GDPR & Swiss nDSG Compliance

Effective Date: January 1, 2026 Last Updated: September 29, 2026

At Nevalto, security, privacy, and regulatory compliance are integral to our core software architecture. We provide sports organizations, clubs, and facilities with enterprise-grade data protection aligned with the Swiss Federal Act on Data Protection (nDSG / FADP) and the EU General Data Protection Regulation (GDPR).

---

1. Technical & Organizational Measures (TOMs)

Nevalto implements comprehensive organizational and technical controls across all hosting environments:

End-to-End Encryption:
Access Controls & Multi-Tenancy:
Zero-Access Security Model:

---

2. Swiss Data Sovereignty

Data Locality: Primary production data stores and AI edge inference pipelines are located exclusively within Swiss and EU/EEA jurisdictions.
No Third-Party AI Data Training: Operational parameters, court schedules, and stringing orders processed by Gemma AI are ephemeral and never utilized for generalized public model training.

---

3. Data Processing Agreement (DPA)

Every Nevalto commercial license includes a comprehensive Data Processing Agreement (DPA) satisfying Article 28 GDPR and Article 9 Swiss nDSG requirements, establishing our obligations as a processor on behalf of your club or facility.

---

4. Breach Notification Protocol

In accordance with statutory timelines, Nevalto maintains an Incident Response Team capable of assessing and notifying impacted club administrators within 72 hours of any confirmed security incident involving personal data.

---

5. Contact the Compliance Team

For audit inquiries, standard DPA requests, or security questionnaires:

Nevalto Security & Compliance Darkventure Studio Sàrl Email: [email protected] Website: https://nevalto.com/contact