Privacy Policy

1. Data Controller

K-I-Soft IT&Holding GmbH
Bernstrasse 27b
3122 Kehrsatz
Switzerland
E-mail: info@k-i-soft.ch
Phone: +41 77 955 55 73

2. Categories of Personal Data Processed

2.1 Website visit (server logs)

When you visit this website, the web server automatically records the following data:

• IP address, unshortened, and the country and network derived from it

• Date and time of the request

• URL requested

• HTTP status code and data volume transferred

• Referrer URL

• Browser type and operating system (User-Agent string)

• Purpose: Ensuring the technical availability and security of the website, and visitor statistics.

• Analysis: The logs are analysed with Munot, our own analytics tool, which also runs in AWS Zurich. Munot counts page views and visitors and tells people, search engines and AI crawlers apart. The IP address is used to count distinct visitors and to check whether a crawler really comes from the provider it claims. No profiles are built.

• Legal basis (GDPR): Art. 6(1)(f), legitimate interest in operating a secure website and in analysing it.

• Legal basis (nDSG): Processing is necessary for the legitimate purposes of the controller (Art. 31 nDSG).

• Retention: The IP address is neither shortened nor anonymised. The logs stay in the website storage for 180 days. For the analysis Munot copies them into storage of its own in Zurich: the raw data stays there for 90 days, the processed logs including the IP address for 400 days. After that only counts without personal data remain.

2.2 Contact by e-mail

If you contact us by e-mail (info@k-i-soft.ch), we process:

• Your e-mail address

• Your name (if provided)

• The content of your message

• Timestamp of receipt

• Purpose: Responding to your enquiry and maintaining the business relationship.

• Legal basis (GDPR): Art. 6(1)(b), performance of pre-contractual measures; Art. 6(1)(f), legitimate interest in responding to enquiries.

• Legal basis (nDSG): Contractual necessity or legitimate interest (Art. 31 nDSG).

• Retention: E-mail correspondence is retained for up to 10 years to comply with Swiss commercial record-keeping obligations (OR Art. 958f); messages not leading to a contract are deleted after 2 years.

2.3 Forms on this website

There are two forms on this website. Both run through our own endpoint in AWS Zurich, with no third-party service involved.

Contact form. We process your name, e-mail address, subject, message, time of receipt and IP address. The message is delivered to info@k-i-soft.ch via Amazon SES and also stored in a database in AWS Zurich so that no enquiry is lost.

WordPress risk check. We process the address of the website you enter, the result of the check and your IP address. If you request the report as a PDF, your e-mail address is added.

• Purpose: answering your enquiry, running the check you requested, and sending the report once. The IP address is used solely to limit the number of requests per sender (abuse protection).
• Legal basis (GDPR): Art. 6(1)(a), consent, for sending the report to your address; Art. 6(1)(b), pre-contractual measures, for enquiries via the contact form; Art. 6(1)(f), legitimate interest, for abuse protection.
• Legal basis (revFADP): consent, or overriding legitimate interest (Art. 31 revFADP).
• Recipients: Amazon Web Services as processor (delivery via Amazon SES, storage in Amazon DynamoDB, both in eu-central-2, Zurich). Your data is not passed to third parties for advertising.
• Retention: check results are deleted automatically after 7 days, abuse-protection counters after 10 minutes. The periods in section 2.2 apply to the delivered message and to your e-mail address.
• No newsletter: the report is sent once. Nothing follows it, and your address is not added to any mailing list.

2.4 Hosting infrastructure (AWS)

The website is hosted on Amazon Web Services (AWS). The hosting contract is with Amazon Web Services EMEA SARL, 38 avenue John F. Kennedy, L-1855 Luxembourg, which acts as a data processor (Art. 28 GDPR, Art. 9 nDSG).

• Origin region: eu-central-2 (Zurich, Switzerland). The website’s S3 bucket, Lambda functions, and supporting AWS resources are located in this region. Server-side data, including the server logs described in section 2.1, is stored in Switzerland.

• Edge delivery: Static content is served through Amazon CloudFront, a global content delivery network. Visitor requests are first served by the CloudFront edge location nearest to the visitor. Edge locations exist worldwide, including outside Switzerland and the EU/EEA.

• What AWS processes: request metadata required to deliver web content (IP address, request URL, response headers, User-Agent, timestamps). This is the same data described in section 2.1.

• Purpose: Technical delivery, scaling, and security of the website.

• Legal basis (GDPR): Art. 6(1)(f), legitimate interest in operating a fast and reliable website.

