Legal documents
Privacy Notice
Last updated: 1 October 2026 · The Training Platform, an Appogée product
1. Controller and contact details
This privacy notice describes how Appogée Sàrl, a limited liability company under Swiss law entered in the commercial register under UID number CHE-340.224.808, with its registered office at Chemin de Paudex 5, 1132 Lully, Canton of Vaud, Switzerland, which operates The Training Platform service (hereinafter we), collects, uses and protects personal data in connection with the website, the Customer Area and the training portals of that service.
Appogée Sàrl acts as controller for the data that we process on our own behalf, as described in this notice. For training data processed on the portals, it acts as processor for the organisation that operates the portal, as specified in section 2.
We process personal data in accordance with the Swiss Federal Act on Data Protection (FADP), in force since 1 September 2023, and, where it applies, the European Union General Data Protection Regulation (GDPR) for persons located in the European Union or the European Economic Area.
For any question relating to this notice or to the exercise of your rights, you may contact Appogée Sàrl by email at info@the-training-platform.ch.
2. Scope and allocation of roles
This notice applies in three contexts. The first is the public website https://the-training-platform.ch, which anyone may consult. The second is the Customer Area, in which the organisations that subscribe to The Training Platform (hereinafter the Organisations) manage their account, their subscription and their invoicing. The third consists of the training portals, accessible at an address specific to each Organisation, on which administrators, trainers, company managers and learners have an account.
On the portals, we process on our own behalf the data necessary for the operation and security of the service: accounts and one-time login codes, authentication and security logs, strictly necessary cookies, audience measurement where you consent to it, error reports, transactional email delivery metadata, and support requests.
The training data entered or uploaded on a portal, in particular data relating to participants, registrations, documents and invoices, belong to the Organisation that operates that portal. That Organisation is the controller of those data and determines the purposes of their processing. We process them solely on its behalf and on its instructions, as processor, in accordance with the Data Processing Agreement concluded with it.
For any question relating to training data, in particular to exercise your rights in respect of them, please consult the privacy policy of the Organisation concerned and contact it directly. If such a request reaches us, we forward it to the Organisation as quickly as possible.
3. Data processed
On the public website, we use no audience measurement tool and no tracking cookie. When you write to us using the contact form, we process the information you provide in it, such as your name, your email address, the name of your organisation where applicable and the content of your message.
In the Customer Area, we process the account data of the Organisation and its users (surname, first name, email address), company data (company name and billing address), as well as subscription and billing data. Payments are processed by our payment service provider: The Training Platform never receives or stores your payment card data.
On the portals, we process your account data (surname, first name, email address, role within the Organisation), the one-time login codes sent to you, as well as authentication and security logs, which record in particular the date and time of logins and technical information relating to them.
Where you consent to it, we process audience measurement data on the portals, such as the pages viewed, the duration of the visit and technical information about your browser and device. We also process transactional email delivery metadata (in particular the recipient and the date of sending) and the content of the support requests you send us.
When the website, the Customer Area or a portal encounters an error, we collect technical diagnostics: the error message and its technical trace, the page concerned, the application version, the browser and device type, and the date and time.
4. Purposes of processing and legal bases
We process account, company, subscription and billing data in order to provide the service subscribed to, manage the contractual relationship and collect payments. Where the GDPR applies, this processing is based on the performance of the contract (Article 6(1)(b) GDPR).
We retain accounting records and invoices in order to comply with our legal obligations, in particular in accounting and tax matters. Where the GDPR applies, this processing is based on compliance with a legal obligation (Article 6(1)(c) GDPR).
We process portal accounts and login codes, authentication and security logs, error reports, transactional email delivery metadata and messages received via the contact form or through support in order to ensure the operation, security and improvement of the service and to respond to your requests. Where the GDPR applies, this processing is based on our legitimate interest in providing a reliable and secure service and in communicating with the persons who contact us (Article 6(1)(f) GDPR), or on the performance of the contract where the processing is necessary for the service subscribed to.
We carry out audience measurement on the portals only with your consent (Article 6(1)(a) GDPR). You may withdraw this consent at any time, without affecting the lawfulness of processing carried out before its withdrawal.
Under Swiss law, we process data in compliance with the principles of the FADP, in particular lawfulness, good faith, proportionality and purpose limitation.
6. Processors
We use the following sub-processors (processors within the meaning of the Data Processing Agreement), which process personal data on our behalf and, where applicable, on behalf of the Organisations. This list is the reference list of sub-processors to which the Data Processing Agreement refers. Each sub-processor is bound by data protection obligations that comply with the FADP and, where applicable, the GDPR.
The portals and the database are hosted in Switzerland by Infomaniak. Infomaniak, in Switzerland, provides domain name management (DNS), the relay for sending transactional emails and object storage in Switzerland for the files of the public website and the Customer Area, with a daily backup copy in Switzerland.
Payrexx AG, in Thun (Switzerland), processes card and TWINT payments, whether for the payment of subscriptions to the service or for payments made by participants on the portals. Sentry processes technical error reports in its European Union region. Matomo, the audience measurement tool, is self-hosted on our infrastructure in Switzerland, so that no audience measurement data are transmitted to a third party.
