Privacy Policy

1. Data Controller

For data protection inquiries, please contact info@theiasolutions.ch. We have not formally appointed a Data Protection Officer, as this is not mandatory under the Swiss DPA or EU GDPR for a company of our size.

2. Data Collection and Processing

When you visit our website, the following data is collected automatically in server logs:

• IP address (for abuse prevention only, deleted after 30 days)
• Date and time of access
• Pages visited
• Browser and operating system used (user agent)
• Referring website (HTTP referrer)

Legal basis: legitimate interest in operating the website and preventing abuse (Art. 6 (1) (f) GDPR / Art. 31 (1) Swiss DPA).

3. Cookies and Consent

On your first visit, a cookie banner lets you grant or decline consent separately for necessary, map, analytics and marketing cookies. Your choice is stored in your browser (localStorage under the key "cookie-consent-v7") and can be reset at any time.

Necessary Cookies

Strictly technical: the CSRF anti-forgery cookie for the contact form, the localStorage entry for your cookie choice, and the language preference. No tracking.

Analytics Cookies

With your consent (the «Analytics» category in the cookie banner) we use Google Analytics 4, a web-analytics service provided by Google Ireland Limited. We use it to evaluate how our website is used (pages viewed, time on page, referral source, approximate city-/region-level location, device/browser). Google processes your IP address in truncated form; data may be transferred to Google servers, including in the USA. The legal basis is your consent (Art. 6(1)(a) GDPR; Art. 6 revFADP); transfers rely on the EU Standard Contractual Clauses. You can withdraw your consent at any time, with future effect, via the cookie settings. Without consent, Google Analytics is not loaded.

With your consent (the «Analytics» category in the cookie banner) we use PostHog, a privacy-friendly product-analytics service provided by PostHog Inc., hosted in the EU (eu.i.posthog.com, EU/Frankfurt region). PostHog is loaded only after you grant «Analytics» consent in the cookie banner; before consent — and after you revoke it — PostHog is not loaded and sets no cookies. Event data is sent first-party via our own server (a reverse proxy at theiasolutions.ch/ingest), not directly to PostHog domains. What is processed: page views, clicks and interactions (autocapture), approximate device and browser information, and a randomly generated visitor ID stored in a first-party cookie. There is no cross-site tracking and no advertising use. The legal basis is your consent (Art. 6(1)(a) GDPR; Art. 6 revFADP), which you can withdraw at any time, with future effect, via the cookie banner. PostHog Inc. is US-based; international transfers rely, where applicable, on the EU Standard Contractual Clauses and/or the Data Privacy Framework, and event traffic is proxied through our own EU/CH infrastructure.

Marketing Cookies (Reddit, LinkedIn, Meta, Google Ads, ChatGPT Ads, Google Tag Manager)

With your consent (the «Marketing» category in the cookie banner) we use the Reddit Pixel, a service of Reddit, Inc. (USA), to measure and optimize our Reddit advertising campaigns (e.g. page views and conversions after an ad click). This may transfer pseudonymous usage and device data and your IP address to Reddit, Inc. in the USA. The legal basis is your consent (Art. 6(1)(a) GDPR; Art. 6 revFADP); transfers rely on the EU Standard Contractual Clauses. You can withdraw your consent at any time, with future effect, via the cookie settings. Without consent, the Reddit Pixel is not loaded.

With your consent (the «Marketing» category in the cookie banner) we use the LinkedIn Insight Tag, a service of LinkedIn Ireland Unlimited Company (for users in the EEA/Switzerland; parent company LinkedIn Corporation, USA), to measure and optimize our LinkedIn advertising campaigns (e.g. page views and conversions after an ad click) and to analyze reach. This may process pseudonymous usage and device data and your IP address and transmit them to LinkedIn. The legal basis is your consent (Art. 6(1)(a) GDPR; Art. 6 revFADP); any transfer to the USA relies on the EU Standard Contractual Clauses and/or the Data Privacy Framework. You can withdraw your consent at any time, with future effect, via the cookie settings. Without consent, the LinkedIn Insight Tag is not loaded.

