Privacy Policy

At Modulos AG, we highly value your privacy and adhere to the applicable privacy laws when collecting and processing your data. This Privacy Policy outlines the principles of data collection and processing for the Modulos website available at www.modulos.ai (hereinafter the “Website”) and the Modulos AI Governance Platform available at app.modulos.ai (hereinafter the “Platform”). The operator of the Website and Platform is Modulos AG in Zurich.

This Privacy Policy does not extend to any external links that lead to offers from third parties. The data protection regulations of the respective provider apply to these offers.

1. Controller name and contact information

This Privacy Policy applies to the processing of your personal data by Modulos AG (hereinafter “Modulos”, “us” or “we”). For questions or requests related to data processing by us, you may revert by mail to the address in our imprint or write us an e-mail at privacy@modulos.ai.

EU and UK representative (Art. 27 GDPR / UK GDPR). Modulos is established in Switzerland. We have appointed DataRep as our data protection representative in the European Union, the European Economic Area and the United Kingdom. If you are located there, you can contact DataRep instead of us about the processing of your personal data, by email to datarequest@datarep.com, using the online form at www.datarep.com/data-request, or by writing to DataRep at any of its contact locations in the 27 EU countries, the UK, Norway and Iceland, listed at www.datarep.com. Please quote "Modulos AG" in your subject line or correspondence. When writing by post, address your letter to "DataRep" and not to "Modulos AG", or it may not reach them. For questions about our products or services, please contact us directly at privacy@modulos.ai rather than DataRep.

2. Data processing activities and data processing purposes when you visit and use the Website and Platform

Modulos respects your privacy and will not collect any personal data (such as name, address, e-mail address) unless they are automatically collected by cookies or you provided them voluntarily to us.

a. Data automatically collected

When you visit the Website or use the Platform, the browser on your device automatically sends information to our servers. This information is temporarily stored in a so-called log file. The following information is collected without your intervention and stored until it is automatically deleted:

• IP address of the requesting computer, date and time of access,

• name and URL of the retrieved file,

• website from which access is made (referrer URL),

• the browser used and, if applicable, the operating system of your computer as well as the name of your access provider.

The mentioned data will be processed by us for the following purposes:

• ensuring a smooth connection of the Website,

• ensuring comfortable use of the Website,

• evaluation of system security and stability, as well as

• for other administrative purposes.

The legal basis for processing the above-listed data is our legitimate interest in pursuing the purposes listed above for data collection. Under no circumstances do we use the data collected for the purpose of drawing conclusions about you personally.

In addition, we use cookies and analysis services when you visit the Website. For more information, please refer to sections 3 and 4 of this Privacy Policy.

b. Data you provide to us

If you provide information that contains personal data, such as your name, address, e-mail address, and telephone number, we use your personal data only for the purpose of providing you the service or information requested by you. We will store this data on our servers for as long as necessary to provide the services or information requests, unless a longer retention period is based on our legitimate interests or prescribed by law.

c. How we use personal data

We use, stor,e and process personal information for the following general purposes:

• to enable you to access and use the Website and the Platform;

• to operate, protect, improve and optimise the Website, the Platform, and our business, for example by performing analytics, conducting research, personalising or otherwise customising your experience, and to provide customer service and support;

• to help maintain a trusted environment on the Website and the Platform, such as detection and prevention of actual and potential fraud and other harmful activity, conducting investigations and risk assessments, verifying any identifications provided by you, and conducting checks against databases and information sources for fraud detection and prevention, risk assessment, and harm prevention purposes;

• to send you service, support, and administrative messages, reminders, technical notices, updates, security alerts, and information requested by you;

• to send you marketing, advertising, and promotional messages and other information that may be of interest to you, including information about us, our services, or general promotions for partner campaigns and services, if you have agreed to receive such information by subscribing to our newsletter service. You can unsubscribe or opt out of receiving these communications at any time.

• to comply with our legal obligations, resolve any disputes that we may have with any of our users, and to enforce our agreements with third parties.

We do not rent, sell, or otherwise share your personal data with third parties, except with your consent.

Further, we may use third-party service providers to help us deliver our service and run or analyse the Website (e.g., third-party data analytics services to analyse, among other things, server load).

Personal data you submit via the Website (such as your name, email address, company information, and behavioural data relating to your use of the Website) is stored and managed in our proprietary Customer Relationship Management system (CRM), operated by Modulos AG and accessible only to authorised Modulos staff at crm.modulos.ai. The CRM relies on EEA-based third-party cloud infrastructure providers (including database hosting and email delivery services), all operating within the European Union. Each provider acts solely on our instructions and is contractually bound to appropriate data protection obligations consistent with the GDPR.

