Privacy Policy

1. Scope

In this Privacy Policy, we provide information about the processing of personal data in connection with our activities and operations, including our website at the domain name appenberg.ch. In particular, we explain why, how, and where we process which personal data. We also provide information about the rights of individuals whose data we process.

For specific or additional activities and operations, we may publish further privacy policies or other information regarding data protection.

2. Contact Information

Responsibility for the processing of personal data:

Appenberg AG
Appenbergstrasse 36
3532 Zäziwil
Switzerland

info@appenberg.ch

In certain cases, third parties may be responsible for processing personal data, or there may be joint responsibility with third parties.

3. Definitions and Legal Basis

3.1 Definitions

Data Subject: A natural person whose personal data we process.

Personal data (data subject): Any information relating to an identified or identifiable natural person.

Personal data requiring special protection: Data regarding trade union, political, religious, or ideological views and activities; data regarding health, privacy, or membership in an ethnic or racial group; genetic data; biometric data that uniquely identifies a natural person; data regarding criminal or administrative sanctions or proceedings, and data regarding social assistance measures.

Processing: Any handling of personal data, regardless of the means and methods used, such as retrieving, comparing, modifying, archiving, storing, reading, disclosing, obtaining, collecting, collection, deletion, disclosure, classification, organization, storage, modification, dissemination, linking, destruction, and use of personal data.

3.2 Legal Basis

We process personal data in accordance with Swiss data protection law, in particular the Federal Data Protection Act (Data Protection Act, DSG) and the Data Protection Regulation (Data Protection Regulation, DPR). To the extent that the European General Data Protection Regulation (GDPR) applies to data processing, the processing of your personal data is based on the legal basis cited in each instance.

4. Nature, Scope, and Purpose of the Processing of Personal Data

We process the personal data necessary to carry out our activities and operations in a sustainable, user-friendly, secure, and reliable manner. The personal data we process falls primarily into the following categories: browser and device data, content data, communication data, metadata, usage data, master data (including inventory and contact information), location data, transaction data, contract data, and payment data.

We also process personal data that we receive from third parties, obtain from publicly available sources, or collect in the course of our activities and operations, to the extent that such processing is permitted by law.

We process personal data, where necessary, with the consent of the data subjects. In many cases, we may process personal data without consent, for example, to comply with legal obligations or to protect legitimate interests. We may also ask data subjects for their consent even when it is not required.

We process personal data for as long as is necessary for the respective purpose. We anonymize or delete personal data, in particular, in accordance with statutory retention and statute of limitations periods.

5. Disclosure of Personal Data

We may disclose personal data to third parties, have it processed by third parties, or process it jointly with third parties. Such third parties include, in particular, specialized service providers whose services we use.

We may disclose personal data to banks and other financial service providers, government agencies, educational and research institutions, consultants and attorneys, IT service providers, credit and business credit bureaus, marketing and advertising agencies, organizations and associations, telecommunications companies, and insurance companies.

6. Communication

We process personal data in order to communicate with third parties. In this context, we process, in particular, data that a data subject provides when contacting us, for example, by mail or email. We may store such data in an address book or using similar tools.

Third parties who transmit data about other individuals are required to ensure data protection for those individuals. To this end, they must, among other things, ensure the accuracy of the personal data transmitted.

7. Data Security

We implement appropriate technical and organizational measures to ensure data security commensurate with the respective risk. Through these measures, we ensure, in particular, the confidentiality, availability, traceability, and integrity of the personal data we process; however, we cannot guarantee absolute data security.

Access to our website and other online presence is secured using transport encryption (SSL / TLS, especially with the Hypertext Transfer Protocol Secure, abbreviated as HTTPS). Most browsers warn users against visiting websites without transport encryption.

Our digital communications—like all digital communications, in principle—are subject to mass surveillance without cause or suspicion by security agencies in Switzerland, the rest of Europe, the United States of America (USA), and other countries. We have no direct influence over the processing of personal data by intelligence agencies, police departments, and other security agencies. Nor can we rule out the possibility that a data subject may be specifically monitored.

