalities, processing settlements and fulfilling legal obligations.

The legal basis is:

• Art. 6(1)(b) GDPR (contract) – in respect of providing services covered by the subscription,
• Art. 6(1)(c) GDPR (legal obligations) – in respect of retaining accounting documents.

Data is stored for the duration of the subscription and for the period required by accounting and tax regulations.

Activity in the Virtual Environment (VR / 3D)

The Platform enables you to participate in virtual spaces such as offices, meeting rooms and conference rooms.

In this context, data relating to your:

• presence in the virtual space,
• activity (e.g. entering a room, participating in a meeting),
• interactions with other users,
• voice communication

is processed.

Voice data is processed in real time only and is not, as a rule, recorded or stored. The purpose of processing is to enable the use of Platform functionalities, and the legal basis is the performance of a contract (Art. 6(1)(b) GDPR).

Additionally, certain data (e.g. technical logs) may be processed for security purposes — on the basis of the controller's legitimate interest (Art. 6(1)(f) GDPR).

Providing data is voluntary but necessary for activity in the virtual environment.

AI "Smart Note" Feature

The Platform offers a feature for the automatic creation of notes based on your voice recordings.

Within this functionality:

• voice data is processed solely for the purpose of transcription,
• processing is temporary and technical in nature,
• recordings are not saved or archived once the process is complete,
• only the generated text note is stored.

Data is not used to train artificial intelligence models or for any other purposes. You decide what information you share when using this feature.

The legal basis for processing is the performance of a contract (Art. 6(1)(b) GDPR).

Notes are stored until deleted by the user.

Providing data is voluntary.

File Storage (Drive)

The Platform enables you to store files in your personal drive.

Processing covers files such as:

• documents,
• images,
• video materials,
• other data uploaded by the user.

These files are stored solely for the purpose of storage, sharing and presentation within the Platform, including in the VR environment. The Controller does not analyse these files, does not use them for profiling or marketing purposes.

The legal basis for processing is the performance of a contract (Art. 6(1)(b) GDPR).

Data is stored until deleted by the user.

Avatar Creation

The Platform enables you to create your digital avatar based on an uploaded photograph.

In this process:

• you may voluntarily provide your image,
• the photograph is used solely to generate the avatar,
• the source photograph is not stored once the process is complete,
• only the resulting avatar model is stored.

Data is not used for biometric identification or facial recognition.

The legal basis for processing is your consent (Art. 6(1)(a) GDPR), given by consciously uploading your photograph.

Use of VR Devices

If you use the Platform with VR headsets, please note that META:

• is the controller of your personal data in respect of data related to the device, account and operation of the VR environment,
• processes data concerning the device, account and activity within the VR system,
• Alterland does not have access to the full scope of this data and does not determine how it is processed.

The use of VR devices is subject to META's privacy policies.

Contact Form

When using the contact form available at www.alterland.io, you will be asked to provide your name, email address and the content of your enquiry.

The data we collect will be used for the purpose of responding to your query — on the basis of our legitimate interest (Art. 6(1)(f) GDPR).

Please note that by using the contact form, you provide your data voluntarily; however, failure to provide certain data will result in our inability to respond to your enquiry.

The data you provide will be processed until any potential claims become time-barred.

Newsletter

We also offer the option to subscribe to our newsletter, for which you will need to provide your email address.

This data is processed for the purpose of:

• sending information about Platform services, functionalities and updates,
• conducting marketing communications,
• measuring campaign effectiveness (to the extent permitted by law).

The legal basis for processing is your consent — Art. 6(1)(a) GDPR.

Providing data is voluntary but necessary to receive the newsletter.

Data is processed until you withdraw your consent. You may unsubscribe from marketing communications at any time without affecting the lawfulness of processing carried out prior to withdrawal.

Platform Monitoring and Security

In connection with the use of the Platform, we process data necessary to ensure its security and proper functioning.

