Privacy policy

Version 1.5 · in force from 12 Nov 2026. Every change receives a new version number; earlier versions are archived under What’s new in the customer account.

General information

The protection of your personal data is of particular importance to us. We treat your personal data confidentially and in accordance with the statutory data protection regulations (GDPR, Swiss Data Protection Act) as well as this privacy policy. This policy informs you about which data we collect on our website, how we use it and which rights you have as a user.

Data Controller

Traniva AG Zimbergstrasse 11 8335 Hittnau, Switzerland Telephone: +41 79 730 06 60 Email: info@traniva.com

Collection and Storage

a) When visiting the website When you access our website, information is automatically collected (e.g. IP address, browser type, time of access) . This information is used to ensure the technical operation of the website and to optimise our services. b) When using the contact form When you contact us via a form or by email, we store your details (e.g. name, email address, telephone number) in order to respond to your enquiry.

Disclosure of data

Your data will only be disclosed if this is permitted by law, if you have given your consent, or if it is necessary for the performance of a contract.

Cookies

Your rights at a glance

You have the right at any time to: access the personal data we hold about you; rectify inaccurate data; erasure or restriction of processing; object to data processing; data portability; and withdraw any consent you have given. Please contact us at: info@traniva.com

Data security

Transmission is encrypted (SSL or TLS). You can recognise an encrypted connection by https:// in the address bar and the padlock symbol in your browser. While the connection is encrypted, the data you send us cannot be read by third parties.

Beyond that, we protect our systems by technical and organisational measures against loss, destruction, access, alteration and unauthorised disclosure. No method on the internet offers complete protection; we therefore keep our measures in line with the state of the art.

Validity and amendments to this privacy policy

This privacy policy applies in the version stated above. Further development of our website or changes to legal requirements may make an amendment necessary.

Contact

When contacting the provider (for example, via the contact form or by email), the user’s details are stored for the purpose of processing the enquiry and in the event that follow-up questions arise.

Liability and copyright

Liability for our own content and for external links, as well as copyright, are governed in the legal notice.

Data Protection

When you visit our website, information regarding access (date, time, page accessed) may be stored on the server. This does not constitute an evaluation of personal data (e.g. name, address or email address). Where personal data is collected, this is done – where possible – only with the prior consent of the website user. Data will not be passed on to third parties without the user’s express consent. We expressly point out that the transmission of data over the internet (e.g. by email) may involve security vulnerabilities. Complete protection of data against access by third parties cannot be guaranteed. We cannot accept any liability for damages resulting from such security vulnerabilities. We expressly object to the use of published contact details by third parties for advertising purposes. We reserve the right to take legal action in the event of unsolicited advertising material being sent, e.g. via spam emails. See further information in the «Cookies» section on this page. You can ask us at any time which data about you is stored, see the section «GDPR – requesting personal data» on this page; for exceptions concerning order and invoice data, see the «Marketplace» section.

Registration and user account

Full use of our services requires registration. We use the data entered to maintain the account and provide the service. We inform you by e-mail to the address on file about changes to the scope of the service or technical adjustments.

Which data is stored, how long it stays and when it is deleted is set out in the sections on retention periods and deletion further down this page.

Information

You may request information from us as to whether we are processing your personal data, and if so, you have the right to be informed about this personal data and the additional information specified in Article 15 of the GDPR.

Right to rectification

You have the right to have any inaccurate personal data concerning you rectified; you may request that incomplete personal data be completed in accordance with Article 16 of the GDPR.

Testing, verification and traceability in Process Studio

Anyone using the «Testing and verification» add-on licence records additional details on the process step: whether it must be verified, which risks and controls attach to it, which test cases exist and which results are available. These details come from the customer and are stored in their workspace. The legal basis is performance of the contract (Art. 6(1)(b) GDPR); in regulated environments the fulfilment of the customer’s legal obligations is added (point (c)). See GTC, clause 5.10.

For the test cases themselves – title, precondition and test steps with test data and expected result – we keep a change history per customer: which detail was changed in which version, when and by whom. The person appears with their identifier, not with name or address; authorised users of the customer see the name. If an approved test case is changed, a new version is created and the earlier one remains traceable in the history. Test cases and history are deleted together with the model.