With your consent (the «Marketing» category in the cookie banner) we use the Meta Pixel (Facebook Pixel), a service of Meta Platforms Ireland Limited (parent company Meta Platforms, Inc., USA), to measure and optimize our advertising campaigns on Facebook and Instagram (e.g. page views and conversions after an ad click). This may process pseudonymous usage and device data, your IP address and — where present — Meta cookies (_fbp/_fbc) and transmit them to Meta. The legal basis is your consent (Art. 6(1)(a) GDPR; Art. 6 revFADP); any transfer to the USA relies on the EU Standard Contractual Clauses and/or the Data Privacy Framework. You can withdraw your consent at any time, with future effect, via the cookie settings. Without consent, the Meta Pixel is not loaded.

With your consent (the «Marketing» category in the cookie banner) we use Google Ads conversion tracking, a service of Google Ireland Limited (parent company Google LLC, USA), to measure the success of our Google Ads campaigns (e.g. inquiries after an ad click). This may set conversion cookies (_gcl*) and process pseudonymous usage and device data and your IP address and transmit them to Google. The legal basis is your consent (Art. 6(1)(a) GDPR; Art. 6 revFADP); any transfer to the USA relies on the EU Standard Contractual Clauses and/or the Data Privacy Framework. You can withdraw your consent at any time, with future effect, via the cookie settings. Without consent, the Google Ads tag is not loaded.

With your consent (the «Marketing» category in the cookie banner) we use the ChatGPT Ads Measurement Pixel together with the server-side OpenAI Conversions API, services provided by OpenAI, to measure and optimize our advertising campaigns in ChatGPT (e.g. page views and qualified inquiries after an ad interaction). Data processed may include the page viewed, event type and time, IP address, browser/device information, and pseudonymous attribution identifiers stored in a first-party cookie. For a qualified inquiry, the normalized email address may be transmitted only as a SHA-256 hash; our integration does not send the plain-text email address to OpenAI Ads. The legal basis is your consent (Art. 6(1)(a) GDPR; Art. 6 revFADP); international transfers are protected under OpenAI's applicable data-processing terms and safeguards. You can withdraw your consent at any time, with future effect, via the cookie settings. Without consent, the Measurement Pixel is not loaded and the Conversions API is not called.

With your consent (the «Marketing» category in the cookie banner) we use Google Tag Manager, a service of Google Ireland Limited (parent company Google LLC, USA). Google Tag Manager is not itself an analytics or advertising tool and does not build user profiles; it is a management tool through which marketing tags are delivered and configured. The technical container loads on page view with Consent Mode denied by default; this transmits your IP address and technical browser information to Google. Marketing tags and our pseudonymous event stream are enabled only after you activate the «Marketing» category and are blocked again when you withdraw consent. We do not pass names, email addresses, or other contact details to the container. The legal basis for marketing processing is your consent (Art. 6(1)(a) GDPR; Art. 6 revFADP); any transfer to the USA relies on the EU Standard Contractual Clauses and/or the Data Privacy Framework. You can withdraw your consent at any time, with future effect, via the cookie settings.

Maps (Google Maps)

On the "About" page we can show our location in a Google Maps embed. The map is only loaded after you accept the maps cookie in the banner. Until then you see a placeholder with the static address. Once you consent, Google LLC (USA) processes your IP address and browser information according to the Google privacy policy.

4. Contact Form

When you submit the contact form, the data you provide (name, email, optionally phone and company, message) is stored to process your inquiry. Processing is based on your express consent (checkbox on submit) and on our legitimate interest in communicating with prospects.

Retention: contact form entries are retained for up to 24 months after the last contact and then deleted automatically, unless statutory retention periods apply (e.g. Swiss CO / VAT Act for invoices).

This data is not shared with unauthorized third parties. It is processed by: the website host (see section 5), our transactional email provider for notifying our team, and Theia staff handling your request.

