Privacy policy

This is a translation of the German Datenschutzerklärung. Only the German version is legally binding.

1. Controller

Scales GmbH, Roosstrasse 53, 8832 Wollerau, Switzerland · Company ID (UID) CHE-187.382.678. Contact for data protection requests: dennis@myscales.ch. majiq is a product of Scales GmbH.

2. Our two roles

Processor for the content of your data room (the uploaded documents and the questions and answers in the data room): you, the advisory, buyer or seller firm, are responsible for this data; we process it only on your instructions (data processing agreement).

Controller for your account data (name, email, company) and for cross-company learning, to which you can object at any time.

3. What data we process

Account data: name, email, company, role, login and usage logs.

Data room content: whatever is in your uploaded documents. This can include personal data of third parties (e.g. names, addresses, IBAN, salary details, positions, tax and company ID numbers).

Questions in the data room: the questions and answers that bidders, sellers, specialists and the advisory team write there, and who wrote them. These can also contain personal data.

4. Purposes and legal bases

Provision of the due diligence platform: preparing the data room, AI-assisted identification of risks, tracking of measures and communication with bidders. Legal bases: performance of a contract (Art. 31(2)(a) revFADP; Art. 6(1)(b) GDPR) and overriding legitimate interests in carrying out the transaction (Art. 6(1)(f) GDPR).

Cross-company learning: To improve quality, we derive general, abstracted review patterns from confirmed findings. A pattern describes a review issue in general terms and contains neither document content nor names, amounts or any other details that would allow conclusions about you, an engagement, a target company or a person. The legal basis is our legitimate interest in improving the service (Art. 6(1)(f) GDPR). You can object to this processing at any time: as a company admin directly via the switch in the settings, or with a short message to dennis@myscales.ch.

5. AI processing

Your data room content is stored and processed in the EU, the EEA or Switzerland: text recognition, classification and AI analysis run in data centers in this area. The application itself runs in Switzerland (Zurich); the database and the uploaded files are located there as well. Document content is not transferred to the USA or any other third country.

Tokenization before upload: People uploading documents can replace personal names with neutral placeholders before uploading. This tool runs entirely locally in the browser; no document content is transferred to us.

Web search of the engagement expert: If a question needs outside knowledge (for example an industry comparison, or market, legal or tax questions), the expert proposes a search phrase made of general terms. The phrase is checked technically: the name of the engagement, the names of its companies and of the persons known to us from the engagement, addresses and numbers other than years are stopped. A search only runs once an advisor approves exactly this phrase; without approval, nothing goes out. The AI model receives only the approved search phrase, no document content, and uses it to form search queries to the search services Brave or Bing. These search services also operate outside the EU, the EEA and Switzerland. Every web search is logged and deleted together with the engagement.

Questions in the data room: Before a person from a bidder sends a new question, an AI model from Microsoft Azure in the EU checks whether an answer already exists. It receives the subject and text of the question and a selection of candidates from what this person can see in the data room: documents with name, document type and area, and questions with subject, the beginning of the text and, if available, the most recent answer. The platform does not pass on the name of the person or their bidder. The model only chooses among these candidates; at most three are shown. It also assigns the question to an area and a document for the advisory team. Whether a match answers the question is decided by the person; they can also send the question anyway or cancel. Nothing is decided automatically. If the check finds nothing or fails, the question goes to the advisory team right away. After a new question has been received, an AI model from Microsoft Azure in the EU compares it with earlier questions in the same engagement, by subject and beginning of the text. It compares it with questions from other bidders and with questions that the advisory team has merged with another bidder’s question. This lets the advisory team answer identical questions together. Only the advisory team sees this result; the bidders are not told about it. When the advisory team opens the questions of an engagement, an AI model from Microsoft Azure in the EU assesses whether a question has been answered. It receives the subject and messages of the question together with the names of attached files, but not the names of the authors; this result is also seen only by the advisory team. Every check before sending is logged, even if the person then cancels or does not send the question: with the question text, candidates, matches, classification and result, as well as the person and their bidder. The log serves as evidence of what the check presented and how the person decided; only the advisory team reads it, and it is deleted together with the engagement.

There is no automated individual decision with legal effect: the analysis supports the advisors; a human makes the decision.

6. Recipients and processors

We use carefully selected service providers under appropriate contracts, in the following categories:

• Database, authentication and document storage (Switzerland, Zurich; encrypted at rest)
• Text recognition/OCR (EU)
• AI analysis (EU data centers)
• Hosting of the application with web application firewall (Switzerland, Zurich)
• Malware scanning of uploaded files (EU/Switzerland)
• Task orchestration (control and workflow data)
• Transactional email delivery
• Web search of the engagement expert (search services Brave and Bing; they receive only search queries formed from the approved search phrase, no document content)

The complete list of our processors by name (including location and safeguards) is part of our data processing agreement. Customers receive it with the contract and at any time on request.

7. Transfers abroad

Services within the EU, the EEA and Switzerland provide an adequate level of protection. Document content stays within this area. For individual technical services (e.g. email delivery, workflow control with pure control data) with providers in the USA, we rely on the EU Standard Contractual Clauses or the Swiss-U.S. and EU-U.S. Data Privacy Framework. A transfer risk assessment is in place. For the web search of the engagement expert (section 5), search queries formed from the approved search phrase go to search services based in the USA; they contain no document content, and the search phrase is designed not to carry personal data.

8. Retention

Engagement data and documents, as well as the questions in the data room and the log of their check before sending: for the duration of the active engagement and at most 24 months afterwards. Processing logs (evidence of processing): 5 years. Technical logs of model calls (only checksums and token counts, no plain data): 12 months. Access logs of the web application firewall (IP address, requested address, time, browser identifier): 90 days. Account data: until the account is deleted.

9. Your rights

You have the right of access (Art. 25 revFADP / Art. 15 GDPR), rectification, erasure or destruction, data release and portability (Art. 28 revFADP / Art. 20 GDPR), and the right to object to cross-company learning. You have the right to lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC) or with the competent EU data protection authority.

10. Contact

Scales GmbH, Roosstrasse 53, 8832 Wollerau, Switzerland · dennis@myscales.ch