AskMeWhy Privacy Policy

Last updated on February 10, 2025

---

This privacy policy (the “Privacy Policy”) describes the principles according to which AskMeWhy AG (hereinafter referred to as “AskMeWhy”, “we” or “the Controller”) processes Personal Data collected via our

• websites askmewhy.com, seamlesswork.com, guests.one
• the platform admin.seamlesswork.com and admin.guests.one (hereinafter referred to as “the Website”),
• our Teams app Seamless and Guests (hereinafter referred to as “App”)

or otherwise in connection with our services in relation to Seamless or Guests.

In particular, it informs you about:

• What Personal Data we collect
• The purposes for which it is processed
• To whom it may be disclosed
• How long we keep it
• What rights and options you have regarding your Personal Data

Personal Data (hereinafter referred to as “Personal Data”) means any information relating to an identified or identifiable natural person, such as name, address, email address, online identifier, or telephone number. The extent to which Personal Data applies depends on each individual case.

Processing refers to any handling of Personal Data, such as obtaining, saving, storing, disclosing, or deleting. This Privacy Policy applies insofar as the processing activities are not subject to other privacy notices or provided for by applicable law.

Please read this Privacy Policy carefully. By using our services, you consent to the collection and processing of your Personal Data in accordance with this Privacy Policy. If you provide us with Personal Data of other persons, please do so only if you are authorized under applicable data protection laws and only if the other person consents to their Personal Data being processed according to this Privacy Policy.

---

1. Who is responsible for your Personal Data / Contact Information

The legal entity responsible for the processing of Personal Data in accordance with this Privacy Policy is:

AskMeWhy AG
Industriestrasse 47
8152 Glattbrugg | Schweiz
Phone: +41 (0)44 390 14 10
E-mail: hello@askmewhy.com
Website: www.askmewhy.com

As Controller, AskMeWhy determines the purposes and means of processing your Personal Data and is responsible for its use in accordance with this Privacy Policy. If AskMeWhy processes Personal Data as a Processor on behalf of another Controller, the Privacy Policy of the respective Controller applies.

If you have a technical or general support question, please visit our services page here: https://docs.seamlesswork.com.
For requests regarding the handling of Personal Data, please contact us via email at hello@askmewhy.com or write to the address above. If your request is unrelated to Personal Data, please visit our contact page on the Website.

---

2. How do we process Personal Data

All Personal Data collected by AskMeWhy is processed in accordance with the provisions of the Swiss Data Protection Act and the European General Data Protection Regulation (GDPR). The GDPR is widely recognized as the global standard for strong data protection. However, whether and to what extent the GDPR applies depends on each individual case.

We collect and process Personal Data carefully and for the purposes described in this Privacy Policy. In accordance with applicable law, we may also use Personal Data in ways other than those described in this Privacy Policy. In such cases, we will generally provide specific privacy statements or notices at the time of collection and may seek your consent.

Where applicable law permits the use of Personal Data without notice or consent (e.g., if the law explicitly requires processing or if processing is necessary to protect overriding interests and is legally permitted), such rights remain reserved.

We make reasonable efforts to collect information in anonymous or pseudonymous form whenever possible, ensuring that individuals cannot be directly identified.

---

3. Which Personal Data we collect for which processing purposes

We collect the following Personal Data via our Website or Apps:

3.1 Automatically transmitted Personal Data

AskMeWhy collects and stores information that your browser automatically transmits to us in “server log files” when you visit our Website or our App. The data collection is based on your consent and interest to visit our Website or our App and our legitimate interests to operate them. This may include the following Personal Data:

• Browser type and browser version
• Operating systems used
• Referrer URL (the previously visited website)
• Host name of the accessing computer
• Date and time of server request
• Internet protocol address (IP address)
• Amount of data transferred
• Other similar data and information that serve to avert danger in the event of attacks on our IT systems.

