Privacy policy

Scope

This policy applies to your visit to the website glattdigital.ch, including booking a call, and to the initiation and performance of services by Glatt Digital GmbH. HeySali is a brand of Glatt Digital GmbH and operates as a separate platform at heysali.ch. Use of that platform is governed exclusively by the privacy policy published there.

Controller

For privacy questions and to exercise your rights, write to hello@glattdigital.ch.

Legal basis

We process personal data under the Swiss Federal Act on Data Protection (FADP). Where the EU General Data Protection Regulation (GDPR) applies to a particular processing activity, for example because you are located in the EU or EEA, we rely on the following legal bases:

• Initiation and performance of a contract (Art. 6(1)(b) GDPR): booking a call, answering enquiries, concluding and performing a mandate or project.
• Consent (Art. 6(1)(a) GDPR): analytics and marketing cookies, and further communications you opt into in the booking form. You may withdraw consent at any time with effect for the future.
• Legitimate interests (Art. 6(1)(f) GDPR): secure operation of the website, protection against abuse, maintaining our business contacts, asserting claims.
• Legal obligations (Art. 6(1)(c) GDPR): retention of business records.

What data we process

The website runs on a server in Switzerland that we operate ourselves. When you open this website, your browser transmits technical information that the web server records in server logs. This includes your IP address, the date and time of access, the page requested, your browser type and operating system. We use this solely to operate the site securely and to investigate faults. We do not combine it with other data sources and we build no user profiles from it. The logs are deleted on a rolling basis. If you open the home page with a browser set to English, we redirect you to the English version and set the cookie i18n_redirected (valid for one year) so that this does not happen on every visit. The language switcher itself sets no cookie.

Name resolution (DNS) for glattdigital.ch is handled by Cloudflare, which does no more than return the address of our server; the website's traffic does not pass through Cloudflare.

Cookies and analytics

On your first visit a banner asks whether you allow statistics and marketing cookies in addition to the essential ones. Your choice is stored only in your browser and is not sent to us; you can change it at any time via "Cookie settings" in the footer, the cookie icon at the bottom left or the button below. Until you decide, or if you allow essential cookies only, the website loads no scripts from Google or HubSpot.

• Essential, always on: the cookie i18n_redirected (one year), only if your browser prefers English and we therefore redirected you from the home page to the English version; your cookie choice in the browser's local storage, until you delete it or we ask you again; Cloudflare Turnstile on the booking page, which sets no cookie on glattdigital.ch (see "Booking a call").
• Statistics, only with your consent: Google Analytics 4, loaded via Google Tag Manager. Google measures which pages are viewed and whether a booking is made; the statistics transmit no names or contact details (for the exception under marketing, see below). Cookies: _ga and _ga_* (up to two years). Provider: Google Ireland Limited, Dublin; data may be transferred to Google LLC in the USA. If you withdraw your consent, we delete the Google cookies in your browser and no longer load Google Analytics.
• Marketing, only with your consent: HubSpot's tracking code recognises you on later visits and links your page views to your contact record in our CRM; for this it uses cookies and an identifier derived from characteristics of your browser. If you book a first call, we link your previous visit history to your contact record; HubSpot also captures what you enter in the booking form and stores it in your contact record. Cookies: hubspotutk and __hstc (six months), __hssc (30 minutes), __hssrc (session); under HubSpot's own domains also __cf_bm from Cloudflare (30 minutes, protection against automated access). Provider: HubSpot, Inc., Cambridge (USA), with data stored in a data centre in the EU. Google Analytics is also linked to our Google Ads account: Google Ads learns whether a booking resulted from one of our ads and may set and read advertising cookies for this (_gcl_*, up to 90 days). If you book a first call, Google Analytics may transmit your email address and telephone number to Google in hashed form so that Google Ads can attribute the booking to an ad. If you withdraw your consent, we delete HubSpot's cookies in your browser, instruct HubSpot to remove them, and Google receives no further advertising signals.

Google LLC, HubSpot, Inc. and Cloudflare, Inc. are based in the USA. Transfers to the USA rely on the Swiss-U.S. and the EU-U.S. Data Privacy Framework, under which these providers are certified. If a service or a category is added, we will ask you again.

Cookie settings

Fonts and embedded content

The typeface used is served from our own server. No connection is made to Google Fonts or any other external font service. The site embeds no third-party videos, maps or social media widgets. Without your consent, your browser loads all content and scripts from our server; the only exceptions are the booking service and Cloudflare Turnstile on the first-call page and the services you accept in the cookie banner. The links to heysali.ch and LinkedIn are ordinary links; you leave our website only when you click them.

