1. Introduction and Commitment

Welcome to exkalibur.ai.
Digital Solutions SA (hereinafter “exkalibur,” “We,” “Our,” “Us”), whose registered office is located at Rue de la Roche de Mars 5, 2900 Porrentruy, operates the exkalibur platform (the “Platform”) and the associated services (the “Services”).

Protecting your personal data is an absolute priority for exkalibur. This Privacy Policy is intended to inform you clearly, transparently and comprehensively about how we collect, use, process, share and protect your personal data when you use our Platform and Services.

We undertake to process your personal data in accordance with applicable data-protection laws, in particular the revised Swiss Federal Act on Data Protection (nLPD) and, where applicable, the European Union General Data Protection Regulation (GDPR).

By using our Platform and Services, you acknowledge that you have read and accept the terms of this Privacy Policy.

2. Definitions

Terms that begin with a capital letter and are not defined in this Privacy Policy have the meaning given to them in our General Terms and Conditions of Sale and Use (GTCU).

• Personal Data: Any information relating to an identified or identifiable natural person.

• Processing: Any operation or set of operations performed on Personal Data, whether or not by automated means—such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

• Controller: The natural or legal person who, alone or jointly with others, determines the purposes and means of Processing Personal Data. For the exkalibur Services, the Controller is Digital Solutions SA.

• Processor: The natural or legal person who processes Personal Data on behalf of the Controller.

• Data Subject: The natural person to whom the Personal Data being processed relate (i.e. you, the User).

3. Identity and Contact Details of the Controller

Digital Solutions SA
Rue de la Roche-de-Mars 5, 2900 Porrentruy
support@exkalibur.com

4. Data Protection Officer (DPO) / Data-Protection Adviser

exkalibur has appointed a Data Protection Officer. For any question regarding the Processing of your Personal Data or the exercise of your rights, please contact:
support@exkalibur.com

5. What Personal Data Do We Collect?

Depending on how you interact with our Platform and Services, we collect various categories of Personal Data:

• Identification and contact data: first name, surname, email address, telephone number, username, encrypted password, IP address, company name and job title (where applicable).

• Transaction and payment data: subscription details, transaction history, billing data, payment-card information (processed securely by our payment providers; exkalibur stores only partial data such as the last digits or expiry date, for management purposes).

• User Content: the Inputs you provide (e.g. prompts or textual instructions for AI features), the Outputs generated in response, and any files, code, designs or information you upload, create or store on the Platform.

• Technical and connection data: IP address, browser type and version, operating system, device type and unique identifiers, time zone, language, mobile-network data, connection logs, access dates/times, pages viewed, visit duration, interactions (clicks, searches).

• Service-usage data: information on how you use our Services, the features you use, settings selected, performance metrics.

• Communication data: content of communications exchanged with us (e-mails, contact-form messages, support chats), plus associated metadata.

• Cookies and tracker data: information collected via cookies and similar technologies (see Section 12).

• Marketing data and preferences: your marketing-communication preferences and responses to surveys.

• Application data: if you apply for a job—CV, cover letter and related documents (career history, education, qualifications, references).

We do not intentionally collect special categories of data (sensitive data) as defined by the nLPD or GDPR—such as racial/ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, genetic data, biometric data for unique identification, health data, or data concerning a person’s sex life or orientation—unless you voluntarily provide them or it is strictly necessary for a specific lawful purpose. In such cases we apply enhanced safeguards and, where required, obtain your explicit consent.

6. For What Purposes Do We Process Your Personal Data?

• Provision and management of Services

  • Create and manage your User Account.

  • Allow access to and use of the Platform and Services.

  • Process your Inputs and generate corresponding Outputs.

  • Perform contracts with you (including payment and billing).

  • Ensure technical maintenance and proper functioning of the Platform.

• Customer support

  • Respond to requests, questions and complaints.

  • Provide technical assistance.

• Service improvement and new-product development

  • Analyse Platform usage to improve user experience, ergonomics and features.

  • Conduct satisfaction surveys and market studies.

  • Develop new services and functionalities.

• AI-model training (where applicable, anonymously and in aggregate)

  • Improve the performance and security of our AI models.

• Marketing and communication (with consent where required)

  • Send information about our Services, newsletters and promotional offers.

  • Personalise marketing messages based on your preferences and usage.

• Security and fraud prevention

  • Secure the Platform, Services and Personal Data.

  • Detect, prevent and investigate fraud, abuse, GTCU violations or other unlawful activity.

• Legal and regulatory compliance

  • Fulfil legal obligations (tax, accounting, authority requests).

  • Manage pre-litigation and litigation.

• Application management

  • Assess your application if you apply for employment with exkalibur.

7. Legal Bases for Processing

We rely on the following legal bases (nLPD & GDPR):

• Performance of a contract (Art. 6 (1)(b) GDPR; Art. 31 (2)(a) nLPD)

• Consent (Art. 6 (1)(a) GDPR; Art. 31 (1) nLPD) – e.g. for direct marketing, certain cookies, or sensitive data. Consent may be withdrawn at any time.

