Privacy Statement

1General

This privacy statement explains how we handle personal data in connection with our business activity and with the use of our website.

Personal data means any information relating to an identified or identifiable natural person.

We handle personal data responsibly and in accordance with the applicable data protection law, in particular the Swiss Federal Act on Data Protection (FADP) and the Ordinance on Data Protection (DPO). Where the General Data Protection Regulation of the European Union (GDPR) applies to a particular processing activity, we observe its requirements as well.

2Controller and contact

The controller for the processing described in this privacy statement is:

3Which personal data do we process?

Which personal data we process depends on your relationship with us and on how you contact us.

We process in particular the following categories of personal data:

• first name and surname;
• email address;
• telephone number;
• details of companies and organisations;
• the content of enquiries and correspondence;
• information you provide to us in the course of a collaboration or when enquiring about our services;
• contract, invoicing and payment information;
• technical data arising when our website is accessed.

You are generally not obliged to provide us with personal data. Where certain personal data is required in order to handle an enquiry, conclude a contract or render a service, we may not be able to handle that enquiry or render that service without it.

4Visiting our website

When you visit our website, the web server may record technically necessary data about the access. This may include in particular:

• IP address;
• date and time of access;
• the page or file requested;
• browser and operating system used;
• referring page or referrer URL;
• technical information about the connection.

This data is processed in particular to ensure the secure, stable and efficient operation of the website, to identify technical faults, and to detect and defend against misuse of or attacks on our systems.

Where the GDPR applies, this processing is based on our legitimate interest in providing the website and in operating it securely and stably, pursuant to Art. 6(1)(f) GDPR.

The website uses no analytics, tracking or marketing services. Fonts, images and scripts are served exclusively from our own domain. No third-party content is loaded automatically.

5Contact and the "Submit a project" form

You can contact us in particular by email, by telephone or through the "Submit a project" form.

In doing so we process the personal data you transmit, in particular your contact details, company information and the content of your enquiry.

The "Submit a project" form collects only the details visible there. There is no file upload.

We use this data in particular:

• to handle your enquiry;
• to communicate with you;
• to prepare a possible collaboration;
• to render agreed services; and
• to administer the business relationship.

Where the GDPR applies and your enquiry is directed at concluding or performing a contract, the processing is based on Art. 6(1)(b) GDPR.

Where the processing is not necessary for pre-contractual measures or for the performance of a contract, it is based on our legitimate interest in handling enquiries and in communicating with clients, prospective clients and business partners, pursuant to Art. 6(1)(f) GDPR.

6Rendering our services and business relationships

Where we act for you or enter into a business relationship with you, we process the personal data required to initiate, perform and administer that relationship.

This may include in particular contact and company data, correspondence, information on projects and engagements, and invoicing and payment information.

We process this data in particular:

• to review and handle enquiries;
• to conclude and perform contracts;
• to render our services;
• to communicate with clients, prospective clients and business partners;
• for invoicing and payment processing;
• to comply with statutory obligations; and
• to safeguard and enforce legal claims.

Where the GDPR applies, the processing is based in particular on the following legal grounds:

• Art. 6(1)(b) GDPR, where the processing is necessary for pre-contractual measures or for the performance of a contract;
• Art. 6(1)(c) GDPR, where the processing is necessary to comply with a legal obligation; and
• Art. 6(1)(f) GDPR, where the processing is based on our legitimate interests in the proper administration of our business relationships, the organisation of our operations, or the safeguarding and enforcement of legal claims.

7Cookies and local storage in the browser

Our website sets no cookies.

In particular, no analytics, tracking or marketing services are embedded, and there is no cross-device recognition of visitors.

Only two pieces of information are stored in your browser’s local storage:

• that you have read the notice on the use of cookies and comparable technologies; and
• that the short contact notice has already been shown once.

This information stays on your device, is not evaluated by us for analytics or marketing purposes, and can be deleted at any time through your browser settings.

As no technologies requiring consent are currently in use, the corresponding notice on our website serves information purposes only and does not obtain consent.

Should we in future use services that employ cookies or comparable technologies for analytics, tracking or marketing purposes, we will — where required — do so only after obtaining your consent, and will update this privacy statement accordingly.

Where the GDPR applies, storing technically necessary information and operating technically necessary functions is based on our legitimate interest in providing the website and keeping it securely functional, pursuant to Art. 6(1)(f) GDPR. Where consent is required for the use of particular technologies, the processing is based on Art. 6(1)(a) GDPR.

8Purposes of the processing

We process personal data in particular for the following purposes:

• operating and securing our website;
• handling enquiries;
• communicating with clients, prospective clients and business partners;
• preparing, concluding and performing contracts;
• rendering and developing our services;
• administration, accounting and invoicing;
• complying with statutory and regulatory obligations;
• safeguarding, exercising and enforcing legal claims; and
• ensuring the security of our IT systems and business processes.

Where the GDPR applies, the processing is based, depending on the purpose, in particular on Art. 6(1)(b), Art. 6(1)(c) or Art. 6(1)(f) GDPR. Where we obtain your consent, Art. 6(1)(a) GDPR is the legal basis.

