SEPM Legal
Privacy Statement
Version 1.0 — 10 November 2026
1. Introduction
SEPM — Software Engineering & Project Management ("SEPM", "we", "us") respects your privacy and is committed to protecting personal data.
This Privacy Statement explains how we collect, use, store and protect personal information when you interact with our websites, software products, online services and business activities.
We process personal data in accordance with the Swiss Federal Act on Data Protection (FADP) and, where applicable, the European Union General Data Protection Regulation (GDPR).
This Privacy Statement applies to:
- The SEPM website at https://www.sepm.ch and related websites.
- The mySEPM User and Subscription Application at https://myaccount.sepm.ch.
- Customer accounts, software licensing and subscriptions.
- Software downloads, maintenance and technical support.
- Business communications, enquiries, marketing and other related activities.
2. Who Is Responsible for Your Personal Data?
SEPM
Software Engineering & Project Management
The responsible provider is:
- SEPM — Software Engineering & Project Management
- Robert Schweikert
- Gerliswilstrasse 42
- CH-6020 Emmenbrücke
- Switzerland
- Website: https://www.sepm.ch
- Email: info@sepm.ch
For privacy-related enquiries or requests concerning your personal data, please contact us at info@sepm.ch.
SEPM generally acts as an independent data controller when processing personal data for its own business operations, including customer relationships, accounts, sales, licensing, billing and support administration.
Where SEPM processes personal data solely on behalf of a customer and according to that customer's instructions, SEPM acts as a data processor. Such processing may be governed by a separate Data Processing Agreement.
3. What Information Do We Collect?
We collect only the information reasonably necessary to provide our products and services, manage business relationships, fulfil legal obligations and operate our systems.
3.1 Contact and Business Information
When you contact SEPM, register an account or establish a business relationship, we may collect:
- Name and business contact details.
- Company or organisation name.
- Business address, country and telephone number.
- Email address and professional role.
- VAT or other relevant tax identification numbers.
- Information provided in enquiries, correspondence and business communications.
3.2 Account and Subscription Information
When you register with mySEPM or purchase software, we may process:
- User account details and authentication information.
- Organisation membership and assigned roles.
- Software products and licence entitlements.
- Subscription periods, assigned users and licence status.
- Software download and licence activation information.
- Billing information, invoices and transaction references.
- Technical information required for online or offline licence management.
- This information is used to provide and administer the services requested by you or your organisation.
3.3 Payment Information
When you purchase a subscription or another product, payment-related information is processed as necessary to complete the transaction, maintain billing records and comply with accounting and tax obligations.
Where payments are processed by an external payment service provider, that provider may process information necessary to complete the payment under its own applicable privacy and security conditions.
SEPM processes or retains payment information only to the extent necessary for its business and legal obligations.
3.4 Technical and Website Information
When you visit our websites or use our online services, technical information may be collected automatically, including:
- IP address.
- Browser type and operating system.
- Date and time of access.
- Requested pages and resources.
- Device and connection information.
- Authentication events and technical error logs.
- This information is used to operate, secure, maintain and improve our online services.
3.5 Customer Support Information
When you request technical support, we may collect:
- Contact and customer account information.
- Product names, software versions and installation details.
- Support ticket descriptions and correspondence.
- Technical logs, configuration files and diagnostic information.
- Example files or datasets voluntarily supplied for troubleshooting.
- Customers should avoid submitting personal data or confidential production information unless necessary for the support request.
- Where possible, diagnostic files and sample datasets should be anonymised or minimised before submission.
4. How Do We Use Your Personal Data?
SEPM processes personal data for the following purposes:
4.1 Providing Products and Services
We use personal information to register customers, manage software subscriptions, issue licences, provide software downloads and administer customer accounts.
4.2 Customer Support
We use contact information, support requests and relevant technical information to investigate problems, provide support, deliver patches and communicate with customers.
4.3 Billing and Administration
We process information necessary for invoicing, payments, subscription administration, tax reporting, bookkeeping and other legal or contractual obligations.
4.4 Security and Fraud Prevention
We may process technical and account information to maintain system security, prevent unauthorised access, investigate suspicious activity and protect our services.
4.5 Business Communications
We use business contact information to communicate about orders, contracts, maintenance arrangements, product updates and relevant business matters.
4.6 Product Information and Marketing
We may send product announcements, release information, invitations to webinars and other relevant SEPM communications to business contacts in accordance with applicable law.
Where consent is required, we obtain it before sending marketing communications.
Recipients can unsubscribe from marketing emails at any time using the unsubscribe facility provided or by contacting SEPM.
Operational communications relating to active accounts, subscriptions, licences, security or contractual obligations are separate from optional marketing communications.
5. Legal Basis for Processing
Where the GDPR applies, SEPM processes personal data on one or more of the following legal bases:
- Performance of a contract: Where processing is necessary to provide software licences, subscriptions, support or other contractual services.
- Compliance with legal obligations: Where processing is required for accounting, tax reporting or other statutory requirements.
Legitimate interests: Where processing is necessary to operate and secure our business, maintain professional relationships, respond to enquiries or improve our products, provided the applicable legal requirements are met.
Consent: Where consent is required, for example for certain marketing activities or optional tracking technologies.
Where processing is based on consent, you may withdraw that consent at any time, without affecting processing that was lawful before withdrawal.
Under Swiss data protection law, processing is governed by the applicable principles and requirements of the FADP.
6. SEPM Software and Customer Data
6.1 Locally Operated Software
Many SEPM products operate within the customer's own technical environment.
For example:
- SEPM X-Translator Smallworld operates within the customer's Smallworld GIS environment.
