This policy describes how we process personal data when you visit eflury.com or get in touch — under the revised Swiss Data Protection Act (revFADP) and, where applicable, the GDPR. We name every service we use, including the inconvenient details.
1. Controller
- Controller
- Emanuel Aaron Flury
eFlury Consulting (sole proprietorship) - Address
- Keltenweg 4, 2540 Grenchen, Switzerland
- me@eflury.com
- Phone
- +41 79 910 77 87
2. What We Process — Service by Service
Instead of abstract categories: here is every data-processing activity on this website, listed individually.
Website & server logs
- Purpose
- Delivering the website, stability, abuse prevention
- Data
- IP address, browser type, pages visited, timestamp (technical log data)
- Recipient & location
- Hostinger (hosting, EU)
- Retention
- Log data is rotated and deleted automatically by the host
Web statistics (Google Analytics 4)
- Purpose
- Understanding which content is used, to improve the website
- Data
- Pseudonymized usage data (pages visited, time on page, device, approximate origin); GA4 does not store full IP addresses
- Recipient & location
- Google (USA; certified under the Swiss–U.S. Data Privacy Framework)
- Retention
- Per Google Analytics settings, at most 14 months
Forms & CRM (HubSpot)
- Purpose
- Answering contact requests, sending the newsletter (double opt-in, unsubscribe any time), following up on download requests, managing prospects, documenting offer acceptances (contract formation)
- Data
- Name, email, phone (optional), message or request context; for offer acceptances additionally company, role and offer key details
- Recipient & location
- HubSpot (CRM; EU data centre Frankfurt; the provider is a US company certified under the Swiss–U.S. Data Privacy Framework — certain service data may be processed in the USA). Acceptance receipts additionally by email to both parties and in an access-restricted directory of our hosting (EU)
- Retention
- Contact data as a rule 3 years after the last interaction; newsletter until you unsubscribe; contract and acceptance records 10 years (Art. 958f CO)
Chat assistant "Effi"
- Purpose
- Answering questions about our services directly on the website
- Data
- Your chat messages and the conversation history of the current session; contact details only if you provide them explicitly and consent to forwarding (then to HubSpot, see above)
- Recipient & location
- DeepSeek (AI provider) — processing takes place on the provider's servers, presumably in China, a country without an adequate level of data protection within the meaning of the revFADP
- Retention
- We do not store chat histories; the history ends with the session. The AI provider's own policy applies on its side
Plain language: What you type into the chat is transmitted to DeepSeek to generate the answer. Do not enter personal data, client data or confidential information there — for anything confidential, use the contact form or call us. Using the chat is voluntary; it only runs once you actively open it.
Job applications (career portal)
- Purpose
- Processing your application and — if it fits — inclusion in the specialist pool
- Data
- Name, address, email, phone, salary expectation, workload, referral, and your documents (CV, certificates, cover letter)
- Recipient & location
- Stored in an access-restricted directory of our hosting (EU); delivered by email to the owner; contact and key details (without files) additionally in the CRM (HubSpot, see above)
- Retention
- For the duration of the process; if added to the specialist pool, for as long as collaboration remains a possibility. Deletion any time on simple request
Spam protection (Cloudflare Turnstile)
- Purpose
- Protecting our forms from automated abuse — without image puzzles
- Data
- Technical connection and device data for bot detection; only loads once you use a form
- Recipient & location
- Cloudflare (USA; certified under the Swiss–U.S. Data Privacy Framework)
- Retention
- Per Cloudflare's policy; we only receive the check result
3. Legal Bases
- Consent — newsletter (double opt-in), forwarding your contact details from the chat, job applications
- Contract or pre-contractual steps — contact requests, quotes, project delivery
- Legitimate interest — operating and securing the website, web statistics, abuse prevention
- Legal obligation — retention where the law requires it
4. Disclosure Abroad
Data may reach the following countries: the EU (hosting, HubSpot data centre), the USA (Google, Cloudflare, HubSpot service data — each certified under the Swiss–U.S. Data Privacy Framework, which Switzerland has recognized as adequate since 15 September 2024; standard contractual clauses in addition) and — exclusively for the voluntary chat assistant — China (DeepSeek, no adequate level of protection; use is based on your voluntary input, see the plain-language note above).
5. Retention
The periods are stated per service in section 2. The principle: we keep data only as long as the purpose requires or the law demands — after that, it is deleted.
6. Your Rights
- Access (Art. 25 FADP) — what data we process about you
- Rectification of inaccurate data
- Deletion of your data
- Data release and portability (Art. 28 FADP)
- Objection to processing and withdrawal of consent, at any time
An email to me@eflury.com is enough — you will receive a personal reply. You may also complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC); where the GDPR applies, also to your local supervisory authority.
7. Cookies & Local Storage
Details on cookies are in the cookie policy. In addition, your browser locally remembers (localStorage) your design preference (light/dark) — this information never leaves your device.
8. Security
Transmission is encrypted throughout (TLS), storage is access-restricted, and we minimize: forms only ask for what the purpose requires, and in our own AI demonstrations we pseudonymize data before API calls — the same standard we recommend to clients.
9. Changes
We update this policy when services or the legal situation change; the version published here is authoritative. The date of the last update is shown above.