For risks at a process step, the customer records in test management a title, description, assessment, controls with their type and responsible party, and the status; the customer may also name a person as the responsible party. Here too we keep a change history per customer showing the ID of the person making the change. Test cases that the customer takes over from its development documentation carry a note of their origin and a reference to the original test case number. This information comes from the customer, is visible only to users of the customer’s company and is deleted together with the workspace or the customer’s data. To name the responsible party, TAOM offers a selection: people on the process step and from the project organisation, display names of users of the same company, and roles – without email addresses. Legal basis as above.

For execution, the customer creates test plans (cycle, environment, period, included models). For each test run we store the result per test step, remarks, uploaded evidence and the identifier of the person testing; evidence is stored with access protection and delivered only to authorised users of the customer. The overall result is also noted on the process step in the model. Test runs and evidence are deleted together with the model, test plans together with the customer’s other data. Approvals of test cases and acceptances of test runs are recorded with the identifier of the approving person and the time; whether the four-eyes principle was met or – according to the customer’s rule – only logged is noted as well. Defects recorded during test runs are stored with description, severity and the identifier of the reporting person. Depending on the customer’s settings, we forward them to the customer’s ticket system (Jira, SAP Cloud ALM), to its Teams or Slack channel or by email to the process owners and the creators of the test plan; the classification of the process step applies. Defects are deleted together with the model.

From this information, the customer can generate test evidence per model or test plan – for viewing, printing or as a file. It contains test cases with version and approval, runs with results per test step, acceptances and defects, as well as names and identifiers of the persons involved at the company. The evidence is compiled anew each time it is requested and is not stored separately by us; the customer decides on the use and disclosure of the generated file. The classification of the process steps also applies to the evidence.

In the authorization register, the customer records which roles exist in its ERP systems, which functions and authorization objects they contain and which organizational units or workstreams hold them. This is information about the customer’s organization, not about individual persons; assignments of roles to persons are not kept there. For each role we store when and under which identifier it was last changed. An uploaded import file is only read for checking and is not retained; the preview is available for a short time until it is applied or discarded. Roles noted as required on a process step are part of the model. The register is not transferred to connected target systems and is deleted together with the customer’s other data.

In the ERP repository, the customer records which transactions, apps, custom programs, function modules and messages exist in its systems – with name, component and module. It serves as a selection on the process step and as the first source for suggestions when a model is built. It contains no personal data; for each entry we only store when and under which identifier it was last changed. Import files are only read for checking and are not retained. The repository is not transferred to connected target systems and is deleted together with the customer’s other data.

Automated data protection

If your company has activated automated data protection, mail addresses, names, identifiers and other personal data appear in test evidence, user manuals, exports, mails and transfers to target systems only the way your company defines; before transmission to language models they can be replaced by placeholders. The data in the system remains unchanged. For this purpose we store the settings including a change log, for each image the review status with the marked areas and the reviewing person, the mapping of placeholders and the sealed activation confirmation with name, mail address and identifier of the confirming person. External screenshots are reviewed and confirmed by a person in your organisation. Logs of activities in your company are recorded according to your company’s setting – persons in plain text, as a placeholder or not at all – and kept for as long as your company determines; the placeholder mapping is stored encrypted. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR) and our legitimate interest in data minimisation (Art. 6(1)(f), Art. 25 GDPR). Details are set out in the Terms, clauses 16.26 and 16.27; more under Automated data protection.

Process Studio Viewer

With the Viewer, a customer’s employees see the customer’s process models, flows and manuals and, depending on licence and role, test management, risks, reporting, process mining and project times. The Viewer only displays; nothing can be changed in it. Manuals and screenshots can only be viewed, not downloaded.

To sign in, a person enters their business email address and receives a sign-in link. It is valid for 20 minutes and only once. Alternatively, the person signs in with their Process Studio account. At the first sign-in we create a Viewer account. It contains the email address, the company, the status, any role or clearance level set by the customer, the first and last sign-in and the number of views. For sign-in we set a technically necessary cookie (at most 14 days, without email address). To prevent mass requests for sign-in links, we keep an encrypted value derived from the email and IP address for at most one hour.

