Privacy Policy

The controller responsible for processing your personal data is:

Garzon Jimenez de Cisneros Analytics (Sonnenberg Analytics)
Benjamín Garzón
Sihlquai 131
8005 Zurich, Switzerland
Email: info@sonnenberg-analytics.com

This privacy policy explains how we process personal data when you visit this website, contact us or do business with us. It is based on the Swiss Federal Act on Data Protection (FADP) and, where applicable, the EU General Data Protection Regulation (GDPR). We have not appointed a representative in the EU, as our processing of data of persons in the EU is only occasional and low-risk (Art. 27(2) GDPR).

This website is hosted by Vercel Inc. (USA). Each time you access the website, Vercel automatically processes technical data transmitted by your browser, such as your IP address, date and time of access, requested page, referring URL, browser type and operating system. This is necessary to deliver the website and keep it secure and stable. Where the GDPR applies, the legal basis is our legitimate interest in operating a secure website (Art. 6(1)(f) GDPR). Vercel retains this log data only for a short period in accordance with its own retention policy.

We use Vercel Web Analytics, provided by Vercel Inc. (USA), to obtain aggregated statistics on how the website is used, such as pages visited, referring websites, country, browser and device type. Vercel Web Analytics does not use cookies or store any data on your device. Visitors are distinguished using a hash of the incoming request that is discarded after 24 hours; your IP address is not stored, and the data cannot be used to identify you or to track you across other websites. Where the GDPR applies, the legal basis is our legitimate interest in understanding and improving the use of our website (Art. 6(1)(f) GDPR). You may object to this processing at any time (see section 10).

If you accept analytics in the consent banner, we use Google Analytics 4, a web analytics service provided by Google Ireland Limited (Ireland) and Google LLC (USA). Google Analytics sets cookies and collects data such as pages visited, session duration, approximate location, browser and device type, and referring URL. Google Analytics 4 does not log or store IP addresses; they are used only briefly to derive an approximate location. We use this data to understand how visitors use the website and to improve its content.

Google Analytics is loaded only after you have given your consent (where the GDPR applies, Art. 6(1)(a) GDPR). You can withdraw your consent at any time via the 'Manage consent' link in the page footer; this does not affect the lawfulness of processing before the withdrawal. Analytics data is retained for 14 months and then automatically deleted. For more information, see the Google Privacy Policy.

When you contact us via the contact form or by email, we process the data you provide (name, email address, message content and any other information you include) in order to respond to your enquiry and, where relevant, to take steps at your request before entering into a contract. Where the GDPR applies, the legal basis is taking pre-contractual steps (Art. 6(1)(b) GDPR) or our legitimate interest in responding to enquiries (Art. 6(1)(f) GDPR).

Contact form submissions are processed by Formspree, Inc. (USA), which forwards them to our mailbox and deletes them after 30 days. Emails are stored in Gmail, provided by Google Ireland Limited (Ireland) and Google LLC (USA). We keep enquiries for up to 12 months after our last contact, unless they lead to a business relationship (see section 6).

If you are a client, prospective client or business partner, we process the data needed to prepare, perform and invoice our services, such as names, contact details, job titles, correspondence, contract and billing data. Where the GDPR applies, the legal basis is the performance of a contract (Art. 6(1)(b) GDPR), compliance with legal obligations (Art. 6(1)(c) GDPR) and our legitimate interest in managing business relationships (Art. 6(1)(f) GDPR). Business records relevant for accounting, such as contracts and invoices, are retained for 10 years as required by Swiss law (Art. 958f Swiss Code of Obligations). Other data is deleted once it is no longer needed.

We do not sell your personal data. We disclose it only to service providers that process it on our behalf, and to authorities where required by law:

• Vercel Inc. (USA) — website hosting and Vercel Web Analytics
• Formspree, Inc. (USA) — contact form processing
• Google Ireland Limited (Ireland) and Google LLC (USA) — Google Analytics 4, only with your consent
• Google Ireland Limited (Ireland) and Google LLC (USA) — Gmail, email communication
• Accounting, tax and IT service providers — business administration, for client data

Some of the recipients listed above are located in the USA. Switzerland and the EU recognise the USA as providing adequate data protection for companies certified under the Swiss-U.S. and EU-U.S. Data Privacy Framework (for example, Google LLC). Where a recipient is not certified, transfers are based on the European Commission's Standard Contractual Clauses, as recognised by the Swiss Federal Data Protection and Information Commissioner (FDPIC) and adapted to Swiss law, or on another safeguard permitted by law.

Without your consent, this website does not set any cookies. It uses your browser's local storage only for the following entries, which never leave your device:

• “analytics_consent” — remembers your consent choice
• “theme” — remembers your light/dark display preference, if you set one

Google Analytics cookies (such as “_ga”) are set only after you accept analytics in the consent banner. You can delete cookies and local storage entries at any time in your browser settings.

Subject to the applicable law, you have the right to:

• request information about the personal data we hold about you
• have inaccurate data corrected
• have your data deleted
• object to processing, including processing based on our legitimate interests
• receive the data you have provided to us in a common electronic format, or have it transferred to another controller (data portability)
• withdraw your consent at any time with effect for the future
• request restriction of processing (where the GDPR applies)

We do not make decisions based solely on automated processing that have legal or similarly significant effects on you.

To exercise your rights, please contact us at info@sonnenberg-analytics.com. We may ask you to verify your identity. You also have the right to lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC) at www.edoeb.admin.ch or, if you are located in the EU/EEA, with the data protection authority in your country.

This privacy policy may be updated from time to time to reflect changes in legal requirements or our data processing activities. The 'Last updated' date at the top of this page indicates the most recent revision.