Privacy

1. Who is responsible

Duavia is operated by Proximy SNC, Route de Soral 117, 1233 Bernex, Switzerland, UID CHE-300.055.327. Proximy SNC is the controller for the data described on this page within the meaning of the Swiss Federal Act on Data Protection (FADP).

Write to contact@duavia.ch about anything here. One person reads that inbox and answers within one working day.

2. What we hold, and why

Your account. First name, surname, e-mail address, mobile number, date of birth, the language you read the site in, and whether you hold a learner permit. We need the name and the mobile so an instructor can recognise you and ring you when they are waiting outside; we need the date of birth because a booking is a paid contract and the law treats one signed by a minor differently.

Bookings and payment. What you booked, when, the meeting point or the pickup address you gave, what it cost, how you paid, and (as reported back to us by the payment provider) the method used and the country your card was issued in. We never receive and never store your card number: the payment fields belong to Stripe and the details go straight to them.

Instructors and schools. In addition: business address, UID, the IBAN and account holder we pay out to, and the documents you upload to prove you may teach (teaching authorisation, liability insurance, vehicle registration, and an identity document where we ask for one).

Reviews. Your rating and the text you write. Published under your first name and the initial of your surname (“Camille B.”), never your full name.

Technical records. When you sign in we record the IP address and the browser identification string against that session, so that both you and we can tell where an account has been used.

We run no analytics of any kind. There is no tracking pixel, no tag manager, no advertising network. Nothing on this site builds a behavioural profile of you, and no decision affecting you is taken automatically by software.

3. Who else sees it

Your instructor or school. They receive your name, your mobile number, what you booked, when, and the meeting point or pickup address. They need all of it to teach you. Your instructor is an independent business, not our employee: for that data they are a separate controller with their own duties towards you, and the instructor terms they accept with us require them to use it only to deliver the lesson.

Our service providers. Acting on our instructions and bound by a written agreement: Stripe for payments, our mail provider for login codes and booking notices, and our hosting and file storage provider. They may do nothing with your data except what we ask.

The federal geoportal. When you type an address into the search box, your browser sends that address and your IP directly to swisstopo at geo.admin.ch, which returns the map and the suggestions. We never receive a copy of what you typed there.

Push notifications. Only if you switch them on. Your browser then registers with its own maker’s push service (Google, Mozilla or Apple), which carries the message.

We do not sell personal data, and we never disclose it for advertising. We hand data to an authority only where the law obliges us to.

4. Whether it leaves Switzerland

Hosting and file storage are in Switzerland. Payments run through Stripe Payments Europe in Ireland, which appears on the list of states with adequate protection in Annex 1 to the Data Protection Ordinance, and may reach Stripe’s United States entity; that transfer rests on Stripe’s certification under the Swiss–U.S. Data Privacy Framework, and on standard contractual clauses where the framework does not cover it. Push messages may pass through servers outside Switzerland. We keep the current list of our providers and will send it to you on request.

5. How long we keep it

We destroy or anonymise personal data once the purpose it was collected for has ended, as Art. 6 para. 4 FADP requires. In practice:

• Account and profile: while the account exists, then 12 months.
• Bookings, payments, refunds and payouts: 10 years, because the Code of Obligations requires accounting records to be kept that long. This is the one thing we cannot delete on request; we remove your identity from the records instead.
• Instructor documents: while valid, and 24 months after they expire or the account closes.
• Sign-in sessions, with their IP address and browser string: 90 days after the session ends.
• Login codes: 24 hours.
• Notifications and e-mail records: 12 months.
• Payment provider event records: 24 months.
• The administration audit trail: 10 years, because it records who moved money.

6. What you can require of us

You may ask what we hold about you and get a copy, receive it in a machine-readable file, have it corrected, have it deleted, and object to a particular use. These are your rights under Art. 25 to 32 FADP.

Two of them are buttons rather than letters. In your account settings, “Download my data” produces the complete file immediately, and “Close my account” deletes it. Anything else: write from the address the account uses, to contact@duavia.ch. We answer within 30 days and we do not charge.

Closing your account removes your name, contact details, profile and reviews. It cannot remove the accounting records described above, which the law obliges us to keep: those stay, with your identity stripped out of them and only the figures remaining.

If you think we have got this wrong, you may raise it with the Federal Data Protection and Information Commissioner in Bern.

7. Cookies

Two, and neither of them watches you.

• duavia_session: keeps you signed in. Without it an account cannot work at all.
• NEXT_LOCALE: remembers which of the four languages you chose, for a year.

There are no analytics or advertising cookies, because there is no analytics and no advertising. Art. 45c of the Telecommunications Act requires us to tell you these two exist and how to refuse them: you refuse by blocking cookies for this site in your browser, after which you will have to pick your language on every visit and will not be able to sign in.

You will not see a consent banner. Swiss law does not require consent for cookies of this kind, and asking for permission we do not need (while making the site harder to use) would tell you something untrue about what we are doing.

8. How it is protected

Signing in uses a single-use code sent to your address rather than a password, and the code is stored only as a hash. Instructors, schools and our own staff must additionally enrol a second factor. Session tokens are stored as hashes and can be revoked. Uploaded documents sit in private, encrypted storage with no public address of any kind (the only way to one is a request we have already checked), and every time an administrator opens sensitive data it is written to an audit trail.

No system is perfect. If a breach of security is likely to lead to a high risk to you, we will notify you and the Federal Data Protection and Information Commissioner, as Art. 24 FADP requires.

9. If you are under 18

You can hold a learner permit at 15 for A1 (moped/small motorcycle), 17 for B (car), so a good number of learners here are minors. You are welcome to use Duavia.

A booking is a paid contract, and under Art. 19 of the Civil Code a minor needs the consent of a parent or guardian to enter one. So we ask for your date of birth when you register, and if you are under 18 we ask for a parent’s or guardian’s name and e-mail address and write to them to confirm. We use that address for nothing else. A parent or guardian may write to contact@duavia.ch to see, correct or delete their child’s data.

10. If you live in the European Union

Duavia sells driving lessons taught in Switzerland, prices in Swiss francs, and is aimed at people living in Switzerland. We do not target the EU market and do not consider ourselves caught by Art. 3(2) of the GDPR.

We are aware that cross-border commuters live on one side of the border and learn to drive on the other. If that is you, the rights set out in section 6 are the ones we will give you; they are in substance the rights the GDPR grants, and we do not intend to draw a line down the middle of a shared car park. If a supervisory authority ever takes a different view of our position, we will appoint a representative and say so on this page.

11. Changes

When this page changes materially we will raise the version number above and tell account holders by e-mail before the change takes effect. Earlier versions are available on request.