Contents
Who is responsible for your data?
The entity responsible for the collection and processing of personal data described in this policy is:
Identity card, Legal entity
CHE-362.077.556- Company name
- Avepto Sàrl
- Address
- Chemin de l’Epinglier 4 1242 Satigny, Switzerland
- Phone
- +41 22 552 96 70
Which laws apply?
This policy is issued in accordance with the Swiss Federal Act on Data Protection (FADP, RS 235.1, in force since 1 September 2023) and its implementing ordinance (DPO).
The General Data Protection Regulation (GDPR, EU Regulation 2016/679) applies additionally to visitors located in the European Economic Area.
What does this policy cover?
This policy concerns exclusively the personal data collected through the avepto.ch corporate website. The corporate website does not handle client data related to Avepto’s managed-service offerings.
Client data managed as part of our managed services is hosted, where possible, on infrastructure located in Switzerland and is governed by the service contracts and data-processing agreements entered into with each client.
Certain management and supervision tools used as part of these services may involve transfers to providers located outside Switzerland, in compliance with FADP requirements.
What data is collected?
Avepto distinguishes two categories of data collected through the corporate website, depending on whether you submit it actively or it is recorded by your browsing.
Data submitted voluntarily
When you use the contact form, the following data is collected:
- 01 First and last name
- 02 Professional email address
- 03 Phone number (optional)
- 04 Company and role (optional)
- 05 Subject of the request
- 06 Message content
- 07 Your briefing opt-in choice (unchecked by default)
- 08 IP address at the time of sending, kept with the request for security and evidence purposes (the same rule applies to job applications)
This data is sent by email to the Avepto team and stored in the website backend.
Audience measurement, anonymous tier
Before your consent, we collect anonymous technical data via our own analytics infrastructure, with no third-party measurement tool:
- 01 Approximate country and city, inferred from your connection by Cloudflare, and your truncated IP address (network, not machine)
- 02 Name of the organisation operating your network (access provider or company), as reported by Cloudflare
- 03 Browser family and operating system, inferred from the User-Agent header
- 04 Pages viewed, date and time of visit
- 05 Traffic source (UTM parameters, referring page)
- 06 Anonymous per-tab session identifier (non-persistent)
Legal basis: legitimate interest (aggregate audience measurement). No browser fingerprint or third-party cookie at this stage.
Audience measurement, enriched tier
At the enriched tier, the same data is tied to a stable session identifier, which lets us reconstruct the path of a visit rather than isolated pages. This tier waits for your consent in the European Economic Area and the United Kingdom; elsewhere it is active by default and refusable at any time (see the cookie policy):
- 01 Browser technical fingerprint, transformed by HMAC-SHA256 cryptographic function before storage (the raw fingerprint is never retained)
- 02 Your full IP address, tied to each event
- 03 Two texts you type, absent from the anonymous tier: your site-search queries, kept with the event and sent to Google Analytics, and the command line typed in the 404 terminal, kept with the event
- 04 Google Analytics runs fully in your browser at this tier: it uses your IP address for approximate geolocation (then anonymises it), sets the _ga and _ga_GKWPDWF0XT cookies (13 months) and tells us the pages viewed, clicks on our contact details, searches and forms sent. Below this tier it runs only in cookieless mode with no identifier (aggregate signals, see the cookie policy)
Legal basis: your consent in the European Economic Area and the United Kingdom; elsewhere, the Swiss regime of article 45c of the Telecommunications Act, which requires that you be informed and allowed to refuse. In both cases refusing takes one click on the “Cookies” link in the footer. See the cookie policy for retention details.
Why is this data processed?
The data collected is processed for the following purposes:
- 01 Responding to requests sent via the contact form.
- 02 Preparing our reply to your contact request, job application, briefing subscription or meeting request, by summarising for the team the visit path that led to it (see the Automated processing section).
- 03 Improving the operation and content of the site (analytics).
- 04 Learning which companies visit the site, using tools that identify the organisation and not the person (see the cookie policy).
- 05 Meeting applicable legal obligations.
Avepto sends an editorial briefing only to people who opted in. We do not approach you individually on the basis of your personal data unless you asked us to. One-click unsubscribe is in every email.
Are your requests analysed automatically?
Requests received through our forms (contact, application, briefing, appointment) may be pre-analysed by automated tools in order to speed up their handling, triage, and categorisation.
