Privacy policy

1. Controller

Unless otherwise stated in an individual case, the controller responsible for the data processing described in this privacy policy is:

SSR DigitalCraft, Inh. Sivakumar · Sole proprietorship

Mühlestrasse 6b, 6313 Edlibach, Switzerland

Email: info@ssr-digitalcraft.ch

Phone: +41 79 770 91 28

Web: www.ssrdigitalcraft.ch

For services in which SSR processes personal data exclusively on behalf of a customer, the respective customer may be the controller under data protection law and SSR the processor. Where necessary, such processing is additionally governed by a data processing agreement (DPA).

2. Purpose and scope

This privacy policy explains how SSR processes personal data in connection with the website, business development, customer and partner relationships, project delivery, support, communication, marketing, applications and the IT and cloud services used.

Personal data is information relating to an identified or identifiable natural person. Sensitive personal data is only processed if this is necessary and legally permissible.

3. Principles of data processing

SSR processes personal data in accordance with the applicable data protection principles, in particular in good faith, proportionately, for specific purposes and with appropriate technical and organisational security measures.

SSR endeavours to process only the data required for the respective purpose, and to correct or delete data if it is incorrect or no longer required and no statutory or contractual retention reasons prevent this.

4. Categories of personal data

Depending on the relationship with SSR, the following data in particular may be processed: master data such as name, company, position and address; contact data such as email and phone number; contract, quote, invoice and payment information; project and communication data; technical data such as IP address, device, browser and log data; usage and interaction data; support information; access information without unnecessary storage of secret authentication values; marketing and consent data; application documents; and data provided by customers in the context of a project.

If data is not collected directly from the data subject, it may originate in particular from employers or business partners, publicly accessible sources, company websites, directories, recommendations or the respective customer.

5. Purposes of processing

SSR processes personal data in particular for the following purposes: operation and security of the website and IT systems; responding to enquiries; acquisition and business development; preparing quotes and contracts; managing customers, suppliers, freelancers and partners; carrying out and documenting projects; support and maintenance; invoicing and accounting; compliance with legal obligations; enforcing or defending claims; quality assurance and internal organisation; communication and scheduling; marketing and maintaining business relationships; analysing and improving the website, services and processes; and recruiting, where applicable.

SSR may also process data where this is necessary for the performance of a contract, for compliance with legal obligations, to safeguard legitimate business interests or on the basis of a required consent. Where the GDPR applies, the corresponding legal bases are taken into account on a project-specific basis.

6. Website, server and log data

When the website is visited, the web server or the infrastructure and security services used may process technical data, in particular IP address, date and time, pages or files accessed, referrer, browser, operating system, device information as well as status and error data.

This data serves in particular technical provision, stability, error analysis, IT security and the prevention of misuse.

7. Contact and contact forms

When people contact SSR by email, phone, contact form, social media or other channels, SSR processes the contact and communication data transmitted in order to respond to the enquiry, assess a possible business relationship and document further communication.

Mandatory fields in forms should be limited to the information necessary for the respective enquiry. Voluntary additional information is processed for the recognisable purpose of the enquiry.

8. Leads, acquisition and CRM

SSR may record business contact data of potential customers, contact persons and network partners in order to present services, follow up on enquiries, document conversations and build business relationships.

The data may originate directly from the data subject, from recommendations, business networks, publicly accessible company sources or other lawful sources. For advertising communication, SSR additionally observes the applicable rules against unfair or unsolicited communication.

In particular, company, name, position, business contact data, source of the contact, conversation notes, interests, quote status, appointments and follow-up information may be stored in the CRM.

9. Customer, project and contract data

For quotes, contracts, SOWs, change requests, project management, acceptances, handovers, support and invoicing, SSR processes the master, contact, contract, project, communication and billing data required for these purposes.

Project-related data is only made accessible to those persons and service providers who need it to provide the services. Additional NDA, authorisation and security rules may apply to confidential projects.

