Privacy Policy

This Privacy Policy explains how greyw (the "Company", "we", "us", or "our") processes personal data of visitors to and users of the website and associated services (together, the "Platform"). It is prepared having regard to the Swiss Federal Act on Data Protection (the "FADP") and its Ordinance. Where the Platform is accessed from outside Switzerland, additional or differing rights may be available to you under the law of your own jurisdiction, and nothing herein is intended to derogate from any such right.

1. Identity of the Controller

1. The controller responsible for the processing of personal data described in this Policy (the "Controller" for the purposes of the FADP) is the Company, contactable via the details published on the Platform.
2. Where the Company does not maintain a domicile or establishment in Switzerland but processes personal data having an effect in Switzerland within the meaning of Article 3 FADP, it shall, where required, appoint a representative in Switzerland and shall publish that representative's details on the Platform.

2. Personal Data We Process

The categories of personal data processed in connection with the Platform, and their respective sources, are set out below.

We do not knowingly process special categories of personal data (within the meaning of Article 5(c) FADP, including data concerning religious, ideological, political, or trade-union views, health, intimate sphere, or racial or ethnic origin) save to the limited extent that a User voluntarily discloses such information within free-text fields, which we do not solicit and do not use for profiling.

3. Purposes and Legal Basis for Processing

1. We process the personal data described above for the following purposes: to create and administer your Account; to provide, maintain, and improve the Platform and its underlying database; to respond to enquiries and correspondence; to maintain the security and integrity of the Platform, including the detection and prevention of unauthorised access; and to comply with our legal obligations.
2. Unlike certain other data protection regimes, the FADP does not require the Controller to identify a specific enumerated legal basis for each processing activity provided the processing does not unlawfully infringe the personality rights of the data subject under Article 30 of the Swiss Civil Code. Processing is nonetheless carried out only to the extent necessary for the purposes stated above, in a manner proportionate to those purposes, and, where consent is the operative justification for a particular activity (for example, non-essential cookies), such consent is sought freely, specifically, and on an informed basis, and may be withdrawn at any time with future effect.

4. Disclosure of Personal Data

1. We do not sell personal data. We may disclose personal data to: service providers engaged to host, maintain, or support the Platform's technical infrastructure, acting as processors under our instruction; professional advisers, where reasonably necessary; and any competent authority, where disclosure is required by Applicable Law or a valid order of a court or regulator.
2. Any processor engaged by us is contractually bound to process personal data solely in accordance with our instructions and to apply security measures no less stringent than those required of the Company itself.

5. Cross-Border Transfers

1. Where personal data is transferred to a recipient located outside Switzerland, we shall ensure that such transfer takes place either to a jurisdiction recognised by the Swiss Federal Council as affording an adequate level of data protection, or subject to appropriate safeguards recognised under Article 16 FADP, such as standard contractual clauses incorporating the Swiss-specific amendments required for their use in this context.
2. Where such safeguards cannot reasonably be implemented, we shall rely only on a derogation expressly permitted under Article 17 FADP, such as your explicit consent to the transfer having been informed of the attendant risk.

6. Retention

1. We retain personal data only for so long as is necessary for the purposes set out in clause 3, or for such longer period as may be required to comply with a legal or regulatory retention obligation, to resolve a dispute, or to enforce our agreements. Account data is generally retained for the duration of the Account's existence and for a limited period thereafter to permit reactivation and to satisfy residual legal obligations, following which it is deleted or irreversibly anonymised.

7. Security

1. In accordance with Article 8 FADP, we implement technical and organisational measures proportionate to the risk presented by our processing activities, including encryption of passwords by way of a one-way hashing algorithm, access controls restricting internal access to personal data on a need-to-know basis, and periodic review of our security practices.
2. No system of transmission or storage can be guaranteed to be entirely secure. In the event of a personal data breach likely to result in a high risk to your personality or fundamental rights, we shall notify the Federal Data Protection and Information Commissioner and, where required, the affected data subjects, without undue delay, in accordance with Article 24 FADP.

8. Your Rights

Subject to the conditions and limited exceptions set out in the FADP, you have the following rights, each exercisable free of charge save in cases of manifestly unfounded or excessive requests:

1. Right of access (Article 25 FADP): to obtain confirmation as to whether we process personal data concerning you, and, where we do, to receive the information prescribed by Article 25(2), including the purposes of processing, the retention period or criteria used to determine it, and, where applicable, the recipients or categories of recipient of that data.
2. Right to data portability (Article 28 FADP): to receive personal data you have provided to us in a commonly used electronic format, or to request its direct transmission to another controller, where technically feasible, in respect of data processed by automated means on the basis of your consent or in connection with a contract with you.
3. Right to rectification (Article 32(1) FADP): to request the correction of personal data concerning you which is inaccurate.
4. Right to erasure or restriction (Article 32(2) FADP): to request the destruction or blocking of personal data processed unlawfully or otherwise than in accordance with the purposes for which it was collected.
5. Right in relation to automated individual decisions (Article 21 FADP): where a decision producing legal effects concerning you, or significantly affecting you, is made solely on the basis of automated processing, to request that the decision be reviewed by a natural person, save where you have given express consent to fully automated decision-making or where such review is not required by Applicable Law. For the avoidance of doubt, the Platform does not, as at the date of this Policy, make any decision of this nature.

Requests may be submitted using the contact details in clause 10 below. We shall respond within thirty (30) days, or, in the case of a complex request, within a reasonable extended period not exceeding three (3) months, having first notified you of the reason for the extension. We may decline a request, or limit its scope, on the grounds set out in Article 26 FADP, including where an overriding interest of a third party or a statutory duty of confidentiality so requires, and shall explain our reasons for doing so save where Applicable Law permits us not to.

9. Cookies and Similar Technologies

1. We use strictly necessary cookies to maintain your session and Account authentication. We do not currently deploy non-essential cookies for advertising purposes; should this change, we shall obtain your prior consent in accordance with clause 3.2 and update this Policy accordingly.

10. Contact and Complaints

1. Enquiries or requests concerning this Policy or the exercise of your rights should be directed to the Company via the contact details published on the Platform.
2. Should you consider that our processing of your personal data infringes Applicable Law, you have the right to lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC), or, where you are resident outside Switzerland, with the competent supervisory authority of your own jurisdiction, without prejudice to any other administrative or judicial remedy available to you.

11. Amendment

1. We may amend this Policy from time to time to reflect changes in our processing activities or in Applicable Law. Material amendments shall be notified by way of a prominent notice on the Platform prior to taking effect. The date of last revision appears at the head of this Policy.