We store favourites for the person’s start page. Errors or requests reported via «Report improvement» are stored with the email address so that the process owner can reply. Only the person, the process owner and the customer’s administrator see the report. We log sign-ins and the opening of manuals without email address (at most 500 entries). Settings such as window height or chart type remain only in your browser and are not transmitted to us.

Public examples and the example processes marked as BPMN demo contain no customer data. Public examples can be viewed without sign-in; no account is created and no sign-in cookie is set.

The customer’s administrator sees the Viewer accounts of their company and can block them. Accounts without a sign-in for 365 days are deactivated. We delete all data together with the customer account. The purpose is to provide the Viewer on behalf of the customer; the legal basis is the contract with the customer. No external services or external fonts are used.

Support portal and training platform

For support and training, Traniva operates its own systems (support.taom.ai, training.taom.ai). You sign in there with your TAOM account; the data transmitted are name, business email address, company, customer number and licence and support level – no passwords. The content of your requests and your course participation are also processed. Screenshots or model content are only transmitted if you attach them yourself.

The purpose is the provision of support and training under your contract. The data is stored for the duration of the contractual relationship and the statutory retention periods and is accessible only to authorised Traniva employees.

Identifier per account

So that it remains apparent who created a piece of content and who approved it, every account receives a permanent identifier. It is non-speaking – it contains neither name nor address nor user name – and is stored on the content created with that account. Anyone reading a file outside our environment sees a number, not an account. Its assignment to the account is held exclusively within our platform; it is resolved by us in the course of operation or at the customer’s request.

This assignment is a condition of the functions named and cannot be switched off: without it, origin and approval cannot be kept apart. The identifier is assigned to every account and is also recorded for ordinary changes to the model and in the provenance seal – where it appears instead of the user name. The editing record of a model additionally names the display name of the person who saved it last, so that it remains traceable within your company who created the latest state. With the Testing and verification add-on licence, details of who recorded a risk or a test case are added. See GTC, clauses 5.10.5 and 16.15.

Persons without an account of their own whom a customer records as process owners or in their project organisation also receive such an identifier per customer. In model files, only the identifier appears instead of their e-mail address; name and address come from the customer and remain held within our platform. The address is used only where a function requires it – for example when transferring to the target systems connected by the customer or for notifications. For persons without an account, the identifier applies only to the respective customer. See GTC, clause 16.15.

If a customer’s administrator changes the field control, we record who changed what and when (display name and identifier). The last 300 changes per customer can be viewed by that customer’s users in the customer account; they are deleted together with the customer’s data.

For each process step we record which detail was changed and when – by whom (identifier) or from which system connected by the customer. Authorised users of the customer see this history with names; addresses are not shown. The history is deleted together with the model.

If a customer takes over a process model from a file, for example from another modelling tool, we additionally store the uploaded file unchanged in the customer’s workspace – as evidence of its origin, together with a checksum. The file may contain details entered by the source tool, such as names of editors; we do not evaluate or pass them on. It can only be retrieved by authorised users of that customer and is deleted together with the model.

Customer number and customer identifier

Each customer receives a fixed customer number. It links the accounts of a company licence, is retained on upgrades and appears on the invoice, licence confirmation and contract documents as well as in the customer account. We use it for contract administration and to assign workspaces, projects and organisational data to the correct customer; accounts of other customers have no access to them. If an account is removed from a licence, its assignment to the customer lapses.

In files that may be passed on – for example in the provenance seal of an exported model – it is not the customer number that appears but a non-speaking customer identifier. Its assignment to the customer is held exclusively within our platform. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR). See GTC, clause 16.24.

Channels (Microsoft Teams, Slack) and target systems

Customers with the Team add-on licence can have notifications from their processes sent to their own channels in Microsoft Teams or Slack and can store their own target systems such as Jira, Confluence or SAP Cloud ALM. The customer sets up the address in their own environment; we send only there and only notifications from that customer’s processes.

