Privacy policy

This policy explains how Pilae SA handles personal data when you visit pilae.com or write to us through it. It is written under the Swiss Federal Act on Data Protection (FADP) and, where it applies to you, the EU General Data Protection Regulation (GDPR).

The short version: we have what you send us, what a web server needs to deliver a page, and what our analytics records about how you use the site. The site runs no advertising trackers, and you can turn analytics off (section 3). Questions go to privacy@pilae.com.

1. Who is responsible

Pilae SA, Rue de Bourg 27, 1003 Lausanne, Switzerland, is the controller of the personal data described here. Contact: privacy@pilae.com.

2. What we collect and why

When you visit the site

Your browser sends your IP address, the page requested, the time and your browser's user agent. Our hosting provider records these in request logs, which we use to deliver the site, diagnose errors and protect it against abuse. Legal basis: our legitimate interest in a working, secure website (GDPR Art. 6(1)(f)).

How you use the site

Our analytics is set up and configured by us and runs on our own domain. It records the pages you view, the site and any campaign tags you arrived with, what you click, how far you scroll, errors and load times, and a recording of the page as you use it, with everything typed into a form hidden. It also stores your IP address and the approximate location derived from it, your browser and device, and the name of the network you connect from, such as your employer's or your internet provider's, as our hosting provider reports it. If you then write to us, book a call or request an account, we link your email address, name and organisation to this record, so we know what you read before getting in touch. Legal basis: our legitimate interest in understanding who is interested in our services and in improving the site (GDPR Art. 6(1)(f)). You can turn it off at any time (section 3).

When you use the contact form

We receive your email address, the topic you chose, your message, your name and organisation if you give them, the page you wrote from, and your IP address and user agent. We use them to answer you and to recognise automated abuse of the form. Your email address is required, otherwise we cannot reply. Legal basis: steps you ask us to take before a possible contract, and our legitimate interest in answering enquiries and keeping the form free of spam (GDPR Art. 6(1)(b) and (f)).

When you request an account

We receive your name, your email address, your organisation and the plan you chose, and your IP address and user agent. We use them to review the request, send you the invitation and recognise automated abuse of the form. Your name, email address and organisation are required, otherwise we cannot set up the account. Legal basis: steps you ask us to take before a contract, and our legitimate interest in keeping the form free of spam (GDPR Art. 6(1)(b) and (f)).

When you book a call

We receive your name, your email address, the time you chose and your time zone, and your organisation and what you would like to cover if you give them. They are stored on our own scheduling server, book.pilae.cloud, which puts the call in our calendars and sends you and us the invite with the Google Meet link. We use them to hold the call and prepare for it. The call itself takes place on Google Meet, under Google's own terms and privacy policy. Your name and email address are required, otherwise we cannot send the invite. Your IP address is used, without being stored, to limit how many calls can be booked in a row and keep the calendar free of automated abuse. Legal basis: steps you ask us to take before a possible contract, and our legitimate interest in preventing abuse (GDPR Art. 6(1)(b) and (f)).

When you email us directly

We receive what you send, and use it to reply. The same legal bases apply.

We do not buy personal data or sell it. The one thing we add to what your browser sends is the name of the network it connects from, described above. We do not add you to a mailing list because you wrote to us.

3. Cookies and tracking

Our analytics sets one cookie and keeps matching entries in your browser's local and session storage. They hold a random identifier, so that visits from the same browser count as one visitor, and last up to a year. Our hosting provider also counts page views, without cookies. The site runs no advertising trackers and no social media plugins. Fonts and images are served from pilae.com itself.

The site links to other sites, such as LinkedIn, GitHub and the projects and companies it mentions. Once you follow a link, that site's own privacy policy applies.

4. Who receives the data, and where

Two service providers process the data on our behalf:

• Cloudflare, Inc., United States. Hosts the website, keeps the request logs, counts page views, reports the network a visit comes from and delivers form messages to our mailbox. Cloudflare serves the site from the data centre closest to you, so a request may be handled outside Switzerland and the EU. Safeguard: Cloudflare's certification under the Swiss-U.S. and EU-U.S. Data Privacy Frameworks, and the Standard Contractual Clauses in its data processing addendum.
• An analytics provider, which holds the analytics data in the EU.

We may also disclose personal data where the law requires it, for example to an authority acting on a legal order. You can ask us for a copy of the safeguards named above at privacy@pilae.com.

5. How long we keep it

• Request logs: a few days, at most seven, after which Cloudflare deletes them.
• Analytics: recordings of the page for 30 days, everything else for 24 months, then deleted.
• Enquiries, account requests, booked calls and email exchanges: twelve months after our last exchange, then deleted.
• If an enquiry leads to a contract: the correspondence becomes part of the business records, which Swiss law requires us to keep for ten years (CO Art. 958f).

6. Security

The site is only served over HTTPS, so data between your browser and the site is encrypted in transit. Access to the mailbox that receives your messages is limited to Pilae staff who need it to answer you.

7. Your rights

You can ask us what personal data we hold about you and receive a copy of it, have it corrected or deleted, restrict or object to its processing, and receive it in a portable format. Write to privacy@pilae.com. We may ask you to confirm your identity, and we reply within 30 days.

You can also complain to a supervisory authority: in Switzerland, the Federal Data Protection and Information Commissioner (FDPIC); in the EU, the data protection authority of the country where you live or work.

8. Automated decisions

We make no decisions based solely on automated processing. We do look at how an individual visitor used the site, and which organisation's network they came from, to understand interest in our services and prepare a conversation. Nothing is decided about you automatically.

9. What this policy does not cover

This policy covers pilae.com. When Pilae runs applications for a customer, the personal data inside them is processed on the customer's instructions, under the contract and data processing agreement signed with that customer.

10. Changes

We update this policy when what the site does changes. The date at the top of the page shows the current version.