Privacy and Data Protection Policy

ARTICLE 1: PREAMBLE

This privacy policy applies to the websites EazyMirror.com and Insights.EazyMirror.com, both published by Getratex SA. Its purpose is to inform users of the websites of how their personal data is collected and processed, the rights they have, the identity of the data controller, the recipients of such data, and the websites' cookie policy. This policy supplements the Legal notice and the Terms of Use of Getratex SA.

ARTICLE 2: GENERAL PRINCIPLES FOR THE COLLECTION AND PROCESSING OF DATA

In accordance with Article 5 of the European Regulation 2016/679 (GDPR) and the Swiss Federal Act on Data Protection, the collection and processing of the data of the websites' users comply with the principles of lawfulness, fairness and transparency; purpose limitation; data minimisation; storage limitation; and integrity and confidentiality. Data may only be collected and processed if the user has given consent, or if the processing is necessary for the performance of a contract, for compliance with a legal obligation, for the protection of vital interests, for a task carried out in the public interest, or for the legitimate interests of the data controller.

ARTICLE 3: PERSONAL DATA COLLECTED AND PROCESSED

A. Data collected

• email address and user name (EazyMirror.com account)
• name and email address of each respondent
• name and email address of each person evaluated ("manager"), used exclusively to send them their score and history

B. Transfer of data to third parties

Data may be transferred to the following third parties:

• the persons designated when the questionnaire is created, to receive the average scores;
• the employer, which only receives anonymous summary data, with no possibility of knowing who answered what;
• Insights EazyMirror, hosted by Abacus.AI (United States): receives no name or email address of any respondent or manager. Respondents' answers are anonymised there (it is impossible to know who answered what); managers are pseudonymised, i.e. designated only by a coded identifier. When a score has to be communicated to a manager, Insights EazyMirror generates a link associated only with that manager's coded identifier; this link is returned to EazyMirror.com, which alone, in Switzerland, holds the correspondence table allowing it to be associated with a real email address. No name or email address of any respondent or manager therefore leaves Swiss territory;
• as part of the AI-assisted analysis features, Abacus.AI may use third-party models, in particular OpenAI and Anthropic, exclusively on the basis of aggregated statistics, without any name, email address or respondent or manager identifier;
• when a payment is made, only price and transaction result information is transmitted to and by PayPal respectively. No banking data is visible to EazyMirror.com.

Emails (invitations, results) are sent directly from Infomaniak's servers, without any third-party mailing provider.

C. Data hosting

The names and email addresses of respondents and managers are hosted and processed exclusively in Switzerland, by Infomaniak (Rue Eugène-Marziano 25, 1227 Geneva, Switzerland, +41 22 820 35 44). The survey data transmitted to Insights EazyMirror (anonymised respondent answers, pseudonymised managers), as well as the login accounts of Insights EazyMirror users (login email), are processed by Abacus.AI, on an AWS/Azure/GCP infrastructure located in the United States (AES-256 encryption at rest, TLS 1.2+ in transit; SOC 2 Type II, ISO/IEC 27001, GDPR and CCPA compliance). A data processing agreement (DPA) governs this relationship.

ARTICLE 4: DATA CONTROLLER AND DATA PROTECTION CONTACT

The controller of personal data is Raphaël Cohen, c/o Getratex SA, who can be contacted by email at [email protected]. For any question relating to data protection: [email protected].

ARTICLE 5: USER RIGHTS

In accordance with the applicable regulations, the user has the right to access, rectify and erase their data; the right to data portability; the right to restrict and object to processing; the right not to be subject to automated decision-making (EazyMirror.com does not use any); the right to determine what happens to their data after their death; and the right to lodge a complaint with the competent supervisory authority. Any request must be sent by email to the data controller, who will respond within 30 days.

ARTICLE 6: USE OF COOKIES AND BROWSER STORAGE

A. On EazyMirror.com

• PHPSESSID — standard technical session cookie — necessary
• userID — "remember me" cookie, set only if the user ticks this option when logging in — functional
• em_lang — stores the chosen language — functional, 1 year
• EZM_Session (not systematic) — keeps the progress of a survey completed before registration — functional
• Affiliate cookie (not systematic) — set only if the user has explicitly accepted it via the consent banner displayed on their first visit

B. On Insights.EazyMirror.com

The application also uses the browser's local and session storage (app_lang, em_selected_dataset, analysis selections, temporary consolidation state), exclusively for ease of use and without any transfer to third parties. No third-party advertising or audience measurement cookies are used on Insights.EazyMirror.com. The application includes a third-party conversational assistant (Abacus.AI), which may set its own cookies from the abacus.ai domain — see https://abacus.ai/privacy.

ARTICLE 7: CHANGES

This policy can be consulted at any time at: https://www.eazymirror.com/politique_confid.html. Last updated: 30 September 2026.

ARTICLE 8: ACCEPTANCE

By browsing the websites, the user confirms that they have read and understood this policy and accepts its terms.