Privacy
Last updated: 25 October 2026.
Ayoub Bensalem, Nawa Corps (sole proprietorship), Promenade de l'Europe 17, 1203 Geneva, Switzerland. Contact for any question about your data: info@nawacorps.ch.
This site applies the Swiss Federal Act on Data Protection (nFADP) and its ordinance (DPO). For visitors located in the European Union, in particular in neighbouring France, the General Data Protection Regulation (GDPR) applies where its conditions are met.
The nFADP does not require a legal basis for processing that respects its principles; we nevertheless state why each processing takes place. Under the GDPR (Art. 6), these are pre-contractual steps taken at your request (point b) or our legitimate interest in answering enquiries and protecting the site (point f). No processing relies on your consent, and none is used for advertising.
Data: your name (required), your phone number or your email address (one of the two required), your message, and the page the enquiry was sent from.
Purpose: to reply to you, arrange the demo and prepare a written offer. Basis: pre-contractual steps.
The enquiry is stored in our database. A notification is sent at once to the operator's Telegram messenger: your name, phone number, email address and the first 200 characters of the message.
Data: what you write to Leo. With each message, the current conversation is sent to an artificial intelligence provider in the United States (see “Recipients”) to produce the reply.
Recording: the conversation is stored in our database when you click “Get my demo”, and also automatically when you leave or close the page after a few exchanges. It is then sent a second time to the AI provider, which extracts your name, phone number, email address, trade, business name, need, its urgency and an interest score from 1 to 5. If a name and a phone number are present, an enquiry record is created, and a Telegram notification sums it up.
No decision is taken automatically: the score is only used to sort enquiries. Every enquiry is read by the operator, who alone decides what happens next.
Purpose: to answer your demo request. Basis: pre-contractual steps and legitimate interest. Do not give Leo any sensitive information (health, your customers' data): write to us directly.
They let the operator, who works alone and without an office, see an enquiry during the day. They contain the data listed in points 1 and 2. The service is provided by Telegram Messenger Inc., established outside Switzerland and the European Union; according to its privacy policy, data may also be shared with its group companies in the British Virgin Islands and Dubai. These countries are not on the list of States whose data protection Switzerland recognises as adequate: the disclosure relies on Art. 17(1)(b) nFADP, because it is directly connected with the conclusion of the contract your enquiry prepares (for visitors from the European Union: GDPR Art. 49(1)(b)).
Telegram keeps messages until they are deleted. The automatic purge of our database does not reach them: the operator deletes the notifications from the messenger himself, within the same periods as the database.
Each time the form is sent, a message is sent to Leo or a conversation is stored, we record a fingerprint of your IP address (SHA-256 hash with a secret salt: the address itself is not kept), the type of action and the time. This fingerprint is also kept with the stored conversation. Purpose: to limit mass sending and abuse. Basis: legitimate interest in the site's security.
Like any server, the host Vercel processes your IP address, the page requested and the time in order to deliver and secure the site. The logs the operator can consult are kept by Vercel for one hour to 30 days depending on the hosting plan; Vercel keeps its other technical logs under its own retention rules.
No audience measurement tool, no advertising pixel, no third-party tracker. In normal operation, the site sets no cookie for visitors. Fonts are served by our own site: your browser does not contact Google Fonts.
The site stores two values in your browser. Neither contains personal data, and neither is sent to our server:
— “bnc-intro”, in session storage: avoids replaying the opening animation on every page. It is cleared when the tab is closed.
— “nawa-cookies”, in local storage: remembers that you closed the cookie information banner, so that it does not come back on every visit. It stays until you clear the site's data in your browser.
If the host's firewall puts your browser through an anti-bot check, Vercel stores a verification session in it, valid for one hour. Lastly, a technical cookie (“admin_session”, valid for 24 hours) exists for the administrator only, when logging in to the management area.
All of this is necessary for the site to work and therefore does not require your consent. If an audience measurement tool were ever added, you could accept or refuse it, and this page would say so.
Your data is neither sold nor rented. It is entrusted to the following processors, for the purposes above only:
— Vercel Inc. (United States): hosting of the site, servers in Frankfurt (Germany).
— Neon, LLC (United States, Databricks group): database, servers in Frankfurt (Germany).
— Groq, Inc. (United States): the AI model that makes Leo answer. By default, Groq does not retain requests; it may keep their content for up to 30 days to troubleshoot an outage or investigate abuse.
— Google LLC (United States): the Gemini AI model, a back-up used only if it is switched on instead of Groq. For a service offered in Switzerland, Google's terms exclude using the content to improve its products; it is logged for a limited period to detect abuse.
— Telegram Messenger Inc.: notifications (point 3).
Germany is on the list of States whose data protection the Federal Council recognises as adequate (Annex 1 DPO). For the United States, the same Annex recognises companies certified under the Swiss-U.S. Data Privacy Framework: Vercel Inc., Google LLC and Databricks, Inc. (including Neon, LLC) are, according to the official list (dataprivacyframework.gov) consulted on 25 October 2026. Groq is not on it: the disclosure relies on the European Union standard contractual clauses, adapted to Swiss law, provided for in its data processing addendum. For Telegram, see point 3. For visitors from the European Union, the equivalent GDPR safeguards apply (EU–U.S. adequacy decision for certified companies, standard contractual clauses for Groq).
If you write to us on WhatsApp, your messages go through WhatsApp (Meta), under its own rules.
Enquiries (form and Leo): 12 months after receipt. Conversations with Leo: 12 months. Abuse log: 30 days. If an enquiry leads to a contract, the data needed for the contract is kept for its duration, then for the legal periods (ten years for accounting records, Art. 958f of the Swiss Code of Obligations).
A purge script automatically deletes from the database everything that has passed these periods. It is run regularly, at least once a month.
The site is served over HTTPS. IP addresses are not stored in clear. The management area is protected by a password and is accessible to the operator only.
You may ask for access to your data, its correction, its deletion, the restriction of processing, object to processing, and obtain your data or have it transmitted in a common format (nFADP Art. 25, 28 and 32; GDPR Art. 15 to 21). Write to info@nawacorps.ch. We reply within 30 days and may ask you to prove your identity.
You may contact the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, edoeb.admin.ch. If you live in the European Union, you may also contact the authority of your country — in France, the CNIL (cnil.fr).
This page follows how the site actually works. It is updated when a processing changes; the date at the top prevails.