Privacy policy

In this privacy policy, we, Onaccounting AG (hereinafter referred to as Onaccounting AG, we or us), describe how we collect and process personal data. This privacy policy is not an exhaustive description; where applicable, other statements relating to data protection govern specific matters. For the purposes of this privacy policy, personal data means any information relating to an identified or identifiable person.

Controller and contact

Onaccounting AG is responsible for the data processing described here, unless otherwise stated in an individual case. Requests relating to data protection can be sent to us by letter or email, enclosing a copy of an identity card or passport to identify the user: Onaccounting AG, Kriesbachstrasse 30, 8600 Dübendorf, Switzerland, +41 44 520 02 90, info@onaccounting.ch.

Collection and processing of personal data

We process personal data in particular in the following categories of processing.

Customer data of customers for whom we provide or have provided services.

Personal data that we have received indirectly from our customers in the course of providing our services.

When you visit our website.

When you take part in one of our events.

When we communicate or a visit takes place.

In any other contractual relationship, e.g. as a supplier, service provider or adviser.

When you apply for a job.

When we are obliged to do so for legal or regulatory reasons.

When we exercise our duties of care or other legitimate interests, e.g. to avoid conflicts of interest, to prevent money laundering or other risks, to ensure the accuracy of data, to check creditworthiness, to ensure security or to enforce our rights.

More detailed information can be found in the description of the respective categories of processing below.

Categories of personal data

Which personal data we process depends on your relationship with us and on the purpose for which we process it. In addition to your contact details, we also process other information about you or about persons who have a relationship with you. In some circumstances, this information may also include sensitive personal data.

We collect the following categories of personal data, depending on the purpose for which we process them:

Contact information (e.g. surname, first name, address, telephone number, email)

Customer information (e.g. date of birth, nationality, marital status, profession, title, job title, passport/ID number, AHV number (Swiss social security number))

Risk assessment data (e.g. credit information, commercial register data)

Financial information (e.g. bank details)

Mandate data, depending on the engagement (e.g. tax information, articles of association, minutes, projects, contracts, employee data (e.g. salary, social insurance), accounting data, beneficial owners, ownership structures)

Website data (e.g. IP address, device information (UDI, unique device identifier), information about the browser, website usage (analysis and use of plug-ins, etc.))

Application data (e.g. CV, employment references)

Security and network data (e.g. visitor lists, access controls, network and mail scanners, telephone call logs)

Where permitted, we also obtain certain data from publicly accessible sources (e.g. debt enforcement registers, land registers, commercial registers, the press, the internet) or receive such data from our clients and their employees, from authorities, (arbitration) courts and other third parties. In addition to the data that you give us directly, the categories of personal data that we receive about you from third parties include in particular information from public registers, information that we learn in connection with official and court proceedings, information in connection with your professional functions and activities (so that we can, for example, conclude and process transactions with your employer with your help), information about you in correspondence and meetings with third parties, credit reports, information about you that people close to you (family, advisers, legal representatives, etc.) give us so that we can conclude or process contracts with you or involving you (e.g. references, your delivery address, powers of attorney), information on compliance with legal requirements such as combating money laundering and export restrictions, information from banks, insurance companies, distribution partners and other contractual partners of ours on the use or provision of services by you (e.g. payments made, purchases made), information about you from the media and the internet (where appropriate in the specific case, e.g. in the context of a job application, etc.), your addresses and, where applicable, interests and other socio-demographic data (for marketing), data in connection with the use of the website (e.g. IP address, MAC address of your smartphone or computer, information about your device and settings, cookies, date and time of the visit, pages and content accessed, functions used, referring website, location data).

Purposes of data processing and legal basis

Provision of services

We primarily process the personal data that we receive, in the context of our client relationships with our customers and other contractual relationships with business partners, from them and from other persons involved.

The personal data of our customers includes in particular the following information:

Contact information (e.g. surname, first name, address, telephone number, email, other contact information)

Personal information (e.g. date of birth, nationality, marital status, profession, title, job title, passport/ID number, AHV number, family circumstances, etc.)