A notification contains in particular the type of event, the company, number, name and path of the process, the activity concerned, the as-of time, a note and links to the process and the activity. In the detailed form, which the customer chooses for each channel, information on the review of the step is added – review obligation, rating and number of risks, test coverage, open defects (for test defects with identifier, severity, test case and test plan) and required roles – together with links to the connected target systems and test management. It contains no further personal data; the classification of the process step applies here as well. Whether the person who triggered it is named, shown only with their personal identifier or not at all is set by the customer for each channel. Transmission takes place on the customer’s instruction. The customer is responsible for the receiving system and the processing there; the respective provider is the customer’s contractual partner and not our sub-processor. We store access keys to target systems encrypted and do not display them again after entry. Each delivery is recorded in the operational log with time and result. See GTC, clauses 5.8.5 and 16.25.

When data is transferred to connected target systems (e.g. Jira or Confluence), the name and link of the documents attached to a process step are included as well – not the files themselves. If the customer keeps documents in its own system (e.g. SharePoint or a document management system), they remain there; we only store the link, and whoever opens it gets access according to the permissions the customer grants in that system. Files uploaded directly in Process Studio are stored access-protected on our server and can only be opened after signing in.

Working together as a team

When several people work on a model together, those involved see the user name and presence of the others as well as their edits; changes are attributed to the person making them. Presence information is processed only briefly. Messages in the team chat are only transmitted to those involved during the joint session and are not stored permanently. These functions are only available to persons of the same customer organisation and to persons expressly invited by the customer. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR); for customers, we process this data as a processor in accordance with the DPA.

Retention after an account is deleted

When a user account is deleted, we remove the associated master data. The identifiers on records already approved remain, however. The reason: without them it would no longer be possible to establish who created a verification record and who approved it – the customer’s chain of evidence would be broken and approvals given would lose their evidential value.

This retention rests on the fulfilment of the customer’s retention and record-keeping obligations and on the legitimate interest in the evidential value of approvals given. It falls under the exceptions to erasure in Art. 17(3)(b) and (e) GDPR. Only the non-speaking identifier is retained, not name or address. The customer determines the duration under the rules applying to them.

Identifiers cannot be changed

Identifiers for process steps, risks and test cases are assigned automatically and cannot subsequently be changed or removed. A link that can be altered unnoticed carries no evidence. This too is a condition of use and cannot be switched off (GTC, clause 16.16).

Operational log

Events are logged for operation and fault finding – logins, saves and error messages, for instance. Persons appear in it only with their identifier, email addresses obscured. The legal basis is our legitimate interest in secure operation (Art. 6(1)(f) GDPR). Older entries are removed automatically; the default is at most 30 days. Customers may adjust the period in their environment. See GTC, clause 16.17.

Consent at purchase and its record

A purchase is not possible without express agreement to the GTC. We record the time of agreement and the version in force on the order; where performance starts immediately, also the separate consent to that and the associated notice that the right of withdrawal lapses. These details appear on the invoice and in the licence document and are filed in the customer account. The legal basis is performance of the contract and the fulfilment of our record-keeping obligations (Art. 6(1)(b) and (c) GDPR). They are retained together with the invoice documents within the statutory periods.

Special Enterprise configurations and zero data retention

For Enterprise customers, the model provider, model, hosting, processing region and data retention can be agreed individually. Where configurations are technically suitable and enabled by the respective provider, this may also include zero data retention (ZDR). In a ZDR configuration, the content transmitted to the model provider for the AI request concerned and the responses produced are not permanently stored once the processing has finished, in accordance with the properties confirmed by contract with the model provider.

ZDR is not part of the TAOM standard configuration and applies only to the Enterprise configuration expressly agreed and confirmed by Traniva. The providers, places of processing and sub-processors used in each case follow from the documentation governing the contract and from the list of sub-processors.

Responsibility for customers in the EEA

Where a customer uses TAOM within the scope of the GDPR and we process personal data exclusively on that customer’s behalf, the customer is the controller and Traniva the processor. The obligations of the controller, in particular informing data subjects and handling data subject requests, remain with the customer. We support them within the framework of the Data Processing Agreement (DPA) (GTC, clause 16.19).

