ARITHMATAX← Home

Privacy policy

This privacy policy explains how Thomet GmbH, operating under the brand Arithma Tax(“we”, “us”), processes personal data when you use this website and our tax-return service. We comply with the revised Swiss Federal Act on Data Protection (FADP / nDSG, in force since 1 September 2023) and, where applicable, the EU General Data Protection Regulation (GDPR).

Controller

Thomet GmbH
Walkeweg 34, 4053 Basel, Switzerland
Email: benjamin@arithma.ch
Phone: +41 79 577 82 79

We have not appointed a Data Protection Officer. Data-protection enquiries can be addressed directly to the contact above.

What we collect

  • Lead form: first name, last name, email, optional phone number, selected service tier.
  • Tax documents you provide: salary certificates (Lohnausweis), pillar 3a statements, bank and brokerage statements, foreign account information, property and mortgage documents, health and insurance certificates, family and childcare documents, and any other records required to prepare your return.
  • Communication: emails, messages and call notes exchanged during the engagement.
  • Technical data: server logs (IP, user agent, timestamp) for security and abuse prevention.

Sensitive data

Tax preparation necessarily involves data that is sensitive under both FADP and GDPR — in particular detailed financial information, family circumstances, religious affiliation (used to determine church tax), and health-related information where it affects deductions. For these categories we rely on your explicit consent, which we obtain in the engagement letter you sign before we begin work (Art. 9(2)(a) GDPR).

Why we process your data and on what basis

  • Contract performance (Art. 6(1)(b) GDPR): preparing your quote, collecting documents, and preparing, discussing and submitting your tax return.
  • Legal obligation (Art. 6(1)(c) GDPR): retention of accounting and tax-relevant records as required by Swiss law (in particular Art. 958f of the Swiss Code of Obligations — 10-year retention).
  • Legitimate interest (Art. 6(1)(f) GDPR): operating the website securely, preventing abuse, and improving our service.
  • Consent (Art. 6(1)(a) and Art. 9(2)(a) GDPR): for processing of sensitive categories of data and for any optional communications.

How you can send documents

You can send tax documents by email or via a secure file-sharing link we provide on request. Please be aware that standard email is not end-to-end encrypted: messages are typically encrypted in transit between mail servers, but their security ultimately depends on your own email provider. If you prefer not to send documents by email, ask us for a secure upload link.

Recipients and processors

We share your data only with the following categories of recipients:

  • Hosting: Vercel Inc. (United States) — hosts this website and processes server logs. See vercel.com/legal/privacy-policy.
  • Transactional email: Resend, Inc. (United States) — delivers form submissions to our case-management address. See resend.com/legal/privacy-policy.
  • Cantonal tax authorities: the relevant cantonal tax office, when we file your return on your behalf with your prior approval.
  • Public authorities: where we are legally required to disclose information (e.g. judicial or tax-authority requests).

We do not sell or rent personal data, and we do not share it with third parties for advertising purposes.

International transfers

Some of our processors are located in the United States. Where data is transferred outside Switzerland or the EEA, we rely on appropriate safeguards: certification under the EU–US and Swiss–US Data Privacy Frameworks where available, and otherwise the European Commission’s Standard Contractual Clauses together with the addendum recognised by the FDPIC.

How long we keep your data

  • Accounting and tax-relevant records: 10 years (Art. 958f CO).
  • Lead enquiries that do not result in an engagement: up to 24 months, then deleted.
  • Server logs: up to 30 days.

After the applicable period, data is deleted or anonymised. You may request earlier deletion of data that is not subject to a retention obligation.

Security

Data is transmitted over TLS. Documents and case files are stored on access-controlled systems, with access restricted to personnel who need it to deliver the service. We review our security measures on an ongoing basis.

Your rights

You have the right to:

  • access the personal data we hold about you;
  • have inaccurate data corrected;
  • have data erased, where no retention obligation applies;
  • restrict or object to processing;
  • receive your data in a portable format;
  • withdraw any consent you have given, with effect for the future.

To exercise any of these rights, contact us at benjamin@arithma.ch. We may need to verify your identity before responding.

Right to lodge a complaint

If you believe we have processed your data unlawfully, you may complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC) — edoeb.admin.ch. Residents of the EU/EEA may also complain to the supervisory authority of their country of residence.

Automated decision-making

We do not use automated decision-making or profiling that produces legal or similarly significant effects on you.

Children

Our service is intended for adults. We do not knowingly process personal data of children other than in the context of a parent’s tax return (e.g. childcare and family-related deductions provided by the parent).

Marketing

We use your contact details only to deliver the service you requested and to follow up on your enquiry. We do not send marketing communications without your consent.

Cookies

This site uses only essential cookies required to operate the application. We do not currently use third-party analytics or advertising cookies. If this changes, we will update this policy and request your consent where required.

Changes to this policy

We may update this policy to reflect changes in our service or applicable law. The current version is always available at this URL.

Last updated: 2026-05-08