Privacy policy

1. Controller

You can submit privacy requests through our contact form.

2. Scope and legal bases

This notice explains how we process personal data when you visit our website, contact us or book an appointment. We comply with the Swiss Federal Act on Data Protection (FADP). Where the General Data Protection Regulation (GDPR) applies, we rely in particular on performance of a contract or pre-contractual steps (Article 6(1)(b)), legitimate interests (Article 6(1)(f)), legal obligations (Article 6(1)(c)) or your consent (Article 6(1)(a)).

3. Website operation and server logs

We operate the website and its Appwrite backend on our own infrastructure in a server cluster of Vautron Rechenzentrum AG in Germany. A request may generate server logs containing your IP address, date and time, requested address, transferred data volume, referrer, browser, operating system and technical status information.

We process these data to provide the website securely and efficiently, diagnose errors and prevent misuse. Under the GDPR, the legal basis is our legitimate interest in secure website operation (Article 6(1)(f)).

4. Contact form and communications

When you use the contact form, we process your name, email address, optional organisation, selected project type, message and enquiry language. Technical address data are processed briefly to limit abusive submissions.

Your details are transmitted using Resend and then received and handled in Google Workspace. We use them to respond and, where relevant, prepare or manage a business relationship. The legal bases are pre-contractual steps or contract performance (Article 6(1)(b)) and our legitimate interest in handling business enquiries (Article 6(1)(f)).

5. Appointment booking with Google Calendar

Google Calendar is blocked on the booking page by default. A connection to Google is established only when you actively load the calendar or follow the external link. Google may then receive technical access data and use cookies or similar technologies. If you book an appointment, we process your booking and contact details in Google Workspace to organise the appointment and communicate with you.

The embedded calendar loads with your consent. Processing of booking details is based on pre-contractual steps, contract performance and our legitimate interest in efficient scheduling.

6. Audience measurement with Matomo

We host Matomo on our own infrastructure in Germany. Matomo loads only after you expressly allow analytics cookies. It may process an IP address, viewed pages, time, referrer, device and browser information, and random visitor identifiers. We use this information to understand website usage in aggregate and improve our services. Matomo respects your browser's Do Not Track setting.

The legal basis is your consent (Article 6(1)(a) GDPR). You can withdraw it at any time for the future through the cookie settings in the footer.

7. Recipients and international transfers

We use carefully selected processors and have entered into the required data processing agreements:

• Vautron Rechenzentrum AG, Germany: data centre and infrastructure services.
• Resend: transmission of contact form messages; Ireland is selected as the region, while Resend primarily processes data in the United States under its contractual terms.
• Google Workspace and Google Calendar: email communication, appointment management and bookings. Depending on configuration and service delivery, Google may process data outside Switzerland and the EEA.

For transfers to countries without an adequate level of data protection, we rely on recognised safeguards, particularly standard contractual clauses and applicable Swiss supplements, unless a statutory exception applies.

8. Retention

We retain personal data only for as long as required for the relevant purpose, system security, the establishment or defence of claims, and compliance with legal obligations. Relevant criteria include the duration of an enquiry or business relationship, technical security needs, limitation periods, and statutory documentation and retention duties. Business records may generally be retained for ten years under Swiss law.

Google Mail and Calendar data are also subject to the retention and deletion rules configured in our Google Workspace tenant. Under its terms, Resend deletes customer and usage data within 90 days after account termination. Backups on our infrastructure are continuously replaced by newer copies.

9. Your rights

Subject to applicable law, you may request access, rectification, erasure, restriction, disclosure or portability of your data, and object to processing. You may withdraw consent at any time for the future. To exercise your rights, use our contact form. We may request additional information to verify your identity.

You may also lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC). Where the GDPR applies, you may lodge a complaint with a competent supervisory authority in the EU or EEA.

10. Changes

We may update this notice if our processing activities or legal requirements change. The version published on this website applies.