9Disclosure of personal data

We disclose personal data only where this is necessary for the purposes described or is provided for by law.

Recipients may in particular be:

• IT and hosting providers;
• providers of business and CRM systems;
• accounting, fiduciary or other administrative service providers;
• other service providers we engage to render our services;
• authorities and courts, where a statutory obligation exists or disclosure is necessary to protect our rights.

Where service providers process personal data on our behalf, we generally oblige them to process it only in accordance with our instructions and in compliance with appropriate data protection and data security requirements.

Where the GDPR applies and a recipient acts as a processor, it is engaged in accordance with Art. 28 GDPR.

Personal data is not disclosed for the advertising or marketing purposes of third parties.

We currently engage the following processors:

• Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA: hosting and delivery of this website. Submissions from the "Submit a project" form and from the contact window also pass through this provider’s infrastructure.
• Plus Five Five, Inc. ("Resend"), 2261 Market Street #5039, San Francisco, CA 94114, USA: dispatch of the emails generated by those two forms.

10Disclosure of personal data abroad

Where we engage external service providers, personal data may also be processed outside Switzerland or outside the European Economic Area (EEA), or may be accessible from such countries.

Where personal data is disclosed to a country that does not provide an adequate level of data protection under the applicable data protection law, we ensure appropriate protection in accordance with the statutory requirements.

For disclosures subject to the Swiss FADP, we observe in particular Art. 16 et seq. FADP.

Where the GDPR applies, we observe the requirements of Art. 44 et seq. GDPR.

Depending on the recipient and the destination country, the disclosure may be based in particular on:

• an adequacy decision or the recognition of an adequate level of data protection;
• an applicable data protection agreement or data protection framework;
• appropriate contractual safeguards, in particular the standard contractual clauses of the European Commission or the standard contractual clauses recognised or adapted under Swiss data protection law; or
• a statutory derogation.

The providers named in section 9 are based in the United States. Emails are dispatched from the European region in Ireland; the account data, metadata and logs arising at the dispatch provider are nevertheless stored in the United States. The disclosure is based on the standard contractual clauses agreed with both providers. Cloudflare additionally names the Swiss-U.S. Data Privacy Framework, Resend the EU-U.S. Data Privacy Framework.

Where necessary, we take additional technical or organisational protective measures.

11Retention of personal data

We retain personal data only for as long as required for the purposes for which it was collected.

Beyond that, we retain personal data where statutory retention obligations exist or where further storage is necessary to safeguard or enforce legal claims.

Business records and accounting documents may in particular be retained for ten years on the basis of statutory requirements.

Once the respective retention period has expired, the personal data is deleted or anonymised, unless further retention is required.

Where the GDPR applies, further retention is based, depending on the purpose, in particular on Art. 6(1)(b), (c) or (f) GDPR.

12Data security

We take appropriate technical and organisational measures to protect personal data against loss, misuse, unauthorised access, unlawful alteration and disclosure.

Depending on the nature of the processing, these include in particular access restrictions, technical security measures and organisational rules on handling personal data.

Absolute security of data transmission over the internet cannot, however, be guaranteed.

13Automated individual decisions and profiling

We generally do not take decisions based solely on automated processing that produce legal effects concerning data subjects or similarly significantly affect them.

We also do not currently carry out profiling for analytics, advertising or marketing purposes.

14Your rights

The rights available to you are governed by the applicable data protection law. Statutory conditions and restrictions are reserved.

You may in particular have the following rights:

• Access: you may request information as to whether and which personal data we process about you.
• Rectification: you may request the rectification of inaccurate personal data or the completion of incomplete personal data.
• Erasure: where the statutory conditions are met, you may request the erasure or destruction of your personal data.
• Data release and portability: subject to the statutory conditions, you may request that certain personal data be released in a commonly used electronic format or transmitted to another controller.
• Objection: you may object to a particular processing activity where the applicable data protection law provides for such a right.
• Withdrawal of consent: where processing is based on your consent, you may withdraw it at any time with effect for the future.

Where the GDPR applies, you may additionally have in particular the following rights:

• the right to restriction of processing under Art. 18 GDPR;
• the right to data portability under Art. 20 GDPR;
• the right to object under Art. 21 GDPR; and
• the right not to be subject to a decision based solely on automated processing, where the conditions of Art. 22 GDPR are met.

These rights may be restricted or excluded in individual cases, in particular where statutory obligations or overriding legitimate interests conflict with the measure concerned.

You also have the right to lodge a complaint with a competent data protection supervisory authority.

In Switzerland, the competent supervisory authority is the Federal Data Protection and Information Commissioner (FDPIC).

Where the GDPR applies, you may also contact a supervisory authority competent under Art. 77 GDPR, in particular in the EU or EEA member state of your habitual residence, your place of work, or the place of the alleged infringement.

15Contact for data protection enquiries

If you have questions about the processing of your personal data or wish to exercise your rights, you can contact us:

16Changes to this privacy statement

We may amend this privacy statement at any time, in particular where we change our processing activities or where new statutory requirements become applicable.

The version published on our website at the relevant time applies.