Privacy Policy

DATED 2026-05-06 · VERSION 20260603_rev01 · COMPARED WITH 20260501_rev01 · ARCHIVE SNAPSHOT

Full text changes — 20260501_rev01 to 20260603_rev01

COLOUR MARKS THE SEVERITY OF A FLAGGED CLAUSE · + AND − MARK ADDED AND REMOVED

+v.13 - Updated February 24th, 2026
+v.14 - Updated May 6th, 2026
 ## A. General Note
 This Privacy Policy is aimed at worldwide users of WebPros websites and other online services (collectively the "Offerings"). To ensure a proper and secure handling of personal data handed over to us, WebPros has decided to make the principles of the **EU General Data Protection Regulation (GDPR)** applicable to all its global entities as a common standard in addition to local privacy laws in effect. E.g. for Europe, both, the provisions of the GDPR and the provisions of the **Swiss Data Protection Act (DSG)** and the **UK General Data Protection Regulation** (for WHMCS) apply, whereas in the USA, the applicable privacy regulations per state apply. If your locally applicable data protection law grants you a level of data protection that exceeds that of the GDPR, this stricter level will also apply in the relationship between you and WebPros. However, the level of data protection provided by the GDPR will never be undercut.
 Insofar as the terms of the GDPR are used (e.g. "processing" or "personal data"), these are to be understood as having the same meaning in the sense of the Swiss DSG and/or your local data protection laws, insofar as this is objectively possible.
 WebPros International GmbH
 Vordergasse 59
 Schaffhausen / Switzerland
+Email: [\[email protected\]](https://www.cpanel.net/cdn-cgi/l/email-protection#7c0c0e150a1d1f053c2b191e2c0e130f521f1311).
+Email: [\[email protected\]](https://www.cpanel.net/cdn-cgi/l/email-protection#f585879c8394968cb5a29097a5879a86db969a98).
 ### 3\. Contact details of the data protection officer of WebPros International GmbH
+Email: [\[email protected\]](https://www.cpanel.net/cdn-cgi/l/email-protection#96e6e4ffe0f7f5efd6c1f3f4c6e4f9e5b8f5f9fb)
+Email: [\[email protected\]](https://www.cpanel.net/cdn-cgi/l/email-protection#1b6b69726d7a78625b4c7e794b69746835787476)
 ## D. Data Processing
 The individual data affected by joint data processing, processing purposes, legal bases, recipients and, if applicable, transfers to third countries are listed below:
 ### 1\. Contacting WebPros
 Search Function and Google Analytics
 When you use the search function on our websites, the terms you enter may be shared with Google Analytics. This helps us understand how visitors interact with our site and improve its functionality and content. The data shared is used solely for analytical purposes and can not include personally identifiable information. By using the search feature, you consent to this processing and sharing of data with Google Analytics. This practice is consistent with applicable privacy laws and does not constitute a violation of the California Invasion of Privacy Act (CIPA), as it is limited to operational analytics and does not involve unlawful interception of communications. Furthermore, you agree that the information you enter is not a "private communication" under CIPA. For more details on how Google processes data, please review Google's Privacy Policy.
 #### 6.4. This specific Offering uses the following cookies and other technologies
+## E. Duration of Data Processing
+### E. Use of Artificial Intelligence (AI) Features
+Some of our websites, products and online services include AI-powered features such as chatbots, content assistants, and other tools based on large language models ("LLMs") (collectively "AI Features"). This section describes how personal data is processed in connection with these AI Features.
+#### 1\. Data Collected and Purposes of Processing
+When you use AI Features, we process the text inputs and prompts you submit, AI-generated outputs, and associated usage and technical data (e.g. session identifiers, timestamps). This data is used to provide the requested AI functionality, ensure security, prevent misuse, and improve our services. Please do not submit special categories of personal data (e.g. health, financial, or political information) through AI Features.
+The legal basis for processing is Art. 6 para. 1 lit. b) GDPR (contract performance) where AI Features form part of a requested service, Art. 6 para. 1 lit. f) GDPR (legitimate interests) for service improvement and security, and Art. 6 para. 1 lit. a) GDPR (consent) where explicitly required. Under Swiss law, processing is based on Art. 31 para. 1 DSG.
+#### 2\. No Use of User Data for AI Model Training
+We do not use any data submitted through AI Features - including inputs, prompts, conversation content, or AI-generated outputs - to train, fine-tune, retrain, or otherwise improve any large language model or AI system, whether operated by us or by any third-party provider. We contractually require all AI service providers to uphold this same prohibition.
