DATA PROTECTION (SWISS FADP / EU GDPR)

Privacy Policy of dropflow GmbH

Version 2.1 · Effective: November 2026

Protecting your privacy and securely processing your personal data are top priorities for dropflow GmbH. This Privacy Policy informs you about how we collect, process, and protect personal data when you visit our website (www.dropflow.ch) and associated campaign or landing pages (such as gutschein.dropflow.ch), use our services in AI & Process Solutions and Industrial Solutions, or contact us.

Your data is processed in accordance with the revised Swiss Federal Act on Data Protection (FADP / revDSG) and – where territorially or materially applicable – the European General Data Protection Regulation (GDPR).

1. Controller and Contact Details

The controller responsible for data processing under data protection law is:

If you have any questions regarding data protection or wish to exercise your rights, you may contact us at any time using the details above.

2. Principles of Data Processing

We process personal data lawfully, in good faith, and transparently. Processing is purpose-bound, proportionate, and limited to what is necessary for the respective purpose (data minimization). We implement appropriate technical and organizational measures (TOMs) to safeguard the confidentiality, integrity, and availability of your data.

3. Collection and Processing of Personal Data

We collect and process personal data that you voluntarily provide to us or that is technically required when visiting our website and delivering our services.

3.1. Visiting Our Website (Server Logs, Hosting & Local Fonts)

This website is delivered via Cloudflare Pages (Cloudflare, Inc.). Lovable serves as a development tool, and Supabase serves as the backend for published blog content and its administration. Domain and DNS services are provided via Hosttech (hosttech GmbH, Switzerland). When accessing the website, infrastructure providers may process technical connection data, in particular:

• IP address of the requesting device
• Date and time of access
• Requested URL, route, and file paths
• Browser type, browser version, and operating system
• Referrer URL (previously visited page, if transmitted)

Local Web Fonts: All fonts used on this website (Inter and Space Grotesk) are hosted locally on our web server. Visiting our pages makes no connection to external font servers (such as Google Fonts).

Purpose & Legal Basis: Ensuring secure, stable, and high-performance operation of the website as well as defending against and investigating cyberattacks (legitimate interest pursuant to Art. 31 para. 1 FADP and Art. 6 para. 1 lit. f GDPR).

3.2. Contact and Consultation Forms, Email, and Telephone Communication

When you contact us via our contact or voucher/consultation forms, email, or telephone, we process the data you provide (in particular topic/category or process challenge, full name, email address, message, and optionally company, phone number, product area, or referral source; on dedicated consultation forms, company name is required).

• Processing upon Form Submission: Inquiries are transmitted in encrypted form to a Cloudflare Pages Function, stored in a private Cloudflare D1 contact database (where configured for the form) with a technical request UUID and timestamp, and forwarded to our business mailbox via the transactional email service Resend. A confirmation email is sent to the email address you provided. Cloudflare Turnstile protects the form against automated abuse and processes technical device and connection metadata for that purpose. A dedicated Cloudflare D1 protection store holds short-lived, pseudonymized technical verification and delivery status records, never the message text or submitted contact fields. Consent to optional analytics is not required to submit the contact form.
• Business Email: We use Google Workspace (Google Ireland Limited, Ireland) for our business email communication.

Purpose & Legal Basis: Processing your technical or commercial inquiry, preparing an initial consultation, process assessment, or quotation, and carrying out pre-contractual and contractual measures (Art. 31 para. 2 lit. a FADP and Art. 6 para. 1 lit. b and lit. f GDPR).

3.3. Customer Management, Project Execution & Accounting

Within customer projects (AI & Process Assessments, process solutions, automation workflows, and supply of industrial equipment and precision parts), we process contact, master, contract, project, and billing data. For quotations, invoicing, and accounting, we primarily use the Swiss business software bexio (bexio AG, Rapperswil-Jona, Switzerland) alongside internal project and documentation systems.

Purpose & Legal Basis: Contract performance, project delivery, billing, and compliance with statutory (particularly commercial and tax law) retention obligations (Art. 6 para. 1 lit. b and lit. c GDPR; Art. 31 FADP).

3.4. AI, Process, and Automation Solutions on Behalf of Customers

When we design and operate workflows, system integrations, custom applications, or AI-assisted processes for clients, data flows, models used, API interfaces, access rights, and storage locations are reviewed per project and contractually defined. For our n8n automation environment we partner with our infrastructure and operations partner philflow (server location in Germany). Where we process personal data on behalf of a client, we conclude a Data Processing Agreement (DPA / AVV) beforehand.

3.5. Newsletter & Updates (Where Used)

If you explicitly subscribe to a newsletter or mailing list, registration takes place via double opt-in (including via Brevo / Sendinblue GmbH, Germany, and n8n workflows). You may withdraw your consent at any time with effect for the future (Art. 6 para. 1 lit. a GDPR).

