Privacy notice

1. Who is responsible

Marvin Kiefer, trading as Swiss Web Development Kiefer, is the controller for the processing described here. You can send data-protection requests to the postal or email address above. This notice covers this website and enquiries to our studio. Separately linked products and services may have their own privacy notices.

2. Visiting the website

Vercel delivers the website and processes technical request data, such as your IP address, requested URL, time of access, browser and operating-system information, referring page where transmitted, and response or error information. This is needed to deliver pages, handle requests, diagnose faults and protect the service against misuse. An IP address can constitute personal data.

Fonts and portfolio images are served with this website. Loading a page does not require a separate Google Fonts request, embedded video player or social-media widget. We do not integrate advertising pixels, behavioural analytics, a newsletter subscription or a CRM into this website.

3. Contact enquiries

The contact form processes your name, email address, optional company name, message and selected language. We use these details to understand and answer your enquiry and, where appropriate, prepare or carry out a project. Required fields are marked; you can instead contact us by email or post.

The form is processed on Vercel and sent through Resend to our business mailbox at Google Workspace/Gmail. Resend also sends a receipt acknowledgement to the address you provide. Resend and Google therefore process message content, sender and recipient details, and technical delivery data. The website does not maintain a separate enquiry database.

A hidden form field helps reject automated spam. We do not use a third-party CAPTCHA. Please do not send passwords, payment-card details or unnecessary sensitive personal information in an enquiry. Contact details are not automatically added to a marketing list.

4. Language choice and cookies

An explicit /en or /de URL determines the page language. On an unprefixed URL, we use a previously saved language choice, then the approximate country supplied by the hosting service from the connection, or your browser’s language settings. We do not request GPS access or create a location history.

Choosing a language in the header stores the first-party cookie swisswebdev-language with the value en or de for one year. It is used only to remember this preference and contains no unique visitor identifier. It is not required to read the site through the language-specific URLs.

You can delete the preference below or block/delete cookies in your browser settings. Deleting it does not change the language of the page you are currently reading. On a later visit to an unprefixed URL, automatic language detection applies again. Selecting a language in the header will save a new preference. We do not set advertising or analytics cookies.

5. Providers and recipients

We use these services for the purposes described above. Providers may use authorised subprocessors for parts of their service. Data may also be disclosed where a legal obligation requires it, or where necessary to establish, exercise or defend legal claims. We do not sell your personal data.

• Vercel Inc. (United States): website hosting, delivery, request processing, technical logs and security. Server-side processing takes place in the United States. Vercel also operates a global delivery network.
• Resend / Plus Five Five, Inc. (United States): delivery of enquiries and receipt emails, including message and delivery data. Resend identifies the United States as its primary processing location.
• Google Workspace/Gmail: receiving, storing and answering business emails. Google and its service providers may process email data outside Switzerland, including in the United States and Ireland. The linked Workspace list identifies further processing countries and activities.
• Hostinger: domain registration and DNS administration. Our domain uses Hostinger’s DNS nameservers. DNS services handle technical domain-resolution requests; they do not receive the contents of the contact form through our application. Hostinger’s notice names Cyprus, Lithuania, the Netherlands and the United Kingdom among its processing locations.

• Vercel
• Resend
• Google Workspace
• Hostinger

6. Processing outside Switzerland

Your data is not processed exclusively in Switzerland. The United States is involved in hosting and email delivery. Google’s international infrastructure and Vercel’s delivery network can involve additional countries. The provider information linked below specifies their processing locations, subprocessors and activities; these lists form part of the information about the services used here.

Swiss law permits disclosure to countries with an adequate level of data protection or on the basis of appropriate safeguards or a statutory exception. The published Vercel, Resend and Google data-processing terms provide for standard contractual clauses for relevant international transfers; Resend expressly includes Swiss adaptations. A provider’s certification or the availability of contract terms does not mean that all processing takes place in Switzerland. Contact us for information about the safeguards relevant to your data or a copy, subject to necessary redactions.

• Vercel — Data Processing Addendum
• Vercel — Network & regions
• Vercel — Subprocessors
• Resend — Data Processing Addendum
• Resend — Subprocessors
• Google Workspace — Subprocessors & countries

7. How long data is kept

We keep enquiries and correspondence for as long as needed to handle the matter, carry out a resulting engagement, comply with applicable retention duties or establish, exercise or defend legal claims. When these purposes no longer apply, we delete or anonymise the data. Retention of provider logs, delivery records and backups depends on the service settings, operational and security needs, and the provider’s deletion cycles. You can request information about the retention period or criteria relevant to your data.

Where records qualify as accounting records or supporting documents subject to Article 958f of the Swiss Code of Obligations, the retention period is ten years from the end of the financial year. This does not make every contact enquiry an accounting record. The language cookie expires after one year unless you delete or renew it earlier.

8. Applicable rules and security

We process personal data under the Swiss Federal Act on Data Protection (FADP/DSG), including the principles of transparency, proportionality, purpose limitation and data security. Where processing requires a justification, this may be consent, an overriding private or public interest, or a statutory basis.

Where the GDPR applies to a particular activity, enquiry and contract processing is based on Article 6(1)(b), legal obligations on Article 6(1)(c), necessary and proportionate operational or security interests on Article 6(1)(f), and processing that requires consent on Article 6(1)(a). This notice itself is not a request for consent.

The public website uses HTTPS. Access to enquiry data is restricted to the people and service providers who need it for the purposes described. Ordinary email is not guaranteed to be end-to-end encrypted. We do not make solely automated decisions producing legal effects or similarly significant effects on visitors.

9. Your rights

You may request information about whether and how we process your personal data, ask for inaccurate data to be corrected, and request deletion or that processing cease where the legal conditions are met. You may withdraw consent for future processing where consent is the basis. Retention duties and other lawful grounds can limit a deletion request.

• Data portability applies under the conditions in Articles 28–29 FADP, including automated processing of data you provided based on consent or in direct connection with a contract. It is not an unrestricted right to export every record.
• Access requests are generally answered free of charge within 30 days. If a permitted exception, restriction or delay applies, we explain it and, where relevant, tell you when to expect the information. We may request proportionate evidence of identity to avoid disclosing data to the wrong person.
• Where the GDPR applies, its additional rights, including objection, restriction and the right to complain to the competent supervisory authority, remain available under their respective conditions.

• Contact the Federal Data Protection and Information Commissioner (FDPIC)

10. Contact and updates

Please contact marvin.kiefer@swisswebdev.ch or the postal address above with questions or to exercise your rights. You can also report a data-protection concern to the FDPIC and seek protection through the competent courts. The date at the top shows when this notice was last updated. If our processing changes, we will update the notice and provide any additional information required by law.