Risk assessment data (e.g. credit information, commercial register data, sanctions lists, specialised databases, data from the internet)

Financial information (e.g. bank details, investments or shareholdings)

Mandate data, depending on the engagement, e.g. tax information, articles of association, minutes, employee data (e.g. salary, social insurance), accounting data, etc.

Sensitive personal data: this personal data may also include sensitive personal data, such as data on health, religious views or social assistance measures, in particular when we provide services in the area of payroll processing or accounting.

We process this personal data for the purposes described on the basis of the following legal grounds:

Conclusion or performance of a contract with or for the benefit of the data subject, including the initiation of the contract and any enforcement (e.g. advice, accounting services (Treuhand))

Compliance with a legal obligation (e.g. when we perform our duties as statutory auditor (Revisionsstelle) or are obliged to disclose information)

Safeguarding legitimate interests (e.g. for administrative purposes, to improve our quality, to ensure security, to manage risks, to enforce our rights, to defend ourselves against claims or to check for possible conflicts of interest)

Consent (e.g. to send you marketing information).

Indirect data processing in the course of providing services

When we provide services for our customers, we may also process personal data that we have not collected directly from the data subjects, or personal data of third parties. These third parties are usually employees, contact persons, family members or persons who have a relationship with the customers or the data subjects for other reasons. We need this personal data to fulfil contracts with our customers. We receive this personal data from our customers or from third parties engaged by our customers. Third parties whose information we process for this purpose are informed by our customers that we process their data. Our customers may refer to this privacy policy for this purpose.

The personal data of persons who have a relationship with our customers includes in particular the following information:

Contact information (e.g. surname, first name, address, telephone number, email, other contact information, marketing data)

Personal information (e.g. date of birth, nationality, marital status, profession, title, job title, passport/ID number, AHV number, family circumstances, etc.)

Financial information (e.g. bank details, investments or shareholdings)

Mandate data, depending on the engagement, e.g. tax information, articles of association, minutes, employee data (e.g. salary, social insurance), accounting data

Sensitive personal data: this personal data may also include sensitive personal data, such as data on health, religious views or social assistance measures, in particular when we provide services in the area of payroll processing or accounting.

We process this personal data for the purposes described on the basis of the following legal grounds:

Conclusion or performance of a contract with or for the benefit of the data subject (e.g. when we perform our contractual obligations)

Compliance with a legal obligation (e.g. when we perform our duties as statutory auditor or are obliged to disclose information)

Safeguarding legitimate interests, in particular our interest in providing the best possible service to our customers.

Use of our website

We do not need any details from you for you to visit our website. However, with every visit the server automatically records a range of user information, which is temporarily stored in the server’s log files.

When this general information is used, it is not attributed to any specific person. Collecting this information or data is technically necessary to display our website and to ensure its stability and security. This information is also collected to improve the website and to analyse its use.

Depending on how you use the website, this includes in particular the following information:

Contact information, if you send it to us (e.g. surname, first name, address, telephone number, email)

Other information that you transmit to us via the website.

Technical information transmitted automatically to us or our service providers, information on user behaviour or on the settings of the website (e.g. IP address, UDI, device type, browser, number of clicks on the page, clicks on links, etc.)

We process this personal data for the purposes described on the basis of the following legal grounds:

Safeguarding legitimate interests (e.g. for administrative purposes, to improve our quality, to analyse data or to promote our services)

Consent (e.g. to the use of cookies).

Participation in events

If you take part in an event organised by us, we collect personal data in order to organise and hold the event and, where applicable, to send you additional information afterwards. We also use your information to tell you about further events. You may be photographed or filmed by us at these events, and we may publish this footage internally or externally.

This includes in particular the following information:

Contact information (e.g. surname, first name, address, telephone number, email)

Personal information (e.g. profession, function, title, employer, dietary habits)

Images or videos.

Payment information (e.g. bank details).

We process this personal data for the purposes described on the basis of the following legal grounds:

Performance of a contractual obligation towards or for the benefit of the data subject, including the initiation of the contract and any enforcement (enabling participation in the event)

Safeguarding legitimate interests (e.g. holding events, distributing information about our event, providing services, efficient organisation)

Consent (e.g. to send you marketing information or to create images and footage).

