Privacy Policy

This policy explains which personal data Sensaria AG collects through this website (all language versions) and through inquiries you send us, why we collect it, who receives it and how long we keep it. It is based on the revised Swiss Federal Act on Data Protection (FADP), in force since 1 September 2023, and, where it applies to our processing, the EU General Data Protection Regulation (GDPR).

When we work on a project for a client, the contract and, where needed, a separate data processing agreement govern the personal data we handle in that project. This policy does not cover that processing.

At a glance

• We process what you type into our forms or send us by email, and the technical data needed to deliver the website.
• The website sets no cookies of its own. Analytics cookies (Google Analytics) are used only if we switch them on, and only after you accept them.
• There are no social media plugins, no embedded maps or videos, no advertising pixels and no external font services on this website.
• We do not sell personal data and do not use it for advertising.

Who is responsible

The controller for the processing described here is:

Sensaria AG, Via Maggio 1c, 6900 Lugano, Switzerland
UID: CHE-256.429.037
Email: contact@sensaria.ch

We have not appointed a data protection officer. Please send any question or request about your personal data to contact@sensaria.ch.

Which data we process and why

When you visit the website

Each time you open a page, your browser sends technical data to our hosting provider, Vercel: your IP address, the date and time, the page requested, the referring page, your browser and operating system (user agent) and the response status. Vercel needs this data to deliver the page and records it in server logs, which we use for security and troubleshooting. We do not use this data to identify individual visitors.

Pages are delivered through Vercel’s content delivery network (CDN), usually from the location closest to you. The server functions that receive our forms are configured to run in Vercel’s Frankfurt (Germany) region.

How you found us (session attribution)

When you open the website, a script stores the following in your browser’s sessionStorage:

• the path of the page on which you entered the website and, if the link you followed contained them, campaign parameters such as utm_source or utm_campaign (no other link parameters are stored); if you later arrive through another link with campaign parameters in the same session, that page replaces the first one,
• the domain of the website that referred you (only the domain, not the full address),
• the time of that page view.

This information stays in your browser. It reaches us only if you submit one of our forms, together with your inquiry, so that we can see which page or campaign led to it. Your browser deletes it when you close the tab or window. It is not a cookie and is not kept from one visit to the next. Details are in our Cookie Policy.

When you use the quote or contact form

The quote form asks for:

• the services you are interested in,
• a description of your project,
• an attachment, if you want to add one (PDF, Word, PowerPoint, Keynote, plain text, Markdown, RTF, ODT, PNG or JPEG, up to 4 MB),
• a budget range and a timeframe (both optional),
• your name, company and email address,
• your phone number and company website (both optional),
• a checkbox confirming that you have read this policy.

The contact form asks for your name, email address, company (optional), your message and the same checkbox.

With every submission, the form also sends the language of the page, the page you sent it from, the service or solution page that linked you to the form (if any), the session attribution described above and a timestamp used for the spam check. When the inquiry arrives, we add a reference number and the time of receipt.

We use this data to answer your inquiry, to prepare a proposal and to communicate with you before any contract is concluded. We use the attribution data to understand which pages and campaigns lead to inquiries.

You do not have to use the forms: you can also write to contact@sensaria.ch. Without the required fields, however, a form cannot be sent and we cannot answer.

Spam protection

• The forms contain a field that people do not see and a minimum time between opening the page and sending. Submissions that fail these checks are discarded and not stored.
• Your IP address is used for a short-term limit on the number of submissions. It is held only in the working memory of the server function and is not stored with your inquiry.
• Cloudflare Turnstile (if enabled). When we switch it on, the quote and contact pages load Turnstile from Cloudflare. It checks in the background whether a person is filling in the form. Cloudflare processes technical signals such as your IP address, TLS fingerprint and user agent. When you submit, our server sends the Turnstile result and your IP address to Cloudflare to confirm the check. Cloudflare states that Turnstile does not use cookies.

When you email us

If you write to us by email, we process your email address, your name, the content of your message, any attachments and the technical metadata of the email in order to reply.

