Privacy Policy

Controller

The controller for the processing of personal data on this website is:

For questions about data protection, or to exercise your rights, write to gdpr@cumuluspro.com.

Scope

This policy covers archive.cumuluspro.com: visits to the website, booking a demo or a pricing call through Microsoft Bookings, the Microsoft Teams meeting that follows, and emails you send us.

It does not cover the CumulusPro Archive service itself. When customers use the service, CumulusPro processes personal data on their behalf as a processor, under a data processing agreement. That processing is described in the agreement, available on request.

Data collected

When you visit the website

• Technical data that your browser sends to our hosting provider with every request: IP address, date and time, page requested, referring page, browser and operating system. This is needed to deliver the website and keep it secure.
• Anonymous usage statistics through Plausible Analytics: pages visited, referring website, country, browser and device type. Plausible sets no cookies and does not store your IP address. It counts unique visitors with a daily changing value that cannot identify you.
• If you consent: data collected by the LinkedIn Insight Tag (see Cookie Notice).

When you book a demo or a pricing call

• Name, company, work email address, phone number (optional), the topics you want us to focus on (optional), and the date and time you choose.
• When you join the Microsoft Teams meeting: your name as shown in Teams and the technical data Teams needs to connect the call.

When you email us

• Your email address, name and the content of your message.

Purposes and legal bases

• Delivering and securing the website (technical data): our legitimate interest in operating a secure website (Art. 6(1)(f) GDPR).
• Understanding how the website is used (Plausible): our legitimate interest in improving the website. No personal data is stored.
• Arranging and holding demos and pricing calls, and sending a pricing proposal: steps taken at your request before a possible contract (Art. 6(1)(b) GDPR) and our legitimate interest in responding to business enquiries (Art. 6(1)(f) GDPR).
• Answering your emails: our legitimate interest in responding to enquiries (Art. 6(1)(f) GDPR).
• Measuring our LinkedIn campaigns (LinkedIn Insight Tag): your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time.

Where the Swiss Federal Act on Data Protection (FADP) applies, we process personal data in line with its principles. We do not use your data for automated decision-making or profiling.

Processors

We use the following service providers, who process personal data on our behalf under a data processing agreement:

• Microsoft (Microsoft Ireland Operations Limited): Microsoft Bookings and Microsoft Teams for demos and pricing calls, Microsoft 365 for email, and Azure Static Web Apps for hosting the website.
• Plausible Insights OÜ, Estonia: website analytics without cookies, hosted in the EU.

With your consent, LinkedIn (LinkedIn Ireland Unlimited Company) receives data through the LinkedIn Insight Tag. LinkedIn processes this data as a joint controller with us for the measurement of our campaigns. [verify with counsel]

We do not sell or rent personal data. We may disclose personal data where the law requires it, for example to comply with a court order.

International transfers

We store and process personal data in Switzerland and the European Economic Area. [verify: data location of the Microsoft 365 tenant] Switzerland and the EU recognise each other as providing adequate data protection.

Microsoft and LinkedIn may process data in the United States. These transfers rely on the EU-U.S. Data Privacy Framework and the Swiss-U.S. Data Privacy Framework, under which both companies are certified, and on the European Commission's standard contractual clauses.

Retention

• Technical data in hosting logs: deleted automatically by our hosting provider after a short period.
• Booking data and emails: kept for as long as needed to handle your request and any business relationship that follows, then deleted, unless legal retention obligations require us to keep them longer. [verify: retention period]
• Data collected through the LinkedIn Insight Tag: retained by LinkedIn as described in its privacy policy.

Data subject rights

Subject to the conditions of the applicable law, you have the right to:

• access the personal data we hold about you;
• have inaccurate or incomplete data corrected;
• have your data deleted;
• restrict the processing of your data;
• receive your data in a common, machine-readable format, or have it transferred to another organisation;
• object to processing based on our legitimate interests, including direct marketing;
• withdraw consent at any time, without affecting the lawfulness of processing before the withdrawal.

To exercise your rights, write to gdpr@cumuluspro.com. If we cannot confirm your identity from your request, we may ask you for additional information.

Complaints

If you believe we process your personal data unlawfully, you can lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, www.edoeb.admin.ch, or with the data protection authority in the EU country where you live or work. We would be glad if you contacted us first at gdpr@cumuluspro.com.

Cookies

This website uses no cookies for analytics. The LinkedIn Insight Tag, which sets cookies, is loaded only after you consent. Details, and how to withdraw consent, are in the Cookie Notice.

Effective date

This policy is effective from [verify: date of publication]. We may update it when our website or the law changes; the current version is always published on this page.