8. Personal Data Abroad

As a general rule, we process personal data in Switzerland. However, we may also disclose or export personal data to other countries, in particular to process it there or have it processed there.

We may transfer personal data to all Countries on Earth announce, provided that the law of that jurisdiction, in accordance with Resolution of the Swiss Federal Council ensures adequate data protection.

We may disclose personal data to countries whose laws do not provide adequate data protection, provided that adequate data protection is ensured for other reasons, in particular on the basis of standard data protection clauses or other appropriate safeguards. In exceptional cases, we may transfer personal data to countries without adequate or appropriate data protection if the specific requirements under data protection law are met, such as the explicit consent of the data subjects or a direct connection to the conclusion or performance of a contract. Upon request, we are happy to provide data subjects with information about any safeguards or to supply a copy of such safeguards.

9. Rights of Data Subjects

9.1 Claims Under Data Protection Law

We grant data subjects all rights provided for under applicable data protection law. In particular, data subjects have the following rights:

Right of Access: Data subjects may request information regarding whether we process personal data about them and, if so, what personal data is involved. Data subjects will also receive the information necessary to exercise their data protection rights and to ensure transparency. This includes the personal data being processed as such, but also, among other things, details regarding the purpose of processing, the retention period, any disclosure or export of data to other countries, and the origin of the personal data.

Correction and Restriction: Data subjects may correct inaccurate personal data, complete incomplete data, and have the processing of their data restricted.

Deletion and Objection: Data subjects may request that their personal data be deleted (“right to be forgotten”) and may object to the processing of their data with future effect.

Data Disclosure and Data Transfer: Data subjects may request the disclosure of their personal data or the transfer of their data to another data controller.

We may defer, restrict, or deny the exercise of data subjects’ rights to the extent permitted by law. We may inform data subjects of any prerequisites that must be met in order to exercise their rights under data protection law. For example, we may refuse to provide information in whole or in part, citing confidentiality obligations, overriding interests, or the protection of other individuals. We may also, for example, refuse to delete personal data, in whole or in part, particularly by citing statutory retention obligations.

In exceptional cases, we may charge a fee for the exercise of these rights. We will inform the individuals concerned in advance of any such fees.

We are required to take reasonable measures to identify data subjects who request information or exercise other rights. Data subjects are required to cooperate.

9.2 Legal Protection

Data subjects have the right to enforce their data protection rights through legal action or to file a report or complaint with a data protection supervisory authority.

The data protection supervisory authority for private data controllers and federal agencies in Switzerland is the Swiss Federal Data Protection and Information Commissioner (EDÖB).

10. Use of the Website

10.1 Cookies

We may use cookies. Cookies—including our own cookies (first-party cookies) and cookies from third parties whose services we use (third-party cookies)—are data stored in the browser. Such stored data is not necessarily limited to traditional text-based cookies.

Cookies can be stored temporarily in the browser as “session cookies” or for a specific period of time as so-called persistent cookies. “Session cookies” are automatically deleted when the browser is closed. Persistent cookies have a specific retention period. In particular, cookies make it possible to recognize a browser the next time it visits our website and, for example, to measure our website’s reach. However, persistent cookies can also be used for online marketing, for example.

Cookies can be disabled entirely or partially, or deleted, at any time in your browser settings. Without cookies, our website may no longer be fully accessible. We actively seek your explicit consent to the use of cookies—at least to the extent necessary.

For cookies used to measure performance and reach or for advertising, many services offer a general opt-out option via the AdChoices (Digital Advertising Alliance of Canada), which Network Advertising Initiative (NAI), YourAdChoices (Digital Advertising Alliance) or Your Online Choices (European Interactive Digital Advertising Alliance, EDAA).

We use Cookiebot by Usercentrics to manage cookies and similar technologies. When you first visit our website, you can choose whether to accept or reject the use of optional cookies. You can change or withdraw your consent at any time by clicking the “Cookie Settings” link in the footer of our website.

10.2 Logging

When you access our website, technical access data is automatically processed and, if necessary, stored in log files.

In particular, this data is used to ensure the secure and reliable operation of our website, to identify technical errors, and to verify the security and performance of our digital infrastructure.