• Legal obligation (Art. 6 (1)(c) GDPR; Art. 31 (1) nLPD)

• Legitimate interests (Art. 6 (1)(f) GDPR; Art. 31 (1) nLPD) – such as improving Services, ensuring security, analysing usage, sending marketing for similar products, or defending legal claims. We balance these interests against your rights and freedoms.

8. With Whom Do We Share Your Personal Data?

• Authorised employees and collaborators who need access to perform their duties.

• Processors (service providers) under strict confidentiality and security obligations, including:

  • Hosting providers

  • Payment processors

  • Analytics and performance-tool providers

  • Messaging/communication providers

  • Customer-support-tool providers
    (A list of key processors is available on request; you will be informed of any changes.)

• Judicial, regulatory or administrative authorities where legally required or to protect rights, property or safety.

• Professional advisers (lawyers, auditors, accountants, insurers).

• Potential acquirers in the event of a merger, acquisition, asset sale or similar transaction.

We do not sell, rent or trade your Personal Data for commercial purposes.

9. International Data Transfers

Your data are primarily processed and stored in Switzerland and/or the European Economic Area (EEA). Transfers outside these areas occur only where:

• The destination country has an adequacy decision recognised by the Swiss Federal Council and/or the European Commission; or

• Appropriate safeguards are in place, such as Standard Contractual Clauses, Binding Corporate Rules, or adherence to the Swiss-U.S./EU-U.S. Data Privacy Framework.

Additional technical, organisational or contractual measures are taken as needed following a Transfer Impact Assessment to ensure an equivalent level of protection. More information is available on request (see Section 3).

10. Data-Retention Periods

* Unless a longer or shorter statutory period applies. After expiry, data are securely deleted or anonymised.

11. How We Secure Your Data

• Encryption in transit (SSL/TLS) and, where appropriate, at rest

• Strict access controls (need-to-know basis)

• Network protections (firewalls, intrusion detection)

• Back-up and disaster-recovery procedures

• Regular security audits and penetration tests

• Staff training and awareness programmes

• Internal security policies

• Pseudonymisation or anonymisation where possible

In the unlikely event of a data breach that poses a high risk to your rights and freedoms, we will notify you and the competent supervisory authority without undue delay, as required by law.

12. Cookies and Tracking Technologies

We use cookies and similar technologies (pixels, web beacons) to ensure site functionality, enhance user experience, analyse usage, and support marketing.

• Cookie tool: Complianz

• Purpose: Tracking and marketing

• Consent management: Non-essential cookies are dropped only with your prior consent via our cookie banner or preference centre. You may change preferences or withdraw consent at any time. Disabling certain cookies may impact site functionality.

• Third-party cookies: Partners (e.g. analytics providers, ad networks) may place their own cookies, governed by their privacy policies.

For full details, please refer to our dedicated [Cookie Policy].

13. Your Rights

• Access (Art. 25 nLPD; Art. 15 GDPR)

• Rectification (Art. 32 (1) nLPD; Art. 16 GDPR)

• Erasure – “right to be forgotten” (Art. 32 (2)(c) nLPD; Art. 17 GDPR)

• Restriction of processing (Art. 32 (2)(a)(b) nLPD; Art. 18 GDPR)

• Data portability (Art. 28 nLPD; Art. 20 GDPR)

• Objection (Art. 30 (2)(b) nLPD; Art. 21 GDPR), including to direct marketing

• Withdraw consent (Art. 6 (6) nLPD; Art. 7 (3) GDPR)

• Not be subject to solely automated decisions (Art. 21 nLPD; Art. 22 GDPR)

• Lodge a complaint with a supervisory authority (Art. 49 nLPD; Art. 77 GDPR)

  • Switzerland: Federal Data Protection and Information Commissioner (FDPIC) – Feldeggweg 1, CH-3003 Bern, https://www.edoeb.admin.ch

  • EU: Supervisory authority of your habitual residence/place of work or the place of the alleged infringement – list at https://edpb.europa.eu/about-edpb/board/members_en

Exercising your rights: Contact us via the details in Section 3 or at support@exkalibur.ai. We may request proof of identity. We will respond within one month, extendable by up to two additional months for complex or numerous requests.

14. Profiling and Automated Decision-Making

exkalibur does not rely on fully automated decision-making, including profiling, that produces legal effects or similarly significant impacts on you. If such processing is implemented, we will inform you, explain the logic, significance and consequences, and provide safeguards—such as human intervention, the opportunity to express your view and to contest the decision—unless otherwise permitted by law.

15. Children’s Privacy

We do not knowingly collect Personal Data from children. If you believe we have inadvertently collected such data, please contact us so that we can take appropriate measures.

16. Changes to This Privacy Policy

We may modify this Privacy Policy from time to time to reflect changes in practices, Services or legal requirements. Changes will be posted on this page with an updated date. For material changes, we will notify you by email or via the Platform before they take effect. Please review this Policy regularly.

17. Contact Us

Contact

exkalibur.ai by Digital Solutions SA
Rue de la Roche-de-Mars 5, 2900 Porrentruy, Switzerland
contact@exkalibur.ai
https://exkalibur.ai/