Privacy policy

This policy explains what personal data karpinity.com processes, why, for how long, and what rights apply. It covers Switzerland’s revised Federal Act on Data Protection (revFADP)¹ and, for visitors in the European Economic Area, the EU General Data Protection Regulation (GDPR)².

Controller

The data controller is:

Davidovski GmbH, trading as KARPINITY Wehntalerstrasse 283A, 8046 Zürich, Switzerland UID CHE-483.604.189 Contact for privacy matters: innovation [at] karpinity.com

Full statutory registration details are in the Impressum.

Analytics and cookies

This site uses two analytics tools. They differ in whether they need your consent.

Cloudflare Web Analytics (always on, cookieless)

Cloudflare Web Analytics measures page views and page performance. It sets no cookies, uses no client-side storage to collect usage metrics, and does not fingerprint visitors by IP address, user agent or any other data point.³ No individual visitor can be identified from this data, so no consent is required and none is asked for.

Google Analytics 4 (only with your consent)

Google Analytics 4 is not loaded when you first visit. Your browser makes no request to Google for analytics until you press “Accept” in the cookie notice. If you press “Decline”, or ignore the notice, Google Analytics is not loaded and nothing is sent to Google for analytics.

If you accept, Google Analytics sets two first-party cookies in your browser:

• _ga, which distinguishes visitors, valid for up to 2 years;
• _ga_<container id>, which keeps session state, valid for up to 2 years.

Google Analytics then processes your pseudonymous online identifier, the pages you view, approximate location derived from your IP address, and device and browser information, to show us which pages are read. We do not use it for advertising, and advertising storage and personalisation signals stay denied.

• Legal basis (GDPR): Art. 6(1)(a) GDPR, your consent, together with the consent requirement for cookies and similar technologies.
• Legal basis (revFADP): your consent, given by pressing “Accept”.
• Retention: we set the retention of Google Analytics event data to 14 months, after which Google deletes it.
• Recipient and transfer: the provider is Google Ireland Limited, with Google LLC in the United States as its processor. Data may therefore be transferred to the United States. The safeguard is the Swiss-US Data Privacy Framework and the EU-US Data Privacy Framework, to which Google LLC is certified, supplemented by standard contractual clauses where needed.
• Withdrawing consent: choose “Cookie settings” in the footer of any page and press “Decline”. Google Analytics stops, and the _ga cookies are removed from your browser. You can also delete them in your browser settings at any time. Your choice is stored in your browser’s local storage, not in a cookie, and you can change it as often as you like.

What personal data is processed, and why

This site processes two categories of personal data, both provided by you directly and voluntarily. Nothing else is collected.

Contact form submissions

When you submit the contact form, we process your name, email address and message to respond to your enquiry.

• Legal basis (GDPR): Art. 6(1)(b) GDPR, taking steps at your request prior to entering into a contract, and Art. 6(1)(f), our legitimate interest in responding to enquiries sent to us.
• Legal basis (revFADP): the FADP does not require a GDPR-style enumerated legal basis. It requires processing to be lawful, in good faith, proportionate, and limited to the purpose disclosed at collection.⁴ Responding to a message you send us meets each of those principles.
• Retention: we keep your message only as long as we need it to answer you and to assess whether an engagement is a fit, then delete it. We have not yet fixed a number of months; when we do, it will be stated here.

Zeza waitlist signups

When you join the Zeza waitlist, we process your email address to tell you when Zeza is available.

• Legal basis (GDPR): Art. 6(1)(a) GDPR, your consent, given by submitting the form.
• Legal basis (revFADP): consent given at signup. Swiss law relies on consent here too, since joining a waitlist is not necessary to fulfil any existing contract.
• Retention: we keep your email address only as long as we need it to tell you about Zeza’s availability, or until you ask us to remove it. We have not yet fixed a number of months; when we do, it will be stated here.

Beyond these two categories and the analytics described above, we process no personal data on this site today: no account system and no e-commerce.

Who processes this data on our behalf

We use three third-party processors, each under a data processing agreement or equivalent terms:

• Cloudflare, for hosting, Cloudflare Pages, Cloudflare Workers, Cloudflare KV storage (which holds form submission and waitlist data), and Cloudflare Turnstile (which tells human visitors from bots on our forms without a visible CAPTCHA).

• Resend, for transactional email: the notification sent when a contact form or waitlist submission arrives.

• Google, for Google Analytics 4, only if you accept analytics cookies (see “Analytics and cookies” above).

None of them is authorized to use this data for its own purposes beyond providing the service.

International transfers

Cloudflare operates a global network, and Resend and Google are headquartered in the United States, so data processed by any of them may leave Switzerland and the EEA. Where that happens, the transfer safeguard is the standard contractual clauses (SCCs) in each processor’s data processing agreement. Cloudflare and Resend offer them for Swiss- and EEA-originating data. For Google Analytics, the safeguard is the Data Privacy Framework described above. Switzerland is also recognised by the European Commission as providing an adequate level of data protection.⁵

How long data is kept

Retention for each category is set out above. Where no fixed number of months is stated, we delete the data once it has served its purpose. You can ask us to delete it sooner at any time.

Your rights

Under the revFADP

If you are in Switzerland, you have the right to:

• ask whether we process data about you and access it, including the minimum information Art. 25 revFADP requires us to disclose (such as the purpose of processing and its retention period), typically within 30 days and free of charge⁶;
• request correction of inaccurate data;
• request deletion or restriction of processing;
• object to processing, subject to the exceptions the Act provides.

Under the GDPR

If you are in the EEA, you additionally have the right to: access your data (Art. 15); rectification (Art. 16); erasure (Art. 17); restriction of processing (Art. 18); data portability (Art. 20); and objection to processing (Art. 21). You also have the right to lodge a complaint with a supervisory authority in your country of residence, place of work, or the place of the alleged infringement (Art. 77).

To exercise any of these rights, contact innovation [at] karpinity.com.

Data breach notification

If a personal data breach occurs, our notification obligations differ by regime. The GDPR requires notification to the relevant supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of a breach (Art. 33).⁷ The revFADP sets no fixed deadline. It requires notification to the FDPIC “as soon as possible” once it is established that a breach is likely to result in a high risk to the data subject’s personality or fundamental rights.⁴

Changes to this policy

This policy is updated when processing activities change. The date at the top of this page shows the last update.

Footnotes

1. Switzerland’s revised Federal Act on Data Protection (revFADP), formally the Federal Act on Data Protection (FADP), SR 235.1, in force since 1 September 2023. Official consolidated text: https://www.fedlex.admin.ch/eli/cc/2022/491/en. ↩

2. Regulation (EU) 2016/679 (General Data Protection Regulation). Official text: https://eur-lex.europa.eu/eli/reg/2016/679/oj. ↩

3. Cloudflare, “Web Analytics” documentation: Cloudflare Web Analytics does not use any client-side state, such as cookies or localStorage, to collect usage metrics, and does not fingerprint individuals via IP address, user agent string or other data for the purpose of displaying analytics. https://www.cloudflare.com/web-analytics/. ↩

4. FADP Art. 6 (general processing principles: lawfulness, good faith, proportionality, purpose limitation) and Art. 24 (breach notification “as soon as possible,” with no fixed deadline, in contrast to the GDPR’s 72-hour standard). Official text: https://www.fedlex.admin.ch/eli/cc/2022/491/en. ↩ ↩²

5. Cloudflare Customer DPA, incorporating EU Standard Contractual Clauses for both EEA- and Switzerland-originating transfers: https://www.cloudflare.com/cloudflare-customer-dpa/. Resend Data Processing Addendum, incorporating EU Standard Contractual Clauses for EEA, UK and Switzerland transfers: https://resend.com/legal/dpa. ↩

6. FADP Art. 25 (right of access): sets out the minimum information a controller must disclose on request, including the purpose and retention period of processing; access is provided free of charge in principle and typically within 30 days. Official text: https://www.fedlex.admin.ch/eli/cc/2022/491/en. ↩

7. GDPR Art. 33 (notification of a personal data breach to the supervisory authority): without undue delay and, where feasible, not later than 72 hours after having become aware of it. Official text: https://eur-lex.europa.eu/eli/reg/2016/679/oj. ↩