Privacy
This website collects very little. This page says exactly what, why, who else is involved, how long we keep it, and what you can ask of us.
The controller for personal data processed through this website is:
Envisma GmbHEnvisma GmbH is a Swiss company. The Swiss Federal Act on Data Protection (FADP) applies to all processing described here. Where we offer our services to companies in the European Union, the European Economic Area or the United Kingdom, the EU General Data Protection Regulation (GDPR) and the UK GDPR apply as well. We have written this policy to meet all of them. We have not appointed a data protection officer, because the nature and scale of our processing do not require one.
Our hosting provider, Infomaniak Network SA in Geneva, Switzerland, records standard server logs for every request: your IP address, the time, the page requested, the browser and operating system reported by your device, and the referring page, if any. These logs exist to run the site securely, to detect and defend against attacks, and to diagnose faults. They are retained by Infomaniak for a limited period defined in its own privacy policy and then deleted. We do not use them to identify or profile visitors.
Legal basis (GDPR): our legitimate interest in operating a secure website, Art. 6(1)(f).
If you use the form on the contact page, we receive the name, work email address, company, role and message you enter. The message is delivered by email to our inbox and we use it solely to answer your enquiry and, if it leads to a conversation, to prepare and conduct that conversation. We do not add you to any mailing list.
To stop automated abuse of the form, two technical measures run alongside it:
Legal basis (GDPR): steps at your request prior to entering into a contract, Art. 6(1)(b), for handling your enquiry; our legitimate interest in preventing spam and abuse, Art. 6(1)(f), for the technical measures.
Our printed brochure carries a link to a product video that is reserved for invited companies. To watch it you enter your company email address, and we send a one-time access code to that address. We record the email address, the time, your IP address and your browser's identification string each time a code is requested and each time the video is played. Access is restricted by a list of invited companies' email domains, not of individual people; we also record addresses that were refused because their domain is not on that list. We use this information to control access to confidential material and to know which invited companies have viewed it, so that we can follow up on our conversations. Access codes expire after ten minutes and are stored only in hashed form.
Legal basis (GDPR): our legitimate interest in protecting confidential material and in following up with companies we are in discussion with, Art. 6(1)(f); where you have asked us for the preview, steps prior to a contract, Art. 6(1)(b).
If you write to us or we hold a call or meeting, we keep the correspondence, the contact details you give us and notes of what was discussed, for as long as needed to pursue the matter. This is ordinary business correspondence and is handled in our company mailboxes, as described in section 4.
We approach companies that we believe could use our products, and we hold contact details of people at those companies who have not written to us first: typically name, role, company and work contact details such as a business email address, telephone number and office address. These details come from meetings at trade fairs and conferences, from business cards and introductions, from referrals by partners and customers, from professional networks such as LinkedIn, and from companies' own websites. We hold them for business development: to introduce ourselves, to send material such as our brochure, and to arrange and follow up on conversations. If we contact you on this basis, our first message will point you to this policy so that you know where your details came from.
You can object to being contacted at any time, by replying to any message or by emailing info@envisma.com, and we will stop. To make sure we do not contact you again by mistake, we then keep your name and address on a small suppression list and nothing else.
Legal basis (GDPR): our legitimate interest in developing business with companies in our field, Art. 6(1)(f). Your interests are protected by the limited, work-related nature of the data and by your unconditional right to object.
When your company is our customer, we keep the contact details of the people we work with there, our correspondence, meeting notes, and the records of orders, deliveries, support and invoicing. We use them to deliver and support our products and services, to manage the contract, and to meet our accounting and tax obligations.
Legal basis (GDPR): our legitimate interest in managing our relationship with your company, Art. 6(1)(f); our legal obligations to keep business records, Art. 6(1)(c).
We share personal data only with service providers that process it on our instructions and under a data processing agreement, and only to the extent needed for the purposes above:
| Provider | Role | Location |
|---|---|---|
| Infomaniak Network SA | Web hosting, server logs, sending of contact-form and access-code emails | Switzerland |
| Cloudflare, Inc. | Turnstile human-verification on the contact page | USA (see section 5) |
| Microsoft Ireland Operations Ltd. | Company mailboxes and calendars (Microsoft 365), including the inbox that receives contact-form messages | European Union |
We disclose personal data to authorities only where the law obliges us to. We do not transfer it to anyone else.
Our site and its data are hosted in Switzerland, which the European Commission recognises as providing adequate data protection, and the EU and EEA are recognised as adequate by Switzerland. The one transfer to a third country is to Cloudflare in the United States for the Turnstile check. Cloudflare is certified under the EU-US Data Privacy Framework and its Swiss-US extension, which the European Commission and the Swiss Federal Council recognise as providing adequate protection; in addition, Cloudflare's data processing terms incorporate the EU Standard Contractual Clauses as a fallback.
| Data | Retention |
|---|---|
| Server logs (Infomaniak) | Limited period set by Infomaniak, then deleted |
| Hashed IP for contact-form rate limiting | One hour, deleted automatically |
| Contact-form messages and the correspondence that follows | Until your enquiry is dealt with and for up to 3 years after our last exchange, the same period as for other business contacts. If a business relationship follows, see "Customer correspondence and records". |
| Business contacts and prospects (section 3.5) | Up to 3 years after our last contact with you, then deleted; immediately on objection, apart from the suppression list |
| Customer correspondence and records (section 3.6) | For the duration of our business relationship and for 10 years after it ends, in line with Swiss rules on business records and the limitation period for contract claims |
| Video preview access log | 12 months, after which entries are deleted automatically |
| Video access codes and request counters | 10 minutes for codes, one hour for counters |
Under the FADP and, where it applies, the GDPR, you have the right to:
To exercise any of these, email info@envisma.com from the address concerned, or write to the postal address in section 1. We answer within 30 days and may ask you to confirm your identity where the request concerns data we cannot otherwise attribute to you. There is no charge.
You also have the right to complain to a supervisory authority: in Switzerland the Federal Data Protection and Information Commissioner (FDPIC), in the EU or EEA the authority of the country where you live or work, and in the UK the Information Commissioner's Office.
The site is served only over HTTPS. Form data travels encrypted to our server and onward to our mailbox over encrypted, authenticated SMTP. IP addresses used for rate limiting are stored only as hashes. The video preview file and its access log are kept outside the public web space and can be reached only through the access check described above. Access to our systems is limited to the people who need it.
Our pages link to partner and supplier websites. Once you follow such a link, that site's own privacy policy applies, and we have no influence over what it collects.
We update this policy when our processing or the law changes. The date at the top shows the current version. Material changes to how we handle data you have already given us will be communicated to you directly where we can.