Principle: as long as necessary, no longer

We store personal data only for as long as it is required for the respective purpose or as long as statutory and contractual record-keeping obligations demand. Once the purpose ceases and no retention obligation stands in the way, the data is deleted or anonymised – without you having to ask.

What is excluded from the right to erasure

If you request erasure, we carry it out – except for the following data. The exceptions are not a matter of discretion but are provided for in Art. 17(3) GDPR:

• Invoicing and accounting records – ten years, under commercial and tax law retention obligations (Art. 17(3)(b) GDPR). This covers the order, invoice, payment details and the record of agreement to the GTC.
• Identifiers on approved verification records – for as long as the customer must retain them under their own rules. Without them it would no longer be possible to establish who created a record and who approved it; the chain of evidence would be broken and approvals given would lose their evidential value (Art. 17(3)(b) and (e) GDPR). Only the non-speaking identifier is retained, neither name nor address.
• Verification details on the process step – verification duty, risks, controls, test cases and results belong to the customer’s model, not to your account. They remain even if your account is deleted; the customer as controller decides on their retention.
• The deletion record itself – it evidences that erasure took place and contains your address only as a checksum.

As soon as the respective obligation ends, this data is deleted too. See GTC, clauses 16.18, 16.20 and 16.21.

Retention periods at a glance

Enquiries via the contact form are kept for a further twelve months after being dealt with – so that the history is still known should there be a follow-up – and are then deleted. User accounts are deleted 90 days after the contract ends; the period allows content to be secured or continued, and deletion may be requested earlier at any time. Invoice documents are kept for ten years (statutory obligation), the operational log for at most 30 days, logs of activities in your company for as long as your company determines. Workspaces are subject to level-dependent retention. The identifiers on approved records remain unaffected (see above). See GTC, clauses 16.20 and 16.21.

How a deletion is carried out

If you request the deletion of your data, we first check what will be deleted and what must be retained, then carry out the deletion. You then receive a confirmation with a case reference setting out both explicitly. Please keep that message – we can only confirm the case later by means of that reference. We keep a record of the deletion itself; your address appears in it not in clear text but only as a checksum. A record containing the address would defeat the deletion.

Right to erasure

You have the right to demand that we erase personal data concerning you without undue delay. We must erase it immediately, in particular for one of the following reasons: your personal data is no longer needed for the purpose for which it was collected or otherwise processed; you withdraw the consent on which the processing of your data was based and there is no other legal basis for the processing; your data has been processed unlawfully. The right to erasure does not apply if the personal data concerning you is required for the establishment, exercise or defence of legal claims.

Right to restriction of processing

You have the right to demand that we restrict the processing of your personal data if: you contest the accuracy of the data and we are verifying its accuracy; the processing is unlawful and you oppose the erasure of the data and request the restriction of its use instead; we no longer need the data, but you need it for the establishment, exercise or defence of legal claims; you have objected to the processing of your data and it is not yet clear whether our legitimate grounds override yours.

Right to data portability

You have the right to receive the personal data you have provided in a structured, commonly used and machine-readable format, and you have the right to transmit this data to another controller without hindrance from us, provided that the processing is based on consent or a contract, and our processing is carried out by automated means.

Right to withdraw consent

You have the right to withdraw your consent to the processing of data at any time with future effect. In the event of withdrawal, we will erase the relevant data without delay, provided that further processing cannot be based on a legal ground for processing without consent. The withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent prior to withdrawal.

Right to object

Where we process your personal data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you have the right to object to this processing at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. You can object to processing for direct marketing purposes at any time without giving reasons. An informal notice to the address given in the section «Contact regarding data protection» is sufficient.

Right to lodge a complaint with a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement, if you consider that the processing of your personal data infringes the GDPR. The supervisory authority with which the complaint has been lodged informs the complainant of the progress and outcome of the complaint, including the possibility of a judicial remedy under Article 78 GDPR.

Withdrawal, amendments, corrections and updates

The user has the right, upon request and free of charge, to obtain information about the personal data stored about them. Furthermore, the user has the right to have inaccurate data rectified, and to have their personal data restricted or erased, provided this does not conflict with any statutory retention obligations.

