Privacy policy

1. Controller

The controller within the meaning of Art. 4(7) GDPR and the responsible body under the FADP is:

In a simple partnership the partners are jointly responsible. You can contact the email address above for all matters.

Contact persons for data protection questions: Dylan Malzach and Sophian Hardouzi. We are not legally required to appoint a data protection officer.

2. Principles

We process personal data only as far as necessary for a functioning website and for our content and services. We do not collect more data than needed, use it exclusively for the stated purposes and do not pass it on for advertising. Processing takes place only where a legal basis exists or you have given consent.

3. Processing in detail

3.1 Visiting the website (server log files)

When you visit this website, our hosting provider automatically records technical data transmitted by your browser: truncated IP address, date and time of access, page requested, amount of data transferred, browser type and operating system, and, where applicable, the page visited before.

Purpose

Delivering the website, ensuring stability and security, defending against attacks.

Legal basis

Art. 6(1)(f) GDPR: our legitimate interest in technically flawless and secure operation. Under Swiss law the processing rests on an overriding private interest.

Retention

Log files are deleted or anonymised after 30 days at the latest.

This data is not merged with other data sources and is not used to identify individual persons.

3.2 Contact form and email

If you use our contact form or write us an email, we process the details you provide. In the form we collect:

• Name: required, so that we can address you
• Email address: required, so that we can reply to you
• Company: optional
• Phone number: optional, for a quick follow-up question
• Desired package: optional, to classify your enquiry
• Message: optional free text with the details you wish to share

Form submissions run in two steps: your entries go to a small server function on our hosting (Vercel Inc., USA), which checks them and passes them on as an email to info@webvoyage.ch. That email is delivered by the email service Resend (Plus Five Five, Inc., USA). Both providers process this data on our behalf; details can be found in section 4 and, regarding transfers to the USA, in section 5.

The form also contains a helper field for spam protection that is invisible to you (a so-called honeypot field). It is filled in only by automated programs and serves solely to sort out such submissions. No personal reference arises from it, and there is nothing for you to do.

If the form cannot be sent for technical reasons, for example because the transmission fails, the site offers as a fallback a draft for your local email program with a prepared message to info@webvoyage.ch. You then decide yourself whether to send this message. In data protection terms this means: in that case your details leave your computer not via our website but via your own email provider, on whose processing we have no influence. The privacy terms of your email provider apply in that respect.

Purpose

Handling and answering your enquiry as well as carrying out pre-contractual measures and any contract performance; for the honeypot field additionally the prevention of abusive submissions.

Legal basis

Art. 6(1)(b) GDPR where the enquiry aims at concluding a contract; otherwise Art. 6(1)(f) GDPR based on our legitimate interest in answering enquiries and protecting against spam. Under Swiss law the processing rests on the contract or an overriding private interest.

Retention

We delete the data once your enquiry has been fully dealt with and no statutory retention obligations stand in the way; as a rule twelve months after the last contact at the latest. If a business relationship comes about, the commercial-law retention period of ten years applies. We delete the copy of the sent email held by the delivery service once the enquiry has reached us and been processed, at the latest after twelve months.

Transmission is encrypted via TLS. Providing the data is neither legally nor contractually required. Without name and email address, however, we cannot answer your enquiry.

3.3 Cookies and audience measurement

This website sets no cookies for analytics, marketing or tracking purposes. We create no user profiles, run no audience measurement and embed no advertising networks. A consent request (cookie banner) is therefore not required.

Nor do we use your browser’s local storage (localStorage or sessionStorage) for analytics, marketing or tracking. No data that would make you recognisable is stored there. Should we use cookies or comparable techniques requiring consent in future, we will set up a consent request beforehand and update this policy.

Retention

Since neither cookies nor local storage are used for these purposes, no such data arises and no retention periods apply.

3.4 Fonts

This website uses the typefaces Bricolage Grotesque, JetBrains Mono and Manrope. The font files are stored locally on our own hosting and delivered from there together with the site. No connection to servers of Google or other third parties is established when the site is loaded; in particular, your IP address is not transmitted to Google Fonts or any other font provider. Consent is therefore not required for displaying the fonts.

These typefaces are licensed under the SIL Open Font License and may be self-hosted in accordance with that licence.

Purpose

Consistent and accessible rendering of the typefaces.

Legal basis

Art. 6(1)(f) GDPR: legitimate interest in a consistent presentation of our website. No data beyond the server log files described in section 3.1 arises.

Retention

No data is transmitted to third parties; for retrieval of the font files from our server the periods of the server log files under section 3.1 apply (deletion or anonymisation after 30 days at the latest).

3.5 Social media and external links

In the footer of this website we link to our profile on Instagram (instagram.com/webvoyage.ch). This is a plain reference in the form of a hyperlink, not an embedded widget, feed or button of the provider. As long as you do not click the link, no data is transmitted to Meta when you merely visit our site.

Only when you click the link do you leave our website and open a service of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland. From that moment Meta’s privacy terms apply exclusively; we have no influence on the processing there, such as the recording of your IP address or the association with an existing account. Information is available in Meta’s privacy policy at privacycenter.instagram.com/policy.

The demo websites in the References section are plain references as well: the preview images are stored on our hosting, and only a click leads to the demo’s own address. The operators of external websites are solely responsible for their content. The same applies to further external links we may set in future.

Purpose

Reference to our presence on Instagram and to our demo websites.

Legal basis

Art. 6(1)(f) GDPR: legitimate interest in presenting our company. The respective operator is responsible for processing after the click.

