1. Controller and contact
The controller for processing on x25pronto.ch is Management Consulting Mayr, Waldaustrasse 2, 9500 Wil SG, Switzerland. “x25pronto” and “x25pronto.ch” are business and service names of the controller and are not a separate legal entity. Privacy requests may be sent to info@x25pronto.ch or +41 71 554 72 93.
2. Categories of data processed
Depending on use, we process identity and contact data, account and security data, email-verification and activation status, timestamps of Terms acceptance, billing and business data, application, courier-partner, vehicle, insurance and evidence data, payment and payout details, routes, schedules, shipment details, prices, booking, order, accounting and complaint data, pickup and delivery evidence including photos, correspondence and technical access, device, log, analytics and security data. For the referral programme, data may additionally include the referring user, the recipient email address, invitation and activation status and technically recorded delivery, open and click events.
3. Purposes
Processing supports website, app and portal operation, registration, account activation, authentication and security, documentation of consents and confirmations, address and route checks, pricing, bookings and payment processing, transport performance, partner assignment, the driver portal, settlement and payouts, complaint handling, the referral programme, contractual communications, lawful customer communications, accounting, evidence, abuse and fraud prevention, error analysis, audience measurement, legal obligations and the establishment, exercise or defence of legal claims.
4. Registration, Terms acceptance and account activation
During registration, the system may record whether the required Terms/privacy confirmation was provided and when it was provided. New accounts may remain inactive until the email address is confirmed. One-time tokens may be generated for activation or comparable security processes, stored only in hashed or otherwise technically protected form, assigned an expiry and invalidated after use. Email-verification status is used for account, security and contractual purposes.
5. Account activation is not marketing consent
Account activation or verification, a booking, an application or a courier partnership does not by itself constitute consent to marketing. Marketing or other communications not strictly required for the requested service are sent only where a lawful basis exists. Unsubscribes, suppression records and “do not contact” flags are respected so that suppressed addresses are not reused for the relevant communications.
6. Switzerland as contract and billing country
The service is designed for Switzerland. For signed-in accounts and bookings, the billing country is stored server-side as ISO country code CH. It is displayed as “Schweiz” on German pages and “Switzerland” on English pages. A manipulated browser value is not accepted for these fields.
7. Bookings, driver portal and courier partners
For the performance of a specific transport, independent courier partners used for that assignment receive only the order, contact, route, schedule, shipment and evidence information required for performance. The driver portal may process business, contact, UID, billing, vehicle, insurance, bank/payout, terms, order, evidence, complaint and settlement data. System status, timestamps, acceptances, rejections, pickup and delivery evidence and comparable events may be logged for contract performance, quality assurance, settlement, complaint handling and abuse prevention.
8. Referral programme
Within the referral programme, a signed-in user may enter a recipient email address and review or confirm the invitation before sending it. Programme administration and attribution may process the referrer, recipient, delivery status, account activation and reward status together with technical open and click events. Automated fetches, security scanners or similar technical accesses may be evaluated separately from human interactions. These data support programme operation, attribution, statistics and abuse detection. A referral does not replace any consent that may be required for further marketing to the recipient.
9. Payment data
Card payments are processed through Stripe. x25pronto receives transaction information needed for authorisation, payment status, accounting, refunds, invoices and documents, but not full card details. Depending on the payment method, Apple Pay or Google Pay may be used as a wallet within the Stripe payment flow. Payment and invoice status may be processed to automate access to portal or service functions where contractually provided.
10. AI Bot
The AI Bot uses approved x25pronto content only as its knowledge base. Questions and the chat history needed for context are sent to the configured AI service for generation and may be logged server-side for operation, quality, abuse prevention and administration. In the browser, AI chat history is kept only in sessionStorage so that it survives page changes and reloads within the same browser session; it is not intended as permanent local history. For signed-in accounts the privacy switch is automatically active; for signed-out sessions it is initially inactive.
11. WhatsApp and electronic communications
When WhatsApp is opened, the message is handed to the WhatsApp service selected by you. Until then, the draft remains local in the browser; logged communication events may be processed for operational and abuse analysis. Contract, account, security, order and partner information may be sent electronically to the contact details stored in the account. Delivery, bounce, open or comparable technical status data may be processed where needed for operation, security, evidence, deliverability or lawful communication. Further processing by WhatsApp/Meta or other external communication providers is governed by their own terms and privacy information.
12. First-party statistics, Google Tag Manager and local storage
Data-minimised baseline statistics are operated through x25pronto’s own infrastructure without a persistent browser identifier. Optional extended first-party analytics with visitor and session identifiers is enabled only according to the choice made in Cookie settings. With that consent, the Google Tag Manager web container (container ID GTM-5XQMWR58) is additionally enabled. Permission is verified server-side using a signed, technically necessary consent record. The GTM bootstrap is delivered only after the backend check through /api/privacy/gtm.js; without valid server-side consent that endpoint remains blocked. Google Analytics is not configured on x25pronto.ch. Advertising and personalisation storage remain denied by x25pronto by default. Session-related functions may use cookies, sessionStorage or other technically necessary browser storage.
13. Recipients and service providers
Data may be disclosed as necessary to hosting, email, payment, mapping/routing, communication, AI and IT service providers and to courier partners used for a transport. Providers receive only data required for the relevant function. Processing abroad may occur where a provider operates there; the requirements and safeguards required under Swiss data protection law are taken into account.
14. Retention, archiving and deletion
Data is retained only as long as needed for the relevant purpose, evidence, complaint handling, security or statutory retention obligations. Accounting, contract, payment, security and evidence data may therefore be retained longer. For archived or deleted accounts, active access may be blocked and the current contact address technically replaced or suppressed for operational communications; data still required for legal, accounting, security or evidentiary reasons may remain in restricted form until the relevant purpose ends.
15. Data security
We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse or unlawful alteration. Measures may include access controls, hashed one-time tokens, server-side plausibility and permission checks, logging of security-relevant events and separation of active from archived accounts.
16. Data-subject rights
Under applicable Swiss data protection law, data subjects may in particular request access and correction and, where no retention duty, overriding justification or other legal basis prevents it, deletion or restriction of processing. Where statutory conditions are met, rights to data export or transfer may also apply. Requests should be sent to info@x25pronto.ch.