Privacy Policy

1. Controller

The controller responsible for data processing is:

privacy@axtero.com

2. Collection and Processing of Personal Data

We collect personal data in the following cases:

• • When you visit our website (technical data such as IP address, browser type, access times)
• • When you use our contact form or send us an email (name, email address, number of devices, message content), which we store in our customer relationship management system
• • When you subscribe to our newsletter (email address)
• • When you book a consultation or discovery call (name, email, company, phone number)
• • When you use our services (project-related data as agreed in individual contracts)
• • From third-party business information providers, professional information about you such as job title, role and employer, added automatically to a contact record we already hold
• • From business information providers, the contact details of people at companies we may wish to work with, including name, role, company and business email address, where those people have not approached us themselves

Data entered before a form is sent

When you type an email address into one of our forms, it is stored on our servers before you send the form, so that we can restore your entry if the page is interrupted. We use it for nothing else. If you do not send the form, the entry is deleted automatically within 24 hours and nobody at Axtero contacts you on the basis of it. If you do send the form, it becomes part of your enquiry and the retention period in section 6 applies.

3. Purposes and Legal Bases

We process your personal data for the following purposes:

• • Provision and optimization of our website (legitimate interest, Art. 6(1)(f) GDPR)
• • Responding to inquiries and providing customer support (contract performance, Art. 6(1)(b) GDPR)
• • Sending newsletters and marketing communications (consent, Art. 6(1)(a) GDPR)
• • Fulfillment of contractual obligations (contract performance, Art. 6(1)(b) GDPR)
• • Compliance with legal obligations (legal obligation, Art. 6(1)(c) GDPR)
• • Understanding who we are dealing with and preparing a useful reply, by adding professional information from third-party business information providers (legitimate interest, Art. 6(1)(f) GDPR, Art. 31 FADP)
• • Identifying businesses that may need our services and approaching them (legitimate interest, Art. 6(1)(f) GDPR, Art. 31 FADP)

4. Cookies and Tracking Technologies

Our website uses strictly necessary first-party cookies for core functionality, such as your language preference and content preview. It also uses Google advertising and analytics cookies, but only if you accept them in the banner shown on your first visit. If you decline, or make no choice, no advertising or analytics cookies are set.

Vercel Analytics is cookieless and collects no personal data. Google Analytics and Google Ads are governed by Google Consent Mode: consent for advertising storage, advertising user data, advertising personalisation and analytics storage all default to denied, and only change if you accept. We use these to measure which searches and pages bring visitors to the site, so that advertising spend goes where it works. You can change your choice at any time by clearing this site's data in your browser. Third-party content such as the HubSpot booking calendar loads automatically only if you accepted in the banner. If you declined, or have not chosen, it loads only after you click to load it.

5. Data Transfer

Your personal data may be transferred to the following categories of recipients:

• • Hosting providers (for website operation)
• • Email service providers (for communication)
• • Cookieless analytics (Vercel Analytics, no personal data collected)
• • Customer relationship management and booking calendar (HubSpot, where the enquiries you send us and our correspondence with you are stored, and whose booking calendar is loaded only with your consent)
• • Business information providers (HubSpot's enrichment service, including its Clearbit brand, which supplies the professional information described in section 9)

Where data is transferred outside the EEA or Switzerland, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses or adequacy decisions. HubSpot is based in the United States, is certified under the Swiss-US Data Privacy Framework, and additionally relies on Standard Contractual Clauses approved by the European Commission and the Swiss authorities.

6. Storage Duration

We store your personal data only for as long as necessary to fulfill the purposes described in this policy, or as required by law. Specific retention periods:

• • Website access logs: 90 days
• • Contact form inquiries: duration of the business relationship plus statutory retention periods
• • Newsletter subscriptions: until you unsubscribe
• • Contractual data: 10 years after end of contract (statutory retention obligation)

7. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include encryption of data in transit (TLS/SSL), regular security updates, and access controls.

8. Obligation to Provide Data

The provision of personal data is neither legally nor contractually required. However, without certain data (such as contact information), we may not be able to provide our services or respond to your inquiries.

9. Profiling and Automated Decision-Making

We carry out profiling within the meaning of Art. 5 of the Swiss Federal Act on Data Protection. Where we hold a contact record for you, professional information about you, such as your job title, your role and your employer, may be added to it by our customer relationship management system. That information comes from third-party business information providers and not from you. It can happen whatever brought the record into being, whether you wrote to us, booked a meeting with us, or your details reached us as part of a list we obtained, and it does not happen to every record. We use the information to understand who we are dealing with and to prepare a useful reply. This is not high-risk profiling, because it does not combine data in a way that would allow an assessment of essential aspects of your personality, and we make no automated decisions about you that produce legal effects or similarly significantly affect you. You can object at any time under section 10, and we will then remove the added information from your record.

10. Rights of Data Subjects

Under applicable data protection law, you have the following rights:

• • Right of access: You may request information about your personal data we process
• • Right to rectification: You may request correction of inaccurate data
• • Right to erasure: You may request deletion of your data under certain conditions
• • Right to restriction: You may request restriction of processing
• • Right to data portability: You may request your data in a machine-readable format
• • Right to object: You may object to processing based on legitimate interests
• • Right to withdraw consent: You may withdraw consent at any time without affecting the lawfulness of prior processing

To exercise your rights, please contact us at privacy@axtero.com.

You also have the right to lodge a complaint with the competent supervisory authority (in Switzerland: the Federal Data Protection and Information Commissioner, FDPIC).

11. Amendments

We reserve the right to amend this privacy policy at any time. The current version is always available on our website. We encourage you to review this policy periodically.