4. Analytics and External Links

4.1. Optional Analytics and Cookie Settings

On the live production website, we use Google Analytics 4 (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) exclusively after your explicit consent in the cookie banner. Its purpose is the statistical evaluation of public page views and fully confirmed contact inquiries. Without your consent, we do not load any analytics scripts and do not send cookieless analytics or consent pings to Google (Basic Consent Mode). On staging and preview hostnames, analytics remains disabled regardless of your selection.

Following consent, Google processes technical browser metadata and page views. Processing outside Switzerland and the EEA, in particular in the United States, is possible. We never transmit names, email addresses, phone numbers, message texts, or request IDs as analytics event parameters. URL query parameters, hashes, and original referrer URLs are stripped from the events we generate. Ad personalization and Google Signals are disabled in this integration.

Your choice is stored locally in your browser for at most 180 days, scoped by hostname and measurement ID. Cookies set by this analytics integration are host-bound and limited to a maximum lifetime of 30 days. Retention of data stored by Google is governed by the Analytics property configuration. Technically necessary security and authentication functions are strictly separated from optional analytics.

You can change or withdraw your choice at any time via “Cookie Settings” in the footer. Upon withdrawal, measurement is blocked, analytics cookies set by this integration are removed, and if measurement was previously active, the page reloads cleanly. Unsent form inputs may be lost during reload. Withdrawal takes effect for the future and does not automatically delete data already stored by Google.

4.2. External Links

• External Links (e.g., LinkedIn, Manufacturer Websites): References to external profiles (such as LinkedIn) or manufacturer websites on our pages are pure static links and not embedded social media plugins. Connection data is only transmitted to the third party when you actively click an external link.

5. Disclosure to Third Parties & Cross-Border Transfers

We do not disclose your personal data to unauthorized third parties. Data is shared solely where necessary to fulfill a contract (e.g., involving manufacturer or machining partners for specific industrial inquiries), to use contractually bound processors (IT/cloud providers such as Cloudflare, Hosttech, Lovable, Supabase, Resend, Google Workspace, bexio, philflow/n8n), based on your consent to optional analytics, or to comply with legal obligations.

International Data Transfers: Our data processing takes place primarily in Switzerland and the EU/EEA (in particular Germany and Ireland). Where individual sub-processors (e.g., cloud/infrastructure providers such as Lovable, Supabase, Resend, or Google) process data in the United States, transfers are safeguarded by the adequacy decisions under the Swiss-US Data Privacy Framework and EU-US Data Privacy Framework (DPF) or by the European Commission Standard Contractual Clauses (SCCs) including the Swiss addendum pursuant to Art. 16 para. 2 FADP and Art. 46 GDPR.

6. Data Security & Retention Period

• Data Security: We protect personal data using state-of-the-art security measures (TLS/HTTPS encryption, role-based access controls, segregated system environments).
• Retention Period: We retain personal data only as long as necessary for the respective processing purpose or as required by statutory retention periods (in Switzerland generally 10 years pursuant to Art. 958f CO for business records and accounting vouchers). Thereafter, the data is deleted or anonymized.

7. Your Rights (Data Subject Rights)

Under the Swiss Federal Act on Data Protection (FADP) and – where applicable – the GDPR, you have the following rights:

• Right of Access (Art. 25 FADP / Art. 15 GDPR): Information on whether and which personal data we process about you.
• Right to Rectification (Art. 32 FADP / Art. 16 GDPR): Correction of inaccurate or incomplete personal data.
• Right to Erasure (Art. 17 GDPR): Deletion of your data, provided no statutory retention obligations or overriding legitimate interests conflict.
• Right to Restriction of Processing (Art. 18 GDPR) as well as Right to Data Portability (Art. 28 FADP / Art. 20 GDPR).
• Right to Withdraw Consent (Art. 7 para. 3 GDPR): Revocation of any consent given at any time with effect for the future.
• Right to Object (Art. 21 GDPR): Right to object at any time, on grounds relating to your particular situation, to data processing based on legitimate interests (info@dropflow.ch).

The competent supervisory authority in Switzerland is the Federal Data Protection and Information Commissioner (FDPIC / EDÖB), Feldeggweg 1, 3003 Bern (www.edoeb.admin.ch). Data subjects in the EU/EEA may also lodge a complaint with the supervisory authority competent for their habitual residence (Art. 77 GDPR).

8. EU Representative Pursuant to Art. 27 GDPR

Where our services are offered to companies in the EU/EEA, any processing of personal data takes place exclusively in a B2B context, only occasionally, does not involve large-scale processing of special categories of data (Art. 9/10 GDPR), and is unlikely to result in a risk to the rights and freedoms of natural persons given its nature, context, scope, and purposes. dropflow GmbH therefore relies on the exemption under Art. 27 para. 2 lit. a GDPR. Please direct any inquiries from the EU directly to info@dropflow.ch.

9. Changes to This Privacy Policy

We reserve the right to update this Privacy Policy at any time to reflect changes in legal, technical, or business requirements. The version published on this page applies.