Website analytics

Vercel Web Analytics (if enabled). We may use Vercel Web Analytics to count page views and a few events, such as “quote form started”, “request sent” or “email link clicked”. An event carries the page, its language and the position of the clicked button and, for a sent quote request, the service categories you selected. It never contains what you type into a form. For each page view, Vercel records the time, the page address, the referring page, filtered link parameters, an approximate location derived from the IP address (country, region, city), the operating system, the browser and the device type. Vercel Web Analytics does not use cookies. Vercel recognizes a visitor only by a hash calculated from the incoming request, which is discarded after 24 hours. We see aggregated statistics only.

Google Analytics 4 and Google Tag Manager (only if enabled, only with your consent). The website is prepared for Google Analytics 4, optionally loaded through Google Tag Manager. If we switch it on, a banner asks for your consent first. The Google scripts load only after you click “Accept analytics”; without your consent, nothing is loaded from Google. With your consent, Google sets the cookies listed in our Cookie Policy and processes information about your visit: pages viewed, time of the visit, referring website, device and browser data, approximate location, a pseudonymous identifier stored in a cookie, and the events described above. We use this to understand which pages are useful. You can withdraw your consent at any time (see Cookie Policy).

Legal bases

Under Swiss law, we process personal data in line with the principles of the FADP. Where processing needs a justification, we rely on your consent, our overriding private interest (answering inquiries, running a secure website, understanding how the website is used) or a legal obligation.

Under the GDPR, where it applies, the legal bases are:

Processing	Legal basis (GDPR)
Delivering the website, server logs, security and spam protection, including Turnstile	Legitimate interests in a secure and reliable website, Art. 6(1)(f)
Answering inquiries and preparing proposals	Steps taken at your request before entering into a contract, Art. 6(1)(b); for other questions, our legitimate interest in replying, Art. 6(1)(f)
Session attribution sent with an inquiry; Vercel Web Analytics	Legitimate interests in knowing which pages and channels are useful, Art. 6(1)(f)
Google Analytics and Google Tag Manager	Your consent, Art. 6(1)(a)
Keeping records required by Swiss law	Legitimate interest in meeting our legal obligations, Art. 6(1)(f); where EU or member-state law requires it, legal obligation, Art. 6(1)(c)

The checkbox on our forms records that you have read this policy and agree to us using your details to answer your request. Where we rely on your consent, you can withdraw it at any time. Withdrawal does not affect processing that took place before it.

Where the data comes from

We receive most data directly from you: through the forms, by email, or from your browser when you visit the website (technical data, the link you followed, the referring website). Cloudflare provides the result of the Turnstile check if it is enabled. Vercel and, with your consent, Google compile the analytics data described above.

Who receives your data

Service providers

We deliver each inquiry through one or more of the channels below: storage in Vercel Blob, an email notification to us, and a message to our CRM. Our providers process personal data on our behalf, under data processing terms.

Recipient	What they do for us	Data concerned
Vercel Inc., USA	Hosting, CDN, server functions and server logs; private file storage (Vercel Blob) for inquiries and attachments; Web Analytics, if enabled	Technical data, form data, attachments, analytics data
Our email service provider	Sends us an email notification with your inquiry and attachment	Form data, attachment
Our email hosting provider	Stores the emails we receive and send at contact@sensaria.ch	Emails, form notifications, attachments
Our CRM provider	Receives your inquiry through a signed server-to-server message (webhook), so that we can manage the follow-up	Form data and attribution; for an attachment only its file name, size and type, not the file
Cloudflare, Inc., USA (if Turnstile is enabled)	Bot check on the form pages	Technical signals, IP address
Google (if Google Analytics or Tag Manager is enabled, only with your consent)	Website analytics	Usage data, cookie identifiers

Cloudflare also uses Turnstile signals to improve its bot detection, as a controller in its own right. Google may use data for its own purposes as described in its privacy policy.

Other recipients

We disclose personal data to authorities, courts or our professional advisers only where the law requires it or where it is necessary to establish, exercise or defend legal claims.

Disclosure abroad

Some recipients process personal data outside Switzerland:

• Germany and other EU/EEA countries: the server functions run in Frankfurt; our providers may also use other EU/EEA locations. The Swiss Federal Council recognizes these countries as providing an adequate level of data protection.
• USA: Vercel, and Cloudflare and Google if their services are enabled. Our email and CRM providers may also process data in the USA.
• Other countries: pages are delivered from the Vercel CDN location closest to you, which may be outside Switzerland and the EU/EEA.

Since 15 September 2024, the Federal Council has recognized an adequate level of protection in the USA for companies certified under the Swiss-U.S. Data Privacy Framework. Vercel is certified under that framework. Where a recipient is not certified, or is located in a country without an adequate level of protection, we rely, where applicable, on standard contractual clauses recognized by the Federal Data Protection and Information Commissioner (FDPIC) (Art. 16 para. 2 let. d FADP) and, under the GDPR, on the European Commission’s standard contractual clauses or the EU-U.S. Data Privacy Framework. You can ask us for information about these safeguards at contact@sensaria.ch.

How long we keep data

Our retention policy:

• Inquiries (form data, emails and attribution): up to 24 months after our last contact with you, unless a contract follows. If it does, we keep the data for the duration of the business relationship and then for as long as the law requires; for business records such as accounting vouchers, Swiss law requires ten years (Art. 958f Code of Obligations).
• Attachments: deleted as soon as we no longer need them for your inquiry, and at the latest together with the inquiry.
• Submissions stopped by the spam check: not stored.
• Session attribution: in your browser only, until you close the tab or window.
• Consent choice (only if the consent banner is active): in your browser for 12 months, or until you change it or clear your browser data.
• Server logs: the logs Vercel makes available to us are kept for no longer than 30 days.
• Vercel Web Analytics: the visitor hash is discarded after 24 hours; we keep aggregated statistics only.
• Google Analytics (if enabled and consented): the cookies last up to two years; Google keeps the analytics data for the retention period set in our Google Analytics account.

We may keep data longer if we need it to establish, exercise or defend legal claims.

How we protect your data

We take technical and organizational measures appropriate to the risk, in particular:

• all pages and form submissions are transmitted over encrypted HTTPS connections,
• inquiries and attachments stored in Vercel Blob are kept in a private store that can only be read with authentication,
• messages to our CRM are signed, so that the receiving system can check they come from us,
• our own application logs record the reference number and delivery status of an inquiry, not its content,
• uploads are limited to certain file types and 4 MB,
• a content security policy limits which external sources the website may load,
• only the people at Sensaria who handle inquiries have access to them.

No transmission over the internet is completely secure. Ordinary email in particular is not end-to-end encrypted, so please do not send highly sensitive information by email or through the forms.

Your rights

Subject to the conditions and exceptions of the applicable law, you have the right to:

• access the personal data we hold about you (Art. 25 FADP; Art. 15 GDPR),
• have incorrect data corrected (Art. 32 FADP; Art. 16 GDPR),
• have your data deleted (Art. 32 FADP; Art. 17 GDPR),
• object to processing or ask us to stop a specific processing or disclosure (Art. 32 FADP; Art. 21 GDPR); under the GDPR you can also ask us to restrict processing (Art. 18 GDPR),
• receive the data you gave us in a common electronic format, or have it transferred to another controller (data portability, Art. 28 FADP; Art. 20 GDPR),
• withdraw your consent at any time, with effect for the future.

To exercise these rights, write to contact@sensaria.ch. We may ask you to confirm your identity. We normally reply within 30 days.

If you believe we are not processing your data lawfully, please tell us first so that we can look into it. You can also contact the Swiss supervisory authority: Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, www.edoeb.admin.ch. If the GDPR applies, you can lodge a complaint with the supervisory authority in the EU/EEA country where you live or work, or where the alleged infringement took place (Art. 77 GDPR).

No automated decisions or profiling

We do not make decisions based solely on automated processing that have legal effects on you or affect you in a similarly significant way, and we do not use your data for profiling. The automatic spam check described above only filters out form submissions that look automated. If you think a message of yours did not reach us, write to contact@sensaria.ch.

Links to other websites

The website links to other websites, for example the projects in our portfolio, official sources and OpenStreetMap on the contact page. The map is not embedded: it opens on openstreetmap.org only when you click the link. Once you are on another website, its operator is responsible for the data it processes, and its own privacy policy applies.

Changes to this policy

We update this policy when the website, our providers or the law change. The date of the current version is shown on this page. If a change requires your consent, we will ask for it.