In this regard, the following may be processed in particular:

• IP address,
• user and session identifiers,
• login data (e.g. dates and times of logins, login attempts),
• system events and technical logs,
• information about the user's device and environment to the extent necessary for security purposes.

This data is processed for the purpose of ensuring the security of systems and data, detecting and preventing fraud, incidents and unauthorised access, ensuring the continuity of Platform operations, and conducting technical analyses relating to the functioning of services.

The legal basis for processing is Art. 6(1)(f) GDPR — the controller's legitimate interest in ensuring the security and integrity of IT systems.

Data is stored for the period necessary to fulfil the above purposes, and thereafter for the period required for the establishment, exercise or defence of legal claims.

Operational Communication and User Support

In connection with the use of the Platform, we may process your personal data for the purpose of conducting communication related to account management and the provision of services. In this regard, the following may be processed in particular:

• email address,
• user identification data,
• content of communications (e.g. requests, enquiries, responses),
• data relating to the use of services, to the extent necessary to provide support.

This data is processed for the purpose of providing ongoing user support, delivering technical assistance, handling requests and complaints, and communicating information relating to Platform operations (e.g. service changes, technical interruptions, security matters).

The legal basis for processing is:

• Art. 6(1)(b) GDPR – to the extent necessary for the performance of a contract,
• Art. 6(1)(f) GDPR – in respect of our legitimate interest in ensuring proper user support and service quality.

Data is stored for the period necessary to handle the request or communication, and thereafter for the period necessary for the establishment, exercise or defence of legal claims.

Platform Analytics and Development

In order to improve Platform functionalities and the quality of services provided, we may process data relating to how the Platform is used. In this regard, the following may be processed in particular:

• data on user activity within the Platform,
• information on the use of specific functionalities,
• technical and statistical data relating to system performance.

This data is processed for the purpose of analysing how the Platform is used, developing and optimising its functionalities, improving service performance and stability, and producing statistics and internal analyses.

Data used for analytical purposes is processed, as a rule, in aggregated or anonymised form, where possible.

The legal basis for processing is Art. 6(1)(f) GDPR — the controller's legitimate interest in developing and optimising services.

Data is stored for the period necessary to fulfil the above purposes, in accordance with the principles of data minimisation.

FOR WHAT PURPOSES AND IN WHAT CIRCUMSTANCES DO WE SHARE YOUR DATA

As a rule, we do not share your personal data with third parties for their own purposes, unless this is required by a legal basis, your consent or the nature of a given service. We share your personal data with third parties who provide certain services on our behalf. Among such service providers, we may in particular distinguish:

• hosting and cloud infrastructure providers,
• authentication and security tool providers,
• voice communication service providers,
• AI and natural language processing tool providers,
• avatar generation technology providers,
• analytics, monitoring and logging system providers,
• newsletter and marketing automation tool providers,
• IT support providers, advisors and law firms,
• public authorities, courts, etc. – where required by applicable law.

We wish to assure you, however, that these service providers have been duly selected and contractually obliged to use the data entrusted to them solely in accordance with our instructions and for the purposes we have strictly defined — unless they act as independent data controllers under their own processing rules.

In connection with the use of the above entities, your personal data may be transferred outside the EEA (European Economic Area), including to Switzerland and the United States. We wish to assure you, however, that in such situations we have taken all necessary steps to ensure appropriate protection of the personal data transferred, including by:

• transferring data to countries for which the European Commission has determined an adequate level of personal data protection, including Switzerland,
• transferring data on the basis of standard contractual clauses approved by the European Commission,
• using other legally permitted mechanisms, where applicable.

YOUR RIGHTS IN CONNECTION WITH OUR PROCESSING OF YOUR DATA

We make every effort to uphold the rights afforded to you under the GDPR, namely:

• the right to withdraw consent,
• the right of access to personal data,
• the right to rectification of data,
• the right to erasure of data,
• the right to restriction of processing,
• the right to data portability,
• the right to object,
• the right not to be subject to decisions based solely on automated processing.

