1. General Information and Controller
This Privacy Policy explains how RIVADIAN ("we," "us," or "RIVADIAN") processes personal data in accordance with the revised Swiss Federal Act on Data Protection (revFADP) and, where applicable, the EU General Data Protection Regulation (GDPR).
The controller responsible for data processing is:
RIVADIAN Tecer
Guggelsstrasse 1
8842 Unteriberg
Switzerland
UID: CHE-152.888.457
For any privacy-related inquiries or to exercise your data subject rights, please contact our Data Protection Officer (DPO) at: privacy@rivadian.com.
2. Personal Data We Process
Personal data is processed when you contact us, engage our services, or use our website, either directly by RIVADIAN or through the service providers supporting our website and business operations.
Communication Data: Name, email address, and message content when you use our contact form or email us. Please refrain from submitting sensitive personal data or confidential client information via the website contact form.
Technical Data: Our website hosting and security providers automatically process technical information when you use our website. Depending on the service and its configuration, this may include your IP address, browser and device information, timestamps, and request metadata. This information is processed to deliver the website, maintain its security and functionality, and prevent spam and abuse. Further information about these providers appears in sections 4 and 5.
Engagement Data: Business contact details, communication records, and project-related information necessary to negotiate and fulfill advisory engagements.
3. Purposes and Legal Bases for Processing
We process your personal data for the following purposes, relying on the indicated legal bases (Art. 31 FADP / Art. 6(1) GDPR):
Pre-contractual and Contractual Obligations: To respond to your inquiries, provide proposals, and deliver agreed cybersecurity advisory services (Performance of a Contract / Pre-contractual measures).
Security and Operation: To operate our website, prevent spam, detect abusive activity, and maintain network security (Legitimate Interest).
Legal Compliance: To maintain mandatory business records and comply with statutory retention laws (Legal Obligation).
4. Data Sharing and Service Providers
To operate our business and website securely, we utilize specialized third-party service providers who act as data processors. These include:
Netlify (USA): Website hosting and initial contact form data storage.
Microsoft 365 / Exchange Online (Switzerland/EEA): Email hosting and mailbox management.
Google Cloud / reCAPTCHA Enterprise (USA): Bot protection and spam prevention.
Cloudflare (USA): DNS, reverse proxy, and web traffic security.
We only disclose data to third parties if required by law, court order, or if necessary to enforce our legal rights. We do not sell your data or use it for advertising analytics.
5. Cookies and Bot Protection (reCAPTCHA)
Our website uses Google reCAPTCHA Enterprise strictly for security and abuse prevention. This service places a strictly necessary cookie (_GRECAPTCHA) and analyzes technical metadata (such as IP address and browser behavior) to distinguish humans from automated bots. This processing is based on our overriding legitimate interest in protecting our IT infrastructure. We do not deploy marketing, tracking, or analytical cookies.
6. International Data Transfers
Personal data may be processed in Switzerland, the European Economic Area (EEA), and the United States. Where data is transferred to a country lacking an adequate level of statutory data protection (e.g., the USA), we ensure appropriate safeguards are in place. These include reliance on the Swiss-U.S. Data Privacy Framework, the EU-U.S. Data Privacy Framework, or the execution of Standard Contractual Clauses (SCCs) with the necessary Swiss adaptations as mandated by the Federal Data Protection and Information Commissioner (FDPIC).
7. Data Retention
We retain personal data only as long as necessary for the purposes outlined above:
Inquiries: Up to 12 months after the last substantive correspondence.
Engagement Records: For the duration of the engagement and up to 10 years thereafter to comply with Swiss commercial and tax law retention requirements.
Form Submissions (Netlify): Automatically deleted within 90 days.
8. Your Rights as a Data Subject
Under the revFADP and GDPR, you have the right to:
Request access to the personal data we hold about you.
Request correction of inaccurate data or deletion of your data.
Object to processing based on legitimate interests.
Request restriction of processing or data portability (where applicable).
Withdraw your consent at any time, with future effect.
To exercise these rights, contact privacy@rivadian.com. You also have the right to lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC) or your competent supervisory authority.
9. Policy Updates
We reserve the right to amend this Privacy Policy to reflect technical or legal changes. The current version published on our website applies.