• Legal basis (nDSG): Processing is necessary for the legitimate purposes of the controller (Art. 31 nDSG).

• Data processing agreement: The AWS GDPR Data Processing Addendum and the AWS Swiss Addendum apply.

• International transfers: Where CloudFront serves a visitor from an edge location outside the EU/EEA, AWS relies on the EU Standard Contractual Clauses (SCCs) under Art. 46(2)(c) GDPR. AWS is certified under the EU-US Data Privacy Framework (DPF) for any US-based processing. For Switzerland-specific transfers, the SCC mechanism recognised by the FDPIC applies.

• Retention: as in section 2.1, at most 400 days with the IP address.

3. No Cookies, No Tracking

This website sets no cookies and loads no analytics, advertising or tracking services. There is no Google Analytics, no Google Tag Manager, no LinkedIn Insight Tag and nothing comparable. That is also why there is no cookie banner: there is nothing for you to consent to.

Your visit leaves only the server logs described in section 2.1. Those logs are held in Switzerland, are analysed with our own tool Munot and are not combined with any other data source. No profiles are built.

Until September 2026 this website used Google Analytics 4 and the LinkedIn Insight Tag, both only after explicit consent through a cookie banner. Both have been removed completely. Any consent previously stored in your browser is deleted automatically on your next visit.

4. Fonts

This website uses the fonts JetBrains Mono and Syne. The font files are served from the same hosting infrastructure as the rest of the website (see section 2.4); no connection is made to Google Fonts or any third-party font CDN. No personal data (including IP addresses) is transferred to Google or any other third party when loading these fonts.

5. Data Retention Summary

Data category	Retention period	Legal basis
Server logs with unshortened IP address	180 days in the website storage, in Munot 90 days raw and 400 days processed	Legitimate interest (security, statistics)
Visitor statistics without personal data	no time limit	Legitimate interest (statistics)
E-mail correspondence (contract)	10 years (OR Art. 958f)	Legal obligation / contract
E-mail correspondence (no contract)	2 years	Legitimate interest
WordPress check result	7 days (deleted automatically)	Consent / legitimate interest
Abuse-protection counter (IP)	10 minutes	Legitimate interest (security)

6. Your Rights as a Data Subject

Under the GDPR (Chapter III) and nDSG (Art. 25 ff.), you have the following rights:

• Right of access (Art. 15 GDPR / Art. 25 nDSG): You may request information about the personal data we hold about you.
• Right to rectification (Art. 16 GDPR / Art. 32 nDSG): You may request correction of inaccurate or incomplete data.
• Right to erasure (Art. 17 GDPR / Art. 32 nDSG): You may request deletion of your personal data, subject to statutory retention obligations.
• Right to restriction of processing (Art. 18 GDPR): You may request that we restrict the processing of your data in certain circumstances.
• Right to data portability (Art. 20 GDPR): You may request your data in a structured, commonly used, machine-readable format.
• Right to object (Art. 21 GDPR): You may object to processing based on legitimate interests. We will cease processing unless we can demonstrate compelling legitimate grounds.
• Right to withdraw consent (Art. 7(3) GDPR / Art. 31(1) nDSG): Where processing is based on consent, you may withdraw it at any time. Withdrawal does not affect prior processing.

To exercise any of these rights, contact us at: info@k-i-soft.ch. We will respond within 30 days.

7. Right to Lodge a Complaint

If you believe that the processing of your personal data violates applicable data protection law, you have the right to lodge a complaint with the competent supervisory authority:

Federal Data Protection and Information Commissioner (FDPIC / EDÖB)
Feldeggweg 1, 3003 Bern, Switzerland
Website: www.edoeb.admin.ch
E-mail: contact20@edoeb.admin.ch

If you are located in the EU/EEA, you may also contact the supervisory authority of your country of residence.

8. Third-Party Services Summary

Service	Provider	Purpose	Legal basis	Data transfer
Amazon Web Services (hosting)	AWS EMEA SARL, Luxembourg	Website hosting, CDN, edge delivery	Legitimate interest (technical operation)	Origin CH (eu-central-2), global edge (SCC + DPF)
Fonts	Same hosting infrastructure (see AWS row)	Typography	n/a, no third-party font service	None additional

9. Changes to This Privacy Policy

We reserve the right to update this privacy policy to reflect changes in legal requirements or our data processing practices. The current version is always available at www.k-i-soft.ch/datenschutz. The “Last updated” date at the top of this page indicates when changes were last made.

10. Contact

For all data protection enquiries:
info@k-i-soft.ch  ·  +41 77 955 55 73