+#### 3\. Third-Party AI Service Providers
+AI Features may be powered by third-party LLM providers acting as data processors on our behalf. Your input data may be transmitted to such providers solely to deliver the requested service. We require all AI providers to: (i) process data only to the extent necessary to provide the service; (ii) implement appropriate technical and organizational security measures; (iii) refrain from using your data to train or improve any AI model; and (iv) comply with applicable data protection law, including the GDPR. AI sub-processors are included in the WebPros list of sub-processors, available [here](https://www.webpros.com/legal/). Currently, AI Features are powered by OpenAI. WebPros reserves the right to change or add LLM providers at any time, provided the required safeguards, described in this documents are fulfilled. International transfers are governed by the mechanisms described in the "Third Country Transfer" section of this Policy.
+#### 4\. AI-Assisted Outputs and Automated Processing
+AI Features on our websites are informational and assistive in nature. They do not produce legally binding automated decisions within the meaning of Art. 22 GDPR or Art. 21 DSG. Where any AI-driven process were to result in decisions with significant legal or similar effect, we would inform you separately and provide the applicable safeguards and rights. Your general rights regarding automated decision-making and profiling are set out in the "No Automated Decision-making or Profiling" section of this Policy.
+#### 5\. AI Chatbot Transparency, Labelling, and Access Controls
+Where AI Features take the form of a chatbot or conversational assistant accessible on our websites or within our products, the following additional measures apply:
+(a) Disclosure of AI nature: In accordance with Art. 50 para. 1 of Regulation (EU) 2024/1689 ("EU AI Act") and applicable national transparency requirements, all chatbot interfaces are clearly and prominently labelled as AI-powered prior to or at the commencement of any interaction. Users will not be left under the impression that they are communicating with a human being.
+(b) Consent for website-based chatbots: Where a chatbot deployed on our websites processes personal data through technologies that access or store information on the user's terminal device (e.g. session cookies, local storage, or similar client-side technologies), such processing is subject to prior informed consent in accordance with the provisions of applicable national laws implementing Directive 2002/58/EC (ePrivacy Directive). Such consent is obtained through our consent management platform (Usercentrics) before the chatbot widget is activated. Where the chatbot is provided exclusively as part of a logged-in product environment and no terminal device storage beyond strictly necessary session management is involved, processing will not require prior consent, provided no additional tracking technologies are employed.
+(c) No automated decisions or profiling: Chatbot interactions do not constitute automated decision-making within the meaning of Art. 22 GDPR and do not involve profiling. Chatbot outputs are informational and assistive only. Users are not subject to any decision based solely on automated processing that produces legal or similarly significant effects as a result of their chatbot interaction.
+(d) EU AI Act classification: Chatbots of the type deployed by WebPros - i.e. general-purpose conversational assistants powered by LLMs, operating in an informational and support capacity without producing legal effects - are not classified as high-risk AI systems under Annex III of the EU AI Act. They may, however, qualify as general-purpose AI systems subject to the transparency obligations set out in Art. 50 EU AI Act. WebPros ensures compliance with these transparency obligations and monitors regulatory developments regarding the classification of LLM-based systems under the EU AI Act.
+#### 6\. AI-Based Identity Verification
+##### Overview and Scope
+In certain contexts - such as account registration, onboarding, or compliance with regulatory Know Your Customer (KYC) / Anti-Money Laundering (AML) or export sanctions requirements - WebPros may offer the option of identity verification using AI-based identity verification solutions ("Identity Verification Solutions"), such as iDenfy or comparable services. This section applies exclusively to those situations in which an Identity Verification Solution is actually used, and only where you have given explicit prior consent as described below. Where no such consent is given, Identity Verification Solutions will not be deployed.
+##### Explicit Consent as Prerequisite
+The use of any Identity Verification Solution is strictly conditional on your freely given, specific, informed, and unambiguous prior consent in accordance with Art. 6 para. 1 lit. a) and Art. 9 para. 2 lit. a) GDPR. Before commencing any verification process, you will be clearly informed of: (i) the identity of the Identity Verification Solution provider acting as a data processor; (ii) the categories of personal data to be collected and processed, including biometric data; (iii) the automated nature of the verification process and the possible legal or similarly significant effects of the result; (iv) the right to refuse consent without suffering any disadvantage from doing so, including the availability of alternative verification methods where technically and legally feasible; and (v) the right to withdraw consent at any time prior to completion of the verification process, with no prejudice to the lawfulness of processing already carried out. Consent is obtained through a dedicated, separate opt-in step and is documented in our consent management system. No pre-ticked boxes or bundled consent will be used.
+##### Categories of Personal Data Processed
+Depending on the verification method chosen and the regulatory requirements applicable to the specific use case, Identity Verification Solutions may process the following categories of personal data: (a) government-issued identity document data (e.g. name, date of birth, document number, nationality, expiry date); (b) facial biometric data, including a real-time or uploaded photograph or video and a derived biometric template used solely to compare the live image with the identity document ("liveness check"); (c) metadata associated with the submission (e.g. device type, IP address, timestamp, session identifier); and (d) the verification result (e.g. verified, rejected, or flagged for manual review). Biometric data constitutes a special category of personal data within the meaning of Art. 9 GDPR and is processed exclusively on the basis of explicit consent as described above. Facial biometric templates are not retained after the verification process is completed beyond the minimum period technically necessary to deliver the result, unless separate explicit consent for retention has been obtained or retention is required by applicable law.