Direct communication and visits

If you contact us (e.g. by telephone, email or chat) or we contact you, we process the personal data required for this. We also process this personal data when you visit us. In this case, you may have to leave your contact details before your visit or at reception. We keep these for a certain period in order to protect our infrastructure and our information. Emails to and from us are handled via Microsoft 365 from Microsoft; the exception are the automatic emails of this website, which are described in the section ‘Forms on this website’.

For telephone conferences, online meetings, video conferences and/or webinars (‘online meetings’), we use the ‘Zoom’ or ‘Microsoft Teams’ service.

In doing so, we process in particular the following information:

Contact information (e.g. surname, first name, address, telephone number, email)

Communication metadata (e.g. IP address, duration of communication, communication channel)

Recordings of conversations, e.g. in video conferences.

Other information that the user uploads, provides or creates while using the video conferencing service, as well as metadata used to maintain the service provided. Further information on the processing of personal data by ‘Zoom’ or ‘Microsoft Teams’ can be found in their privacy policies.

Personal information (e.g. profession, function, title, employer)

Time of and reason for the visit.

We process this personal data for the purposes described on the basis of the following legal grounds:

Performance of a contractual obligation towards or for the benefit of the data subject, including the initiation of the contract and any enforcement (provision of a service)

Safeguarding legitimate interests (e.g. security, traceability and the handling and administration of customer relationships).

Job applications

You can submit your application for a position with us by post or to the email address given on our website. The application documents and all personal data disclosed to us with them are treated in strict confidence, are not disclosed to any third party and are processed only for the purpose of handling your application for employment with us. Unless you consent otherwise, your application file will either be returned to you or deleted/destroyed after the application process has been completed, unless it is subject to a statutory retention obligation. The legal bases for processing your data are your consent, the performance of the contract with you and our legitimate interests.

In doing so, we process in particular the following information:

Contact information (e.g. surname, first name, address, telephone number, email)

Personal information (e.g. profession, function, title, employer)

Application documents (e.g. cover letter, references, diplomas, CV)

Assessment information (e.g. assessment by recruitment consultants, references, assessments)

We process this personal data for the purposes described on the basis of the following legal grounds:

Safeguarding legitimate interests (e.g. hiring new employees)

Suppliers, service providers, other contractual partners

If we conclude a contract with you for you to provide a service for us, we process personal data about you or your employees. We need this data to communicate with you and to use your services. In some circumstances, we also process this personal data to check whether there could be a conflict of interest in connection with our activity as statutory auditor, and to ensure that the collaboration does not expose us to any unwanted risks, e.g. with regard to money laundering or sanctions.

In doing so, we process in particular the following information:

Contact information (e.g. surname, first name, address, telephone number, email).

Personal information (e.g. profession, function, title, employer).

Financial information (e.g. bank details).

We process this personal data for the purposes described on the basis of the following legal grounds:

Conclusion or performance of a contract with or for the benefit of the data subject, including the initiation of the contract and any enforcement

Safeguarding legitimate interests (e.g. avoiding conflicts of interest, protecting the company, enforcing legal claims).

Cookies and consent

This website does not itself set any cookies for statistics, marketing or advertising. Until you have given your consent, neither an analytics service that sets cookies nor any measuring code for advertising is loaded, and we do not embed any social media plug-ins. The only things that run without consent are Vercel's visitor statistics and loading time measurement, which set no cookies and store nothing on your device; they are described in the next section.

We store three types of entries in your browser’s local storage (‘localStorage’). The ‘oa-einwilligung’ entry records whether you have allowed external services and when you made your decision. The ‘oa-offerte’ entry keeps the details you have entered in the price calculator so that they are still there after an interruption. The ‘oa-blog-…’ entries record which blog articles you have already rated and which ones you have read to the end; the reading status serves only to mark articles in the blog overview.

These entries themselves are not transmitted to us or to third parties; they remain on your device, and you can delete them at any time in your browser settings. What you enter in the price calculator only reaches us when you expressly request the quote.