GDPR – requesting personal data

If you would like to know which personal data we have stored about you, or receive a copy of it (Art. 15 GDPR, Art. 25 Swiss FADP), an informal request to the address given in the section «Contact regarding data protection» is sufficient. To ensure that your data does not reach unauthorised persons, we may ask for proof of your identity. The information is provided free of charge and usually within one month. For exceptions concerning order and invoice data, see the «Marketplace» section.

Contact regarding data protection

To contact us regarding data protection, please use one of the following contact options. Controller within the meaning of the GDPR: Laurenc Riese Zimbergstrasse 11 8335 Hittnau Switzerland Email: info(at)traniva(dot)com Phone: +41 79 730 0660 The controller within the meaning of the GDPR is the person who decides, alone or jointly with others, on the purposes and means of the processing of personal data (such as names, email addresses, etc.).

What is personal data?

Personal data is data that reveals or could reveal the identity of the customer. We adhere to a data minimisation policy. Wherever possible, we avoid collecting personal data.

Handling of personal data

Personal data is used exclusively for the purpose of drawing up a contract, determining its content, executing or processing a contractual agreement (Article 6(1)(b) of the GDPR). Data is only passed on to third parties for the provision of services and the fulfilment of the contract. Please see the list of third-party providers below.

Data collection when visiting our website

If you visit our website for information purposes (such as reading content) without registering or otherwise providing us with information, we only collect general technical information that your browser transmits to our server. These include: The page YOU visited; IP address (possibly in anonymised form); date and time of access; duration of the visit; browser type; the referring page; the operating system used. For technical reasons, this data is recorded in a server log file and may be used and stored for the purpose of statistical analysis of this website. This data is not transferred or used for any other purpose. We reserve the right to review the server log files retrospectively if there are specific indications of unlawful use. The use of certain external services, such as embedded videos, may in some cases require the transmission of technical data to third-party providers and is described below.

Data processing for order fulfilment (Marketplace)

To process your order, we work with service providers who support us in whole or in part in performing concluded contracts. Personal data is transmitted to these service providers as explained below. To process payments, we pass on the necessary payment data to the payment institution selected in each case. The payment service providers used are listed in our list of sub-processors. The legal basis for the transmission of the data is Art. 6(1)(b) GDPR.

Marketplace

All Marketplace items and the terms and conditions relating to the respective items are set out here or directly in the item description. Data is stored for further use in connection with the Marketplace and invoicing. For invoicing purposes, at least the first name and surname, user name, postal address and email address must be stored. In the case of software and the purchase of software licences, the user name and the associated licence must also be stored for the purpose of subsequent recovery. The following Marketplace content is affected: software licences and add-on licences, training courses and workshops, enquiries and appointment bookings. Users can request information directly from the Marketplace regarding which data is stored; see the section on this page: * GDPR – requesting personal data

Booking workshops and training courses

All conditions relating to the respective items are contained here or directly in the item description in the Marketplace. See the previous section «Marketplace» on this page. You can ask us at any time which data about you is stored, see the section on this page: «GDPR – requesting personal data». The statutory right of withdrawal for consumers, its conditions, its early expiry when performance begins immediately, the withdrawal address and the model withdrawal form are set out in the GTC, clause 18.

Processing of AI Data

In order to provide the functions of the TAOM Process Studio, user inputs (prompts), uploaded documents, generated models, metadata and technical log data may be processed. This processing is carried out exclusively for the purpose of providing the requested services, for fault analysis, quality assurance, system security and the technical further development of the platform. Depending on the function selected, external AI service providers may be used for this purpose. Only the data required for the respective processing is transferred. Further information on the technologies used or individual enterprise solutions is available via our contact page.

Sub-processors. A complete and continuously maintained overview of all service providers used – with purpose, types of data processed, place of processing and legal basis – can be found in the list of sub-processors. This list is authoritative; information in other documents is explanatory and takes second place to it.

---

Related documents

• Licence terms and GTC
• Data Processing Agreement (DPA)
• Technical and organisational measures (TOM)
• Sub-processors
• Trust Center
• Compliance & Governance