Data processing is carried out by our hosting provider, Netlify. For more information about the data collected, the purposes of processing, and the hosting provider, please see Section 17.9 of this Privacy Policy.

10.3 Pixel Count

We may use web beacons, scripts, and similar technologies on our website to analyze website usage statistically and measure the effectiveness of our online communications.

These include, for example, small, invisible image files or technical scripts that are loaded when a webpage is accessed. Technical usage data may be collected in this process and, where applicable, processed by third-party providers involved.

To the extent that consent is required for the use of such technologies, processing will take place only with your prior consent. Information regarding third-party providers used and the transfer of data abroad can be found in sections 13, 15, and 16 of this Privacy Policy.

11. Notices and Announcements

11.1 Measuring Success and Reach

Notifications and messages may contain web links or tracking pixels that track whether an individual message has been opened and which web links were clicked within it. Such web links and tracking pixels may also track the use of notifications and messages on a personal basis. We require this statistical tracking of usage to measure effectiveness and reach so that we can send notifications and messages in a way that is effective, user-friendly, sustainable, secure, and reliable, based on the needs and reading habits of the recipients.

11.2 Consent and Objection

You must generally consent to the use of your email address and other contact information, unless such use is permitted for other legal reasons. To obtain double-confirmed consent, if necessary, we may use the “double opt-in” procedure. In this case, you will receive a message with instructions for double confirmation. We may use the consent obtained, including IP address and Timestamp Record this for evidentiary and security reasons.

You may generally opt out of receiving notifications and communications, such as newsletters, at any time. By opting out, you may also object to the collection of usage data for the purpose of measuring performance and reach. This does not apply to necessary notifications and communications related to our activities and operations.

11.3 Service Provider for Notifications and Announcements

We send out notifications and announcements through specialized service providers.

In particular, we use:

Mailchimp: Communication platform; Provider: The Rocket Science Group LLC, doing business as Mailchimp (U.S.), as Subsidiary Intuit Inc. (U.S.); Privacy Policy: Privacy Policy (Intuit) including “Country and Region-Specific Terms,” "Frequently Asked Questions About Data Protection at Mailchimp", "Mailchimp and European Data Transfers", "Security", Cookie Policy, "Privacy Rights Requests", "Legal Provisions".

12. Social Media

We maintain a presence on social media and other online platforms to communicate with interested individuals and provide information about our activities and operations. In connection with these platforms, personal data may also be processed outside of Switzerland.

The General Terms and Conditions (GTC), Terms of Use, privacy policies, and other provisions of the individual operators of such platforms also apply in each case. These provisions provide information, in particular, about the rights of data subjects directly vis-à-vis the respective platform, including, for example, the right of access.

13. Third-Party Services

We use services provided by specialized third parties to ensure that we can carry out our activities and operations in a sustainable, user-friendly, secure, and reliable manner. These services allow us, among other things, to embed features and content on our website. When content is embedded in this way, the services used collect—at least temporarily, for technical reasons—the IP addresses users.

For necessary security-related, statistical, and technical purposes, third parties whose services we use may process data related to our activities and operations in an aggregated, anonymized, or pseudonymized form. This includes, for example, performance or usage data necessary to provide the respective service.

In particular, we use:

Google Services: Providers: Google LLC (U.S.) / Google Ireland Limited (Ireland), in part for users in the European Economic Area (EEA) and Switzerland; General Information on Data Protection: "Principles of Data Protection and Security", "Information on how Google uses personal data", Privacy Policy, "Google is committed to complying with applicable data protection laws", "Guide to Data Protection in Google Products", "How we use data from websites or apps on or within which our services are used", "Types of Cookies and Similar Technologies Used by Google", "Advertising You Can Control" ("Personalized Advertising").

13.1 Digital Infrastructure

We use services provided by specialized third parties to access the digital infrastructure we need in connection with our activities and operations. These include, for example, hosting and storage services from selected providers.

In particular, we use:

Dato CMS: Website builder; Provider: Dato SRL (Italy); Privacy policy: Privacy Policy.

Netlify: Web hosting; Provider: Netlify, Inc., 101 2nd Street, San Francisco, CA 94105; Privacy policy: Privacy Policy.

When using these services, personal data—in particular, technical connection and access data—may be processed by the respective providers.

For more information on the processing of access data by our hosting provider, please see Section 17.9. For information on the transfer of personal data abroad, please see Section 16 of this Privacy Policy.

13.2 Social Media Features and Social Media Content

We use third-party services and plugins to embed features and content from social media platforms and to enable the sharing of content on social media platforms and through other channels.

In particular, we use:

Meta Platform (Instagram and Facebook): Embedding Instagram and Facebook content; Providers: Meta Platforms Ireland Limited (Ireland) and Other Meta companies (including the U.S.); Information on data protection: Privacy Policy (Instagram), Privacy Policy (Facebook).

LinkedIn platform: Embedding LinkedIn Content; Provider: LinkedIn Ireland Unlimited Company (Ireland); Privacy Policy: Privacy Policy (LinkedIn)

13.3 Fonts

We use third-party services to embed selected fonts, icons, logos, and symbols on our website.

In particular, we use:

Adobe Fonts: Fonts; Providers: Adobe Inc. (U.S.) for users in North America / Adobe Systems Software Ireland Limited (Ireland) for users in the rest of the world; Privacy information: "Adobe Privacy Center", Privacy Policy (Adobe Fonts), Privacy Policy (Adobe), "Questions about data protection?", "Adobe Privacy Settings".

Google Fonts: Fonts; Provider: Google; Google Fonts-specific information: "Your Privacy and Google Fonts", "Data Protection and Data Collection" (on Google Fonts).

Good Type Foundry: Fonts; Provider: Good Type Foundry; Good Type Foundry-specific information: "User License Agreement"

14. Website Extensions

We use extensions on our website to enable additional features. We may use selected services from appropriate providers or implement such extensions on our own digital infrastructure.

In particular, we use:

Google reCAPTCHA: Spam protection (distinguishing between desired content from humans and unwanted content from bots and spam); Provider: Google; Google reCAPTCHA-specific information: "What is reCAPTCHA?".

15. Measuring Success and Reach

We strive to measure the success and reach of our activities and operations. Within this framework, we can also measure the impact of third-party content or test how different parts or versions of our online platform are used (the “A/B testing” method). Based on the results of these success and reach measurements, we can, in particular, fix errors, enhance popular content, or make improvements.

In most cases, the following are used to measure success and reach: IP addresses collected from individual users. In this case, IP addresses are always truncated (“IP masking”) in order to comply with the principle of data minimization through the corresponding pseudonymization.

Cookies may be used to measure success and reach, and user profiles may be created. Any user profiles created may include, for example, the individual pages visited or content viewed on our website, information about the size of the screen or browser window, and the user’s location (at least approximately). As a general rule, any user profiles created are exclusively pseudonymized and are not used to identify individual users. Certain third-party services with which users are registered may, in some cases, associate the use of our online services with the user’s account or profile on the respective service.

In particular, we use:

Google Analytics by Google Ireland Limited, located at Gordon House, Barrow Street, Dublin 4, Ireland, or Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (Google).

16. Information on Data Transfers Abroad, Particularly to the United States

As part of our business operations and in connection with the operation of our website, personal data may be transferred to or processed by service providers located abroad. This applies in particular to providers of hosting, software, analytics, and communication services.

Data is transferred, in particular, to countries within the European Union and to the United States. Depending on the service used, personal data may also be processed in other countries.

We ensure that the requirements of applicable data protection laws are met when transferring personal data abroad.

For data transfers to countries recognized as having an adequate level of data protection, no additional data protection safeguards are generally required for the transfer.

For transfers to the United States, the Swiss-U.S. Data Privacy Framework and the EU-U.S. Data Privacy Framework are in place. These data privacy frameworks allow for the transfer of personal data to appropriately certified U.S. companies, subject to the applicable conditions.

According to its own statements, our hosting provider, Netlify, Inc., is certified under the Swiss-U.S. Data Privacy Framework and the EU-U.S. Data Privacy Framework. For more information, please see the Netlify Privacy Policy.