4.1 Maturity Check / Assessment

When you complete our maturity check (/assessment) we store your answers, the computed category scores and — if you opt to receive the report by email — the contact details provided in the lead form (name, email, optionally company, role, phone, employee band). Processing is based on your express consent (checkbox before submit).

Retention: assessment records are kept for up to 24 months after the last contact, identical to contact form entries, and then deleted automatically. Anonymized score distributions may continue to be used for benchmark analytics.

4.2 Email Communication via Microsoft Dynamics 365

We may use Microsoft Dynamics 365 Customer Insights - Journeys (formerly Dynamics 365 Marketing) for CRM, customer communication, consent management and sending service or marketing emails, and may synchronize data from forms or assessments to that system. This may include contact details (name, email address, company, role, phone), communication preferences, inquiry or assessment context, and technical delivery and sending data.

Service or assessment emails are sent to handle your inquiry or, at your request, to deliver a report. Marketing emails are sent only on the basis of your consent or another permitted legal basis. Every marketing email includes an unsubscribe option. If open or click tracking is used, we provide transparent information and use this data to measure and improve our communication.

4.3 Gaia AI Interview (Requirements Engineering)

On the «Requirements Engineering» page you can request an interview with Gaia AI, our AI-assisted requirements engineer. We store the details you enter in the form (name, email address, optionally company, project description) like a contact request (see above) and pass them on to our interview service Gaia AI. We operate Gaia AI on Microsoft Azure in Switzerland (Switzerland North region); it creates an interview session for you and sends you an email with a personal interview link via Microsoft 365.

For the interview, Gaia AI processes your name, your company, your project description, your answers and any attached files with an AI model from Anthropic (contracting party: Anthropic Ireland, Limited; group parent Anthropic, PBC, USA), which acts as our processor for this purpose. Anthropic stores this content in the USA; processing may also take place in other countries where Anthropic uses data centres. The transfer relies on the EU Standard Contractual Clauses with adaptations for Switzerland (Anthropic is not certified under the Data Privacy Framework). By default, Anthropic deletes the content within 30 days at the latest and does not use it to train its models. Your email address is not sent to Anthropic. When you complete the interview, Gaia AI creates a structured specification that is sent to Theia.

Processing is based on your express consent (checkbox on submit) and on our legitimate interest in preparing and quoting your project. We retain the request like contact form entries; the interview content is retained as long as needed to handle your project.

4.4 Protecting Our Forms Against Abuse (Cloudflare Turnstile)

To protect our inquiry forms (e.g. contact, booking, maturity check, Gaia AI interview) against automated requests and abuse, we may use Cloudflare Turnstile, a service of Cloudflare, Inc. (USA). Turnstile checks technical characteristics of your browser and device as well as your IP address to tell whether a request comes from a human; this data (in particular IP address, browser identifier and technical connection characteristics) is transmitted to Cloudflare for that purpose. Turnstile does not read the content of your form entries. We use Turnstile only to prevent abuse, not for analytics or advertising. Cloudflare also uses these signals under its own responsibility to improve Turnstile’s bot detection. The legal basis is our legitimate interest in secure forms and in preventing spam (Art. 6 (1) (f) GDPR / Art. 31 (1) Swiss DPA); Cloudflare is certified under the Swiss-U.S. and EU-U.S. Data Privacy Framework; the EU Standard Contractual Clauses apply in addition.

4.5 Website Assistant (AI Chat)

You can choose to use our website assistant, an AI chat. It answers questions about our services, points you to relevant pages, shows available consultation slots and, if you wish, prepares a booking or contact request. Only when you open the assistant and send a message do we process your chat messages together with the previous replies in the conversation, the selected language and the path of the page you are on (e.g. «/services»). Please do not enter sensitive data in the chat, such as health data, passwords or bank details. The assistant does not need your name or email address: a prepared booking or contact request is only sent once you complete and submit it yourself. The available slots shown are read from our consultants' Microsoft 365 calendars. After you submit a booking request, you receive an email with a time-limited confirmation link; until you confirm, we keep your details as an unconfirmed request. Only after you confirm do we create the appointment and record the request in our CRM (see section 4.2). A submitted contact request is handled like a request via the contact form (see section 4). To prevent abuse, we limit the number of requests per IP address (see section 2).