When you send a contact request, a job application, a briefing subscription or a meeting request, your request is tied to your browser’s analytics session identifier, the very one our audience measurement uses. From it we build a visit summary attached to the internal notification sent to the team: pages viewed and how often, notable actions, referring domain, campaign parameters (UTM), approximate city and country, the name of your network’s organisation, browser and operating system. If you accepted enriched measurement, that summary also covers your earlier visits (how many there were, your most-viewed pages and the source of your first visit), the dates of requests already sent from the same browser, and the session identifier itself, which lets the team find the matching session recording when recording is active; otherwise it is limited to the current visit.
The log of those events is also sent to Cloudflare Workers AI, a language model running at our hosting provider, which writes a short observational paragraph added to that same internal notification. This step is optional: if it fails, the notification goes out without that paragraph. The corresponding processing is described in Cloudflare’s documentation on Workers AI data usage.
That summary is preparation material, read by a member of the Avepto team who then handles your request. It may shape the way we reply to you, but no decision producing legal or similarly significant effects is taken solely on the basis of automated processing.
What is the legal basis for this processing?
Data processing relies on:
- 01 Your consent, for analytics cookies and certain optional fields of the contact form.
- 02 Avepto’s legitimate interest in responding to contact requests and improving its website, where this interest does not override your rights.
- 03 Compliance with applicable legal obligations.
You can withdraw your cookie consent at any time via the “Cookies” link in the footer, which opens the cookie policy and its management panel.
Who has access to your data?
Personal data is neither sold nor rented. With your explicit consent to “Meta advertising”, browsing events are sent to Meta to measure our ads and build audiences. Other recipients and purposes are listed below:
| Recipient | Country | Role | Data scope |
|---|---|---|---|
| Recipient Cloudflare, Inc. | Country USA | Role Hosting, CDN, attack protection and protection against automated form submissions (Turnstile), and generation by the Workers AI service of the visit summary attached to our internal notifications | Data scope Browsing data, plus hosting of the data entered in the contact, application, newsletter and booking forms (D1 / R2 storage) |
| Recipient Google LLC | Country USA | Role Processor: Google Analytics audience measurement. In your browser, in cookieless mode with no identifier as long as audience measurement is not active for you, then fully once it is (pages viewed, clicks on our contact details, searches, forms; _ga and _ga_GKWPDWF0XT cookies); from our server, via the Measurement Protocol API, at both tiers, for the requests sent through our forms, performance measurements and technical errors | Data scope Pseudonymised data. IP address received by Google only for the part collected by your browser, for approximate geolocation; no IP address in the part sent by our server |
| Recipient Microsoft Corporation | Country USA / EU | Role Processor: Clarity session replay (with consent in the European Economic Area, active by default and refusable at any time elsewhere) and, for online appointments, creation of the invitation in Avepto’s Microsoft 365 calendars with a Teams link | Data scope Clarity: pseudonymised browsing interactions and the transformed session identifier. Appointments: name, email and meeting subject |
| Recipient Meta Platforms Ireland Limited | Country Ireland / USA | Role Facebook and Instagram advertising measurement and audience creation through the Meta Pixel, only after your explicit consent in every region | Data scope Page views, successful enquiries, confirmed bookings, IP address, browser information and advertising identifiers (_fbp, _fbc). Our integration sends no form contents, email or phone number |
| Recipient SMTP2GO Ltd | Country New Zealand / EU | Role Processor: delivery of the site’s transactional emails (confirmations, internal notifications, application files) | Data scope Form content sent by email, including application documents |
| Recipient Competent authorities | Country CH / EU | Role Disclosure where required by law | Data scope Strict minimum required by law |
Enhanced Google advertising measurement
With your optional consent in the enquiry or booking form, Avepto sends your hashed email to Google LLC. This accompanies only a successfully confirmed enquiry or booking.
Our server normalises the email and transforms it using SHA-256 before transmission. This value remains pseudonymised personal data. Google can match it with its user data to attribute an enquiry to an advertisement, including across devices.
The checkbox is unchecked by default in every region. You can send your request without agreeing. Your choice and the wording version are recorded with the request. Each new submission offers a new choice.
This mechanism sends no name, phone number, postal address, message, job application or subscriber list. It adds no advertising cookie and is not used to personalise advertisements. Other audience measurement follows its own settings.
Google LLC may process this data outside Switzerland, including in the United States. Google Analytics retention is configured to 14 months. You can exercise the rights described in this policy by contacting us.
Does your data leave Switzerland?
Hosting of the site by Cloudflare, Inc. involves a transfer of browsing data to the United States. Cloudflare adheres to the Swiss-U.S. Data Privacy Framework.
