Privacy Policy & Data Protection

1. Data Controller (Verantwortliche Stelle)

The data controller responsible for the processing of personal data on this website and in the context of our software engineering services is:

2. Legal Framework & Fundamental Principles

We adhere strictly to the principle of data minimization and purpose limitation under the revised Swiss Federal Act on Data Protection (revDSG / FADP) and, where applicable, Regulation (EU) 2016/679 (General Data Protection Regulation - GDPR).

We process personal data solely when a legal basis exists, specifically: (a) for the performance of a contract or pre-contractual measures (Art. 6 para. 1 lit. b GDPR / Art. 31 para. 2 lit. a FADP); (b) on the basis of legitimate commercial interests (Art. 6 para. 1 lit. f GDPR); or (c) on the basis of explicit consent (Art. 6 para. 1 lit. a GDPR).

3. Data Collected & Processing Purposes

3.1 Discovery & Project Enquiries: When you submit a project enquiry through our contact forms, we collect your full name, work email address, company name (optional), budget range, timeline, and project overview. This information is processed exclusively to evaluate technical feasibility, provide architecture recommendations, and manage client communications.

3.2 Technical Connection Logs & Security: To guarantee system stability and firewall defense, our web servers process technical metadata (IP address, user-agent, timestamp, HTTP method, response status). Application logs automatically redact sensitive fields and PII.

4. Data Storage & International Data Transfers

All primary application databases and customer enquiry records are hosted in certified enterprise data centers located in Switzerland or the European Economic Area (EEA) with Row Level Security (RLS) and end-to-end TLS 1.3 encryption.

In the event that third-party processing tools involve transfers to jurisdictions outside Switzerland or the EEA, transfers are governed by standard contractual clauses (SCCs) approved by the Federal Data Protection and Information Commissioner (FDPIC / EDÖB).

5. Data Retention & Erasure

Personal data collected through prospective client enquiries is retained only for the duration necessary to conduct scoping evaluations and client communications (up to 24 months if no contract is concluded).

Client records associated with completed contracts and commercial billing are retained for ten (10) years in accordance with statutory commercial record-keeping requirements under the Swiss Code of Obligations (Art. 958f OR).

6. Your Rights as a Data Subject

Under Swiss data protection law and GDPR, you are entitled to the following rights:

• Right to Information (Auskunftsrecht): You may request confirmation and details regarding personal data processed about you.
• Right to Rectification (Berichtigungsrecht): You may request correction of inaccurate or incomplete personal records.
• Right to Erasure (Löschungsrecht): You may request erasure of your data when statutory retention obligations no longer apply.
• Right to Restriction & Objection (Widerspruchsrecht): You may object to data processing based on legitimate commercial interests.

To exercise your data protection rights, please contact our Data Protection Officer at info@popcorndigital.ch.