Privacy and personal data

No sale of customer contact details

Pseudonymised internal statistics

Message translation on our server

One contact to exercise your rights

1. Controller and contact

Claude-Alain Martin, operating OpenSwissData in his own name, Rue de l’Église 23, 1045 Ogens, Switzerland, is responsible for the processing described here. Contact: contact@openswissdata.com. This notice provides information; accepting sales terms does not constitute marketing consent.

2. Information processed

Account and purchase: email, identity and company when provided, billing address and payment details processed by Stripe, transaction references, products, amounts, refunds, disputes, access rights and evidence of the accepted terms version. We do not store full card numbers or security codes.

Customer relationship: business contact details, chosen or estimated language, messages and attachments received in our support mailboxes, sending history, notes and requests. Language detection is indicative; reading translations may contain errors and originals remain with the mail provider.

Operation and security: IP address and browser needed for connections and abuse prevention, session cookies, product access, response codes and technical timings. Internal statistics record pages or call types, country if available, referring domain, browser category and a pseudonymised identifier changing daily. An authenticated call may be linked to the account. Pseudonymised does not mean anonymous.

Public sources: some distributed data, including FINMA registers and warnings or LEI/GLEIF data, may concern individuals or sole traders. They come from sources cited in files and pages, not from direct collection from every person. An entry reflects its source context and date, not an independent assessment of a person.

3. Purposes and grounds

We use information to prepare and fulfil purchases, provide access, handle support and complaints, reconcile refunds, prevent abuse, check availability, measure use and improve the service. Necessary records support accounting obligations and the defence of rights.

Swiss data protection law governs these activities. Where the GDPR applies, relevant grounds are contract performance or pre-contract steps, legal obligations and legitimate interests in secure service, answering requests and measuring use, subject to individuals’ rights. Consent is requested where required and can be withdrawn for the future.

Required fields are indicated. Without an accessible email or confirmed payment, we cannot fulfil a purchase. Receiving advertisements is not required. We do not use a language model to make individual decisions with legal effects on a customer. Financial reconciliation and security restrictions can be reviewed by a person.

4. Messages, CRM and translation

The management dashboard is restricted to the authorised operator. It may combine support messages with OpenSwissData correspondence from the operator’s personal business mailbox. Other correspondence from that mailbox is excluded from the CRM. Originals remain with Infomaniak and outgoing mail with Resend.

Reading translations run on the application server using locally installed models. Text is not sent to an external translation or text-generation provider. Translations are not stored as new messages or automatically sent to their authors. Avoid unnecessary secrets, card details or sensitive information.

5. Recipients and locations

The operator and the providers needed for their tasks can access the relevant information. Stripe processes payments (Stripe Payments Europe, Limited, Ireland, with international processing, including in the United States) and may also act as an independent controller for its own obligations. Resend sends our emails and tracks their delivery: messages leave from Amazon Web Services infrastructure in Ireland, but account data, logs and sending metadata are stored in the United States. Infomaniak, in Switzerland, hosts the mailboxes, registers the domain name, manages its DNS and redirects the address without "www".

Railway hosts the application and its database in the Amsterdam region, Netherlands; operations and support may involve the United States. Cloudflare provides R2 storage for distributed archives and encrypted backups. When you download a file, your browser connects directly to this storage, which therefore receives your IP address and technical information. This storage comes with no guarantee of residency in a given country. Detailed locations depend on each service and its subprocessors.

Plausible (Plausible Insights OÜ, Estonia) measures audience without cookies on infrastructure located in Germany. Sentry (United States) receives filtered technical errors, stored in the European Union storage region chosen for our account; request bodies, cookies, users and activity trails are removed before sending. In Google Search Console we view aggregated statistics about the site’s presence in Google Search; the site loads no Google script and sends no visitor data to Google. Fonts are served directly by OpenSwissData, without a browser connection to Google Fonts. If you subscribe to our newsletter, Substack (United States, certified under the Swiss-U.S. Data Privacy Framework) stores your email address and reading statistics on our behalf; we are responsible for this list, and Substack applies its own notice to its own purposes. You can unsubscribe at any time using the link in each issue.