Audience measurement events are collected by our first-party infrastructure, operated on our hosting (see Cloudflare in the processor list above), and by Google Analytics in your browser: in cookieless mode with no identifier (aggregate signals of Google’s consent mode) as long as audience measurement is not active for you, then fully once it is, Google then using your IP address (approximate geolocation, then anonymisation). Our server additionally transmits to Google LLC, via the Measurement Protocol API and without any IP address, the requests sent through our forms, performance measurements and technical errors, at both tiers, to feed our marketing dashboard. When you send one of our forms, the log of your events is also sent to Cloudflare’s Workers AI service, which writes the summary described in the Automated processing section. The enriched tier’s browser fingerprint is computed in your browser, sent to our server over an encrypted connection and transformed by the HMAC-SHA256 cryptographic function before any storage; only that transformed value is kept or passed to third parties.
The site’s internal search sends the text you type to Cloudflare, our hosting provider, in order to look up the content of our own pages. Without your consent to audience measurement, only the fact that a search took place is counted: the text you typed is not recorded in our visit statistics.
No client data related to managed-service offerings transits through the corporate website.
With your consent to “Meta advertising”, your browser sends the events described above to Meta. Meta may associate them with your Facebook or Instagram account and process them outside Switzerland, including in the United States. You can withdraw consent at any time through the “Cookies” link. Meta’s privacy policy describes its own processing and your rights.
How long is your data kept?
Data is retained for the time strictly necessary for the purpose pursued, then deleted or archived in line with legal obligations.
| Data type | Retention period |
|---|---|
| Data type Contact-form data Name, email, phone, company, role, subject, message, briefing opt-in choice, IP address at sending | Retention period 12 months after the request has been handled, unless an active contractual relationship exists |
| Data type Audience measurement data Anonymous and enriched events, logged in our first-party infrastructure | Retention period About 90 days a rolling window that erases itself, with no older archive on our side. The identifier we keep is the fingerprint transformed by HMAC-SHA256, not the raw fingerprint; the IP address is truncated at the anonymous tier and full at the enriched tier; it is tied back to your identity only if you send one of our forms, in which case it is stored alongside your request (see the Automated processing section) |
| Data type Job application files CV, cover letter and attachments, applicant contact details, IP address at sending | Retention period 12 months after the application is received, unless it progresses towards a hire, as stated on the form |
| Data type Newsletter subscription Email address, consent state and truncated IP address at the time of subscription | Retention period Until you unsubscribe every email carries a one-click unsubscribe link |
| Data type Online appointments Name, email, phone, organisation, meeting subject, additional notes and hashed IP address at the time of booking | Retention period 24 months after the appointment, unless an ongoing contractual relationship exists |
| Data type Server logs Cloudflare | Retention period Third-party policy according to Cloudflare’s retention policy |
What rights do you have over your data?
In accordance with the FADP (art. 25 et seq.), you have the following rights regarding data concerning you:
- 01 Right of accessObtain confirmation that your data is being processed and receive a copy of it.
- 02 Right to rectificationRequest correction of inaccurate or incomplete data.
- 03 Right to erasureRequest the deletion of your data, subject to legal retention obligations.
- 04 Right to portabilityReceive your data in a structured and commonly used format.
- 05 Right to objectObject to the processing of your data on legitimate grounds.
To exercise these rights, contact Avepto Sàrl by email at or by post at Avepto Sàrl, Chemin de l’Epinglier 4, 1242 Satigny, Switzerland. Avepto undertakes to respond within 30 days.
In the event of a dispute, you may file a complaint with the Federal Data Protection and Information Commissioner (FDPIC).
How is your data protected?
Avepto puts in place appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, or destruction.
The public forms on this site are protected against automated submissions by Cloudflare Turnstile. The service analyses technical browser signals (IP address, TLS fingerprint, User-Agent header, sitekey and associated origin) to tell a human visitor from a bot; these signals are used solely for bot detection and neither to identify you nor for advertising profiling. The corresponding processing is described in Cloudflare, Inc.’s Turnstile Privacy Addendum.
How does this policy change over time?
Avepto reserves the right to amend this privacy policy at any time. The version in force is the one published on this site, with the last-updated date shown at the top of this page.
Who can you contact with questions?
For any question relating to data protection: by email at , by phone at +41 22 552 96 70, or by post at Avepto Sàrl, Chemin de l’Epinglier 4, 1242 Satigny, Switzerland.