Privacy Policy

This policy covers the website softium.ch only: visiting it and writing to us through its contact form. It is governed by the Swiss Federal Act on Data Protection (FADP) and, where it applies, the EU General Data Protection Regulation (GDPR).

Our products have their own privacy policies, for example the Polymorfa Privacy Policy.

When you load a page, your browser sends technical data to the servers that deliver the website. Our hosting provider processes it to deliver the page and to keep the service secure and working:

• your IP address;
• the date and time of the request and the page requested;
• your browser’s user agent and the referring page, if your browser sends it.

This data appears in short-lived server logs. We do not use it to identify you or to build profiles, and we do not combine it with other data.

The website sets no cookies and uses no analytics, advertising or tracking tools. It stores nothing on your device.

Our fonts are served from our own domain, so loading a page does not send requests to Google or any other font provider.

When you use the contact form, we process:

• the name, email address and message you enter;
• your IP address, which we use in memory to limit the number of messages that can be sent in a short time and include in the email we receive so we can recognise abuse.

We use this data only to read and answer your message and to protect the form against abuse. The form is sent to us as an email. Please do not include sensitive personal data (for example, about health or religion) in your message unless it is needed for your request.

If your message concerns one of our products, for example a privacy request about Polymorfa, we handle it under that product’s privacy policy.

Swiss law does not require a legal basis for each use of personal data, but we follow the principles of the FADP. Where the GDPR applies, we rely on:

• Article 6(1)(b) GDPR, steps at your request before entering into a contract, when your message is about working with us;
• Article 6(1)(f) GDPR, our legitimate interests in answering enquiries, running a secure and reliable website and preventing abuse.

We use the following service providers, who process data on our behalf and under our instructions:

• Vercel Inc. (United States): hosting and delivery of the website, including server logs;
• Resend (United States): delivery of contact-form messages to our inbox;
• Google Workspace (Google): the email service where we receive and answer messages.

Some of these providers process data in the United States or other countries whose laws may not offer the same level of protection as Switzerland. Where that is the case, we rely on an adequacy decision of the Swiss Federal Council (such as the Swiss–US Data Privacy Framework for certified companies) or on the standard contractual clauses recognised by the Federal Data Protection and Information Commissioner (FDPIC) and the European Commission.

We do not sell personal data, and we do not share it for advertising.

• Server logs at our hosting provider are kept for a short time, as set by the provider, and then deleted.
• Rate-limiting data is held only in memory for a few minutes and is never written to disk by us.
• Messages you send us are kept as long as needed to deal with your request, and deleted no later than 24 months after our last exchange, unless we need to keep them longer for legal reasons or because they led to a contract.

The website is served only over encrypted connections (HTTPS). We take appropriate technical and organisational measures to protect personal data against loss and unauthorised access, and give access only to people who need it.

Under the FADP and, where it applies, the GDPR, you have the right to:

• ask whether we process your personal data, and get a copy of it;
• have incorrect data corrected;
• have your data deleted, or its processing restricted;
• object to processing based on our legitimate interests;
• receive data you gave us in a common electronic format (data portability).

To exercise a right, contact us using the details under “Who is responsible” above. We may ask you to prove your identity. We answer within 30 days.

You can also complain to a supervisory authority. In Switzerland, that is the Federal Data Protection and Information Commissioner (FDPIC). In the EU or EEA, you can contact the authority in the country where you live or work.

We do not make automated individual decisions or carry out profiling on this website.

We update this policy when the website or the law changes. The current version is always on this page, with its effective date at the top.