Google Firebase Storage stores the files uploaded on the portals, such as participants' documents and Organisations' logos; this storage is located outside Switzerland. Amazon S3 stores the database backups; this storage is also located outside Switzerland. Section 7 describes the safeguards applicable to these transfers.
When an Organisation connects its own mailbox to its portal, the emails of that portal are sent through the provider chosen by the Organisation, namely either Microsoft 365 or the Organisation's SMTP provider.
We inform the Organisations of any addition or replacement of a sub-processor at least 30 days in advance, and each Organisation may object under the conditions set out in the Data Processing Agreement.
7. Transfers of data outside Switzerland
The portals and the database are hosted in Switzerland. Certain data are, however, processed outside Switzerland: the files uploaded on the portals, stored with Google Firebase Storage, and the database backups, stored with Amazon S3.
Technical error reports are processed by Sentry in its European Union region. The Member States of the European Union are recognised by the Federal Council as providing an adequate level of data protection.
Any disclosure of personal data abroad relies on one of the grounds provided for in Article 16 FADP: where the country of destination is on the Federal Council's list of countries providing an adequate level of protection (Article 16(1) FADP), the disclosure relies on that decision; otherwise, appropriate protection is ensured by standard data protection clauses recognised by the Federal Data Protection and Information Commissioner (FDPIC) (Article 16(2)(d) FADP). The list of destination countries will be provided to you on request sent to info@the-training-platform.ch.
We plan to move the storage of uploaded files and database backups to providers established in Switzerland. This move has not yet taken place; this notice will be updated when it has.
8. Retention period
We retain personal data for as long as necessary for the purposes for which they are processed, and then delete or anonymise them, subject to statutory retention obligations.
Accounting records, including invoices and the related billing data, are retained for 10 years in accordance with Article 958f of the Swiss Code of Obligations.
When an account is deleted, invoices already issued are kept for the statutory retention period stated above. From the deletion onwards, they are no longer linked to the deleted user.
Portal accounts are retained for 24 months after the last activity. Authentication and security logs are retained for 12 months. Technical error reports are retained for 90 days. The audience measurement cookie has a lifetime of 13 months; raw visit logs are deleted after 6 months, and only aggregated reports are retained.
Training data processed on behalf of an Organisation are retained in accordance with its instructions and returned or deleted at the end of the contract, under the conditions set out in the Data Processing Agreement and the Terms of Sale.
Messages sent through the contact form of the presentation website are kept for 365 days from receipt and then deleted automatically. With each message we record the full identification string your browser sends (the “user agent”, truncated to 512 characters) and a hash of the IP address computed with a secret key (a keyed hash), used only to fight abuse; the IP address itself is not stored.
9. Data security
We implement appropriate technical and organisational measures to protect personal data against loss, unauthorised access, alteration and disclosure, taking into account their nature and the risks involved.
These measures include in particular the encryption of communications between your browser and our services, login to the portals by means of one-time codes, the separation of each Organisation's data, the restriction of access to those persons who need it, the logging of security events and the regular backup of the database.
As no system is entirely free of risk, we cannot guarantee absolute security. In the event of a data security breach posing a risk to you, we take the necessary measures and inform the Organisations concerned and, where required by law, the Federal Data Protection and Information Commissioner (FDPIC) and the data subjects.
10. Your rights
Within the limits laid down by the FADP and, where it applies, the GDPR, you have a right of access to your personal data, a right to rectification of inaccurate data, a right to erasure and a right to restriction of processing.
You also have the right to receive the data that you have provided to us in a structured, commonly used format and to have them transmitted to another controller (right to data portability), as well as the right to object to processing based on our legitimate interest.
Where processing is based on your consent, in particular for audience measurement on the portals, you may withdraw that consent at any time, without affecting the lawfulness of processing carried out before its withdrawal.
To exercise your rights, contact Appogée Sàrl by email at info@the-training-platform.ch. We may ask you to provide proof of your identity. For training data, contact the Organisation that operates the portal, as indicated in section 2.
You also have the right to file a report with the Federal Data Protection and Information Commissioner (FDPIC) in Switzerland (Article 49 FADP) or, if you reside in the European Union, to lodge a complaint with the supervisory authority of your place of habitual residence, your place of work or the place of the alleged infringement.
11. Minors
The public website and the Customer Area are intended for organisations and their representatives, not for minors.
The portals are not intended for persons under 16 years of age. Appogée Sàrl does not verify the age of users; each Organisation is responsible, in its capacity as controller, for the participants it registers, including for obtaining the authorisation of their legal representative where applicable law so requires.
If you discover that an account has been opened in breach of this rule, you may inform us at info@the-training-platform.ch so that we can take appropriate measures together with the Organisation concerned.
12. Amendments to the notice
We may amend this privacy notice to take account of developments in the service, in our processors or in applicable law. The date of the last update appears at the top of the document.
In the event of a material amendment, we inform the Organisations by email or by a notice in the Customer Area, and the users of the portals by a notice on the portal.
For any question relating to this notice, you may contact us at info@the-training-platform.ch.