A FADP-compliant chatbot for your website: transparent and from Switzerland

A chatbot on your website holds conversations with visitors and may process personal data in the process, for example when someone types their name or email address into the chat. Under the Swiss Federal Act on Data Protection (FADP), principles such as transparency and proportionality apply. If you use service providers, you need to know who receives the data and in which countries it is processed.

Whether a specific use is ultimately compliant depends on several factors: the configuration, the content, your privacy policy and your business. That is why no provider can give a blanket guarantee. This text is not legal advice.

SWAI Solutions GmbH is a Swiss company based in Zurich. Data processing follows the Swiss FADP and the Data Protection Ordinance and, where applicable, the GDPR. If you use a SWAI chatbot on your website, you usually determine the purpose and content of the conversations. SWAI then processes the conversation and knowledge data as a processor on your instructions.

Your content and conversations are not used to train generally available AI models. Data is encrypted in transit, and access is role-based. The embedded chatbot can store a random session identifier in your visitors' browser session storage, so that a conversation can continue during the session.

Which service providers are involved and in which countries data can be processed is listed in full in our privacy policy. Depending on the chosen AI model and configuration, this can also be outside Switzerland, for example in the EEA or the USA. For countries without a recognised adequate level of data protection, we use in particular recognised standard contractual clauses with the adjustments required for Switzerland.

You remain responsible for the use on your website. Point your visitors to the chatbot in your own privacy policy, and add only content to the knowledge base that visitors may see, because anything in it can appear in an answer. Specify in the system prompt that the chatbot should not ask for sensitive personal data.

Also check, using the privacy policy, whether the listed service providers and processing locations meet your requirements. If in doubt, we recommend clarifying the use with your data protection adviser or legal counsel.