For transfers outside Switzerland, we rely on a country recognised by the Federal Council as providing adequate protection, such as the member states of the European Union, on the recipient’s certification under the Swiss-U.S. Data Privacy Framework, recognised since 15 September 2024, or, failing that, on standard contractual clauses adapted to Swiss law. This currently applies to Resend, which is not certified for Switzerland. Processing agreements, subprocessor lists and the official list of certified companies are referenced below. A European server location alone does not rule out transfers. On request we can clarify recipients and safeguards concerning your data. No overall compliance certification is claimed here.

6. Retention

Orders, amounts, refunds and evidence of the accepted terms (version, language, document fingerprint): ten years from the end of the calendar year of the order’s last payment event (purchase, refund or dispute), then deleted automatically, unless a dispute or review is still open. Access rights tied to an order end with it: the account then no longer offers the corresponding versions, without affecting the licence to files already downloaded. Published versions of the terms and conditions remain archived.

Notes, customer record, tasks and language preference used for customer care: deleted three years after your last purchase or the last exchange recorded with you (office note, task created or completed, closure of a delivery incident, accepted delivery email, sign-in link request made within the last 30 days, change to the customer record). We keep no record of sign-ins beyond that: an older sign-in does not extend this period. We do not store emails in our database: a message not recorded in a note does not extend it either. Nothing is deleted while a task, delivery incident or payment review concerning you remains open. Customer-care records of an account linked to an MCP application are kept as long as that application exists.

Customer account (email address, sessions and dependent technical records): deleted once it has had no order for ten years, after its orders and customer-care records have been deleted under the rules above, and when no session is active. An account linked to an MCP application is kept as long as that application exists.

Sessions: valid for up to 30 days; sign-in links: 15 minutes; delivery links: 48 hours. Expired entries are removed during periodic cleanup. Internal statistical events as well as delivery-email technical identifiers and download-link records (account, product, version, preparation and authorisation times, without the secret link) are deleted after 180 days during cleanup. Authorising a download does not prove that the file was fully received or opened.

Encrypted technical copies from CRM connectors and financial reconciliation: around 30 days, purged by UTC day during periodic cleanup (scheduled every six hours) and subsequent consultations, with volume caps. Original mail at the email providers is retained as needed for the relationship, complaints and legal duties; technical cleanup does not erase it. Customer-care notes follow the three-year rule above.

Encrypted backups support incident recovery. Deletion may take effect there only when the retention cycle expires. Each automatic deletion is entered in a register holding only an internal identifier, a category and a date; after a restoration, it is reapplied at start-up or, at the latest, at the next cleanup. After a restoration, applicable deletion requests must be reapplied. We review erasure requests to limit retained data to what is needed.

7. Cookies and audience measurement

The necessary cookies __Host-osd_session (sign-in, up to thirty days) and __Host-osd_login (confirmation, up to five minutes) are protected by HttpOnly, Secure and SameSite and restricted to the site that issues them. Payment links lead to Stripe, whose cookies and notice apply on its page. The site uses no OpenSwissData advertising cookie; Plausible works without cookies. This does not mean no technical data are processed. Our emails contain no tracking pixel and their links are not routed through a click-measurement service.

You can remove cookies in your browser, ending the session. Server-side measurement uses the technical data described above without an identifier stable across days. You may contact the controller to object where applicable law provides that right.

8. Your rights and reports

Depending on applicable law, you may request access, correction, erasure, restriction, objection and delivery or transfer of your data under statutory conditions. Email contact@openswissdata.com describing your request; proportionate identity verification may be needed. Access requests are normally answered within 30 days, subject to explained statutory exceptions.

For public-register data, identify the entry, source and alleged error. We review correction, context or justified removal without silently altering official documents. You may contact the Swiss Federal Data Protection and Information Commissioner (FDPIC), or your competent national authority where the GDPR applies.

9. Notice changes

The date reflects an actual editorial revision. Changed processing may require an update and, where legally required, specific information or fresh consent. A new notice is not retrospective consent.