goNEON

GDPR overview

Implementation is concrete but narrowly scoped. The published privacy policy, effective 18 May 2026, covers only the Microsoft 365 Sight Lines Agent and explicitly excludes the corporate website and other products. Within that scope it names legal bases under both the GDPR and the Swiss nDSG: contract performance (Art. 6(1)(b) GDPR / Art. 31(2)(a) nDSG), legitimate interests (Art. 6(1)(f) / Art. 31(2)(b)) and legal obligations (Art. 6(1)(c) / Art. 31(2)(c)). It lists access, rectification, erasure, restriction, portability, objection and consent withdrawal, promises a response within 30 days, and points to the Swiss FDPIC. Transfers outside the EU/EEA and Switzerland rely on Standard Contractual Clauses or equivalent Swiss safeguards. No Article 27 EU representative is named, and the site never claims GDPR compliance in so many words.

Who owns the data?

Under the terms of service, the customer keeps ownership of everything they submit, including the geometric drawings and plans fed to the agent. goNEON Agentic Systems AG receives only a limited, non-exclusive licence to process that material in order to deliver the service. Ownership runs the other way for the technology: the AI models, computational methods, software, design and documentation remain the exclusive property of the publisher, and nothing in the terms transfers any intellectual property to the user. For the Microsoft 365 agent, goNEON declares itself a separate controller for data flowing through its own backend, while Microsoft processes authentication data under its own terms.

Reuse rights

Outputs come back to the customer, but the terms attach an explicit condition to reusing them: results must be independently verified by a qualified engineer or planning professional before being relied upon, and users agree not to present them to a third party, including a regulatory authority or a client, without that independent verification. The service is framed as a technical assistance tool only, not as engineering advice, planning certification or a formal permit assessment. Input data is licensed to goNEON solely to deliver the service, while the privacy policy separately allows anonymised or aggregated data to feed model improvement. Reverse-engineering or extracting the underlying models is prohibited.

Data retention & training

Hosting summary

The publisher states that its primary infrastructure is located in the EU/EEA and Switzerland, and that hosting, storage and compute services are currently provided within those regions under data processing agreements with adequate safeguards. Microsoft Corporation operates the Microsoft 365 platform and processes authentication data under its own terms, acting separately from goNEON, which declares itself a distinct controller for data flowing through its own backend. Where processing takes place outside these regions, for instance across Microsoft's global infrastructure, the publisher relies on EU Standard Contractual Clauses or equivalent Swiss safeguards. Two limits are worth noting: no cloud provider is named, no specific region or data centre is identified, and this hosting statement appears in a privacy policy whose scope is explicitly restricted to the Microsoft 365 Sight Lines Agent. The jurisdiction governing the terms is Swiss law, with the courts of Zurich competent.