Privacy policy

This policy explains how Webmobix Solutions AG handles personal data when you visit this website, contact us, or subscribe to our newsletter. It is written to meet the Swiss Federal Act on Data Protection (revised FADP), the EU General Data Protection Regulation (GDPR), and Singapore's Personal Data Protection Act 2012 (PDPA), to the extent each applies to you.

Who is responsible

Webmobix Solutions AG
c/o Impact Hub Zürich
Sihlquai 131
8005 Zürich
Switzerland

Email: danny@webmobix.com

We are the controller for the personal data described in this policy. Our data protection officer, who is responsible for compliance under the PDPA and our other privacy obligations, can be reached at the same address and email.

What we collect and why

We collect only what we need to run the site, answer enquiries, and send updates you asked for.

Purpose	Data	Legal basis (GDPR)	Retention
Delivering and securing the site	IP address, date and time, requested URL, referrer, browser and device type	Legitimate interest in operating a secure website (Art. 6(1)(f))	Held by Cloudflare for a short period for security and delivery; not combined with other data
Answering contact form messages	Name, email, organisation, role, message	Taking steps at your request (Art. 6(1)(b)) or legitimate interest in replying (Art. 6(1)(f))	12 months after our last exchange, unless an ongoing matter requires longer
Newsletter and updates	Email address, sign-up and confirmation date	Your consent (Art. 6(1)(a))	Until you unsubscribe; a minimal suppression record is kept so we don't email you again
Analytics and performance	Aggregated page views, referrers, country, device type, page load timings	Legitimate interest in improving the site (Art. 6(1)(f))	Aggregated; no individual profiles

The legal bases above are those required by the GDPR. Under the PDPA and the FADP, we collect and use personal data only for the purposes described here, with your consent where it is required, and we will ask for consent again before using your data for any new purpose.

We do not sell personal data, use it for advertising, or make automated decisions about you.

Hosting

This site is hosted and delivered by Cloudflare, Inc. (101 Townsend Street, San Francisco, CA 94107, USA), which acts as our processor under its data processing agreement.

When you visit the site, Cloudflare processes technical data such as your IP address, browser type, and the pages you request. This is needed to deliver the site, defend it against attacks and abuse, and keep it available.

The personal data we store (contact form submissions and newsletter subscriptions) is held in Cloudflare storage located in the European Union. Because Cloudflare runs a global network, requests are handled at the Cloudflare location nearest to you, so some processing may take place outside the EU or Switzerland.

International transfers

We are based in Switzerland and store the personal data we hold in the European Union. If you are in Singapore or another country outside Switzerland and the EU, your data will be transferred to, and processed in, these locations.

Switzerland and the EU have comprehensive data protection laws. For transfers to Cloudflare, including any processing in the United States, we rely on Cloudflare's data processing agreement, its certification under the EU-US and Swiss-US Data Privacy Frameworks, and Standard Contractual Clauses. For personal data collected in Singapore, these measures give protection comparable to the PDPA, as its transfer rules require.

Your rights

Depending on the law that applies to you, you have the right to:

ask whether we process your data and receive a copy of it
ask how your data has been used or disclosed in the past year (PDPA)
have inaccurate data corrected
have your data deleted
restrict or object to processing based on our legitimate interests
receive your data in a portable format
withdraw consent at any time, with effect for the future

If you withdraw consent, we will tell you of any likely consequences, for example that we can no longer send you updates.

To exercise these rights, email us at the address above. We may need to confirm your identity before acting on a request. We respond within 30 days; if we need longer, we will tell you when to expect a reply.

You can also complain to a supervisory authority:

Switzerland: Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, www.edoeb.admin.ch

EU/EEA: the data protection authority in your country of residence or work, or where you believe an infringement occurred. A list is available from the European Data Protection Board at edpb.europa.eu.

Singapore: Personal Data Protection Commission (PDPC), www.pdpc.gov.sg

Contact form

When you use the contact form, we collect your name, email address, organisation, role, and message. Submissions are stored in a Cloudflare database located in the EU, and we use them only to reply to you and follow up on your enquiry.

We keep submissions for 12 months after our last exchange and then delete them, unless we need them longer to handle an ongoing matter or meet a legal obligation.

To block spam, the form uses Cloudflare Turnstile. Turnstile checks whether a real person is submitting the form by evaluating technical signals from your browser and device. It does not use tracking cookies, and Cloudflare states that it does not use this data for advertising. See Cloudflare's privacy policy for details.

If you subscribe, we collect your email address and record when you signed up and confirmed. We use double opt-in: you receive a confirmation email and are subscribed only after you confirm.

Subscriptions are stored in a Cloudflare database located in the EU, and our emails are sent through Cloudflare's email service. We do not use a separate newsletter provider.

We send updates about SAFR, OpenSAFR, and related articles. We do not track whether you open our emails or click links in them.

You can unsubscribe at any time through the link in every email or by writing to us. Withdrawing consent does not affect the lawfulness of emails sent before.

Analytics

We use Cloudflare Web Analytics, including its performance monitoring (real user measurements of page load speed). It does not use cookies, does not fingerprint visitors, and does not track you across other websites. A small script reports the page visited, the referrer, your country, browser and device type, and how quickly the page loaded. We see this only as aggregated statistics.

Cookies and local storage

This site does not use tracking or advertising cookies.

We store your light or dark theme choice in your browser [TODO: confirm "in local storage" or "in a cookie"] so the site remembers it. This stays on your device and is not sent to us.

Cloudflare may set strictly necessary security cookies (for example __cf_bm or cf_clearance) to tell people from bots and protect the site. They contain no information that identifies you and are not used for tracking. [TODO: confirm which, if any, appear in production.]

Because we use only strictly necessary storage, we don't show a cookie banner.

Recipients

We share personal data only with Cloudflare, Inc., which provides hosting, security, storage, email sending, analytics, and spam protection for us and acts on our instructions. We may also disclose data where the law requires it.

Security

We protect personal data with appropriate technical and organisational measures, including encrypted connections (HTTPS), restricted access, and storage with a processor bound by a data processing agreement.

Changes to this policy

We may update this policy when our services or the law change. The date at the top shows the latest version. Material changes affecting newsletter subscribers will be announced by email.