10. Access data and technical secrets

In the course of projects, SSR may require access to customer accounts, domains, hosting, CMS, cloud platforms, APIs or other systems. Where possible, individual user accounts, roles and secure invitation mechanisms are used.

Passwords, 2FA codes, recovery codes, API keys, tokens and private keys should not be stored in general project documents or sent unprotected by email. Suitable secure transmission channels and password/secret management procedures are used for such information.

Temporary access that is no longer required is removed, reduced or returned in accordance with the agreed process after the end of the project or once the purpose no longer applies.

11. Invoicing, accounting and payment data

SSR processes invoice, payment and accounting data for contract performance, payment processing, payment reminders, financial accounting, tax and documentation obligations. This may include the billing address, contact person, invoice items, payment status, bank references and accounting records.

Retention is based on the applicable statutory retention obligations and legitimate interests in providing evidence.

12. Newsletters and marketing communication

Where SSR offers newsletters or comparable electronic marketing communication, contact data and, where applicable, interaction data are processed for sending and measuring success. Where required, sending takes place on the basis of consent or another permissible basis.

Recipients can unsubscribe from voluntary marketing messages via the unsubscribe mechanism provided or by notifying SSR. Necessary project- or contract-related communication remains unaffected.

13. Cookies, local storage technologies and consent

The website may use technically necessary cookies or comparable storage technologies. Optional analytics, marketing, media or third-party functions may only be activated in accordance with the consent or information logic that is actually required.

Browser and consent settings may affect the functionality of individual parts of the website.

14. Web analytics, SEO and performance

SSR may use analytics, Search Console, performance or SEO services in order to understand and improve the reach, technical quality and use of the website. Technical identifiers, IP/device information, page views, events and interaction data may be processed in this context.

15. Google Business Profile and map/business services

SSR may use a business profile and other functions of search engine or map services. When users interact with such services, the respective platform operators process data in accordance with their own privacy policies. Depending on the service, SSR receives, for example, messages, reviews, statistics or interaction information.

16. Social media and external platforms

SSR may maintain presences on social networks and business platforms, for example LinkedIn or Instagram. When users interact with these profiles, both SSR and the respective platform may process personal data.

SSR processes in particular messages, comments, business contact data and interaction information to the extent necessary for communication, community management, marketing or business development. Any further processing by the platform operators is subject to their own privacy information.

17. Microsoft 365, collaboration and cloud services

SSR may use cloud and collaboration services for email, documents, appointments, project work, communication and file storage, for example Microsoft 365, Outlook, Teams, SharePoint or comparable services.

Master, contact, communication, document, project, appointment and technical metadata may be processed in this context.

18. AI services and automations

SSR may use AI and automation services for internal workflows or agreed customer services. Depending on the use case, inputs, project information, technical metadata or other data may be transmitted to an AI/automation provider.

Confidential personal data, sensitive personal data or personal data that is otherwise sensitive should only be entered into external AI services if this is necessary for the specific purpose, contractually provided for and permissible under data protection law. In doing so, SSR reviews in particular data minimisation, provider terms, retention, training settings, access rights and international data transfers.

19. Hosting, IT security and technical service providers

SSR may use hosting, domain, DNS, CDN, email, backup, security, monitoring and other IT service providers. These may process technical data and, depending on the service, content, contact or project data.

SSR selects service providers taking into account the necessary data protection and security requirements and, where necessary, concludes appropriate data processing agreements.

20. Recipients and categories of recipients

To the extent necessary for the respective purpose, personal data may be disclosed in particular to the following categories of recipients: IT, hosting, cloud and communication providers; payment and financial service providers; accounting/fiduciary services; freelancers and subcontractors; technical project partners; analytics and marketing service providers; legal, tax and other professional advisors; authorities and courts where required by law or for the enforcement of rights; and customers or contractual partners within the scope of the respective project.

Disclosure only takes place to the extent necessary and in compliance with the applicable confidentiality, data protection and security requirements.

21. Disclosure of personal data abroad

Some service providers or their sub-processors may be located outside Switzerland or process data on systems abroad.