If an adequate level of data protection has not been recognized for a recipient country or a recipient, data may be transferred only in compliance with the statutory requirements. This may include, in particular, appropriate contractual safeguards, such as recognized standard data protection clauses, or exceptions provided for by law.

Despite appropriate protective measures, when data is processed abroad, it cannot be completely ruled out that foreign authorities may access personal data in accordance with the legal provisions in effect in those countries.

For more information about the service providers we use, please see Section 13 of this Privacy Policy.

17. Scope and Purpose of the Collection, Processing, and Use of Personal Data

17.1 Data Processing When Booking an Overnight Stay Through Our Website

You can book an overnight stay on our website. To do so, we collect the following information; required fields are marked with an asterisk (*) during the booking process:

Salutation
First Name
Last Name
Birthday
Place of Birth
Phone number
Email
Country or Nationality
Payment Method
Card number, verification number, name on the card
Reservation Details
Special Requests
Confirmation of Marketing Email
Confirmation of Acknowledgment and Acceptance of the Terms and Conditions and Privacy Policy

We use this information to verify your identity before entering into a contract. We need your email address to confirm your reservation and for future communication with you—as required for contract fulfillment. We store your data along with the booking details (e.g., room category, length of stay, and the description, price, and features of the services), payment information (e.g., selected payment method, payment confirmation, and date and time) as well as information regarding the processing and fulfillment of the contract (e.g., receipt of and handling of complaints) in our PMS so that we can ensure proper booking processing and contract fulfillment.

To the extent necessary for the performance of the contract, we will also share the required information with any third-party service providers (e.g., event organizers or transportation companies).

The legal basis for this data processing is the performance of a contract with you pursuant to Article 6(1)(b) of the GDPR.

The provision of data not marked as required is voluntary. We process this data to tailor our services as closely as possible to your personal needs, to facilitate the fulfillment of contracts, to contact you via an alternative communication channel if necessary for the purpose of fulfilling the contract, or for statistical collection and analysis to optimize our services.

The legal basis for this data processing is your consent within the meaning of Article 6(1)(a) of the GDPR. You may revoke your consent at any time by notifying us.

To process bookings through our website, we use a software application provided by MEWS Systems B.V., ScaleHub Building, Wibaudstraat 137D, 1097DN Amsterdam, Netherlands. Therefore, your data may be stored in a database maintained by MEWS Systems B.V., which may allow MEWS Systems B.V. to access your data if necessary to provide the software and to assist you in using it. Information regarding the processing of data by third parties and any potential transfer of data abroad can be found in Section 8 of this Privacy Policy.

The legal basis for this data processing is the performance of a contract with you pursuant to Article 6(1)(b) of the GDPR.

17.2. Data Processing When Requesting a Seminar or Banquet Through Our Website

On our website, you can submit a request for a seminar or banquet. To do so, we collect the following information; required fields are marked with an asterisk (*) during the booking process:

Salutation
First Name
Last Name
Billing Address
Arrival and Departure Dates
Check-in and Check-out Times
Number of people
Type of Event
Confirmation of “Would you like a shuttle?”
Number of single and double rooms
Confirmation of “Would you like suggestions for a supporting program?”
Phone number
Email
Company
Comments

We use this data to verify your identity before entering into a contract. We need your email address to confirm your request and for future communication with you—as required for contract fulfillment. We store your data along with the booking details (e.g., number of people or length of stay) as well as information regarding the processing and fulfillment of the contract (e.g., receipt of and handling of complaints) in our event management system so that we can ensure proper booking processing and contract fulfillment.

To the extent necessary for the performance of the contract, we will also disclose the required information to any third-party service providers (e.g., event organizers or transportation companies).

The legal basis for this data processing is the performance of a contract with you pursuant to Article 6(1)(b) of the GDPR.

The legal basis for this data processing is your consent within the meaning of Article 6(1)(a) of the GDPR. You may revoke your consent at any time by notifying us.

For booking requests made through our website, we use a software application provided by Event Temple Labs Inc., #805-510 West Hastings Street, Vancouver, BC, Canada, V6B 1L8. Consequently, your data may be stored in a database maintained by Event Temple Labs Inc., which may allow Event Temple Labs Inc. to access your data if necessary to provide the software and to assist you in using it. Information regarding the processing of data by third parties and any potential transfer of data abroad can be found in Section 8 of this Privacy Policy.