Booking a call

You book a first call directly on this website. The available times and your booking run through the scheduling service of Glatt Digital GmbH, which is operated on our own server in Switzerland. The request for available times contains no personal data. The service books the meeting in the HubSpot calendar that Glatt Digital GmbH keeps in its own HubSpot account (HubSpot, with data stored in the EU); HubSpot creates or updates a contact record in our CRM, and the invitation is sent from there with a Google Meet link. We process the details you enter for that purpose (first name, last name, business email address, company, job title, telephone number, the chosen length, the chosen time, your time zone and the language of the page) in order to hold the meeting and answer your enquiry. The service does not accept personal email addresses such as Gmail or similar providers. HubSpot's own privacy policy applies in addition.

The scheduling service keeps no database of bookings. While the booking is in progress it holds your details in memory; afterwards it keeps only your email address and the chosen time for 15 minutes so that a repeated click cannot create a second meeting (the entry is removed at the next booking request after that period, at the latest when the service restarts). It also writes one line with the time, the length, the HubSpot contact ID and your answers in the consent block to its operating log on our server.

The booking form is protected against automated abuse by Cloudflare Turnstile. Its script is only loaded once you reach the form. Technical details of your browser are transmitted to Cloudflare, and Cloudflare may set a cookie or token within its own domain; the check sets no cookie on glattdigital.ch itself. The scheduling service has Cloudflare confirm the token; it sends only the token, not your details. The check is required to send the form and cannot be declined.

The consent block in the form comes from our HubSpot account. By clicking "Book the call" you consent to us storing your details to hold the meeting. The consent to further communications that you can give in the form is voluntary and not needed for the booking. You can withdraw it at any time.

Contacting us

If you contact us by email, we process your details in order to answer your enquiry and, where applicable, to initiate a contractual relationship. There is no contact form on this website. Our mailbox and calendar run on Google. We retain such correspondence for as long as the purpose requires or statutory retention periods demand.

Client relationships and CRM

We keep the contact details of prospects and clients and of their contact persons in our CRM at HubSpot (data stored in the EU). We use Bexio for proposals, for the delivery of mandates and projects, and for invoicing. Where you have consented, we also use HubSpot to inform you about our services.

Processing within a mandate or project

Within a mandate or project we process personal data of our clients and of their business contacts on their behalf and on their instructions. We work in the client's systems and under the client's domain. Such processing is governed by the contractual arrangements, in particular any data processing agreement, and not by this privacy policy. The client remains the controller within the meaning of data protection law.

Where data from the HeySali platform is used in that context, such as company and contact data or signals, the privacy policy published at heysali.ch applies in addition. This data stays in HeySali and is deleted when the mandate or project ends (clauses 8.5 to 8.8 of the Terms). This does not apply to the notifications that HeySali sends by email to the user accounts in the workspace, as it does to all other users, such as the weekly digest of new leads.

Disclosure to third parties

We do not sell personal data. We share it only with service providers who support us in operating the website and serving clients, and only to the extent required. These providers are contractually bound to confidentiality.

Retention

We retain personal data only for as long as the respective purpose requires or statutory retention obligations demand. In practice: server logs are deleted on a rolling basis (see above). Your cookie choice stays in your browser until you delete it or we ask you again. Booking and contact data remain in our CRM for as long as a business relationship exists or appears possible; there is currently no automatic deletion period, and we delete on request. Contracts, invoices and accounting records are kept for ten years (Art. 958f of the Swiss Code of Obligations). After that, the data is deleted or anonymised.

Your rights

Within the scope of applicable law you have the right to information about the personal data we process, and to rectification, erasure or restriction of processing. You may also object to processing and request your data in a common format. You may withdraw any consent you have given at any time; processing carried out before the withdrawal remains lawful. Please contact us at hello@glattdigital.ch; we may ask questions to verify your identity. You further have the right to lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC), and, where the GDPR applies, with the data protection authority of your place of residence.

Data security

This website is served exclusively over encrypted HTTPS (HSTS for one year) and protects itself with security headers. We take appropriate technical and organisational measures to protect your data against unauthorised access, loss and misuse; nobody can guarantee absolute security.

Changes

We may amend this privacy policy at any time, for example when our services, our service providers or the legal requirements change. The version published on this page at any given time is the one that applies.

Legal notice