Right to Withdraw Consent

You have the right to withdraw any consent you have given us to process your personal data. Withdrawal of consent takes effect from the moment it is withdrawn, meaning it does not affect processing carried out by us in accordance with the law prior to withdrawal. Withdrawal of consent should not entail any consequences; however, it may prevent you from continuing to use services provided on the basis of the consent given.

Right of Access to Data

You have the right to obtain confirmation from us as to whether we are processing your personal data, and if so, you have the right to:

• obtain information about the purposes of processing, the categories of personal data processed, the recipients or categories of recipients of that data, the planned storage period or the criteria for determining it, the rights available to you under the GDPR and the right to lodge a complaint with a supervisory authority, the source of the data, automated decision-making including profiling, and the safeguards applied in connection with the transfer of data outside the European Union;
• obtain access to your personal data, which includes, for example, obtaining a copy of all your personal data processed by us.

Right to Rectification of Data

You have the right to have your personal data rectified and completed. We will also endeavour to remove any discrepancies or errors in the personal data we process and to supplement it if it proves to be incomplete.

Right to Erasure of Data ("Right to be Forgotten")

You have the right to request that we erase all or some of your personal data, and we are obliged to do so where one of the following circumstances applies:

• your personal data is no longer necessary for the purposes for which it was collected or processed,
• you have withdrawn the consent on which the processing was based,
• you have objected to the use of your personal data for direct marketing purposes,
• your personal data is being processed unlawfully.

Right to Restriction of Processing

You have the right to request restriction of the processing of your personal data. If you submit such a request, we will not be able to carry out any operations on your personal data other than storing it. You may request restriction of processing in the following cases:

• when you contest the accuracy of your personal data — we will then restrict processing for the time necessary to verify the accuracy of your data;
• when the processing of your data is unlawful and you request restriction of processing rather than erasure;
• when your personal data is no longer necessary for the purposes for which it was collected or used, but is needed by you for the establishment, exercise or defence of legal claims;
• when you have objected to the use of your data on the basis of our legitimate interest — restriction then applies for the time needed to consider whether, given your particular situation, your interests, rights and freedoms override the interests we are pursuing by processing your personal data.

Right to Data Portability

You have the right to receive from us your personal data that you have provided to us and that we process in our IT systems, and to transmit it to another data controller of your choice. You also have the right to request that your personal data be transmitted directly by us to such other controller, where technically feasible. Your personal data will be sent in a file saved in one of the commonly used, machine-readable formats, such as CSV or XML. The use of such a format should enable the transfer of data to another personal data controller.

Right to Object to the Use of Data

You have the right to object at any time to the use of your personal data for purposes relating to the direct marketing of our products and services. An objection does not result in the erasure of data, but only in our ceasing to use it for marketing purposes. You may also object at any time — on grounds relating to your particular situation — to the processing of personal data carried out on the basis of our legitimate interest. An objection in this regard should include reasons.

Right Not to be Subject to Automated Decision-Making

You also have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.

However, we wish to inform you that we do not make decisions regarding your personal data that are based solely on automated processing, including profiling.

TIMEFRAME FOR FULFILLING YOUR REQUEST

If you submit one of the above requests to us, we will inform you of its fulfilment or refusal no later than one month from the date of receipt. If, due to the complex nature of your request or the number of requests, we are unable to fulfil your request within one month, we will fulfil it within the following two months, informing you in advance of the intended extension of the deadline.

CHANGES TO THE PRIVACY POLICY

This Privacy Policy is subject to systematic review and its content may be amended in particular in the event of changes in law, new guidelines from data protection supervisory authorities, or the emergence of industry codes of good practice.

CONTACT

If you have any additional questions, concerns or doubts about how we process your personal data, you may at any time send an email with your query to gdpr@alterland.io. All queries received from you will be addressed promptly.

Please note that you may always lodge a complaint with the competent supervisory authority. Depending on the circumstances, this may be the relevant data protection authority in the country of your habitual residence, place of work or place of the alleged infringement, and in the case of Switzerland — the Federal Data Protection and Information Commissioner (FDPIC).