FADP & GDPR in Nyteca®

Last updated: September 2026

1. Roles: who is responsible for what?

In case of discrepancies, the German version prevails. The firm is the controller for the personal data of its clients. It decides which data it collects, how long it keeps it and who has access to it.

Tax AI AG operates Nyteca® and processes this data as a processor exclusively on the instructions of the firm (Art. 9 DSG, Art. 28 GDPR). It does not use client data for its own purposes and does not use it to train AI models without the firm’s express consent.

For the personal data of visitors to this website, Tax AI AG is itself the controller; this is governed by the privacy policy.

2. Nyteca® Chat

Draft. This section has not yet been reviewed by a lawyer.

Nyteca® Chat is a standalone AI assistant for tax law, without a firm system, client records or onboarding. Tax AI AG is itself the controller of the account and contract data of its users. Personal data of third parties, such as clients, contained in questions and uploaded documents is the firm’s responsibility; Tax AI AG processes it as a processor, solely to answer questions, analyse documents and prepare drafts.

We do not use uploaded files, questions or drafts for our own purposes, nor to train AI models without express consent. Only upload the documents you need for the question at hand.

You can request access to, rectification or deletion of your account data directly from us; the procedure is described in our privacy policy. Data subjects whose data a firm has used in the chat should contact that firm; we support the firm in responding. Information on the retention period for chat histories and uploads and on any transfer abroad will be added.

3. Data processing agreement

We conclude a data processing agreement (DPA) with every firm. It governs the subject matter and duration of the processing, the type of data, the right to issue instructions, technical and organisational measures, subprocessors, support with data subject requests, notification of data breaches as well as the return and deletion of the data at the end of the contract. You can obtain the DPA on request at kontakt@taxaiag.swiss; for firms in the EEA it contains the requirements of Art. 28 para. 3 GDPR.

4. Principles and how the Nyteca® App implements them

Lawfulness and transparency

The privacy policy, consents and powers of attorney are granted digitally during onboarding and filed in the dossier with a timestamp.

Purpose limitation

Every firm works in its own environment. Data is processed only for the engagement it was collected for; there is no analysis across firms.

Data minimisation

The core fields of the KYC questionnaire are predefined and follow the due diligence obligations; the firm adds its own fields and criteria only where it needs them for the engagement.

Accuracy

Clients enter their data themselves via the onboarding link; AI suggestions are confirmed by a person before they are applied.

Storage limitation

Retention rules per firm define how long which data and documents are kept.

Integrity and confidentiality

Encrypted transmission, role-based permissions, token-based authentication; hosting in Switzerland, we name the data centre operator in writing on request.

Accountability

The audit log records every operation with time and person and serves as evidence towards clients, auditors and supervisory authorities.

5. Tenant separation (Nyteca® App)

Every firm is its own tenant of the platform with a self-contained data space. A login belongs to exactly one firm; there is no switching between firms and no shared records. Every database access is restricted server-side to the firm of the signed-in user. Public links for clients (enquiry, KYC, consent, quote) are bound to a token that points only to the corresponding firm and the corresponding process. Enterprise customers receive a dedicated environment on request.

6. Audit log (Nyteca® App)

Every operation in the platform, whether creating, checking, approving, sending, revoking or deleting, is logged with time, person and the object concerned. When a person applies an AI suggestion, the resulting action appears in the log, for example filing the document or sending the email. The audit log can be viewed within the firm and serves as evidence of accountability (Art. 5 para. 2 GDPR) as well as a basis for audits and access requests.

7. Consents and revocation (Nyteca® App)

Consents (for example for data processing or for unencrypted transmission), powers of attorney and acknowledgement of the privacy policy are collected by the firm digitally through the onboarding flow. Every consent is filed in the client’s dossier with its date, the version of the document and the signature.

A revocation deletes nothing: the consent stays in the dossier as evidence and is marked as revoked with date and reason. The firm can therefore show at any time what applied when, and processing on the revoked basis is stopped.

8. Retention and deletion (Nyteca® App)

Each firm defines its own retention rules, versioned and per document category. In doing so it takes account of statutory obligations, for example the ten-year retention of business books and records under Art. 958f OR or the obligations arising from anti-money laundering law for KYC documents.

Documents are archived as PDF/A and therefore stay readable in the long term. Records with evidential value (signed consents, powers of attorney, KYC uploads) are not deleted during the retention period but revoked or marked as ended. Once the period expires, the firm deletes the data or has it deleted; at the end of the contract the firm’s data is exported and then removed (see the Terms).

9. Access, rectification, deletion and data portability (Nyteca® App)

Clients address data subject requests to their firm. The Nyteca® App supplies the data needed to answer them on time: master data of the client and their people, the dossier with all documents, the consents with their status and the audit log of operations. Data and documents can be exported in common formats (PDF/A, Word, CSV). Where the firm needs support, Tax AI AG assists within the scope of the DPA.

10. Technical and organisational measures (Nyteca® App)

• Database and file storage in the same environment, in Switzerland; we name the data centre operator in writing on request.
• Encrypted transmission (TLS) for the application, client links, Nyteca® Drive and the email connection.
• Token-based authentication, roles and groups with graded permissions, new users invited only by authorised people.
• Self-hosted fonts and scripts; no third-party CDNs, no trackers in the application.
• Separate environments per firm, a dedicated environment for Enterprise customers.
• Backup and restore are described in the DPA.

11. AI features

In Nyteca® Chat the AI answers questions, analyses uploaded documents and prepares drafts, for example opinions and objections, each with citations. In the Nyteca® App it makes suggestions: client, category and year in the inbox, drafts for email replies, deadlines and cases, answers in the case chat. It does not decide. Results from the chat are reviewed and owned by the professional; in the Nyteca® App every suggestion is confirmed or discarded by a person, and the resulting action, such as filing a document or sending an email, appears in the audit log. The firm controls how suggestions in the Nyteca® App are worded through its own AI instructions.

Which data is transmitted to the AI provider for an answer or a suggestion is documented per function and disclosed in the DPA. Questions, uploads and client data are not used to train models without express consent.

12. Subprocessors

We use the following subprocessors to run Nyteca® Chat and the Nyteca® App. We announce changes to our customers in advance; they may object for good cause.

13. Data protection breaches

If Tax AI AG identifies a breach of data security, it informs the affected firms as quickly as possible (Art. 24 para. 3 DSG, Art. 33 para. 2 GDPR) with the nature of the breach, the data concerned, the consequences and the measures taken, so that the firm can meet its notification obligation towards the EDÖB or the competent supervisory authority.

14. Contact

We answer questions about data protection, the DPA and subprocessors at kontakt@taxaiag.swiss. Please report security vulnerabilities to kontakt@taxaiag.swiss. You can find more information about the security of the Nyteca® App under Security & compliance.