Price calculator
Loading Estimate Cost...
Valid from 04.10.2026 (replaces all previous versions)
Sponti-Car GmbH
Talstrasse 24
8852 Altendorf
Switzerland
Email: info@sponti-car.ch
Phone: 055 264 10 00
Data protection contact: Mark Ritzmann
Sponti-Car is the controller within the meaning of the Swiss Data Protection Act (DSG) and – to the extent applicable – the EU General Data Protection Regulation (GDPR).
This privacy policy applies to all customers, interested parties and users of the website, app and vehicles of Sponti-Car as well as to all other persons whose data is processed within the scope of the service. The German version is authoritative.
| Purpose | Legal basis |
|---|---|
| Registration, contract, booking, billing, support | Contract (Art. 31 para. 2 lit. a FADP / Art. 6 para. 1 lit. b GDPR) |
| Identity, driving licence and SwissPass verification | Contract and legitimate interest in abuse prevention |
| Credit check (CRIF) and admission decision | Contract and legitimate interest; where required, consent or Art. 21 FADP / Art. 22 GDPR |
| AI-supported review, decision and email communication (Grok) | Contract and legitimate interest in efficient, uniform processing |
| Website/app analysis (Google Analytics) | Consent |
| Accounting, authorities, statutory obligations | Law |
We use the AI system Grok from xAI LLC, USA, via the business API/Enterprise use.
Grok is used in particular for:
AI phone assistant: Calls to the hotline may be answered, transcribed and processed by an AI (Grok/xAI) for identification (member number, date of birth, phone number), for opening vehicles, for extending bookings and for sending notifications. Call transcripts are stored with the AI or in the system for a maximum of 90 days. You may request transfer to a staff member at any time.
Telephone system: For the hotline, we use the 3CX telephone system. The software provider is 3CX Ltd, headquartered in Nicosia (Cyprus, EU). The telephone system is used to accept, forward and log calls (e.g. telephone number, time and duration of the call). A data processing agreement (Data Processing Addendum) exists for this processing. The data may be processed in the European Economic Area (EEA). For push notifications to the phone apps, services from providers in the USA (e.g. Apple or Google) may be used.
Only the information necessary for the respective process is transmitted to Grok (e.g. name, email, SwissPass number, verification result, CRIF score/relevant creditworthiness characteristics, process data). Not transmitted to Grok are biometric images from Stripe Identity and complete credit card data.
xAI acts as processor. The Data Processing Addendum of xAI applies. According to xAI's Enterprise/API terms, business inputs and outputs are not used for model training . Data may be processed in the USA (data processing agreement and standard contractual clauses; Data Privacy Framework to the extent applicable to xAI).
Documents: xAI DPA, xAI Privacy Policy.
The decision as to whether you may become a customer or continue to use the offer can be made exclusively on an automated basis by Grok. The basis for this is our defined admission criteria as well as the credit report from CRIF, supplemented by the SwissPass and identity check.
A rejecting or restricting decision will be communicated to you. You have the right:
Contact: info@sponti-car.ch or 055 264 10 00.
Legal bases: Art. 21 DSG and Art. 22 GDPR. Insofar as consent is legally required, we obtain it during registration. Refusal may result in no contract being concluded.
Data is only disclosed to the extent necessary for the contract, legal requirements, or legitimate interests. The list is not exhaustive. The privacy policies of the named companies apply in each case.
| Recipient | Location | Purpose | Note |
|---|---|---|---|
| ibiola Mobility Solutions GmbH | Austria | Booking, opening, telematics | Data processing agreement; EU adequacy |
| Stripe Inc. (Payments / Identity) | USA | Payment and identity verification | Data processing agreement; DPF/SCC |
| CRIF AG | Switzerland | Creditworthiness and identity information | see also mycrifdata.ch |
| xAI LLC (Grok) | USA | AI: emails, SwissPass verification, admission decision | DPA; no training on business data according to xAI |
| xAI LLC (Grok), AI phone assistant | USA | AI phone assistant: Receiving and transcribing hotline calls, identification (membership number, date of birth, phone number), opening vehicles, extending bookings, sending notifications | DPA; call records for a maximum of 90 days; forwarding to an employee possible at any time |
| 3CX Ltd (3CX phone system) | Cyprus (EU) | Hotline phone system: accepting, forwarding and logging calls | Data processing agreement (DPA); processing within the EEA possible; push notifications possibly via services in the USA |
| Google Ireland/USA (Analytics) | Ireland/USA | Website/app analysis | only with consent |
| Bexio AG | Switzerland | Accounting | Data processing agreement |
| Microsoft (Office 365) | USA/EU | Office communication | Data processing agreement; DPF/SCC |
| OpenAI (ChatGPT) | USA | internal text and auxiliary work, insofar as used | only with AVV/API; own regulations of OpenAI |
| WhatsApp / Meta | USA/EU | communication, insofar as you use this channel | own regulations of Meta |
Other possible recipients: authorities (legal obligation), insurance companies (damage cases), payment service providers, IT and support partners. All processors are contractually bound to our instructions and may not use the data for their own purposes, insofar as the respective contract so provides.
Third-party privacy notices (excerpt):
xAI ·
Stripe ·
CRIF ·
Google ·
Bexio ·
Microsoft ·
OpenAI ·
WhatsApp
Some of the processing takes place in the EU/EEA (adequate level of protection) and in the USA (Stripe, xAI, Google, Microsoft, Meta, OpenAI). Depending on the recipient, the basis is the data processing agreement, standard contractual clauses and – insofar as the recipient is certified – the EU-US or Swiss-US Data Privacy Framework. A copy of the guarantees used can be requested.
You have – within the framework of the FADP and the GDPR – the right to information, rectification, erasure, restriction, data portability, objection to processing based on legitimate interest, as well as the right to human review of automated decisions.
Complaint: Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, www.edoeb.admin.ch. Where the GDPR applies, additionally to the competent EU supervisory authority.
Contact: info@sponti-car.ch
Google Analytics only with consent (Consent Mode v2, IP anonymization). Consent can be withdrawn via the cookie banner.
We take appropriate technical and organizational measures (access restrictions, encryption of transmission, instructions to processors). Only minimized data sets are transmitted to Grok.
We may amend this privacy policy. The current version applies upon publication on the website. We will communicate material changes, in particular regarding the use of AI or automated decisions, in an appropriate manner (website, email or app).
As of: 04.10.2026