To protect against automated scraping, the contact details only appear when you press the button.
Who is responsible for the data
The controller of this website is its operator. To protect against automated scraping, the operator's details only appear when you press “Show contact details” at the top of this page:
- Name:
- Street:
- Postcode and town:
- Country:
- Email:
Send privacy questions by email to this address or through the contact form, which you reach with the “Contact” link in the footer. The Swiss Data Protection Act requires the controller to inform people appropriately about the collection of personal data. At a minimum it must state its identity and contact details, the purpose of the processing and, where there are any, the recipients. The GDPR also lists the name and contact details of the controller as required information. More about the provider is in the legal notice. The website is hosted by Host Europe GmbH, Hansestrasse 111, 51149 Köln, Deutschland. The provider stores and processes the data of the website on behalf of the controller as a processor within the meaning of Swiss law and the GDPR. The servers are located in Germany, and therefore in the EU.
Which data protection law applies
The Swiss Data Protection Act sets the frame first, here in the version dated 7 July 2025. The GDPR can come on top, even if the controller is not established in the Union. The condition is a link to offering goods or services to people in the Union, even without payment, or to monitoring their behavior there.
Cookie notice, consent and GDPR cookies
The Swiss Telecommunications Act permits processing data on other people’s devices only if users are informed about the processing and its purpose and may decline it. The version of the Telecommunications Act consulted is dated 1 June 2026.
The rule is stricter in Germany. Under § 25 TDDDG, storing information on a terminal device or reading it is allowed only if the end user has consented after clear and detailed information. Information and consent follow the GDPR. Consent is not needed if access is strictly necessary so that a digital service the user expressly asked for can run.
Austria regulates this in § 165 of the Telecommunications Act 2021, here in the current consolidated version. Providers must disclose which personal data they process for what purpose and on what basis, and how long they store it. This data may be collected only if the user has actively agreed after clear and detailed information. Technically necessary storage without which a service the user expressly asked for would not run needs no consent.
Legal bases for processing
Every processing needs a legal basis. Under the GDPR, processing is lawful only if at least one of its conditions is met, for example your consent for specific purposes. It is also lawful if it is necessary for legitimate interests and your interests or fundamental rights do not override them.
Toward you, the controller names the purposes and the legal basis. If it relies on a legitimate interest, it names that interest. Added to this are the recipients or their categories and the storage period, or the criteria used to set it. Under Swiss law, a required consent is valid only if it is given voluntarily, for specific processing and after appropriate information.
Server logs (log files)
The website sits behind the web server nginx. It writes an entry to an access log for every request, including when you send the contact form. In the standard “combined” format, an entry contains your IP address, the date and time, the requested address (URL), the HTTP status, the amount of data transferred, the referrer (the page you came from) and the identifier of your browser (user agent). In addition, nginx keeps an error log. The application server inside the container (the technical runtime environment of the website) also records the requests in the container log. The servers are located at Host Europe GmbH, Hansestrasse 111, 51149 Köln, Deutschland in Germany.
The logs serve secure operation, protection against attacks and abuse, and troubleshooting. The purpose and the legal basis have to be stated to you. The legal basis is the legitimate interest, which has to be named for processing under Art. 6 para. 1 let. f GDPR: it is the secure and trouble-free operation of the website. Under Swiss law, the operator does not ask for consent for this, but relies on an overriding interest in secure operation.
The nginx logs are written to a new file each day, and files older than 14 days are deleted. The container log is limited to three files of 10 MB each that overwrite one another, so the entries are kept only for a short time. The storage period has to be stated.
The logs are not combined with other data, not used for usage analysis and not passed on. The exceptions are the hosting provider named above as processor and authorities where the law requires disclosure. The recipients also have to be stated.
Contact form
The contact form is a second way, besides email, to reach the operator. The details are used only to answer your request and to handle what follows from it. This section names the purpose and the legal basis because they have to be stated to you.
What gets stored is your email address (required, so that a reply is possible), your name (optional), the subject you chose, your message, the language of the page and the time of sending. To protect against abuse, the website stores with the message a keyed, non-reversible hash of the IP address, never the full IP address, and no browser information. The server logs from the previous section are separate from this. The form sets no cookie, and no third-party service is involved, including any captcha provider.
The legal basis is the legitimate interest in answering requests. For processing under Art. 6 para. 1 let. f GDPR this interest has to be named: it is answering your message.
Messages are deleted automatically 12 months after receipt. Messages marked as spam are deleted after just 30 days. The storage period has to be stated.
Nothing is passed on to third parties except to the hosting provider named above. For a new message the operator receives a notification with the subject and a link, without the text of the message. The website does not send an automatic reply to the email address entered. The rights in the section “Your rights” apply.
Disclosure of data abroad
Personal data may go abroad only under statutory conditions. Under the Swiss act this is permitted if the Federal Council has found that the recipient state ensures adequate protection. Which states these are is listed in Annex 1 of the Data Protection Ordinance. For organizations certified under the data protection framework between Switzerland and the USA, the level of protection is deemed adequate.
If there is no such decision, suitable data protection must be secured by other means. Standard data protection clauses qualify, among other things, provided the FDPIC approved, issued or recognized them beforehand. As an exception, your explicit consent to the disclosure is enough. For a disclosure abroad, the controller also tells you the state and, if applicable, the safeguards or the exception applied.
The GDPR allows a transfer to a third country only if the conditions of its transfer chapter are met. One route is an adequacy decision of the Commission. For the USA such a decision exists, and it covers organizations on the Data Privacy Framework List. Without a decision, suitable safeguards plus enforceable rights and effective remedies are needed. Standard data protection clauses of the Commission can serve as a safeguard.
Google Analytics (GA4)
On this website, Google Analytics (GA4) measures usage. The sections on legal bases and disclosure abroad apply to this processing. Purpose and legal basis must be stated for it, as must the intention to transfer data to a third country. If the measurement rests on your consent, you can withdraw it at any time.
Your rights
You can ask for access, rectification and erasure, depending on whether Swiss law or the GDPR applies. Under Swiss law:
- If you want to know whether the controller holds personal data about you, you can ask for access.
- Access is free of charge, and the Federal Council may provide for exceptions.
- It is usually given within 30 days.
- Under certain conditions you can ask for the data you provided in a common electronic format.
- You can have incorrect data rectified unless an exception applies.
- In a lawsuit to protect personality rights, the claimant can ask for data to be deleted or destroyed.
Under the GDPR, these rights come in addition:
- Confirmation and access regarding the data processed.
- Prompt rectification of incorrect data.
- Erasure if one of the statutory grounds applies.
- Restriction of processing if one of the conditions is met.
- Data portability in a structured, commonly used and machine-readable format.
- Objection, on grounds relating to your particular situation, to processing under Art. 6 para. 1 let. e or f.
- Protection from decisions based solely on automated processing that significantly affect you.
- A complaint to a supervisory authority, in particular in the member state of your residence.
The controller must point out this right to complain. Art. 19 GDPR also sets out a notification duty on rectification, erasure or restriction. Send your requests by email to the address that appears at the top after you press “Show contact details”, or through the contact form, which you reach with the “Contact” link in the footer.