Privacy

Who is responsible

The website operator is the controller for the processing described here. Use the contact details below for privacy enquiries.

Legal bases for processing personal data

Our processing of personal data is governed primarily by the Federal Act on Data Protection (FADP; SR 235.1) and the Data Protection Ordinance (DPO; SR 235.11).

For private controllers, Swiss data protection law does not provide the same exhaustive list of legal bases as the European Union’s General Data Protection Regulation. We process personal data in accordance with the processing principles of the FADP, in particular lawfully, in good faith, proportionately, for specified purposes, transparently and only for as long as necessary for the respective purpose.

Where processing would unlawfully infringe a data subject’s personality rights, we rely, where applicable, on a ground for justification under Art. 31 FADP. Such grounds include, in particular, the data subject’s consent, an overriding private or public interest, or a statutory basis.

Information about the collection of personal data is provided in accordance with Art. 19 FADP. The rights of data subjects, in particular the right of access, are governed, among other provisions, by Art. 25 et seq. FADP.

Where the European Union’s General Data Protection Regulation applies to a particular processing activity, we additionally rely on the following legal bases under Art. 6(1) GDPR:

Consent — Art. 6(1)(a) GDPR

We rely on freely given consent, in particular, for:

• optional usage statistics and web analytics;
• analytics features of Vercel Analytics and PostHog;
• optional session recordings in the partner portal;
• browser-side error, performance and security reports sent to Sentry;
• sending a newsletter, if one is offered and expressly subscribed to;
• other optional features identified as such in the consent window.

Consent may be withdrawn at any time with effect for the future. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

Contract and pre-contractual measures — Art. 6(1)(b) GDPR

We rely on the performance of a contract or pre-contractual measures, in particular, for:

• reviewing and responding to specific business enquiries;
• setting up and managing partner accounts;
• providing the contractually agreed features of the partner portal;
• communicating with partners in the course of our collaboration;
• sending system emails that are technically or contractually necessary.

This legal basis applies only to the extent that the processing concerned is actually necessary for entering into or performing a contract.

Legal obligations — Art. 6(1)(c) GDPR

Where we are subject to a legal obligation, we process personal data, in particular, to:

• comply with statutory accounting and retention obligations;
• comply with binding orders from authorities or courts;
• comply with other statutory documentation and record-keeping obligations.

We rely on this legal basis only where a specific legal obligation exists.

Legitimate interests — Art. 6(1)(f) GDPR

Provided that the interests or fundamental rights of data subjects do not override them, we rely on our legitimate interests or those of third parties for the following processing activities:

• operating the website, guest application and partner portal securely and reliably;
• maintaining technically necessary server, error and security logs;
• protecting against misuse, attacks and unauthorised access;
• enforcing access rights and keeping different partners’ data separate;
• logging changes relevant to security and business operations;
• providing controlled and traceable access for support purposes;
• handling general enquiries that are not directly related to entering into a contract;
• safeguarding, establishing and defending legal claims;
• using technically necessary cookies and local storage;
• storing and demonstrating the privacy settings selected;
• developing our services administratively and technically, provided that this does not involve analytics requiring consent.

Our legitimate interests include, in particular, providing our services securely, reliably and economically, protecting our systems and users, and conducting our business processes in a traceable manner.

Before processing based on legitimate interests, an assessment must be made as to whether the interests, rights or freedoms of data subjects override those interests. For statistics, analytics or browser-side error-reporting features that require consent, we do not rely on legitimate interests as an alternative.

No automated individual decision-making

According to the currently documented range of features, Grüezy does not make decisions based solely on automated processing that produce legal effects concerning a data subject or similarly significantly affect them.

If such a feature is introduced in the future, this privacy policy will be updated beforehand and data subjects will be informed in accordance with the applicable statutory provisions.

Serving the website

The website is hosted with Vercel. Delivering pages and protecting the service requires technical request data such as IP address, browser information, requested URL and time of access. The site's images, video and fonts are served as website assets; opening the tour does not require an external video platform account.

When you email us

Contact links open your email application. The website does not send a message automatically. If you write to us, we use your email address, name and message to respond and discuss your interest in Grüezy. Your emails are processed by Infomaniak Network AG in data centres in Switzerland. We keep enquiries for up to 12 months after they arrive and then delete them, unless they lead to a collaboration.

Optional analytics

PostHog and Vercel Web Analytics load only after you choose Allow analytics. PostHog uses a browser identifier stored in cookies or local storage to measure visits and interactions. Vercel Web Analytics measures page visits. Neither service is needed to use the tour or contact links. Change your choice through Cookie settings in the footer. Withdrawing permission stops further analytics collection; it does not automatically delete data already received by a provider.

Technical diagnostics

Sentry helps identify technical errors in the service. Browser session recording is disabled on this website. Browser error reports are configured to omit user details, request headers, cookies, request bodies, URL queries and navigation breadcrumbs. Hosting and server diagnostics may still include technical request information required to investigate an error.

Your choice and service providers

We store your privacy choice in this browser for up to 180 days. If browser storage is blocked, the choice lasts for the current page session. Vercel, PostHog and Sentry process data on behalf of the operator.

Where and for how long these providers process data:

• Vercel (Vercel Inc., USA), hosting: server functions in Frankfurt (Germany), delivery through a global network whose location depends on where you are. Technical logs for at most 30 days; audience measurement, only with your consent, for at most 24 months.
• PostHog (PostHog Inc., USA), analytics, only with your consent: EU Cloud in Frankfurt (Germany), kept for 30 days.
• Sentry (Functional Software Inc., USA), error reports, in the browser only with your consent: EU region in Germany, kept for 30 days.

Under Swiss law, Germany provides an adequate level of data protection. All three companies are based in the USA, and access from there is possible. They are certified under the Swiss-U.S. Data Privacy Framework, which the Federal Council recognises as adequate for certified companies. Data processing agreements with standard contractual clauses apply in addition; you can obtain a copy of the standard contractual clauses on request.

Your rights

Contact the operator to request access to, correction or deletion of your personal data. Where the legal conditions are met, you can also request restriction of processing and the release or transfer of your data, and object to processing, in particular where it relies on legitimate interests. You can withdraw optional analytics consent at any time through Cookie settings in the footer. Withdrawal does not affect the lawfulness of processing before withdrawal. You can contact the FDPIC about Swiss data protection matters. Where the GDPR applies, you have the right to complain to a competent EU/EEA supervisory authority, in particular where you habitually live, work or where the alleged infringement occurred.