We do not combine this Personal Data with Personal Data from other sources. They are stored by us for a short period of time until they are automatically deleted within a period of six months. This Personal Data is processed for the purpose of the proper functioning and administration of our Website or App, including:

• Establishing a connection
• Ensuring stability and uninterrupted system security
• Improving our services
• Protecting our systems
• Statistical purposes in the event of attacks on the network infrastructure

These purposes form the legal basis for our legitimate interests (Art. 6 para. 1 lit. f GDPR) to process your Personal Data accordingly.

3.2 Personal Data provided for communication purposes

We collect Personal Data that you actively and voluntarily provide to us with your consent and/or in advance of a potential contract with us by sending a message to us via email, mail, telephone, or other communication means. This may include:

• Identification and address information: title, name, first name, company name, employer, position, address, place, location, email address, phone number, language, other information about you.
• Your message, comments, or request.

We will use this information to:

• Respond to your questions or requests about our products and services.
• Communicate with you about our services and schedule appointments.
• Comply with legal or regulatory requirements.
• Establish, exercise, or defend actual or potential legal claims.

These purposes form the legal basis for our legitimate interests (Art. 6 para. 1 lit. f GDPR) and contractual obligations (Art. 6 para. 1 lit. b GDPR).

3.3 Personal Data collected and generated for the provision of our paid services

When you purchase our services, we collect and generate the following Personal Data:

• Your email address
• Subscription status with start and end date
• Other subscription-related information
• System-generated IDs to identify you as a user

Additionally, we may receive:

• Address data: industry, company name, contact person, address, country, telephone number, email, language, currency, position, mobile number.
• Communication data: email content, written correspondence, phone calls.
• Contract data: contract initiation and conclusion details.
• Payment data: means of payment, bank details, billing address.

We process this Personal Data to:

• Provide and maintain our services.
• Notify you of service changes.
• Monitor service usage.
• Detect, prevent, and correct technical problems.
• Provide customer support.
• Comply with legal requirements.
• Establish or defend legal claims.

Processing is based on contractual (Art. 6 para. 1 lit. b GDPR) and legal obligations (Art. 6 para. 1 lit. c GDPR). Data may be shared with third parties for payment, delivery, or enforcement purposes.

3.4 Personal Data processed for the proper operation of our business

We process Personal Data for our business operations, including:

• Managing customer Personal Data.
• Document storage and retention.
• Communication (email, telephone, video meetings).
• Support request management.
• Website and App hosting.
• Newsletter management.

This processing is based on our legitimate interests (Art. 6 para. 1 lit. f GDPR) and contractual obligations (Art. 6 para. 1 lit. b GDPR).

3.5 Personal Data collected and generated for user account registration or login

We collect the following data for user registration:

• Registration and Identification Data: title, name, company, email, phone, language.
• User account data: username, password, IP address, time of user actions.

Processing is based on legitimate interests (Art. 6 para. 1 lit. f GDPR) and contractual obligations (Art. 6 para. 1 lit. b GDPR). User accounts are not public and cannot be indexed by search engines.

3.6 Use of the Seamless App

We collect and process:

• Microsoft Entra ID User ID (Object ID) for telemetry purposes.
• Optionally provided user and group object IDs for tenant configuration.

This data is stored in Switzerland with Microsoft Schweiz GmbH. Processing is limited to support purposes and is deleted after 90 days.

3.7 Use of the Seamless Admin Center

When using the Seamless admin center, we collect:

• Tenant ID
• Display name of the Global Admin
• Consent date

This information enables the use of the admin center and supports compliance with legal and regulatory requirements.

3.8 Email communication and newsletters for promotional purposes

If you sign up for our newsletter or show interest in our products, we will send you marketing material. This includes:

• Emails about our services
• Event announcements, promotions, and surveys

You can unsubscribe at any time. Data may be combined with publicly available information or obtained from third-party providers.

3.9 Personal Data collected in job applications

We collect Personal Data when you submit a job application, including:

• Application details: name, address, email, phone, CV, qualifications, employment certificates.
• Information from interviews
• Publicly available professional data

This data is processed for:

• Assessing qualifications and experience.
• Processing applications effectively.