We also reserve the right to disclose your personal data to (a) comply with relevant laws, regulatory requirements and to respond to lawful requests, court orders, and legal process; (b) to protect and defend the rights or property of us or third parties, including enforcing agreements, policies, and terms of use; (c) in an emergency, including to protect the safety of our employees or any person, or (d) in connection with investigating and preventing fraud.

We also aggregate data into anonymized system usage statistics.

Access to personal data is limited to those employees, as well as sales and cooperation partners, who need to know this data. The persons and companies concerned are obliged to maintain confidentiality and comply with the applicable data protection laws.

d. Identity and access management for the Platform

Access to the Modulos AI Governance Platform is managed through Zitadel, an identity and access management solution provided by ZITADEL (CAOS AG), Switzerland. Zitadel handles account creation, authentication, single sign-on, multi-factor authentication and session management for the Platform, acting as our data processor under a data processing agreement.

When you register for or sign in to the Platform, the following data is processed through Zitadel on our behalf:

• your email address, username and display name, and any profile information you choose to provide;

• authentication credentials and factors (passwords are stored only in salted and hashed form, together with any multi-factor authentication methods you enrol);

• login and session metadata, such as IP address, device and browser information, and the date and time of each authentication attempt;

• audit records of security-relevant account events, such as successful and failed logins, password changes and permission changes.

This data is processed in order to authenticate you, to protect your account and the Platform against unauthorised access, to enforce the access rights assigned to you within the Platform, and to meet our own security and audit obligations. The legal basis for this processing is the performance of the contract with you or with the organisation on whose behalf you use the Platform (Art. 6(1)(b) GDPR), and our legitimate interest in the security and integrity of the Platform (Art. 6(1)(f) GDPR). Because authentication is strictly necessary for the operation of the Platform, the cookies set by Zitadel are strictly necessary cookies and are not subject to consent.

Platform identity data is hosted in Switzerland and within the European Economic Area and is not transferred to third countries. Further information on Zitadel's data protection practices is available at https://zitadel.com/docs/legal/policies/privacy-policy.

If your organisation uses its own identity provider (for example a corporate SAML or OpenID Connect single sign-on), Zitadel federates the authentication request to that provider. In that case, your employer or organisation remains the controller of the account data held in its own directory, and its privacy notice applies to that data.

e. Newsletter and email communication (Mautic)

We send our newsletter, event invitations and other email communication with Mautic, an open-source marketing automation software that we operate ourselves on our own servers in Microsoft Azure in the European Union (West Europe, Netherlands). No data is shared with the Mautic project or any other third party for this purpose. We process your email address, name, company and the details you provide when subscribing or registering, together with information on whether you open our emails and click on links in them, so that we can measure and improve our communication. We send marketing emails only with your consent (Art. 6(1)(a) GDPR) or, for existing business contacts, on the basis of our legitimate interest (Art. 6(1)(f) GDPR). You can unsubscribe at any time via the link in every email or by writing to privacy@modulos.ai.

f. B2B prospecting

If you work for a company that may benefit from our services, we may contact you even if you have not been in touch with us before. For this purpose we process business contact details: your name, job title, company, business email address and phone number, and the URL of your professional profile. We obtain these details from publicly available sources, such as company websites and LinkedIn, and from the B2B data provider Apollo.io (ZenLeads Inc., trading as Apollo.io, USA). When we look up business contact details with Apollo.io we disclose the email address or company domain we are querying. Apollo.io acts as an independent controller of the business contact information held in its own database, so it may retain and use that information for its own purposes alongside providing the service to us. We send our outreach emails with Instantly (Instantly, USA). If you respond or engage with us, we store your details in our CRM, hosted in the European Union.

We process this data on the basis of our legitimate interest in presenting our services to businesses (Art. 6(1)(f) GDPR). Transfers to Apollo.io and Instantly in the USA are based on the EU Standard Contractual Clauses or, where applicable, the EU-U.S. Data Privacy Framework. If you do not respond or engage with us, we delete or anonymise your data two years after our last interaction.

You can object to this processing at any time, free of charge, by using the unsubscribe link in any of our emails or by writing to privacy@modulos.ai. We will then stop contacting you and keep only the minimum information needed to respect your objection.

3. Cookies

We use cookies on our Website. These are small files that your browser automatically creates and that are stored on your device (laptop, tablet, smartphone, etc.) when you visit our Website. Information is stored in the cookie that results in each case in connection with the specifically used terminal device. However, this does not mean that we immediately become aware of your identity.