External services are only loaded after you have given your consent; without your consent, no request is sent to the provider concerned. Your consent is voluntary, and you can withdraw it at any time with effect for the future, via the round icon at the foot of every page or via ‘Privacy settings’ in the footer. The legal basis is your consent (Art. 31 para. 1 of the Federal Act on Data Protection, FADP (DSG); Art. 6(1)(a) of the EU General Data Protection Regulation, GDPR (DSGVO)).

Visitor statistics and loading times with Vercel

To see which pages are read and where visitors come from, we use Vercel Web Analytics from Vercel Inc., USA, the same provider that delivers our website. The data recorded are the time, the page visited, the referring website, the approximate location (country, region, city), device type, operating system and browser. Before sending, we remove any additions to the address, except campaign details (utm). In addition, we count when someone requests a quote, submits a form, books an appointment or clicks on our telephone number; for a quote, the calculated annual amount is included, for a form its name. Names, email addresses, telephone numbers and form texts are not transmitted.

Vercel Web Analytics sets no cookies and stores nothing on your device. Vercel recognises whether two page views belong to the same visit by means of a hash value that is generated from the request and discarded after 24 hours. Your IP address is not linked to the statistics, and we only see aggregated figures from which no person can be identified. Vercel may process the data in the USA; the transfer is based on the standard contractual clauses agreed with Vercel. The legal basis is our legitimate interest in a clear and functioning website (Art. 31 para. 1 FADP, Art. 6(1)(f) GDPR). We do not ask for consent for this; your right to object remains unaffected (section ‘Your rights’).

Also without consent, we use Vercel Speed Insights to measure how quickly our pages load and respond on your device. The data recorded are the page visited without any additions to the address, the measured loading times (Web Vitals) and the page element that determined them, the type of network connection, browser, device type, operating system and country. These data points are not linked to any visit or person; there is no identifier and no cookie, and nothing is stored on your device. We use the values to find and improve slow pages. The same applies to the transfer to the USA and the legal basis as for the visitor statistics.

Appointment booking via Calendly

To book the free initial meeting, we embed the Calendly service of Calendly LLC, USA. The calendar is only loaded if you have consented in the consent banner or directly in the booking window.

With your consent, your IP address, details of your browser and device and the page visited are transmitted to Calendly, and Calendly sets its own cookies. If you book an appointment, Calendly also processes the details you enter in the booking form, in particular your name, email address, any telephone number and your message, as well as the appointment you have chosen. We use this information to arrange and hold the meeting with you.

Calendly processes the data in the USA. From a Swiss and European perspective, the USA does not generally have an equivalent level of data protection, and there is a risk that US authorities may access the data. The transfer is therefore based on your express consent (Art. 17 para. 1 let. a FADP, Art. 49(1)(a) GDPR) and on the standard contractual clauses agreed with Calendly. Details of the processing by Calendly can be found at https://calendly.com/privacy.

If you would rather not load the calendar, we are happy to arrange the appointment by telephone on +41 44 520 02 90 or by email to info@onaccounting.ch. This does not put you at any disadvantage.

Forms on this website

When you submit a form on this website, we send your details to ourselves by email; for sending, we use the Resend service of Resend, Inc., USA. In addition, we create a PDF from your details, which you can download immediately after submitting. If you request a quote in the price calculator, we send it to the email address you provided via the same service; the sender shown is info@onaccounting.ch. We process this information in order to answer your enquiry and to initiate a possible collaboration. The legal bases are the initiation or performance of a contract and our legitimate interest in answering enquiries.

If you came to the website via one of our adverts on Google, we note in the enquiry sent to us that it came via an advert. To do so, we only check whether the address of the page contains the identifier of an ad click. The identifier itself is not included, and nothing is transmitted to Google in the process. We want to know which advertising leads to enquiries. The legal basis is our legitimate interest in effective advertising.

Feedback on blog articles

Below each blog article, you can indicate with one click whether it was helpful. The only information transmitted is which article was rated and how; we receive this information by email via the Resend service mentioned above. No personal data is involved: neither a name, nor an email address, nor an identifier that would make you recognisable. We read the feedback in order to improve our articles. The legal basis is our legitimate interest in the quality of our content.