Application data is deleted within three months unless you provide consent for retention for future vacancies.

For more details on data retention, transfers, and security, please refer to clause 7.

---

4. On what legal basis do we process Personal Data about you

Depending on the applicable law, data processing is only permitted if the applicable law specifically allows it. If not indicated for a specific purpose otherwise in this Privacy Policy, the processing of your Personal Data may be based on the following legal bases:

• Your consent, only if it can be revoked at any time (e.g. newsletter, tracking cookies) (Art. 6 para. 1 lit. a GDPR);
• For the fulfillment of a contract with you or for the intention to conclude a contract with you (e.g. when subscribing to services) (Art. 6 para. 1 lit. b GDPR);
• To comply with a legal obligation (e.g. for tax reasons or for the purpose of judicial investigations or proceedings) (Art. 6 para. 1 lit. c GDPR);
• Where processing is necessary to protect the vital interests of the data subject or another natural person (Art. 6 para. 1 lit. d GDPR);
• For the purposes of our legitimate interests, e.g. to maintain and improve our internal business management, organization, operation, protection of systems and premises, prevention of fraud and other crimes, to ensure effective, efficient, secure, and harmonized service, to comply with legal or other regulatory requirements and internal rules, and to establish, exercise, and/or defend actual or potential legal claims, investigations, or similar proceedings (Art. 6 para. 1 lit. f GDPR).

If the processing is based on your consent or our legitimate interests, you may withdraw your consent or object to this processing at any time by contacting us directly via email at hello@askmewhy.com. Please note, however, that the withdrawal of your consent does not affect the lawfulness of the processing prior to your withdrawal.

---

5. With whom do we share the Personal Data we collect?

We take the necessary measures to ensure that only authorized persons who have the necessary knowledge have access to your Personal Data in order to fulfill the purposes for which your Personal Data was collected. We may disclose your Personal Data to the following possible categories of recipients in accordance with the purposes and legal bases of processing described above, to the extent necessary for the intended data processing or as may be provided for by law:

• Other companies in the Group;
• Service providers who process Personal Data on our behalf and at our instruction (so-called processors, such as in the area of IT, hosting, and support, e.g. Microsoft and our CRM provider Hubspot and accountants);
• Payment service providers, financial institutions;
• Customers, partners, suppliers, insurance companies, and other business partners;
• Media and marketing agencies, and the public via our social media website interactions (e.g. via our social media plugins);
• Acquirers or parties interested in acquiring business units, companies, or other parts of the Group;
• Courts, arbitration bodies, law enforcement agencies, regulators, attorneys, and other parties in potential or actual legal proceedings where necessary to comply with the law or to establish, advise on, exercise, or defend rights or legal claims.

We select our partners and processors carefully and only upon providing sufficient guarantees that they have appropriate technical and organizational measures in place in accordance with legal requirements. We also contractually ensure that our processors only process your Personal Data in the way that we are permitted to do. Furthermore, our processors may only process Personal Data on our documented instructions. They are all subject to confidentiality requirements and may only use your Personal Data to the extent necessary to fulfill the purpose for which your Personal Data was collected or as required by law.

---

6. Transfer of Personal Data to countries outside the EU/EEA

The Personal Data we collect is stored in Switzerland and the EU. Since we operate globally, we may transfer, store, and process your Personal Data at data locations around the world, for example, where our third-party vendors, service providers (especially Microsoft), or business partners are located. Therefore, we may transfer your Personal Data outside the European Economic Area (EEA) if necessary for the data processing described in this Privacy Policy. The data protection and other laws of these countries may not be as comprehensive as those in the EEA or in Switzerland. If data is transferred to countries that do not ensure an adequate level of data protection, AskMeWhy will ensure adequate data protection by taking appropriate safeguards, such as:

• Contractual safeguards (e.g. based on EU standard clauses),
• Binding corporate rules,
• The transfer of data pursuant to your explicit consent,
• The conclusion or performance of a contract with you, or
• In connection with the establishment, exercise, or enforcement of legal claims.