The use of cookies serves, on the one hand, to make the use of our Website more pleasant for you. For example, we use so-called session cookies to recognize that you have already visited individual pages of the Website. These will be deleted automatically after leaving our Website. In addition, we also use temporary cookies that are stored on your end device for a specified period of time to optimize user-friendliness. If you visit our Website again to use our services, it will automatically recognize that you have already been with us and what entries and settings you have made, so that you do not have to enter them again.

On the other hand, we use cookies to statistically record the use of the Website and to evaluate it for the purpose of optimising our service. These cookies enable us to automatically recognize when you return to our Website that you have already been with us. These cookies are automatically deleted after a defined period of time.

Strictly necessary cookies are placed on the basis of our legitimate interest in operating the Website. All non-essential cookies (analytics, marketing, personalization) are placed only after you have provided explicit prior consent via our Cookie Consent Management Platform (CMP). You can manage or withdraw your cookie consent at any time through the cookie settings link in the footer of the Website. Withdrawing consent does not affect the lawfulness of processing based on consent before its withdrawal.

Most browsers automatically accept cookies. However, you can configure your browser so that no cookies are stored on your computer, or a message always appears before a new cookie is created. However, the complete deactivation of cookies can lead to the fact that you cannot use all the functions of the Website. For full details on the types of cookies we use, their purposes, and how to manage your preferences, please refer to our Cookie Policy at www.modulos.ai/cookie-policy/.

4. Analytics Tools

We use tracking tools to ensure the design and continuous optimisation of the Website and to record and evaluate use of the Website for the purpose of improving our offer. We use the tracking measures listed below, each of which is activated only after you have provided your explicit prior consent via our Cookie Consent Management Platform (CMP).

The respective data processing purposes and data categories can be found in the information on the corresponding tracking tools below.

Secondly, we use social plug-ins from different providers on the Website (Facebook, Twitter, LinkedIn, and Instagram). This can be accompanied by a data collection of the respective providers.

Google Analytics

For the purpose of the continuous optimization of our pages and their design, we use Google Analytics, a web analysis service provided by Google Ireland Ltd., Ireland, and Google Inc., USA (Google) (“Google”). In this context, pseudonymised user profiles are created, and cookies (see section 3) are used. The information generated by the cookie about your use of the Website, such as

• Browser type/version,

• the operating system used,

• Referrer URL (the previously visited page),

• Host name of the accessing computer (IP address),

• Time of the server request

are transferred to a Google server in the USA and stored there. The transfer of personal data to the USA is based on the Standard Contractual Clauses (SCCs) approved by the European Commission (as per Google’s Data Processing Terms) and, where applicable, the EU-U.S. Data Privacy Framework. The information is used to evaluate the use of the Website, to compile reports on the Website activities, and to provide further services associated with the use of the Website and the Internet for the purposes of market research and demand-oriented design of these Internet pages. This information may also be transferred to third parties if this is required by law or if third parties process this data on behalf of Google. Under no circumstances will your IP address be merged with other data from Google. The IP addresses are anonymized so that an assignment is not possible (IP masking).

You may refuse the use of cookies by selecting the appropriate settings on your browser. Please note that if you do this, you may not be able to use the full functionality of the Website.

You can also prevent the collection of data generated by the cookie and related to your use of the Website (including your IP address) and the processing of this data by Google by downloading and installing a browser add-on (Google Analytics Opt-out Browser Add-on).

As an alternative to the browser add-on, especially for browsers on mobile devices, you can also prevent Google Analytics from collecting data by clicking here.

An opt-out cookie is set to prevent future collection of your data when you visit the Website. The opt-out cookie is only valid in this browser and only for the Website and is stored on your device. If you delete the cookies in this browser, you must set the opt-out cookie again.

Further information on data protection in connection with Google Analytics can be found in the Google Analytics Help

Google Analytics is only activated after you have provided your explicit prior consent via our Cookie Consent Management Platform (CMP). You may withdraw your consent at any time through the cookie settings link available in the footer of the Website.

Matomo

We use Matomo, an open-source web analytics software, to understand how visitors use the Website. We operate Matomo ourselves on our own servers in Microsoft Azure in the European Union (West Europe, Netherlands), so the collected data stays under our control and is not shared with the Matomo project or any other third party. Matomo processes information such as pages visited, the time and duration of the visit, the referring page, browser and device type, and a shortened (anonymised) IP address. Matomo is only activated after you have provided your explicit prior consent via our Cookie Consent Management Platform (CMP). You may withdraw your consent at any time through the cookie settings link available in the footer of the Website.

