Privacy Policy
Version bf1ddf40fdbb
Controller
The controller responsible for processing data on this website and in our services is:
soosap GmbH
Theaterstrasse 25a
8400 Winterthur
Switzerland
Email: gruezi@kolaveri.co
What this policy covers
This policy describes which personal data we process when you visit this website or use our services, for what purpose, on which legal basis of the General Data Protection Regulation (GDPR), and for how long. We do not sell personal data and do not use it for third-party advertising.
Visiting this website
Server logs
With every request our server processes technically necessary details: IP address, time, the address requested, the amount of data transferred, and the browser and operating system. We need them to deliver the website and to fend off attacks (legitimate interest, Art. 6(1)(f) GDPR).
Contacting us
If you write to us, we process your details to answer your request (Art. 6(1)(b) GDPR where it concerns a contract, otherwise point (f)).
Cookies
Our cookie policy describes which cookies we set and how you decide about them.
Service providers working for us
Hosting
The website and the application run on servers of Amazon Web Services EMEA SARL (Luxembourg) in the Frankfurt am Main data centre (eu-central-1). The databases, uploaded files and backups are stored there too. A data processing agreement under Art. 28 GDPR is in place with AWS.
Sending email
Emails Kolaveri sends (confirmations, notifications, invoices) are delivered by Amazon Simple Email Service (SES) of Amazon Web Services EMEA SARL (Luxembourg) from the Frankfurt am Main data centre. For this SES processes the recipient address, the content and the delivery status (Art. 6(1)(b) GDPR). A data processing agreement is in place.
Email
Our correspondence runs on Proton Mail of Proton AG (Geneva, Switzerland), end-to-end encrypted where the recipient supports it.
Analytics
To understand how our website is used, we use OpenPanel. We run it ourselves, on our servers in Frankfurt am Main; no data goes to OpenPanel AB or any other third party. It records the pages viewed, the referring page, the browser, the device type and the approximate location (country, region, city) derived from the IP address; the IP address itself is not stored. The legal basis is your consent where we ask for it (Art. 6(1)(a) GDPR), and otherwise our legitimate interest in improving the website (Art. 6(1)(f) GDPR). The data is deleted after 26 months at the latest.
How long we keep data
We keep personal data only as long as its purpose requires. Server logs are deleted after 30 days at the latest. Data we must keep under commercial or tax law is restricted until those periods end (usually six to ten years) and then deleted.
Security
Every connection to this website is encrypted with TLS. Stored data and backups are encrypted; only the people who need access for their work have it.
Your rights
You have the right to
- access the data we hold about you (Art. 15 GDPR),
- have inaccurate data corrected (Art. 16 GDPR),
- erasure (Art. 17 GDPR) and restriction of processing (Art. 18 GDPR),
- data portability (Art. 20 GDPR),
- object to processing based on legitimate interests (Art. 21 GDPR),
- withdraw consent with effect for the future (Art. 7(3) GDPR).
An informal message to gruezi@kolaveri.co is enough.
Complaints
You may complain to a data protection supervisory authority, in particular in the country where you live or work. The authority responsible for us is: the Federal Data Protection and Information Commissioner (FDPIC), Bern.
Changes to this policy
When our processing changes, we update this policy. The version published here applies.