- The new SEPM X-Translator provides desktop-based GIS and CAD data processing.
- SEPM DataCheck analyses Smallworld database configurations and data.
- SEPM X-Symbols provides SVG assets for GIS applications.
- The core local processing performed by these products does not, by itself, require customer datasets to be transferred to SEPM.
6.2 Licensing and Online Services
Certain products may communicate with SEPM online services for account authentication, subscription validation, software licensing, downloads or related administrative functions.
These services may process user identifiers, organisation information, licence entitlements and technical information necessary for their operation.
6.3 Customer-Owned Data
Customers retain responsibility for the data they process using SEPM software.
SEPM does not acquire ownership of customer GIS databases, CAD drawings, source files or converted datasets.
Customer datasets are not routinely collected by SEPM solely because the customer uses a locally operated SEPM product.
Where customers voluntarily provide datasets, logs or other materials for technical support or project work, SEPM processes those materials for the relevant agreed purposes.
6.4 Data Processing on Behalf of Customers
Where SEPM processes personal data on behalf of customers in the context of support, software development or other services, the respective customer may act as the data controller and SEPM as a data processor.
Where required, the parties may conclude a separate Data Processing Agreement defining the applicable responsibilities, processing purposes and security measures.
7. Third-Party Service Providers
SEPM uses specialised external service providers to operate its business and deliver its products and services.
These may include:
Provider
Purpose
Amazon Web Services (AWS)
Hosting SEPM websites, applications and mySEPM services
Zoho
Customer relationship management, business administration and billing
Zendesk
Customer support, ticket management and related services
Green.ch
Business communications and technical infrastructure
Stripe
Processing online payments and related transactions
Service providers receive or access personal data only to the extent necessary for their respective functions and subject to applicable legal and contractual requirements.
SEPM does not sell personal data to third parties.
8. International Data Transfers
SEPM is based in Switzerland and works with customers and service providers internationally.
Depending on the services involved, personal data may be processed or accessed in Switzerland, the European Economic Area or other countries.
Our existing technical and organisational arrangements include:
- Hosting of mySEPM applications using AWS infrastructure in the EU, including the Paris region.
- Customer and business administration using Zoho services configured for EU data centres.
- Customer support using Zendesk services with EU hosting arrangements.
- Authorised development and support activities involving personnel or service providers in India.
- Project-related collaboration using external document and communication services where required.
Where personal data is transferred to or accessed from countries without a recognised adequate level of data protection, SEPM applies appropriate safeguards as required by applicable law, which may include contractual data protection obligations and recognised standard contractual clauses.
Information about applicable transfer arrangements may be requested from SEPM.
10. Data Security
SEPM implements technical and organisational measures appropriate to the nature of the information processed and the associated risks.
These measures may include:
- Access restrictions and role-based permissions.
- Authentication and account security controls.
- Encrypted communication channels.
- Secure hosting infrastructure.
- Restricted access to customer and support information.
- Security updates and operational monitoring.
- Contractual confidentiality obligations for authorised personnel and service providers.
- SEPM periodically reviews relevant measures and adapts them where appropriate.
- However, no method of electronic storage or transmission can guarantee absolute security.
11. How Long Do We Retain Personal Data?
SEPM retains personal data only for as long as necessary for the purposes for which it was collected or as required by applicable legal obligations.
Retention periods may depend on the type of information:
- Customer and contractual records: For the duration of the business relationship and any subsequent legally required retention period.
- Invoices and accounting records: According to applicable Swiss accounting and tax retention requirements.
- Subscription and licensing information: For the duration necessary to administer licences, subscriptions and related contractual rights.
- Support tickets and technical documentation: For as long as reasonably necessary to provide support, maintain technical history and manage relevant obligations.
- Marketing contact information: Until consent is withdrawn, an applicable objection is received or continued retention is no longer justified.
- Technical and security logs: For periods appropriate to operational and security requirements.
- Once information is no longer required, it is deleted, anonymised or retained in restricted form where legally necessary.
12. Your Rights
Depending on the applicable data protection law and circumstances, you may have the right to:
- Request information about the personal data SEPM processes about you.
- Request access to your personal data.
- Request correction of inaccurate or incomplete information.
- Request deletion of personal data where legally applicable.
- Object to certain processing activities.
- Withdraw consent where processing is based on consent.
- Request restriction of processing or data portability where provided by applicable law.
To exercise your rights, contact:
SEPM may request reasonable information to verify your identity before responding.
Certain requests may be restricted where SEPM must retain information to comply with legal obligations, perform contracts or establish or defend legal claims.
You may also contact the competent data protection supervisory authority where applicable.
13. External Websites and Services
The SEPM website may contain links to third-party websites, software platforms or external resources.
SEPM does not control the privacy practices or content of these external services.
When accessing third-party websites or services, their own privacy notices and terms may apply.
14. Changes to This Privacy Statement
SEPM may update this Privacy Statement to reflect changes in its products, services, technical infrastructure, business operations or applicable legal requirements.
The current version will be published on the SEPM website with an updated revision date.
Where required by applicable law, SEPM will provide additional notification or request consent before implementing material changes to personal-data processing.
15. Contact
SEPM
Software Engineering & Project Management
For questions about this Privacy Statement or SEPM's handling of personal data, please contact:
- SEPM — Software Engineering & Project Management
- Robert Schweikert
- Gerliswilstrasse 42
- CH-6020 Emmenbrücke
- Switzerland
- Email: info@sepm.ch
- Website: https://www.sepm.ch
© 2026 SEPM. All rights reserved.