Fonts, hosting and server logs

The font used is supplied when the page is built and delivered from our own server. Visiting our website therefore does not create a connection to Google Fonts or to any other font provider.

The website is hosted by Vercel Inc. and delivered via its network; for visitors from Europe, delivery is usually via locations in Europe. Vercel processes forms and quotes for us in a data centre in Frankfurt. This generates technical server logs as described above under ‘Use of our website’. The basis is our legitimate interest in operating the website securely and reliably.

Disclosure and transfer of data

We only pass on your data to third parties if this is necessary to provide our service, if these third parties provide a service for us, if we are obliged to do so by law or by the authorities, or if we have an overriding interest in passing on the personal data. We will also pass on personal data to third parties if you have given your consent or asked us to do so.

Not all personal data is transmitted in encrypted form by default. Unless expressly agreed otherwise with the customer, accounting data, payroll administration data, payslips and salary certificates (Lohnausweise) are transmitted unencrypted.

The following categories of recipients may receive personal data from us:

• Service providers (e.g. IT service providers, hosting providers, suppliers, advisers, lawyers, insurance companies).

• Third parties in the context of our legal or contractual obligations, authorities, state institutions, courts.

We conclude contracts with service providers who process personal data on our behalf that oblige them to ensure data protection. Our service providers are mostly located in Switzerland or in the EU/EEA. Certain personal data may also be transferred to the USA (e.g. to Calendly for appointment booking, to Resend for sending form emails and quotes, to Vercel for hosting, visitor statistics and loading time measurement, to Microsoft for email and online meetings, or to Google for Google Workspace, in which we also process mandate data) or, in exceptional cases, to other countries worldwide. Should a transfer of data to other countries that do not have an adequate level of data protection be necessary, it takes place on the basis of your express consent, the EU standard contractual clauses or other suitable instruments.

Retention period for personal data

We process and store your personal data for as long as is necessary to fulfil our contractual and legal obligations or otherwise for the purposes pursued by the processing, i.e. for example for the duration of the entire business relationship (from the initiation and performance to the termination of a contract) and beyond in accordance with the statutory retention and documentation obligations. Personal data may be retained for the period during which claims can be asserted against our company (i.e. in particular during the statutory limitation period) and insofar as we are otherwise legally obliged to do so or legitimate business interests require it (e.g. for evidence and documentation purposes). As soon as your personal data is no longer required for the above purposes, it is generally deleted or anonymised as far as possible. For operational data (e.g. system logs, logs), shorter retention periods of 12 months or less generally apply.

Data security

We take appropriate technical and organisational security measures to protect your personal data against unauthorised access and misuse, such as issuing instructions, training, IT and network security solutions, access controls and restrictions, encryption of data carriers and transmissions, pseudonymisation and checks.

Obligation to provide personal data

In the context of our business relationship, you must provide the personal data that is necessary to establish and conduct a business relationship and to fulfil the associated contractual obligations (as a rule, you have no legal obligation to provide us with data). Without this data, we will not be able to conclude or perform a contract with you (or with the entity or person you represent). The website also cannot be used if certain information needed to ensure data traffic (such as the IP address) is not disclosed.

Your rights

In connection with our processing of personal data, you have the following rights:

Right of access to the personal data we hold about you, the purpose of the processing, its origin and the recipients or categories of recipients to whom personal data is disclosed.

Right to rectification if your data is incorrect or incomplete.

Right to restriction of the processing of your personal data.

Right to request the erasure of the processed personal data.

Right to data portability.

Right to object to data processing or to withdraw consent to the processing of personal data at any time without giving reasons.

Right to lodge a complaint with a competent supervisory authority, where provided for by law.

To exercise these rights, please contact us at the address given above under ‘Controller and contact’.

Please note, however, that we reserve the right to invoke the restrictions provided for by law, for example if we are obliged to retain or process certain data, have an overriding interest in doing so (insofar as we are entitled to rely on this) or need it to assert claims. If you incur any costs, we will inform you in advance.

Changes to this privacy policy

We expressly reserve the right to change this privacy policy at any time.

Last updated: October 2026.