Privacy Policy

1. General Information and Legal Basis

1.1 Controller

isofloc AG Soorpark CH-9606 Bütschwil

Phone: +41 (0)71 313 91 00 E-mail: info@isofloc.swiss

Authorised Managing Director: Michel Alder Commercial register entry: CH-035.3.000.242-4

For data protection enquiries please reach us at info@isofloc.swiss.

1.2 Legal Basis for Processing

As a Swiss company, isofloc AG is primarily subject to the revised Federal Act on Data Protection (revFADP, effective 1 September 2023). To the extent that individuals within the scope of the EU General Data Protection Regulation (GDPR) are affected, we additionally observe the requirements of the GDPR.

The processing of personal data takes place on the following legal bases:

• Consent (Art. 6(1)(a) GDPR / Art. 6 revFADP)
• Contract performance or pre-contractual measures (Art. 6(1)(b) GDPR / Art. 31(2)(a) revFADP)
• Legal obligation (Art. 6(1)(c) GDPR)
• Legitimate interest (Art. 6(1)(f) GDPR / Art. 31(1) revFADP): conducting our business activities and analysing, optimising and maintaining the security of our online offering.

2. Log Files, Hosting

The server statistics automatically store data that the browser transmits to us (so-called "log files"):

• Browser software language and version
• Operating system used and its interface
• Referrer URL (previously visited page)
• Hostname of the accessing device (IP address)
• Date and time of the server request
• Time zone difference to Greenwich Mean Time (GMT)
• Content of the request (specific page)
• Amount of data transferred
• Access status / HTTP status code

We can usually not assign this data to specific persons. The data is not merged with other data sources. After statistical evaluation, the data is deleted within 7 days. Data whose retention is required for evidentiary purposes is excluded from deletion until final clarification of the incident.

Hosting Provider

This website is hosted with Netlify Inc., 512 2nd Street, Suite 200, San Francisco, CA 94107, USA. Netlify processes the mentioned log files as part of providing the infrastructure. Privacy policy: https://www.netlify.com/privacy/ (DPF-certified).

3. Contractual Processing

The personal data you provide for contractual purposes (e.g. offer or project enquiries) — such as name, address, phone number or e-mail address — is used exclusively internally to answer your enquiries, process orders or grant you access to contractual information.

When submitting the contact form, your data is transmitted via Resend (see section 7) to our internal e-mail address. To prevent spam and automated requests, Cloudflare Turnstile is used (see section 7).

4. Contact, Application Data

When you contact us by e-mail or via the contact form, your information is stored to answer your questions.

Disclosure to third parties does not take place in principle, unless applicable data protection regulations justify a transfer or we are legally obliged to do so. You can revoke your consent at any time with effect for the future. In the event of revocation, your data will be deleted immediately unless a statutory exception exists.

Application Data

You can also apply to us via our contact form. The data entered is processed exclusively for the purpose of applicant selection. By applying, you agree to be contacted in writing and/or by phone. Your data is accessible to our HR department and the positions relevant to the role to be filled. We evaluate all applicants only by their qualifications — regardless of origin, gender, religion, disability, age or sexual identity. You can change or delete your application at any time and revoke your consent.

5. Cookies

On your first visit to this website you will be informed via a cookie banner. There you can accept or decline statistics cookies. Your choice is stored in a cookie. To reset it, delete this site's cookies in your browser — the banner will reappear on your next visit.

This site uses the following cookie categories:

Of course, you can also use our website without accepting statistics cookies.

6. Newsletter

If you wish to receive the newsletter offered on our website, we need a valid e-mail address from you. We use the double opt-in procedure: after you enter your e-mail address we send you a confirmation e-mail. If you do not confirm within 24 hours, your data related to the newsletter dispatch is automatically deleted.

We only send newsletters with your consent or a statutory permission. Your personal data will not be passed on to third parties.

You can revoke your consent to the storage of your e-mail address and its use for sending the newsletter at any time. You will find a link to unsubscribe at the end of every newsletter.

7. Disclosure of Data to Third Parties

We pass on data to third parties when this is necessary to fulfil a contract and/or we are legally obliged or authorised to do so. Within the scope of our legitimate interests in analysis, optimisation and economic operation of our online offering, we use the following external service providers:

Cloudflare Turnstile (bot protection)

We use Cloudflare Turnstile by Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA, to protect our contact form against automated attacks. For this purpose, Turnstile processes client-side signals: IP address, TLS fingerprint, User-Agent header as well as Sitekey and its associated origin. According to Cloudflare, direct identification of individuals via these signals is not possible. The cookies set by Turnstile are strictly necessary to distinguish bots from human users and therefore do not require separate consent. Cloudflare processes the signals on our behalf (as a data processor) for the purpose of bot detection, and additionally as an independent controller to improve its detection algorithms. Legal basis for our use of Turnstile: Art. 6(1)(f) GDPR (legitimate interest in the security of form processing) and Art. 31(2)(d) revFADP. Cloudflare privacy policy: https://www.cloudflare.com/privacypolicy/ — Cloudflare's Turnstile Privacy Addendum applies in addition.

Resend (e-mail delivery)

We use Resend, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA, for the transactional delivery of form e-mails to our internal address. Processing of the transmitted data takes place in the AWS Dublin, Ireland (eu-west-1) region and therefore remains within the European Economic Area. A Data Processing Agreement is in place with Resend; any data transfers to the US parent company are based on the EU Standard Contractual Clauses (SCCs). Only the contents of the contact form (name, company, e-mail, phone, message) are transmitted; they are retained at Resend only as long as necessary for delivery and delivery logging. Legal basis: Art. 6(1)(b) GDPR (performance of a contract or pre-contractual measures) or Art. 31(2)(a) revFADP. Privacy policy: https://resend.com/legal/privacy-policy

Google Analytics 4

We use Google Analytics 4 (GA4) by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (parent: Google LLC, USA) to analyse usage behaviour on our website. GA4 anonymises IP addresses by default; a direct personal identification is excluded. Google is certified under the EU-U.S. Data Privacy Framework (DPF), providing a guarantee to comply with European data protection law (https://www.dataprivacyframework.gov/). Cookies and tracking by GA4 only occur after your consent via the cookie banner (Art. 6(1)(a) GDPR / Art. 6 revFADP). You can revoke your consent by deleting this site's cookies in your browser. Google privacy policy: https://policies.google.com/privacy

WhatsApp (contact option)

On our website you will find a click-to-chat link to WhatsApp (Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland). No embedding takes place — the link only leads to WhatsApp when clicked. Only there will data be processed in accordance with Meta's privacy policy. Privacy policy: https://www.whatsapp.com/legal/privacy-policy-eea

Social media links (YouTube, LinkedIn, Facebook)

In the footer there are external links to our profiles on YouTube (Google Ireland Ltd.), LinkedIn (LinkedIn Ireland Unlimited Company) and Facebook (Meta Platforms Ireland Ltd.). These are plain links — no embeds, no pixel tags, no trackers on our pages. Only when clicked will you be redirected to the respective platform.

8. Rights of the Data Subject

You have the right to:

• Access to the personal data stored about you
• Rectification of incorrect data
• Restriction and deletion of your personal data
• Data portability
• Withdrawal of consent given, with effect for the future
• Objection to processing, in particular for direct marketing

Send an e-mail to info@isofloc.swiss with the subject "Data Protection".

Supervisory Authorities

Switzerland: Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, https://www.edoeb.admin.ch

EU: data protection supervisory authority responsible for your country of residence

You also have the right to lodge a complaint if you believe that any processing violates statutory provisions.

9. Retention Period of Personal Data

We store personal data for the duration of the respective statutory retention period or as long as the purpose of collection exists. After the retention period has expired, the data is routinely deleted unless it is required for contract initiation or performance. Data that must be retained for commercial or tax law reasons is processed in a restricted manner accordingly.

10. Security Information

We strive to process your personal data with all technical and organisational means available so that the provisions of data protection laws are observed. Our website is encrypted via HTTPS/TLS.