Microsoft Clarity

We use Microsoft Clarity to better understand how visitors interact with our Website. Clarity is a user behavior analytics tool provided by Microsoft that helps us understand how users navigate, use, and interact with our Website. The service collects data about your device and your interaction with our Website, including:

• Mouse movements, clicks, and scrolling

• Page load timing and performance data

• Browser viewport dimensions and screen resolution

• Pages visited and navigation between pages

• Geographic location (country level only)

• Device type and browser information

• Language preferences

Clarity may collect some personal data, such as IP address, but this information is pseudonymized and not used to identify individual users. The data collected is used to provide us with aggregated insights into user behavior, helping us improve our Website’s usability and performance.

Clarity uses cookies and similar tracking technologies to collect this information. Microsoft Clarity is only activated after you have provided your explicit prior consent via our Cookie Consent Management Platform (CMP). The data collected is processed and stored by Microsoft in the USA. Microsoft provides Clarity as an independent controller rather than as a processor acting on our instructions, so Microsoft's own processing of this data is governed by the Microsoft Privacy Statement. We have not concluded a data processing agreement or Standard Contractual Clauses with Microsoft for Clarity. The transfer to the USA relies on Microsoft's certification under the EU-U.S. Data Privacy Framework. You may withdraw your consent at any time through the cookie settings link available in the footer of the Website.

You can opt out of Clarity tracking by adjusting your browser settings to block cookies or by using your browser’s “Do Not Track” setting. For more information about Microsoft Clarity’s privacy practices, please visit their privacy policy at Microsoft Clarity Privacy Policy.

Sentry
We use Sentry in order to optimize our Website and collect your user feedback using a
widget. Feedback collected via the Feedback Widget may have some or all of the following
information (depending on what you mark as required and what’s available from the error
context):

• Description from the user

• User email

• Associated replay event (with up to 60 seconds of replay recording before the user submitted the feedback)

• Learn more about how to set up Session Replay here.

• URL of the page the user was on when they submitted the feedback

• Tag

The mentioned replay function allows us to see video-like reproductions of user sessions in order to help us understand what happened before, during, and after an error or performance issue occurred. A session replay is not a video recording. It is a video-like reproduction of a user session created from snapshots of your web application’s DOM state (the browser’s in-memory representation of HTML).

For further information, please see https://docs.sentry.io/product/user-feedback/ and Sentry Session Replay. Sentry session replay and feedback functionality is only activated after you have provided your explicit prior consent via our Cookie Consent Management Platform (CMP). You may withdraw your consent at any time through the cookie settings link available in the footer of the Website.

Social Media

Facebook is a social network of the American company Meta Platforms, Inc. (1601 S. Willow Road, Menlo Park, CA 94025, USA). X, formerly Twitter, is a microblogging service provided by the American company X, Corp. (1355 Market Street, Suite 900, San Francisco, CA 94103). LinkedIn is a social network of LinkedIn Corporation (2029 Stierlin Court, Mountain View, CA 94043, USA). Instagram is a social network of the American company Meta Platforms, Inc.

Social media plugins are only loaded after you have provided your explicit prior consent via our Cookie Consent Management Platform (CMP). Prior to your consent, the plugins are disabled, and no connection to third-party servers is established. Once activated, your browser establishes a direct connection with the servers of the respective provider. Please note that, pursuant to the CJEU’s Fashion ID ruling, Modulos AG acts as a joint controller with the respective social media provider for the initial data transmission that occurs upon loading the plugin. The information that the Website has been accessed is transmitted to the respective provider. If you are a registered user of the service in question, the provider can also assign the page access to the corresponding profile and, under certain circumstances, collect further data. Further information on data collection and processing can be found in the data protection declarations of the respective providers, which are available under www.facebook.com, www.twitter.com, www.linkedin.com and www.instagram.com.

5. Sharing of data

Your personal data will not be shared with third parties for purposes other than those listed below.

We will only pass on your personal data to third parties if:

• You have given your express consent,

• The disclosure is necessary to assert, exercise, or defend legal claims, and there is no reason to assume that you have an overriding interest worthy of protection in the non-disclosure of your data.

• in the event that a legal obligation exists for the transfer; or

• This is legally permissible and necessary for the execution of contractual relationships with you.

We store, use, and process your data, including any personal information, in Switzerland or within the European Economic Area (“EEA”). You should note that laws vary from jurisdiction to jurisdiction, and so laws and regulations relating to privacy and data disclosure, applicable to the places where your information is transferred to or stored, used, or processed, may be different from the laws and regulations applicable to your place of residency. We take the legally required safeguards and contractual measures to ensure that any parties we transfer personal data to do so in keeping with the level of data protection and security prescribed by the applicable data protection regulation.