Retention

We store no data in this context; no retention periods apply on our side.

4. Recipients and processors

We pass on personal data only where necessary to provide our services, where you have consented, or where we are legally obliged to. Data is not sold. The following list names every service provider we actually use for this website. Beyond that we embed no further services, in particular no analytics, tracking or advertising services, no newsletter software and no embedded third-party maps or videos. The images, fonts and scripts of the start page are stored as files on our own hosting.

4.1 Hosting and receipt of the form

Purpose

Operation and delivery of this website, server log files, and receipt and checking of enquiries from the contact form by a server function.

Provider

Vercel Inc.

Registered office

440 N Barranca Avenue #4133, Covina, CA 91723, USA.

Legal basis

Art. 6(1)(f) GDPR: legitimate interest in secure and reliable operation; for form enquiries with a contractual context additionally Art. 6(1)(b) GDPR. On transfers to the USA see section 5; Vercel is certified under the EU-U.S. Data Privacy Framework.

Contract

Data processing agreement under Art. 28 GDPR obliging the provider to confidentiality and appropriate security measures.

4.1a Delivery of form enquiries

Purpose

Delivery of the email generated from the contact form to info@webvoyage.ch. The form details listed in section 3.2 are transmitted; the service logs the delivery.

Provider

Resend (Plus Five Five, Inc.)

Registered office

2261 Market Street #5039, San Francisco, CA 94114, USA.

Legal basis

Art. 6(1)(b) GDPR for enquiries with a contractual context, otherwise Art. 6(1)(f) GDPR: legitimate interest in reliable delivery. On transfers to the USA see section 5.

Contract

Data processing agreement under Art. 28 GDPR incorporating the European Commission's standard contractual clauses.

4.2 Email mailbox

Messages to info@webvoyage.ch are handled via the email provider that hosts our mailbox. This provider processes the content and metadata of your messages on our behalf and solely for the purpose of email delivery and storage. We keep the details of provider and registered office up to date and will name them on request at any time; please contact the address given in section 1.

Purpose

Receiving, sending and storing our business email correspondence.

Provider and office

The provider of our email mailbox; we will name the specific company and its registered office on request.

Legal basis

Art. 6(1)(b) GDPR for contract-related correspondence, otherwise Art. 6(1)(f) GDPR: legitimate interest in functioning business communication.

Contract

Where the provider processes data on our behalf, a data processing agreement under Art. 28 GDPR is in place.

If you write to us through your own email program, including via the fallback described in section 3.2, your own email provider is additionally involved in the transmission. Its processing lies outside our sphere of influence.

5. Transfers to third countries

In the course of hosting, data may be transferred to the USA. For the USA an adequacy decision of the European Commission of 10 July 2023 exists (EU-U.S. Data Privacy Framework); the Swiss Federal Council has issued a corresponding recognition for the Swiss-U.S. Data Privacy Framework. It applies to companies certified under the framework.

In addition, we base transfers on the standard contractual clauses of the European Commission under Art. 46(2)(c) GDPR. Despite these guarantees, it cannot be completely ruled out that authorities in third countries access data. You can request a copy of the guarantees from us.

6. Retention and deletion

We keep personal data only as long as necessary for the respective purpose or as required by statutory retention obligations. The specific periods are stated for each processing activity in section 3; the following overview summarises them:

Server log files

Deletion or anonymisation after 30 days at the latest (section 3.1).

Contact form and email

Deletion after your enquiry has been fully dealt with, as a rule twelve months after the last contact at the latest; ten years under commercial-law retention obligations in the case of a business relationship (section 3.2).

Cookies and local storage

Not used, therefore no retention periods (section 3.3).

Fonts

No transmission to third parties; only the periods for server log files apply (section 3.4).

Social media and external links

No storage on our side (section 3.5).

Where data is no longer required for its original purpose but still covered by a retention obligation, we restrict its processing and delete it once the period has expired. Backup copies are overwritten in the usual rotation.

7. Your rights

Under the GDPR and the FADP you have the following rights:

• Access (Art. 15 GDPR) to the data we process
• Rectification (Art. 16 GDPR) of inaccurate or incomplete data
• Erasure (Art. 17 GDPR), unless retention obligations stand in the way
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR) in a common, machine-readable format
• Objection (Art. 21 GDPR) to processing based on legitimate interest
• Withdrawal of consent (Art. 7(3) GDPR) with effect for the future

An informal message to info@webvoyage.ch is sufficient to exercise these rights. In case of reasonable doubt about your identity we may request proof. Handling is free of charge for you.

We usually answer your request within one month of receipt (Art. 12(3) GDPR). If your request is particularly complex or several requests are pending, we may extend this period by up to two further months; we will inform you of the extension within one month, stating the reasons.

Right to lodge a complaint

Independently of this, you have the right to lodge a complaint with a supervisory authority. In Switzerland this is the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern. If you reside in the EU, you may contact the supervisory authority of your member state under Art. 77 GDPR.

8. No automated decision-making

We use no automated decision-making and no profiling within the meaning of Art. 22 GDPR.

9. Data security

This website is delivered exclusively encrypted via HTTPS. We take appropriate technical and organisational measures under Art. 32 GDPR to protect your data against loss, misuse and unauthorised access. Complete protection during transmission over the internet is, however, not possible.

10. Changes to this policy

We adapt this privacy policy when our services, the services we use or the legal requirements change. The version published on this page at the time applies.

Version: September 2026