For more information about our security measures to ensure an adequate level of data protection, please contact us by email at hello@askmewhy.com.

For the sake of completeness, we would like to point out to users resident or domiciled in Switzerland as well as in the EU that in the USA there are surveillance measures by US authorities that generally allow the storage of all Personal Data of all persons whose data has been transferred to the USA. This is done, in principle, without differentiation, limitation, or exception based on the objective pursued and without an objective criterion that makes it possible to limit the access of the U.S. authorities to the data and their subsequent use to very specific, strictly limited purposes that are capable of justifying the intrusion associated both with the access to these data and with their use.

In addition, we would like to point out that in the USA there are no sufficient legal remedies available to data subjects from Switzerland and the EU that would allow you to obtain access to the data concerning you and to obtain its correction or deletion, or that there is no effective judicial legal protection against general access rights of US authorities. We explicitly draw your attention to this legal and factual situation in order to enable you to make an appropriately informed decision to consent to the use of your data.

We would also like to point out to users residing in a member state of the EU, the EEA, or Switzerland that, from the perspective of the European Union as well as Switzerland, the USA does not have an adequate level of data protection—among other things due to the issues mentioned in this section. Insofar as we have explained in this Privacy Policy that recipients of data (such as Microsoft or Google) are based in the USA, it will be ensured through contractual arrangements with these companies that your data is protected with our partners with an appropriate level.

---

7. How long do we retain Personal Data?

We will retain your Personal Data for as long as necessary to fulfill the purposes for which your Personal Data was collected. For this reason, we will delete or anonymize Personal Data as soon as it is no longer necessary to achieve the purposes, but subject to:

1. Applicable legal or regulatory requirements to retain Personal Data for a longer period of time (e.g., for tax or accounting reasons).
2. If we have an overriding interest (e.g., an interest for evidentiary reasons to establish, exercise, and/or defend actual or potential legal claims, investigations, or similar proceedings, including legal processes we may enforce to preserve relevant information, or where we have an interest in non-personal analysis).

On this basis, we generally process Personal Data in compliance with the following rules and obligations:

• The data automatically transmitted by you through the use of our Website or Apps (so-called log files) for the purpose of displaying, operating, and ensuring the functionality of the Website will be deleted within six months.
• The Personal Data you provide to us in connection with the use of our services and products that are offered on our Website or that you otherwise provide to us via physical correspondence, email contact address for communication purposes will generally be stored by us for one to five years.
• The Personal Data you provide to us in connection with a newsletter or a user account will generally be stored by us until you request us to delete it, revoke your consent to store it, or the purpose for storing the data no longer applies (e.g., after we have finished processing your request).
• The Personal Data collected and generated when you engage with our Apps (e.g., Audit Logs and Application Telemetry) will generally be deleted within 30 days (Audit Logs) and 90 days (Application Telemetry). Application Settings will be retained until deleted by you or until you request us to delete them.
• For contract-related Personal Data (including business documents and communications), we store Personal Data as long as the contractual relationship exists and thereafter for eleven additional years after termination of the contractual relationship, unless:
  1. In individual cases, a shorter or longer legal retention obligation applies.
  2. Retention is required for reasons of evidence or for another valid reason under applicable law.
  3. Deletion of the data is required earlier (e.g., because the data is no longer needed or we have to delete the relevant data).

Information collected by using the App

Category	In-System Retention	Total Retention
Audit Logs	30 days	30 days
Application Telemetry	90 days	90 days
Application Settings	Until deleted by the customer	Until deleted by the customer

Information collected via other means than engaging with our App

Category	In-System Retention	Total Retention
Physical Correspondence	1 year	1 year or 10 years, depending on applicable regulations
Electronic Correspondence	5 years	5 years
Accounting Records	11 years	11 years
Contracts	Data is kept as long as it is marked as active	Data is kept for an additional 5 years from the date of de-registration
Job Applications	3 months if applicant is unsuccessful in the selection process	3 months if applicant is unsuccessful in the selection process

We may rectify, replenish, or remove incomplete or inaccurate information at any time and at our own discretion.