The legal basis for this data processing is the performance of a contract with you pursuant to Article 6(1)(b) of the GDPR.

17.3 Data Processing When Reserving a Table

On our website, you can reserve a table at one of the restaurants listed there. To do so, we collect the following information—depending on the specific offer—with required fields marked with an asterisk (*) when making a reservation through the website:

First Name
Last Name
Number of guests (adults and children)
Email address
Phone number
Address
Menu or Offer Type
Comment
Date and time of the reservation

We collect and process your data to process your reservation, specifically to fulfill your reservation request according to your preferences and to contact you in the event of any uncertainties or problems. We store your data along with the reservation details (e.g., date and time of receipt, etc.), reservation information (e.g., assigned table), and details regarding the processing and fulfillment of the contract (e.g., receipt and handling of complaints) in our table reservation system so that we can ensure proper reservation processing and fulfillment of the contract.

We use a software application from Aleno AG, Werdstrasse 21, 8004 Zurich, Switzerland, to process table reservations. Consequently, your data may be stored in a database maintained by Aleno AG, which may allow Aleno AG to access your data if necessary to provide the software and to assist you in using it. You can find information about the processing of data by third parties and any potential transfer of data abroad in Section 8 of this Privacy Policy.

The legal basis for this data processing is the performance of a contract with you pursuant to Article 6(1)(b) of the GDPR.

17.4 Data Processing During Payment Transactions at the Hotel

When you purchase products, obtain services, or pay for your stay at our hotel using electronic payment methods, the processing of personal data is required. By using the payment terminals, you transmit the information stored in your payment method—such as the cardholder’s name and the card number—to the relevant payment service providers (e.g., payment solution providers, credit card issuers, and credit card acquirers). These parties also receive information indicating that the payment method was used at our hotel, along with the amount and the time of the transaction. Conversely, we only receive confirmation that the payment amount has been credited at the relevant time—which we can associate with the corresponding receipt number—or a notification that the transaction was not possible or was canceled. Please always refer to the information provided by the respective company, particularly its privacy policy and terms and conditions.

We use a software application from Stripe, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland, to process payments. Therefore, your data may be stored in a Stripe database, which may allow Stripe to access your data if necessary to provide the software and to assist you in using it. You can find information about the processing of data by third parties and any potential transfer of data abroad in Section 8 of this Privacy Policy.

The legal basis for our data processing is the performance of a contract with you pursuant to Article 6(1)(b) of the GDPR.

17.5 Data Processing in Connection with the Fulfilment of Statutory Reporting Obligations

Upon arrival at our hotel, we may need the following information from you and your companions; required fields are marked with an asterisk (*) on the corresponding form:

Salutation
Gender
First and Last Name
Address (ZIP Code, City, State)
Phone
Date of Birth
Nationality
Identity card or passport
Arrival and Departure Dates

We collect this information to comply with statutory reporting requirements, which arise in particular from hospitality industry regulations or police laws. To the extent that we are required to do so under applicable regulations, we will forward this information to the relevant authority.

The legal basis for the processing of this data is the necessity to comply with legal obligations within the meaning of Art. 6(1)(c) of the GDPR.

17.6 Data Processing When Purchasing a Gift Certificate

Please review the privacy policy for gift certificates at this link: https://appenberg.ch/gutscheine

17.7 Data Processing When Booking Through a Booking Platform

If you make reservations through a third-party platform (i.e., booking.com, Hotel, Expedia, Holidaycheck, HRS, Kayak, Tripadvisor, Trivago, Weekend4Two), we receive various pieces of personal information from the respective platform operator in connection with the reservation made. This information generally consists of the data listed in Section 17.1 of this Privacy Policy. In addition, inquiries regarding your booking may be forwarded to us. We will process this data specifically to record your booking as requested and to provide the booked services. The legal basis for data processing for this purpose is the implementation of pre-contractual measures and the performance of a contract pursuant to Article 6(1)(b) of the EU GDPR.