+##### Automated Decision-Making in the Context of Identity Verification
+By way of exception to the general statement in the "No Automated Decision-making or Profiling" section of this Policy, and exclusively where you have given explicit prior consent as described above, Identity Verification Solutions involve automated processing that may produce a result - such as identity confirmed, identity not confirmed, or flagged for further review - which may have a legal or similarly significant effect on your access to the requested service. Such processing constitutes automated decision-making within the meaning of Art. 22 GDPR (EU) and Art. 21 DSG (Switzerland). You are entitled to the following safeguards: (i) the right to obtain human review of the automated result by a qualified WebPros employee, upon request made to [\[email protected\]](https://www.cpanel.net/cdn-cgi/l/email-protection); (ii) the right to express your point of view and to contest the result; and (iii) the right not to be subject to a decision based solely on automated processing if explicit consent is withdrawn before a final result is communicated. WebPros will not use Identity Verification Solution outputs as the sole basis for a decision that produces significant legal effects without the option of human review unless you explicitly waive this right after being fully informed.
+##### AI Act Compliance - Classification and Obligations
+AI-based identity verification systems that perform biometric identification or verification of natural persons are classified as high-risk AI systems under Annex III of Regulation (EU) 2024/1689 ("EU AI Act"). Where WebPros deploys or uses an Identity Verification Solution that falls within this classification, WebPros, in its capacity as deployer within the meaning of Art. 3 no. 4 EU AI Act, ensures compliance with the following obligations applicable to deployers of high-risk AI systems: (a) Use in accordance with the provider's instructions for use (Art. 26 para. 1 EU AI Act); (b) Assignment of appropriate human oversight to qualified personnel prior to putting the system into use (Art. 26 para. 2 EU AI Act); (c) Monitoring the operation of the system on the basis of the instructions for use (Art. 26 para. 5 EU AI Act); (d) Implementation of a fundamental rights impact assessment prior to deployment, where required under Art. 27 EU AI Act; (e) Logging and record-keeping obligations in accordance with Art. 26 para. 6 EU AI Act; (f) Transparency towards data subjects in accordance with Art. 50 EU AI Act, including disclosure that they are interacting with an AI system and that an automated result may affect their access to a service. WebPros will only deploy Identity Verification Solutions provided by vendors who fulfil the obligations of AI providers under the EU AI Act, including registration in the EU AI Act database where applicable, and who maintain an up-to-date technical documentation and conformity assessment in accordance with Arts. 11, 16, and 43 EU AI Act.
+##### Third-Party Processor and International Transfers
+Identity Verification Solution providers act as data processors on behalf of WebPros pursuant to a Data Processing Agreement in accordance with Art. 28 GDPR. Such agreements require the processor to: (i) process personal data only for the purpose of delivering the verification service; (ii) implement appropriate technical and organizational measures to protect personal data, in particular biometric data; (iii) refrain from using any personal data to train, improve, or develop AI models; (iv) delete or return all personal data upon completion of the verification process or termination of the engagement; and (v) comply with applicable data protection law, including the GDPR and the EU AI Act. Where the Identity Verification Solution provider is located outside the EU/EEA, transfers are governed by the mechanisms described in the "Third Country Transfer" section of this Policy, in particular standard contractual clauses pursuant to Art. 46 GDPR or, where available, an adequacy decision pursuant to Art. 45 GDPR. Currently, identity verification services may be provided by UAB iDenfy, registered in Lithuania (EU), which as an EU-based processor does not require a separate transfer mechanism. WebPros reserves the right to change or add Identity Verification Solution providers, provided the required safeguards described in this section are fulfilled. Any change will be reflected in the WebPros list of sub-processors, available at webpros.com/legal/.
+##### Retention and Deletion
+Biometric data and raw identity document images processed through Identity Verification Solutions are deleted or irreversibly anonymized upon completion of the verification process, unless: (a) applicable law (e.g. AML/KYC regulations) requires retention for a defined period, in which case only the minimum data necessary to fulfil the legal obligation will be retained; or (b) the data subject has given separate explicit consent to a longer retention period. The verification result (i.e. a binary or categorical outcome, without underlying biometric data) may be retained by WebPros for as long as necessary to document compliance with the applicable regulatory obligation or to defend against legal claims, in accordance with the general retention periods described in the "Duration of Data Processing" section of this Policy. Data subjects may request deletion of their verification data at any time by contacting [\[email protected\]](https://www.cpanel.net/cdn-cgi/l/email-protection), subject to any overriding legal retention obligations.
