Privacy Policy

The controller responsible for processing your personal data under the Swiss Federal Act on Data Protection (FADP) and, where applicable, the EU General Data Protection Regulation (GDPR) is:

This policy applies to the website esysagency.ch, the client portal (/kunden), our forms and promotions, and our communication with prospective and existing clients.

We process personal data lawfully, in good faith and proportionately: only for recognisable purposes, only as much data as necessary and only for as long as required. We do not sell personal data and do not use automated individual decision-making.

Website visits (automatic)

• IP address, date and time of access, URL requested
• Browser type, operating system, referrer, amount of data transferred, HTTP status code

Contact, quote and partner forms

• First and last name, email, phone, company name (partly optional)
• Content of your message, services requested, time of the enquiry
• Result of the spam check by Cloudflare Turnstile (see section 9)

Online appointment booking

• Name, email, phone, selected service, date/time, your message
• For video appointments: appointment and link in the Google Calendar of the responsible staff member (Google Meet)

Orders and client relationship

• Contact and company data, billing address, contract and invoice data
• Project documents and access credentials to your systems, insofar as you provide them to us

Client portal and accounts

• Sign-in with email address and one-time code; optional two-factor authentication
• Passkeys: only the public key is stored — your fingerprint or face recognition never leaves your device
• “Trust this device” (optional): a security cookie for 30 days so that a code is not required at every sign-in
• Access credentials you store in the portal are saved in encrypted form

Quotes and contracts with electronic signature

When you sign, we additionally store your name, the time, IP address and browser identifier as proof of the signature (legitimate interest and statutory retention obligation).

Invoices and payments

You receive invoices by email and in the portal, with a QR-bill for bank transfers. Online payments by card or TWINT are processed by Payrexx AG (Switzerland) or TWINT AG (Switzerland) respectively. Card data is captured directly by the payment provider; we only receive the payment status, the amount and a transaction reference.

WebStart programme

For an application we collect company data (name, legal form, UID, address, industry, size, description), the contact person (name, position, email, phone), your statements on ownership in accordance with the terms of participation, your goals and your motivation. You confirm your email address via a link. The data is used exclusively for the selection and for communication about the campaign; you only receive marketing communications if you have expressly ticked the corresponding box.

Wheel of Fortune

For the Wheel of Fortune we do not collect a name or an email address. To ensure that each person can only spin once per year, we store a random code in a cookie and a non-reversible hash of your IP address, together with the language, the prize and the voucher code. If you redeem a prize, we process the details of your request in the same way as a contact enquiry.

We analyse publicly accessible company websites (e.g. loading time, security, discoverability) and use published business contact details such as the company name, website and business email address to inform companies once about possible improvements. You can object to this at any time with a short message to kontakt@esysagency.ch; your address will then be blocked for any further contact.

• Responding to enquiries, quote requests and appointment bookings
• Concluding and performing contracts, client portal and support
• Invoicing, payment processing and accounting
• Running promotions (WebStart, Wheel of Fortune)
• Website security, protection against spam and abuse
• Operation, statistics and improvement of the website
• Marketing — only with consent or within the scope of section 6

Under the FADP, processing is permitted as long as it complies with the principles set out in section 2. Where the GDPR applies, we rely on the performance of a contract and pre-contractual measures (Art. 6(1)(b)), consent (Art. 6(1)(a)), legal obligations (Art. 6(1)(c)) and legitimate interests (Art. 6(1)(f)) — e.g. security, cookieless statistics and business contacts. Consent can be withdrawn at any time with effect for the future by email to kontakt@esysagency.ch or via the cookie settings.

We only disclose personal data insofar as this is necessary for the purposes stated or required by law. The following service providers process data on our behalf:

Data may also be disclosed to authorities, courts or advisers (e.g. fiduciary, auditors) if we are obliged to do so or if it is necessary to protect our rights.

Data is processed in Switzerland, in the EU (Romania, France, Ireland) and in the USA and Singapore. According to the Federal Council, the EU provides an adequate level of data protection. For the USA we rely on the Swiss-U.S. Data Privacy Framework where the provider is certified, otherwise on the standard contractual clauses (SCCs) recognised by the FDPIC and the European Commission. Standard contractual clauses also apply to Singapore.

• Necessary cookies and storage — security, sign-in, your cookie choice; without consent
• Google Analytics 4 — only after your consent in the cookie banner (Google Consent Mode v2, IP truncated)
• Ahrefs Web Analytics — statistics without cookies and without recognising individual persons
• Marketing cookies — not currently in use

As long as you have not given consent, Google Analytics does not set any cookies and only transmits cookieless signals without recognition (Consent Mode). YouTube videos are only loaded when you click on them; preview images and the Google map on the contact page may be loaded from Google servers, in which case Google receives your IP address. All details: Cookie Policy.

The website, database and email server run on HostON servers in a data centre in Romania (EU). Data traffic runs via Cloudflare and is encrypted end to end with SSL/TLS (recognisable by “https://” and the padlock symbol). Server log files are deleted automatically after 14 days. Encrypted backups are additionally kept on a separate storage system of our own.

Under the FADP and, where applicable, the GDPR, you have the following rights:

• Access — which data we process about you, for what purpose and for how long
• Rectification of inaccurate data
• Erasure, unless a retention obligation prevents it
• Restriction of processing
• Delivery or transfer of your data in a common electronic format
• Objection to processing based on legitimate interest and to direct marketing
• Withdrawal of consent given, with effect for the future

• Contact and appointment enquiries without an order: 12 months after the communication has ended
• Contracts, quotes, invoices and accounting records: 10 years (Art. 958f CO)
• Client account in the portal: for the duration of the client relationship, then deletion or retention under the CO
• WebStart applications not selected: 12 months after the end of the campaign
• Wheel of Fortune: 12 months after the spin (redeemed prizes are treated like client data)
• Server log files: 14 days
• Google Analytics: 14 months
• Block list after objection to being contacted: indefinitely, email address only

Technical measures: SSL/TLS encryption, two-factor sign-in and passkeys, encrypted storage of access credentials, firewall and bot protection by Cloudflare, regular updates and security checks, daily encrypted backups at a second location.

Organisational measures: access only for authorised persons on a need-to-know basis, confidentiality obligations, logging of access and changes. In the event of a data security breach posing a high risk, we inform the FDPIC as soon as possible (Art. 24 FADP) and, where the GDPR applies, the supervisory authority within 72 hours and, where appropriate, the persons concerned.

We adapt this privacy policy when our services or the legal situation change. The current version at esysagency.ch/datenschutzerklaerung applies. For questions about data processing you can reach us at kontakt@esysagency.ch or by phone at 044 554 91 91.