Privacy policy

1. Controller

The controller for the processing of personal data on this website is:

E-Mail

lucacruz@ayus-verda.ch

The website trades under the name “Luca Cruz”. For any data protection matter an email to the address above is enough; no particular form is required.

2. What data is processed

This website processes data in the places listed below. Each is set out with its purpose, legal basis and retention period.

a) Visiting the site (server logs)

Each time a page is requested, your browser transmits technical details that the server records: IP address, date and time, the address requested, the referring link, browser identification and operating system. The purpose is the operation and security of the website — without these details a page cannot be delivered and an attack cannot be detected. The legal basis is the legitimate interest in secure operation (Art. 6(1)(f) GDPR, Art. 31(1) Swiss FADP). The logs are not combined with other data and are not used to recognise you.

b) Contact form

When you submit the form, the following is transmitted: name, email address, message, the language you were reading in and — optionally — phone number, company, topic and budget range. The purpose is answering your enquiry and taking steps prior to a contract. The legal basis is pre-contractual measures (Art. 6(1)(b) GDPR, Art. 31(2)(a) Swiss FADP); where no contract is in prospect, the legitimate interest in replying (Art. 6(1)(f) GDPR). The details are stored in this website’s database (see 4, Supabase) and are also delivered as an email and kept in the mailbox.

c) Language cookie

One single cookie is set: NEXT_LOCALE records which language the page was loaded in. It is a session cookie, it expires when you close your browser, it contains nothing but the language code (for example “en”) and it does not allow you to be recognised. The legal basis is the legitimate interest in technical operation (Art. 6(1)(f) GDPR). No consent is required for it.

d) Abuse prevention on the contact form

So that the form cannot be flooded automatically, we count how often it has been submitted from the same internet connection. The IP address itself is NOT stored — only an irreversible check value derived from it (SHA-256 with a secret addition held on the server alone). The address cannot be recovered from that value; it serves only to compare “the same connection as a moment ago”. What is stored is the check value and the time, and both are deleted after 24 hours at the latest. The purpose is protection against abusive mass use; the legal basis is the legitimate interest in a working way of getting in touch (Art. 6(1)(f) GDPR, Art. 31(1) Swiss FADP).

e) Partner page: application as a partner

Anyone applying as a partner on the partner page sends: name, e-mail address, line of work, the selected language and — optionally — phone number, company and a message. The purpose is to set up a partnership and later to settle a commission. The legal basis is the performance of pre-contractual measures (Art. 6(1)(b) GDPR, Art. 31(2)(a) Swiss FADP). Storage and delivery are the same as for the contact form under b) (see 4, Supabase and Resend).

3. What does not happen

So that the list above is complete, here is its counterpart — this website does none of the following:

• No audience measurement and no statistics. No Google Analytics, no Tag Manager, no comparable tool.
• No advertising networks, no retargeting, no profiling.
• No embedded third-party content that loads on arrival — no maps, no videos, no fonts from other people’s servers. The fonts are served from our own.
• No newsletter and no marketing mail.
• No user accounts and no sign-in.
• No payment processing and no bank or card details.
• No automated decision-making and no profiling within the meaning of Art. 22 GDPR.
• No disclosure or sale of data for advertising purposes — to anyone.

4. Processors

Three service providers are used to run the site. All three process data solely on our behalf and on our instructions; a data processing agreement is in place with each.

Vercel Inc. (hosting)

The website runs on Vercel and is served from data centres in the European Union. Vercel processes the log data described under 2 a). Vercel Inc. is based in the USA; the transfer relies on the European Commission’s standard contractual clauses.

Resend (email delivery)

Messages from the contact form are delivered via Resend. The details described under 2 b) are transmitted to Resend for that purpose. Resend is based in the USA; the transfer relies on the European Commission’s standard contractual clauses.

Supabase (database)

Enquiries from the contact form are stored in a database operated by Supabase, so that they can be worked through in an orderly way rather than depending on the mailbox alone. What is stored is the information described under 2 b) — name, email address, message, language and, where given, phone number, company, topic and budget range — together with the time of arrival and the processing status. The IP address is not stored. The storage location is the European Union (AWS data centre eu-west-1, Ireland). The purpose is storing and handling contact enquiries; the legal basis is the same as under 2 b). Supabase Inc. is based in the USA; the transfer relies on the European Commission’s standard contractual clauses.

Beyond this, data is disclosed only where there is a legal obligation to do so or where you have expressly consented.

5. How long data is kept

• Server logs: a few days, then deleted automatically.
• Language cookie: until you close your browser.
• Abuse-prevention check values (2 d): 24 hours, then deleted automatically.
• Contact form enquiries — both the database record and the email in the mailbox: until the matter is dealt with. If the enquiry leads to an engagement, the statutory retention periods for business records apply (ten years in Switzerland, Art. 958f CO). If it does not, it is deleted after twelve months at the latest.
• Applications via the partner page (2 e): the same as contact form enquiries. If no partnership comes about, they are deleted after twelve months at the latest.

6. Your rights

You may request the following at any time and without giving reasons:

• Access to the data held about you
• Rectification of inaccurate data
• Erasure of your data
• Restriction of processing
• Your data in a commonly used format (portability)
• Objection to processing based on legitimate interests

An email to lucacruz@ayus-verda.ch is enough. Where there is doubt about your identity, proof may be requested — that protects your data from being handed to someone else.

You also have the right to lodge a complaint with a supervisory authority: in Switzerland the Federal Data Protection and Information Commissioner, and within the EU the authority in your country of residence.

Switzerland: edoeb.admin.ch

7. Security

The website is served exclusively over an encrypted connection (HTTPS). What you send through the form is therefore protected against interception on its way to the server. Absolute protection of data on the internet is not technically possible.

8. Links to other websites

This website links to third-party websites in a few places, for example to work done for clients. Once you follow such a link, the privacy policy of that provider applies. We have no influence over how they handle your data.

9. Changes

This policy is updated when the processing changes — for instance when a further service is added. The version that applies is the one shown on this page; the date below states when it was last revised.