If there is no adequate level of data protection under Swiss data protection law, SSR bases a transfer, where necessary, on appropriate safeguards, in particular recognised standard data protection clauses with the necessary Swiss adaptations and, where applicable, additional technical or organisational measures, or on an exception provided for by law.

22. Processing on behalf of customers

Where SSR processes personal data on behalf of a customer in the context of websites, software, hosting, support, AI automations or other projects, this is generally done in accordance with documented instructions and within the scope of the agreed purpose.

Depending on the project, the subject matter and duration, types of data, data subjects, security measures, sub-processors, transfers abroad, deletion/return and support obligations are governed by a separate DPA.

The customer is generally responsible for ensuring that the processing it initiates and the data transmitted to SSR are lawful, unless the statutory allocation of responsibility provides otherwise.

23. Freelancers, partners and subcontractors

SSR may engage suitable freelancers, developers, designers, specialists or other partners for projects. They only receive access to the data required for their task and, where necessary, are contractually bound to confidentiality, data protection and appropriate security.

If such a service provider acts as a sub-processor, the requirements of the respective DPA and the applicable data protection rules are taken into account.

24. Data security

SSR takes appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, alteration or unlawful disclosure. These may include in particular role-based permissions, MFA, password/secret management, secure devices, updates, backups, access controls, encryption and organisational processes.

No system offers absolute security. Security measures are further developed on a risk-based basis and adapted to the systems and processing used.

25. Data security breaches

SSR handles identified data protection and security incidents in accordance with the applicable statutory and contractual requirements. Where SSR acts as a processor, SSR informs the responsible customer in accordance with the DPA or the applicable obligations.

Whether a notification to the Federal Data Protection and Information Commissioner (FDPIC) or information of the data subjects is required is assessed on the basis of the statutory requirements and the specific risk.

26. Retention period

SSR generally stores personal data only for as long as this is necessary for the respective purpose, a business or contractual relationship exists, statutory retention or documentation obligations apply, or legitimate interests in evidence, security or the enforcement of rights exist.

Specific periods may vary depending on the data category. Contract, invoice and accounting documents may in particular be stored for the duration of the statutory retention periods.

27. Rights of data subjects

Within the scope of the applicable data protection law, data subjects may in particular request information as to whether and which personal data SSR processes about them. Depending on the requirements, they may also request the correction of incorrect data, erasure or destruction, the restriction or cessation of certain processing, the release or transfer of data, and assert other claims provided for by law.

Where processing is based on consent, consent can generally be withdrawn with effect for the future. Processing that has already been carried out lawfully does not thereby become retroactively unlawful.

Requests should be sent to info@ssr-digitalcraft.ch. To prevent unauthorised disclosure of data, SSR may request appropriate proof of identity. Statutory restrictions or exceptions remain reserved.

28. Automated individual decisions and profiling

If such an automated individual decision is used in the future, the data subjects will be informed in accordance with the applicable statutory requirements and will be given the options provided for by law to state their point of view and to request a human review.

Profiling or high-risk profiling is only used where this is intended for a specific purpose, made transparent and legally permissible.

29. Applications and freelancer enquiries

In the case of applications, internship, freelancer or cooperation enquiries, SSR processes the contact data, CVs, qualifications, work samples, correspondence and other voluntarily submitted information in order to assess a possible collaboration.

Application documents that are not required are deleted within an internally defined period after completion of the selection process or are only retained for future opportunities with an appropriate basis.

30. Data of children and minors

The services of SSR are generally aimed at companies and business contacts and not specifically at children. If data of minors is to be processed in a customer project, the purpose, roles, protective measures and required consents or other bases must be examined on a project-specific basis.

31. Changes to this privacy policy

SSR may amend this privacy policy if processing, services, legal requirements or business processes change. The version published on the website at the time applies.

In the event of material changes that require additional information or consent, the data subjects will be informed in accordance with the applicable provisions.

32. Contact for data protection matters

Questions or requests regarding data protection can be addressed to: