Version 1.0 · Updated 2026-08-12
This page describes the personal data processed by Formboard, why it is processed, and the rights available to you. It is written in accordance with the Swiss Federal Act on Data Protection (nFADP) and the General Data Protection Regulation (GDPR).
This distinction determines who to address a request to.
The organisation using Formboard is the controller
It decides which participant data it enters and why. If you are a course participant, address your requests to the training organisation: it is the one holding your data.
The publisher of Formboard is the processor
It provides and operates the application, and processes participant data only in order to run it. It does not use that data on its own behalf or for commercial purposes.
Email address, name, and where provided a profile picture and phone number.
Participant identity and contact details, employer and billing address, enrolments, attendance, invoices and certificates.
Server logs: IP address, date and time of requests, in the event of an error.
The application provides no field intended for sensitive data within the meaning of art. 5(c) nFADP (health, religious or political views, biometric data). Free-text fields must not be used to record any.
Art. 31(2)(a) nFADP / art. 6(1)(b) GDPR
Provision of the application, management of accounts, courses, invoicing and certificates.
Art. 31(1) nFADP / art. 6(1)(c) GDPR
Retention of accounting records for ten years (art. 958f CO).
Art. 31(1) nFADP / art. 6(1)(f) GDPR
Service security, abuse prevention, fault diagnosis.
| Data | Period |
|---|---|
| Active accounts | Duration of the contract |
| Deleted accounts | 30 days |
| Accounting records | 10 years (art. 958f CO) |
| Server logs | 12 months |
Accounting records cannot be deleted before the statutory period expires, even following an erasure request.
Data is never sold, transferred or used for advertising. It may be disclosed:
Hosting is provided directly by the publisher on infrastructure located in Switzerland; no third-party host is involved. The following services receive data only if your organisation enables them by entering its own credentials:
Resend
Service · Email delivery
Location · United States / EU
Only if enabled by your organisation
https://resend.com/legal/dpaSMSFactor
Service · SMS delivery
Location · France (EU)
Only if enabled by your organisation
https://www.smsfactor.comData is hosted in Switzerland. A transfer occurs only if your organisation enables email or SMS sending: the recipients of those messages are then passed to the provider concerned, which may be located in the European Union or the United States. Such transfers are governed by the European Commission's standard contractual clauses, recognised by the FDPIC.
The following measures are in place:
You have the rights of access, rectification, erasure, restriction, objection and portability, as well as the right to withdraw consent already given.
Who to contact
If you are a course participant, contact the training organisation: it is the controller of your data.
If you hold a Formboard user account, write to the address below. privacy@formboard.ch
You may lodge a complaint with the supervisory authority:
Federal Data Protection and Information Commissioner (FDPIC)
https://www.edoeb.admin.chThis policy may be amended. In the event of a material change, account holders are notified by email at least 30 days in advance. The version in force is always the one published on this page.
For any question about this policy or the processing of your data: