Privacy Policy
How écociel handles personal data
Valid from October 2026
At a glance
- écociel AG in Stansstad is responsible for the processing described here. Contact: contact@ecociel.ch.
- We process personal data to run our website, answer enquiries, and offer and provide our services.
- When we process data in our clients' systems for them, we act as their processor under the data processing annex of our Terms.
- We do not use client data to train or fine-tune AI models without written consent.
- Google Analytics only runs after you accept the cookie banner.
- You can request access, correction or deletion of your data at any time.
01Who is responsible
1.1Responsible for the processing of personal data described in this policy is écociel AG, Mühlebach 7, 6362 Stansstad, Switzerland, UID CHE-499.979.531 ("écociel", "we"). For all data protection questions, write to contact@ecociel.ch or to the postal address above.
1.2This policy follows the Swiss Federal Act on Data Protection (FADP). Where the EU General Data Protection Regulation (GDPR) applies, for example to visitors or clients in the EU, it also follows the GDPR. We have not appointed a representative in the EU.
02What this policy covers
2.1This policy covers our website ecociel.ch, enquiries and appointments, and our dealings with clients, prospects and business partners and their contact persons.
2.2"Personal data" means any information relating to an identified or identifiable person, for example name, email address, postal address or usage behaviour.
03Visiting our website
3.1When you visit our website, our hosting provider Cloudflare (Cloudflare Pages) processes technical data such as IP address, date and time of access, page requested, and browser and operating system, in order to deliver the website and keep it secure.
3.2Cookies and Google Analytics. We use Google Analytics to evaluate how our website is used. Analytics is loaded only after you accept the cookie banner on your first visit; IP addresses are shortened. Your choice is stored in your browser. You can set your browser to inform you about cookies, allow them only in individual cases, block them, or delete them automatically when you close the browser. If you disable cookies, the website may not work fully. More about cookies: allaboutcookies.org. We do not use any other analytics or tracking tools on the website.
04Contacting us and booking appointments
4.1When you contact us by email or by booking an appointment, we store the data you provide in order to handle your request; at least your first and last name and your email address.
4.2Appointment booking uses Google Calendar appointment scheduling; Google's privacy policy applies.
05Clients, prospects and business partners
We process the contact and business data of our clients, prospects and business partners and their contact persons (e.g. name, company, role, email, correspondence, offers, contracts, invoices and payments) to prepare offers, perform contracts, manage the business relationship, keep accounts and comply with legal obligations.
06Client data in our services
6.1When we process personal data in our clients' systems or on their behalf, for example in projects, proofs of concept or in Longshift, the client is the controller and we are its processor. We then process the data only on the client's documented instructions and under the annex "Data processing" of our Terms of Service. Questions about such data should be addressed to the client concerned.
6.2We do not use client data or client-specific outputs to train or fine-tune AI models without the client's written consent. For third-party AI providers, we use settings and terms that exclude training on submitted data.
6.3For each client, we choose the hosting region that fits the client's legal requirements best, normally Switzerland, the EU or the US, and state it in the offer. We back up the systems and data we host or operate for clients.
07Client references
7.1Under section 11 of our Terms of Service, we may name client companies, show their logo and publish short use-case write-ups. References never contain personal data or confidential information; a client sees a write-up before it is published.
7.2Clients can opt out at any time, fully or in part, by email to contact@ecociel.ch or with our opt-out form. Material already online is removed within 14 days.
08Providers we use
We work with carefully selected providers that process personal data on our behalf. We impose equivalent data protection obligations on them. This list is also the subprocessor list referred to in Annex A.6 of our Terms of Service; we inform clients in advance of new or replaced subprocessors.
| Provider | Purpose | Location |
|---|---|---|
| OpenAI | AI models for our services and Longshift | USA; region per client where offered |
| Anthropic | AI models for our services and Longshift | USA; region per client where offered |
| xAI | AI models for our services and Longshift | USA; region per client where offered |
| AI models (per client); Google Analytics (with consent only); appointment booking | USA / EU | |
| Hosting for client solutions and Longshift | Operation of client solutions and Longshift; provider chosen per client and named in each offer | Switzerland, EU or US, as legally best fit for the client |
| Cloudflare (Cloudflare Pages) | Website hosting and delivery, including server logs | USA; global network |
| bexio AG | Offers, invoices and accounting | Switzerland |
| Google Workspace | Email, calendar and file storage | USA / EU |
| Notion | Internal documentation and project notes | USA |
| Slack | Internal communication | USA |
09Disclosure abroad
Some of these providers process data outside Switzerland, in particular in the EU and the US. We disclose personal data abroad only to countries that the Swiss Federal Council (and, where the GDPR applies, the EU Commission) recognises as providing adequate protection, for example under the Swiss-US or EU-US Data Privacy Framework for certified US companies such as Google, Cloudflare, Notion and Slack, or on the basis of suitable safeguards such as standard contractual clauses, or where a legal exception applies.
10Legal bases under the GDPR
Where the GDPR applies, we process personal data to perform a contract or take steps before one (Art. 6(1)(b)), to comply with legal obligations (Art. 6(1)(c)), on the basis of our legitimate interests such as answering enquiries, running our business and keeping our website secure (Art. 6(1)(f)), or with your consent, for example for Google Analytics (Art. 6(1)(a)). You can withdraw consent at any time with effect for the future.
11How long we keep data
11.1We keep personal data only as long as needed for the purpose or as required by law. Enquiries are deleted once they are no longer needed. Business records such as contracts and invoices are kept for 10 years under Swiss law. Google Analytics data is deleted after 14 months.
11.2Client data processed on behalf of clients is returned or deleted at the end of the services; for Longshift, clients can export their data for 30 days after the term ends. Backups are overwritten in the regular backup cycle.
12Security
We take technical and organisational measures appropriate to the risk to protect personal data, such as access control, encryption and separation of client data. We report data security breaches as required by law.
13Your rights
13.1Within the applicable law, you have the right to access your personal data, to have it corrected or deleted, to object to or restrict its processing, to receive it in a common electronic format (data portability) and to withdraw consent. To exercise your rights, write to contact@ecociel.ch. We may ask you to prove your identity.
13.2You can lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC, edoeb.admin.ch) or, where the GDPR applies, with a data protection authority in the EU.
14Changes to this policy
We may update this policy. The current version is published at ecociel.ch/privacy-policy/. It replaces the version valid from 26 January 2024.