Legal
Privacy Policy
Last updated: July 2026
What this website collects, why, where it goes and how long it stays. Analytics and marketing run only if you switch them on in the cookie banner. The rest is a contact form, a newsletter you opt into and the logs every web server writes.
1. Controller
Vayron AG
Maneggstrasse 33
CH-8041 Zurich
Switzerland
Email: privacy@vayron.ch
2. Scope
This policy covers the website vayron.ch (the "Site"). It does not cover the Vayron Vector platform or other customer services: Data processing in those services is governed by the applicable customer agreements and data processing agreements.
3. Personal Data We Collect
| Category | Examples | Source |
|---|---|---|
| Identity and contact data | Name, email address, message content | You (contact form) |
| Newsletter data | Email address, subscription status | You (newsletter signup) |
| Technical and usage data | IP address, browser type, device information, pages visited, timestamps | Automatically via analytics cookies (only with your consent) |
| Marketing data | Pages viewed, interactions with our content | HubSpot scripts (only with your consent) |
| Server log data | IP address, requested URL, timestamp, user agent | Automatically by our hosting infrastructure |
| Consent choices | Your cookie consent settings | You (cookie banner) |
4. Purposes and Legal Bases
| Purpose | Personal Data | Legal Basis |
|---|---|---|
| Responding to your inquiry | Identity and contact data | Steps prior to entering into a contract at your request (Art. 6(1)(b) GDPR) and our legitimate interest in responding to inquiries (Art. 6(1)(f) GDPR) |
| Sending the newsletter | Newsletter data | Your consent (Art. 6(1)(a) GDPR), withdrawable at any time via the unsubscribe link in every email |
| Analytics and performance | Technical and usage data | Your consent (Art. 6(1)(a) GDPR) |
| Marketing | Marketing data | Your consent (Art. 6(1)(a) GDPR) |
| Operating and securing the Site | Server log data | Our legitimate interest in providing and protecting the Site (Art. 6(1)(f) GDPR) |
| Consent management | Consent choices | Our legal obligation to demonstrate consent (Art. 7(1) GDPR) |
Providing personal data is neither legally nor contractually required. Without it, we simply cannot answer your message or send you the newsletter.
5. Cookies and Similar Technologies
Our Site uses the following categories of cookies and similar technologies:
-
Strictly necessary
Purpose: Stores your consent choices (localStorage) and enables core Site functionality.
Legal Basis: Legitimate interest.
Retention: Up to 12 months. -
Analytics (Google Analytics 4, disabled until you consent)
Purpose: Measures traffic and Site performance.
Provider: Google Ireland Limited.
Retention: 14 months for user-level data. -
Marketing (HubSpot, disabled until you consent)
Purpose: Lead capture and marketing communications.
Provider: HubSpot, with data held in HubSpot's EU data region.
You can change or withdraw your cookie consent at any time via the Cookie Settings link on the Site. This Site loads no external fonts or CDN typography: All fonts are self-hosted, so no font provider receives your data.
6. Processors
We engage the following processors, each bound by a data processing agreement:
- Google Ireland Limited (Google Analytics 4)
- HubSpot (marketing and newsletter delivery)
- Resend, Inc. (transactional email delivery for contact form submissions)
- Heroku, a Salesforce company (web infrastructure, server logs and backups, EU region)
7. International Transfers
Some of our processors are based in the United States. Where personal data leaves Switzerland or the EEA, we rely on: Adequacy decisions of the Swiss Federal Council and the European Commission, including the Swiss-U.S. and EU-U.S. Data Privacy Frameworks where the recipient is certified, and Standard Contractual Clauses with the Swiss addendum where no adequacy decision applies.
8. Data Retention
| Data Category | Retention Period |
|---|---|
| Contact form submissions | 3 years from last contact; longer only if a business relationship follows, then per contractual and statutory retention duties |
| Newsletter data | Until you unsubscribe; a minimal suppression record is kept afterward to honor your opt-out |
| Analytics data | 14 months (Google Analytics 4 setting) |
| Consent records | 12 months |
| Server logs | Up to 7 days (transient retention on our hosting platform) |
After these periods, data is deleted or anonymized.
9. Your Rights
Under the Swiss Federal Act on Data Protection (FADP) and the GDPR, you have the right to:
- Access: Request a copy of your personal data.
- Rectification: Correct inaccurate or incomplete data.
- Erasure: Have data deleted where no legitimate basis remains.
- Restriction: Temporarily limit processing.
- Portability: Receive your data in a structured, machine-readable format.
- Objection: Object to processing based on legitimate interests or to marketing.
- Withdrawal of consent: At any time, without affecting prior processing.
To exercise any of these rights, email privacy@vayron.ch.
You also have the right to lodge a complaint with a supervisory authority: In Switzerland, the Federal Data Protection and Information Commissioner (FDPIC, www.edoeb.admin.ch); in the EEA, the supervisory authority of your place of residence or work.
10. Security
All traffic to this Site is encrypted in transit (HTTPS/TLS). Access to our mailboxes and processor accounts is restricted and protected with multi-factor authentication. We collect only what the purposes above require.
11. No Automated Decision-Making
We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects.
12. Updates to This Policy
We may update this policy to reflect changes in regulation or our practices. The date above indicates the current version. Material changes will be visible here before they take effect.
Back to Vayron