---

8. Cookies, Services of Google and Social Media Plug-Ins

When you access or use our Website or our Apps, we may place so-called cookies - small text files - or similar tools on your computer. We use these cookies to recognize you as a user of the Website or App, to customize content, to improve the performance of the Website or App and to enhance your user experience.

a. Categories of cookies we use

Depending on their function and purpose, the cookies we use can be divided into the following categories:

Necessary cookies Cookies may be absolutely necessary for the operation of a website and to provide you with the essential features of our services (e.g., sign-in, service health, or for security reasons).

Functional cookies These cookies serve a variety of purposes related to the presentation, functionality, and performance of a website, enhancing visitors’ experience. They allow a website to remember information already provided (e.g., username, location, or language selection) and provide enhanced, more personalized functionality. Functional cookies cannot track your movement on other websites.

Performance cookies These cookies collect information about how a website is used - for example, how visitors arrived at our website, which pages a visitor opens most often, and whether they receive error messages. These cookies monitor website activity and improve performance.

Marketing and personalization cookies These cookies are used for tracking user interests or behavior and creating user profiles. This process, known as “tracking,” helps in displaying personalized content and advertisements. Advertising cookies enable personalized ads and track the effectiveness of advertising campaigns.

Temporary cookies Temporary cookies (session cookies) are deleted after a user leaves the website and closes the browser.

Permanent cookies Permanent cookies remain stored even after the browser is closed. They save login statuses, preferences, and other relevant settings. These cookies may be placed by us or third parties. Below are links to privacy policies of third-party services we currently use:

• Microsoft Privacy Policy
• Google Privacy Policy
• More on Cookies

b. Responsible Google Company

We use various Google services operated by Google LLC, Mountain View, California, USA. For users in the European region, the responsible company is Google Ireland Limited, Dublin, Ireland.

1. Website Analysis with Google Analytics

Google Analytics uses cookies to analyze website usage. Data collected may include:

• Number of visits
• Visit duration
• Entry and exit pages
• Geographic location of visitors
• Search engine and referral data

Google processes this data on our behalf for evaluation purposes. We have activated IP anonymization, ensuring IP addresses are shortened within the European Region before transmission to the USA. You can refuse cookie usage by adjusting your browser settings or using Google’s opt-out tool: Google Opt-Out.

Further details on Google Analytics can be found here.

2. Google Fonts

We use locally integrated Google Fonts on our website to improve visual appearance. No personal data is transmitted to Google.

c. Website analysis with Microsoft Clarity

Microsoft Clarity helps us analyze user interactions on our website. Data collected may include:

• IP address
• Browser information
• Screen resolution
• Clicks, scrolls, and mouse movements

Data is used to improve usability. We process this data based on our legitimate interest in website optimization.

d. Administration of Cookies

If you do not wish to accept cookies, you can refuse their use in the cookie banner or adjust your browser settings. Instructions for managing cookies in different browsers:

• Internet Explorer
• Mozilla Firefox
• Google Chrome
• Safari

e. Social Media Plug-Ins

We use social media plug-ins to enhance engagement. These plug-ins may collect user data and transfer it to their respective platforms. Data processing is based on user consent.

1. LinkedIn

LinkedIn plug-ins allow users to share content. When interacting with the LinkedIn button, LinkedIn collects various data, including IP address, access time, and browser information. More information can be found in LinkedIn’s Privacy Policy.

2. Instagram

Instagram plug-ins connect our website with Instagram. Interaction with the Instagram button allows data transfer to Meta Platforms, Inc. Further details can be found in Instagram’s Privacy Policy.

For details regarding data transfers outside the EU, please refer to section 6.

---

9. No Automated Individual Decision-Making, Including Profiling with Legal Effects

We will not make any decision about you which is based solely on automated processing – including profiling – and which produces legal effects concerning you or similarly significantly affects you.