The replies are generated by an AI model from Azure OpenAI in Microsoft Foundry. The provider is Microsoft, which acts as our processor for this purpose. The Azure resource is located in the Switzerland North region. Processing by the model takes place within Microsoft's EU Data Boundary (EU and EFTA states, including Switzerland), so your messages may also be processed in data centres in EU states. Under Swiss law, these states ensure an adequate level of data protection. Microsoft does not use inputs or replies to train AI models and does not share them with OpenAI.

To detect abuse, Microsoft checks inputs and replies automatically, including for harmful content. If this system flags content as potential abuse, it may additionally be reviewed by authorised Microsoft employees; for this review, Microsoft stores the affected inputs and replies in the Azure geography of our resource (Switzerland). Microsoft commits to the location of these reviewers only for resources in the European Economic Area (EEA), which does not include Switzerland; access from outside Switzerland and the EEA can therefore not be ruled out. For such transfers, Microsoft relies on the EU Standard Contractual Clauses and also abides by the Data Privacy Framework. Details are governed by Microsoft's data protection and product terms.

We do not store chat transcripts. The conversation is kept in your browser and sent to our server again with each message; our server forwards it to Azure OpenAI without having the conversation stored there. Our technical logs contain no message content; the information in section 2 applies to them.

Processing takes place at your request and is based on our legitimate interest in informing visitors about our services and making it easier for them to get in touch (Art. 6 (1) (f) GDPR / Art. 31 (1) Swiss DPA). The replies are generated automatically by an AI model and may be incomplete or wrong. Please check important information on the linked pages or with us directly.

5. Processors and Hosting

We use the following service providers as data processors. Data processing agreements (DPAs) are in place with each.

Data transfers to the US (Google, Reddit, LinkedIn, Meta, Cloudflare, Anthropic) are based on the EU Standard Contractual Clauses (SCCs) and/or the Data Privacy Framework. The marketing services (Reddit, LinkedIn, Meta) are loaded only after your «Marketing» consent; visitors are informed and asked for consent via the cookie banner first.

6. Fonts (Webfonts)

The "Montserrat" typeface is served from our own servers (self-hosted via @fontsource). There is no connection to Google Fonts servers, so your IP address is not transmitted to Google when you visit our website.

7. Your Rights

Under the Swiss Data Protection Act (revised DPA, effective 1 September 2023) and the EU GDPR you have the following rights:

• Right to access your stored data (Art. 25 Swiss DPA / Art. 15 GDPR)
• Right to rectification of inaccurate data (Art. 32 Swiss DPA / Art. 16 GDPR)
• Right to erasure (Art. 32 Swiss DPA / Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 28 Swiss DPA / Art. 20 GDPR)
• Right to object to processing (Art. 30 Swiss DPA / Art. 21 GDPR)
• Right to withdraw consent — effective prospectively, not retroactively

Right to lodge a complaint: You have the right to lodge a complaint with the competent supervisory authority.

• Switzerland: Eidgenössischer Datenschutz- und Öffentlichkeitsbeauftragter (EDÖB)
• EU/EEA: the national data protection authority of your country of residence

8. Data Security

We implement technical and organizational measures to protect your data against accidental or intentional manipulation, loss, destruction or unauthorized access: TLS/SSL encryption for all data transfers, CSRF protection on forms, rate limiting to mitigate brute-force and spam attacks, role-based access in the admin UI, and regular security updates of all components.

9. Changes

We reserve the right to update this privacy policy to meet current legal requirements or to reflect changes in our services. The current version is always available on this page.