Finally, we may be notified by platform operators of disputes related to a booking. In such cases, we may also receive data regarding the booking process, which may include a copy of the booking confirmation as proof that the booking was actually completed. We process this data to safeguard and enforce our claims. This constitutes our legitimate interest within the meaning of Article 6(1)(f) of the EU GDPR.

Please also review the privacy policy of the respective booking platform.

17.8 Data Processing in Connection with Job Applications

You have the option to apply for a position at our company either on an open-ended basis or in response to a specific job posting. In doing so, we process the personal data you provide.

We use the information you provide to review your application and assess your suitability for employment. Application materials from applicants who are not selected will be deleted once the application process has concluded, unless you explicitly consent to a longer retention period or we are legally required to retain them for a longer period.

The legal basis for processing your data for this purpose is the performance of a contract (precontractual phase) pursuant to Article 6(1)(a), (b), (c), and (f) of the GDPR.

Data may be retained for a longer period to the extent necessary to protect our legitimate interests, in particular to assert or defend legal claims.

17.9 Data Processing When Visiting Our Website (Log File Data)

When you visit our website, our hosting provider, Netlify, Inc., 101 2nd Street, San Francisco, CA 94105, USA, automatically processes technical access data. This data may be stored in log files.

In particular, the following data may be collected:

· IP address of the device accessing the site

· Date and time of access

· Name and URL of the accessed webpage or file, including any URL parameters

· The website from which the request originates (referrer), if this information is transmitted

· Information about the browser, operating system, and device type used

· Country of origin of the request

· Technical information about the request and server response, such as the HTTP status code and the amount of data transferred

The type and scope of the data collected depend on the technical design of the website and the services used.

This data is processed to enable the use of our website, ensure system security and stability, detect technical errors, and monitor and optimize the performance and reliability of our website.

In the event of an attack on the technical infrastructure or if unauthorized or abusive use is suspected, the relevant access data may be analyzed for investigative and defensive purposes. To the extent permitted or required by law, this data may also be used in legal proceedings or disclosed to the appropriate authorities.

Data processing is carried out to safeguard our legitimate interest in the secure, stable, and reliable operation of our website. To the extent that the European General Data Protection Regulation (GDPR) applies, we base this processing on Article 6(1)(f) of the GDPR. In all other respects, data processing is carried out in accordance with the Swiss Data Protection Act (DSG).

The retention period for access data is determined by technical and operational requirements as well as applicable retention guidelines. Data is deleted or anonymized as soon as it is no longer needed for the stated purposes and there are no legal retention obligations that prevent this.

According to our hosting provider, technical access data is stored for 30 days and then deleted.

Since Netlify is headquartered in the United States, personal data may also be processed outside of Switzerland. For more information, please see Section 16 of this Privacy Policy as well as the Netlify Privacy Policy.

When you visit our website, cookies and similar technologies may also be used. For more information, please see Section 10 of this Privacy Policy.

18. Subscribe to Our Newsletter

You can subscribe to our newsletter on our website. Registration is required to do so. The following information must be provided during registration:

· Email address

The information above is necessary for data processing. In addition, you may voluntarily provide further information. We process this information solely to personalize the information and offers we send you and to better tailor them to your interests.

By registering, you give us your consent to process the provided data for the regular distribution of the newsletter to the address you provided, as well as for the statistical analysis of usage patterns and the optimization of the newsletter. This consent serves as our legal basis for processing your email address. We are authorized to engage third parties to handle the technical aspects of our marketing activities and are authorized to disclose your data for this purpose.

At the end of each newsletter, you’ll find a link that allows you to unsubscribe at any time. When you unsubscribe, you may voluntarily provide us with the reason for unsubscribing. After you unsubscribe, your personal data will be deleted. Any further processing will be done only in anonymized form to help us optimize our newsletter.

19. Final Notes on the Privacy Policy

We have updated this Privacy Policy with the Privacy Policy Generator by Data Protection Partners created.

We may update this Privacy Policy at any time. We will notify you of any updates in an appropriate manner, in particular by publishing the most current version of the Privacy Policy on our website.

As of October 29, 2026