6. Your rights

You have the right:

• to request information about your personal data processed by us. In particular, you may request information about the purposes of processing, the category of personal data, the categories of recipients to whom your data have been or will be disclosed, the planned storage period, the existence of a right to rectification, deletion, restriction of processing or objection, the existence of a right of appeal, the origin of your data, if these have not been collected by us, and the existence of automated decision-making including profiling and, if applicable, meaningful information on their details;

• request the correction of incorrect or incomplete personal data stored by us;

• to demand the deletion of your personal data stored by us, unless the processing is justified by our legitimate interests, necessary to fulfil a legal obligation, for reasons of public interest, or to assert, exercise, or defend legal claims;

• to demand the restriction of the processing of your personal data if you dispute the accuracy of the data, if the processing is unlawful but you refuse to delete it, and we no longer need the data, but if you need it to assert, exercise, or defend legal claims, or if you have filed an objection to the processing;

• if our data processing is based on your consent, you have the right to revoke your consent to us at any time. As a result, we are no longer allowed to continue processing data based on this consent in the future;

• you also have the right to receive the personal data you have provided to us based on consent or a contract in a structured, common, and machine-readable format or to request its transfer to another processor;

• to complain to a supervisory authority. In Switzerland, you can contact the Federal Data Protection and Information Commissioner (www.edoeb.admin.ch,) and outside Switzerland, the supervisory authority responsible for your concerns.

You can reach the responsible office for such requests and demands as follows:

E-Mail: privacy@modulos.ai

We are obliged to verify your identity in such requests. Inquiries can therefore only be processed if they are accompanied by suitable proof of your identity (copy of identity card or similar).

7. Objection

Within the scope of application of the GDPR, you also have the right to object to the processing of your personal data, provided that your personal data are processed on the basis of legitimate interests and provided that there are reasons for the objection that arise from your particular situation or that the objection is directed against direct advertising. In the latter case, you have a general right of objection, which will be implemented without specifying a particular situation.

For withdrawing consent or objecting to any data processing as described above, simply send an email with your specific request to privacy@modulos.ai.

7a. Swiss Data Protection (nFADP / revDSG)

As a company domiciled in Switzerland, Modulos AG is also subject to the revised Federal Act on Data Protection (Bundesgesetz über den Datenschutz, revDSG / nFADP), which has been in force since 1 September 2023.

Swiss residents have rights under the nFADP, including the right of access, the right to rectification, the right to erasure (subject to legal retention requirements), the right to data portability, and the right to object to certain processing activities. These rights may be exercised by contacting us at privacy@modulos.ai. Where the nFADP applies, the competent supervisory authority is the Federal Data Protection and Information Commissioner (FDPIC) at www.edoeb.admin.ch.

Where both the GDPR and the nFADP apply, we apply the higher standard of protection. Transfers of personal data from Switzerland to third countries are governed by the applicable provisions of the nFADP, and we rely on equivalence decisions, Standard Contractual Clauses recognised under Swiss law, or other lawful transfer mechanisms as appropriate.

8. Data retention

We may retain information regarding you and your use of the Website and the Platform, including personally identifying information, for as long as needed to provide you with our services and the uses described in this Privacy Policy. We may, in any even,t retain and use such data as necessary to comply with our legal obligations, maintain accurate accounting, financial, and other operational records, resolve disputes, and enforce our rights connected to your use of the Website and the Platform.

9. Data security

We take commercially reasonable technical and organisational precautions to prevent the loss, misuse, or alteration of your personal information and data. Accordingly, we store all the personal information you provide on secure (password- and firewall-protected) servers.

You also acknowledge that no technical and organisational measures can fully eliminate security risks connected with the transmission of information over the Internet. We therefore cannot guarantee the security of data sent over the Internet. We use the common SSL (Secure Socket Layer) method in connection with the highest level of encryption supported by your browser. Whether a single page of the Website is transmitted in encrypted form is indicated by the closed display of the key or lock symbol in the lower status bar of your browser.

We also use suitable technical and organisational security measures to protect your data against accidental or intentional manipulation, partial or complete loss, destruction or unauthorised access by third parties. Our security measures are continuously improved in line with technological developments.

10. Validity of this Privacy Policy

The version number and effective date of this Privacy Policy are shown at the top of this page, and in the footer of the PDF version.

Due to the further development of the Website, the Platform, and our offers, or due to changed legal or official requirements, it may become necessary to change this Privacy Policy. We therefore reserve the right to update and modify this Privacy Policy from time to time.

You can access, download, save, or print this Privacy Policy at any time. If you have any questions regarding our Privacy Policy, please contact us.