Privacy Policy

Rhaetix AG · Last updated: 09.11.2026 · Version 1.0

Rhaetix AG (hereinafter "Rhaetix", "we", or "us") operates the website rhaetix.com and the Rhaetix Workspace. Protecting your data is not merely an obligation for us, but part of our product: this website sets no cookies, loads no third-party content, and uses no tracking technologies.

This Privacy Policy informs you about which personal data we process, for what purposes, and what rights you have. It is governed by the Swiss Federal Act on Data Protection (FADP / DSG, revised version) and, where applicable, the EU General Data Protection Regulation (GDPR).

1. Controller

1.1 Controller

Rhaetix AG
Obere Briggasse 175
3902 Glis
Switzerland

Email: contact@rhaetix.com

2. Principles of Our Data Processing

Data minimisation: We collect only the data required for the respective purpose.
Hosting in Switzerland: This website and the Rhaetix Workspace are hosted in Switzerland.
End-to-end encryption: In the Rhaetix Workspace, chat messages and shared files are encrypted on your device; the keys remain with you. Which data our servers can technically view is documented on our Security page.
No sharing for advertising purposes: We do not sell or rent personal data.

3. Data Processing on This Website

3.1 Server Log Files (Hosting)

When you access this website, the hosting server automatically collects and stores information in so-called server log files:

IP address
Date and time of the request
Requested page / file
User-Agent (browser type, operating system)
Referrer URL (if transmitted)

Purpose: Ensuring operation, system security, error analysis, and defence against attacks.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure operation); processing within the principles of the Swiss FADP (DSG).

Retention period: 30 days, followed by deletion or anonymisation.

Recipient: Our hosting provider "Infomaniak Network SA" (CH-660.0.059.996-1), Switzerland. Data is not transferred to third countries.

3.1.1 Language Preference (Local Storage)

To remember the visitor's chosen language, the site stores a single value (rhaetix-lang) in the browser's local storage. It is strictly necessary for that function, contains no personal data, and is never transmitted.

3.2 Contact Form and Email Enquiries

If you contact us by email or via a contact form provided in the future (we currently do not offer a contact form on this website), we process:

Name
Email address
Company (if provided)
Content of your message as well as any details regarding your request (e.g. company size, preferred deployment model)

Purpose: Processing your enquiry, communication, and, where applicable, initiating and performing a contractual relationship.

Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures / performance of a contract) or Art. 6(1)(f) GDPR (legitimate interest in responding to enquiries).

Retention period: Until your enquiry has been resolved. If a contract is concluded, statutory retention obligations apply (in Switzerland regularly 10 years pursuant to Art. 958f OR for business-relevant records).

3.3 Newsletter

If we offer a newsletter in the future and you subscribe to it (no newsletter is currently offered), we will process your email address (and optionally your name) to send you news about Rhaetix.

If a newsletter is introduced, registration will use a double opt-in procedure: after registering, you will receive an email with a confirmation link.
Legal basis: Art. 6(1)(a) GDPR (consent).
Withdrawal: You may withdraw your consent at any time with effect for the future, e.g. via the unsubscribe link in every issue or by email to contact@rhaetix.com. After unsubscribing, your email address will be deleted from the mailing list.
Any future dispatch will be carried out via our own infrastructure hosted in Switzerland.

3.4 Website Usage Analysis (Analytics)

We currently do not use any analytics tools and do not employ any tracking.

4. Data Processing in the Rhaetix Workspace (Product)

4.1 Managed Hosting (Commissioned Data Processing)

When a company uses the Rhaetix Workspace as a managed hosting solution, we process the data stored in the Workspace instance on behalf of the respective customer. The customer remains the controller under the GDPR and the Swiss FADP (DSG). The details, in particular the subject matter, duration, nature and purpose of processing, technical and organisational measures, and subprocessors, are governed by a separate Data Processing Agreement (DPA / AVV) pursuant to Art. 28 GDPR and Art. 9 FADP.

Thanks to end-to-end encryption, we have no access to the content of encrypted data (chat messages, shared files). Which data our servers can technically process is publicly documented.

4.2 Self-Hosted

In the self-hosted variant, the software runs entirely on the customer's infrastructure. In this case, we do not process any customer content data. Data processing takes place only to the extent that the customer grants us access, e.g. for support cases, or transmits diagnostic data; this is always done on the basis of a separate agreement.

4.3 Customer Contract and Billing Data

For contract performance (quotes, contracts, invoicing, support communication), we process as controller in particular:

Name and contact details of contact persons
Company details, billing and payment data

Legal basis: Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(c) GDPR (legal obligations, in particular statutory retention obligations).

5. Disclosure of Data and Transfers to Third Countries

Personal data is disclosed to third parties only to the extent required for contract performance, where we are legally obliged to do so, or where you have given your consent.
Processors (subprocessors): For hosting and operations, we use selected processors in Switzerland (including our hosting provider Infomaniak Network SA). You can find the complete and current overview on our Subprocessors page.
Location in Switzerland: An adequacy decision of the European Commission exists for Switzerland; data transfers from the EU to Switzerland are therefore permissible.
Transfers to other third countries generally do not take place. Should a transfer exceptionally become necessary, we ensure an adequate level of data protection (e.g. EU Standard Contractual Clauses).

6. Retention Period

We store personal data only for as long as required for the stated purposes or as statutory retention obligations apply. Thereafter, the data is deleted or anonymised.

7. Data Security

We take appropriate technical and organisational measures to protect your data against loss, unauthorised access, and misuse. These include in particular:

encrypted transmission (TLS) for the entire website and the Workspace,
end-to-end encryption of chat messages and files in the Workspace,
access restrictions limited to the necessary minimum,
hosting in Switzerland.

8. Your Rights

Under the Swiss FADP (DSG) and, where applicable, the GDPR, you have in particular the following rights:

Information about the personal data processed concerning you (Art. 25 FADP / Art. 15 GDPR),
Rectification of inaccurate data (Art. 16 GDPR),
Deletion of your data (Art. 17 GDPR), provided no statutory retention obligations conflict with this,
Restriction of processing (Art. 18 GDPR),
Data portability (Art. 20 GDPR / Art. 28 FADP),
Objection to processing based on legitimate interests (Art. 21 GDPR),
Withdrawal of consent given with effect for the future (Art. 7(3) GDPR),
Surrender or destruction of data under Swiss law (Art. 25(2)(c) FADP).

To exercise your rights, an email to contact@rhaetix.com is sufficient. We may request additional information to verify your identity.

Right to lodge a complaint:

Switzerland: Federal Data Protection and Information Commissioner (FDPIC / EDÖB), Feldeggweg 1, 3003 Bern.
EU: the data protection supervisory authority competent for you, in particular the authority at your place of residence or place of work.

9. No Automated Decision-Making, No Obligation to Provide Data

We do not make automated individual decisions and do not engage in profiling. The provision of your data is not required by law; however, without the respectively required data, we cannot provide certain services (e.g. responding to an enquiry, concluding a contract).

10. Changes to This Privacy Policy

We may amend this Privacy Policy, in particular as our products evolve or legal requirements change. The version published on this website at any given time applies.