---

10. How Do We Safeguard and Transfer Your Information?

We have taken various technical and organizational measures to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized use, disclosure, or access, in particular where the processing involves the transmission of data over a network, and against all other unlawful forms of processing and misuse.

The infrastructure of our platform admin.seamlesswork.com is operated on servers in Microsoft’s Swiss data centers that have ISO 27001 certification and have implemented high security standards. We are committed to using our reasonable efforts, in accordance with market best practices, to ensure the security, confidentiality, and integrity of the Personal Data you choose to provide us. Access to the Personal Data is based on the ‘least to know’ concept together with role-based access control systems, ensuring only authorized access to the Personal Data.

To protect the privacy of any Personal Data you may have provided, we are using data hosts (redundant setup Microsoft Azure PaaS services, storing and processing data globally, inside and outside of the EU) who implement market best practice security measures, including encryption for data-at-rest and data-in-transit. Furthermore, we already take the protection of Personal Data into account during the development or selection of hardware, software, as well as procedures in accordance with the principle of data protection, through technology design and through data protection-friendly default settings.

This website uses SSL/TLS encryption for security reasons and to protect the transmission of confidential content, such as requests that you send to us as the site operator. You can recognize an encrypted connection by the fact that the address line of the browser changes from http:// to https:// and by the lock symbol in your browser line. If SSL or TLS encryption is activated, the data you transmit to us cannot be read by third parties.

AskMeWhy may use third parties as processors to collect and process your Personal Data. The data processors we use will only process your Personal Data in accordance with our instructions and are required by law to take strict security precautions when handling Personal Data. Unfortunately, the transmission of information over the Internet (e.g., when communicating by email) is not completely secure. Although we have taken appropriate measures, we cannot guarantee the security of your data transmitted via the Internet; complete protection of data against access by third parties without the use of email encryption, such as PGP or S/MIME, is not possible and is at your own risk.

---

11. Privacy Policies of Third Parties

Please note that if you click on the link to a third-party website (e.g., Google or other websites), you will be redirected to a website that we do not control, and our privacy policy will no longer apply. Your browsing and interaction on another website are subject to the terms of use and privacy policies of those third-party websites. In addition, we also cannot guarantee the accuracy or timeliness of these links.

We encourage you to carefully read the terms of use and privacy policies of other websites before submitting any Personal Data through this website. We are not responsible or liable for the information content on such third-party websites.

---

12. What Are Your Rights?

You can request information from AskMeWhy as to whether Personal Data about you is being processed. In addition, you have the right to request the correction, destruction, or restriction of Personal Data about yourself and to object to the processing of Personal Data. Where processing is based on your consent or our legitimate interests, you may withdraw consent or object to such processing at any time by contacting us directly by email at hello@askmewhy.com.

In certain cases, you have the right to obtain Personal Data arising from the use of online services in a structured, common, and machine-readable format that allows further use and transmission. Requests in this regard should be addressed to AskMeWhy at the following email address: hello@askmewhy.com. To protect your privacy and security, we will take appropriate steps to verify your identity before granting access or making changes to your Personal Data.

AskMeWhy reserves the right to limit your rights under applicable law and, for example, not to disclose comprehensive information or to delete data (e.g., due to document retention obligations). If we reject your request or you are not satisfied with our processing, you also have the right to file a complaint with the relevant supervisory authority and seek a remedy.

For users located in Switzerland, the competent authority is the Federal Data Protection and Information Commissioner in Switzerland. For users located in EU countries, you can find a list of supervisory authorities at this link.

---

13. Changes to Our Privacy Policy

This Privacy Policy may be changed from time to time and without prior notice as part of our continuous improvement process, in particular to remain compliant with legal regulations in the future. Your rights as a data subject remain unaffected by such changes.

Any changes to this Privacy Policy will be effective when posted on the website unless otherwise stated. We encourage you to review this Privacy Policy regularly for any changes.

Last updated on February 10, 2025