Privacy policy

1. Controller

The controller responsible for processing your personal data is:
Swiss GU Group GmbH
Gaswerkstrasse 33
4900 Langenthal
Schweiz
Email: info@swizz-it.com

The Swizz-IT brand and the swizz-it.com website belong to this company.

2. What data we process

• Customer account: name, company, address, email address, phone number. We only store your password as a non-reversible hash.
• Orders: selected products, plans and domains, term and proof of your consent to the terms and conditions (time, IP address, version of the terms).
• Invoices and payments: invoice amounts, payment status and the payment reference. You enter card details directly with the payment service provider; they are not stored by us.
• Support tickets: content and history of your requests.
• Move: your access data at your previous provider if you start a move to us. We store it encrypted, use it only for the move and delete it as soon as the move has been completed or cancelled.
• Login log: time, IP address and result of login attempts. For addresses without an account, we only store the part after the @.
• Server logs: when you visit our website, the IP address, time, page visited and information about the browser.
• Product data: depending on the product, further information such as domain holder data; details are given in section 5.

3. Purposes and legal bases

We process your data in order to:

• carry out your order and provide the products ordered,
• issue invoices and process payments,
• answer your support requests and inform you about your contract,
• protect our systems and prevent misuse, for example by blocking logins after repeated failed attempts,
• fulfill legal obligations, in particular the retention of business records.

The legal basis is the Swiss Federal Act on Data Protection (FADP). Insofar as the EU General Data Protection Regulation (GDPR) applies, we rely on the performance of the contract (Art. 6 para. 1 lit. b GDPR), on legal obligations (lit. c) and on our legitimate interest in secure systems (lit. f).

4. Controller and processor

This privacy policy applies to the data we process as a controller, that is, to the data of our customers and of the visitors to swizz-it.com.

Our customers are themselves responsible for the data they process on their websites, in their databases and mailboxes or in other products. We only process this data on their behalf as a processor under the data processing agreement. If you visit a website operated with us or write to a mailbox hosted by us, the privacy policy of the respective operator applies. We forward requests about this to our customer.

5. Processing by product

Web hosting

For a web hosting account, we process your account data, the assigned domains, the settings in the customer panel and technical logs of the web server. We process the content of your websites and databases as a processor (section 4).

Domains

To register a domain, we pass the holder data (name, address, email address, phone number) on to our partner registrar and to the registry of the respective extension. The registry determines which holder data can be retrieved via public lookup services (Whois, RDAP) or is disclosed to persons with a legitimate interest; for .ch and .li the rules of the SWITCH foundation apply, for generic extensions the requirements of ICANN. To check whether a domain is available, we query a public DNS service; only the domain name searched for is transmitted.

Email

We process the content of your mailboxes as a processor (section 4). Incoming emails are automatically checked for spam and malware. We send our own emails to you, such as confirmations, invoices and password reset links, through an email delivery service.

SSL certificates

For an SSL certificate, we transmit the domain name to a certification authority if the product is ordered or you set up a free certificate in the customer panel. Issued certificates are logged in public directories (Certificate Transparency). For paid certificates with verification of the company, the certification authority additionally receives the information it requires for this verification.

Website Builder

If the product is ordered, the provider of the website builder stores your account data and the content of the website created with it. We and the provider process the content as processors (section 4).

6. Recipients

To provide our services, we pass data on to the following categories of recipients:

We do not sell data and do not pass it on for advertising purposes. Authorities only receive data if we are legally obliged to provide it.

7. Disclosure abroad

According to Annex 1 of the Swiss Data Protection Ordinance (DPO), Germany, Finland, Ireland, the Netherlands and France ensure an adequate level of data protection. We only disclose data to the USA and to other countries without adequate data protection with appropriate safeguards: to companies certified under the Swiss-U.S. Data Privacy Framework, or on the basis of standard contractual clauses recognized by Switzerland.

If the registry of a domain extension is located in a country without adequate data protection, we disclose the holder data because this is necessary for the registration of the domain you requested (Art. 17 para. 1 lit. b FADP).

8. Cookies and local storage

Our website only sets technically necessary cookies: a session cookie that keeps you logged in and protects forms against misuse and, as soon as you choose a language, the cookie swizzit_sprache. It only stores the chosen language, cannot be read by scripts and is deleted after 365 days. If you are logged in, we also store the chosen language in your customer account.

If you put something in your cart, we also set the cookie swizzit_warenkorb. It only contains a random key so that your cart is kept, cannot be read by scripts and is deleted after 30 days. On our side we only store a value derived from it (a checksum), not the key itself. When you log in, we assign the cart to your customer account.

We do not store your choice in the cookie notice as a cookie, but in your browser's local storage. We do not use any analytics, tracking or advertising services.

9. Fonts and external content

We deliver the fonts of our website from our own server; no Google Fonts or scripts of other providers are loaded. For a card payment, we redirect you to the payment page of the payment service provider; its privacy policy applies there.

10. Retention

• We keep business records such as invoices and accounting vouchers for 10 years (Art. 958f of the Swiss Code of Obligations).
• We delete records of login attempts used for blocking after failed attempts after 7 days.
• We delete security logs (for example on logins and repelled attacks) and server logs with IP addresses after 30 days at most.
• We delete logs of our requests to the domain registrar (for example registration, transfer and DNS records, with the owner data transmitted for this purpose, but without email addresses and transfer codes) after 90 days.
• We delete websites, databases and mailboxes 30 days after the end of the contract for the respective product.
• We only keep other data for as long as necessary for the contract, for security or for legal reasons.

11. Data security

All connections to our website and to the customer panel are encrypted with HTTPS. We only store passwords as a hash, logins are temporarily blocked after repeated failed attempts, and every hosting account runs under its own system user. We also keep encrypted backup copies in a data center in Finland (EU).

To protect our systems, we automatically check publicly accessible pages and file names of customer websites for indications of prohibited content. We use information from abuse reports (address, description, optional contact details) only to handle the report; the IP address is kept in the security log for no more than 30 days.

12. Your rights and contact

You can request information about the personal data we process about you, have incorrect data corrected, request the deletion or restriction of processing, object to processing and request your data in a common format, unless legal obligations prevent this.

To do so, please contact info@swizz-it.com. You also have the right to lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC) or with the supervisory authority responsible for you.

13. Changes

We adapt this privacy policy when our services or the legal situation change. The version published on this page is authoritative.