+##### Your Rights in the Context of Identity Verification
+In addition to your general data subject rights described in the "Your Rights as a Data Subject" section of this Policy, the following specific rights apply in connection with identity verification: (a) Right to withdraw consent at any time prior to completion of the verification, without detriment and without affecting the lawfulness of prior processing; (b) Right to request human review of any automated verification result, by contacting [\[email protected\]](https://www.cpanel.net/cdn-cgi/l/email-protection) within 30 days of receiving the result; (c) Right to access the personal data processed about you during the verification process, including the verification result and any flags generated; (d) Right to erasure of biometric data immediately upon completion of verification, subject to legal retention obligations; (e) Right to lodge a complaint with a supervisory authority, in particular the competent data protection authority in your country of residence. To exercise any of these rights or to raise concerns about the identity verification process, please contact [\[email protected\]](https://www.cpanel.net/cdn-cgi/l/email-protection) with the subject line "Identity Verification - Data Subject Request".
+#### 7\. Data Retention and Your Rights
+Interaction data from AI Features is retained only as long as necessary to provide the service or as required by law. Session-based inputs are generally not retained beyond the active session unless you have an account and session history is an explicit feature. Retention is otherwise governed by the "Duration of Data Processing" section of this Policy. Your rights of access, rectification, erasure, restriction, portability, and objection apply equally to data processed through AI Features and are described in the "Your Rights as a Data Subject" section of this Policy. To exercise your rights or raise any AI-related privacy concern, please contact [\[email protected\]](https://www.cpanel.net/cdn-cgi/l/email-protection).
+### F. Duration of Data Processing
 We store personal data only as long as it is necessary to achieve the respective purpose or until you revoke your consent.
 If there are legal retention obligations - for example, under commercial, tax, or social security law in Switzerland or the EU - the retention of certain data may be required for up to 10 years or longer, regardless of the processing purpose.
 To ensure that no data is stored longer than necessary, we conduct regular reviews and delete personal data as soon as the purpose of storage ceases to exist and there are no legal obligations or legitimate interests remaining.
+## F. Your rights as a Data Subject
+### G. Joint Data Processing within the WebPros group
 #### 1\. Request for Information
 Upon request, you can receive information about all personal data we have stored about you at any time, free of charge.
 #### 2\. Rectification, Erasure, Restriction of Processing (Blocking), Objection
 #### 5\. Restriction of Processing
 Data for which we are unable to identify the data subject, for example, if it has been anonymized for analysis purposes, is not covered by the aforementioned rights. Information, deletion, blocking, correction, or transfer to another company may be possible for such data if you provide us with additional information that allows us to identify you.
 #### 6\. No Automated Decision-making or Profiling
+Your data is not used by us for automated decisions which have legal consequences for you or significantly affect you in a similar way - as described in Art. 22 GDPR (EU) or Art. 21 DSG (Switzerland).
+Subject to the exception for Identity Verification Solutions set out hereinabove. Your data is not used by us for automated decisions which have legal consequences for you or significantly affect you in a similar way - as described in Art. 22 GDPR (EU) or Art. 21 DSG (Switzerland).
 We also do not conduct so-called profiling. This means that we do not create automated evaluations of your data to analyze or predict personal characteristics such as interests, behavior, or preferences. Should we exceptionally use automated decisions or profiling, we will inform you transparently in advance and obtain your explicit consent where necessary.
 #### 7\. For WebPros companies domiciled in Switzerland: Inspection of the data collection register
 If the data processing is carried out by a WebPros company based in Switzerland, you have the right to inspect the register of data collections at any time. This contains information on which federal bodies and private persons process which kinds of personal data. With the help of the register you can find out who is processing your data and how, and on the basis of this information you can decide which data collection you wish to request information about.
 #### 8\. Exercising your rights as a Data Subject and right to lodge a complaint
+If you have any questions regarding the processing of your personal data, information, rectification, blocking, objection or deletion of data, or if you wish to transfer your data to another enterprise, please contact [\[email protected\].](https://www.cpanel.net/cdn-cgi/l/email-protection#5d2d2f342b3c3e241d0a383f0d2f322e733e3230)
+If you have any questions regarding the processing of your personal data, information, rectification, blocking, objection or deletion of data, or if you wish to transfer your data to another enterprise, please contact [\[email protected\].](https://www.cpanel.net/cdn-cgi/l/email-protection#e090928996818399a0b78582b0928f93ce838f8d)
 You also have the option of complaining to a supervisory authority about your rights as a data subject. In the case of a WebPros company based in Switzerland, you have the right to lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC).
+Upon request, you can receive information about all personal data we have stored about you at any time, free of charge.
 This policy is subject to periodic revisions and may be amended by WebPros from time to time if necessary. Please come back periodically and check for updates.