1. Who we are

Octotronic AG is the controller for the processing described in this policy.

• Controller: Octotronic AG, Technoparkstrasse 1, 8005 Zürich, Switzerland
• Contact for privacy matters: info@octotronic.com
• Representative in the EU (Art. 27 GDPR): VISENSE Service GmbH, August-Bebel-Strasse 88, 14482 Potsdam, Germany
• Contact for the EU representative: info@visense.io

‍

2. Scope of this policy

This policy describes how we process personal data about:

• website visitors, newsletter subscribers, event registrants, and people who download materials from octotronic.com;
• business contacts, customers and prospects, and their employees, in the course of sales and customer relationship activities;
• employees, including former, future and temporary staff, and external personnel working on site;
• applicants;
• users of our public websites and of any application we make available outside the OctoCore product.

What this policy does not cover. Personal data processed inside a customer's OctoCore environment is processed on that customer's instructions, under the customer contract and our Data Processing Agreement. For that data the customer is the controller and we are the processor. If your employer uses OctoCore and you want to exercise rights over data held there, contact your employer; if you contact us instead, we will refer your request to them and assist them in responding.

Employees and applicants receive additional, more specific information at the point their data is collected.

‍

3. Categories of personal data

3.1 Contact and lead data. Identification and contact details, company and role, the content of your inquiry, meeting notes, communication preferences.

3.2 Newsletter and event data. Email address, subscription preferences, registration details, attendance status and related logistics.

3.3 Download data. Contact details provided to access a download, and download metadata.

3.4 Technical data from the website. When you visit the site, our hosting provider records technical information needed to deliver and secure it: IP address, device and browser information, the pages requested, timestamps, referrer and error codes.

3.5 Cookies and similar technologies. Identifiers stored on or read from your device so that the site functions and remembers your consent preference. Section 6 lists them individually, with their purpose and duration.

3.6 Employment data. For employees, including former, temporary and external personnel on site: identification and contact details, employment history and role, contract and payroll data, time and attendance, training records, access logs for company systems and premises, and information required to meet legal duties.

3.7 Applicant data. Identification and contact details, CV and application documents, interview and assessment information, references you authorise us to obtain, and communication records.

We do not create user accounts on the public website, and we do not ask you to upload files there.

‍

4. Where the data comes from

• Directly from you, through forms, sign-ups, emails, meetings, interviews and events.
• Automatically from your device when you browse the website or use our public applications.
• From the service providers listed in section 7.
• From publicly available business sources and professional networking platforms, where permitted.

Providing personal data is voluntary. Where we cannot provide something without it — for example, replying to an inquiry or processing an application — we say so at the point of collection.

‍

5. Why we use the data, and on what legal basis

5.1 Responding to inquiries and providing requested information or registrations. Legal basis: performance of a contract or steps taken at your request before entering into one.

5.2 Sending newsletters and product updates. Legal basis: your consent, which you may withdraw at any time.

5.3 Operating and securing the website. Delivering the site, keeping it available and protecting it against misuse and attack. Legal basis: our legitimate interest in a functioning and secure website. We do not use analytics or advertising technologies on the site.

5.4 Managing sales leads and customer relationships in our CRM. Legal basis: our legitimate interest in maintaining and developing business relationships with organisations that have shown interest in our products.

5.5 Human resources administration — employment, access, payroll, benefits and workplace safety. Legal bases: performance of the employment contract, compliance with legal obligations, and our legitimate interest in administering the business.

5.6 Recruitment. Legal bases: steps taken at your request before entering into a contract, and our legitimate interest in assessing candidates. Where local law requires consent for a particular step, we ask for it.

5.7 Legal compliance and protection of rights. Complying with legal obligations, and establishing, exercising or defending legal claims. Legal bases: compliance with a legal obligation, and our legitimate interest in protecting our rights, our people and our services.

Where we rely on legitimate interests, you may object to the processing. See section 12.

‍

6. Cookies and similar technologies

6.1 What we use. The site uses only cookies that are strictly necessary to deliver it and keep it secure. We do not use analytics, advertising or social media tracking cookies, and we do not build profiles of visitors.

6.2 Consent. Because only strictly necessary cookies are used, no consent is required for them. We nonetheless display a consent banner, managed by CookieYes, so that you can see what is set and record a preference. You can reopen and change that preference at any time through the CookieYes control on the site, and withdrawing consent is as easy as giving it. If we introduce any cookie that is not strictly necessary, it will be set only after you consent to it.

6.3 Cookies we use. The site sets two cookies, both strictly necessary. This list reflects our most recent cookie scan.

• cookieyes-consent (and related cookieyes-* cookies) — domain www.octotronic.com. Set by CookieYes to record your cookie preference, so that you are not asked again on every visit. Duration: 1 year.
• _cfuvid — domain .octotronic.com. Set by Cloudflare, which delivers and protects our website. It is used to distinguish incoming requests for rate limiting and protection against automated abuse. It does not identify you and is not used for tracking or advertising. Duration: session, and it is deleted when you close your browser.

We rescan the site regularly. If we add any cookie beyond the two above, we will update this section and, unless the cookie is strictly necessary, ask for your consent before setting it.

‍

7. Service providers

We use the service providers below. Each processes personal data on our instructions and only to the extent needed to deliver its service.

• Website hosting and content delivery: Webflow, Cloudflare
• Consent management: CookieYes
• Customer relationship management: Close CRM
• Email delivery and newsletters: Mailchimp
• Meeting scheduling: Calendly

We update this list when our providers change. Transfers outside Switzerland and the EEA are described in section 8.

‍

8. Transfers outside Switzerland and the EEA

Several of the providers listed in section 7 are established in the United States or process personal data there. Where personal data is transferred to a country that does not offer an adequate level of protection under Swiss or EU law, we rely on one of the following:

• the EU-US Data Privacy Framework and its Swiss-US counterpart, where the provider is certified under it; or
• the European Commission's Standard Contractual Clauses, together with the Swiss addendum recognised by the Federal Data Protection and Information Commissioner, and additional technical and organisational measures where the circumstances of the transfer require them.

You can request a copy of the relevant safeguard by writing to info@octotronic.com.

‍

9. How long we keep data

• Contact and lead records: up to 24 months after the last interaction, unless a longer period is required by law.
• Newsletter data: until you unsubscribe. Your email address is then kept on a suppression list so that we can honour your choice.
• Event and download records: 12 to 24 months after the event or download.
• Server and security logs: 30 to 180 days, depending on the system.
• Analytics data: 3 to 18 months, depending on the tool's configuration.
• Core employment records: for the periods required by Swiss employment, social insurance and accounting law.
• Applicant records: up to 6 months after the process ends, unless you agree that we may keep your profile for future roles.

Where data is needed to establish, exercise or defend a legal claim, we keep it until that purpose ends.

‍

10. Security

We apply technical and organisational measures appropriate to the risk. These include encryption in transit, access control on the principle of least privilege, logging and monitoring, backups, secure development practices, and security assessment of our vendors. Our information security management system is aligned with ISO/IEC 27001. We notify the competent authority and affected individuals where the law requires it.

‍

11. Automated decision-making

We do not make decisions based solely on automated processing that produce legal effects concerning you, or similarly significantly affect you.

‍

12. Your rights

Subject to the conditions and exceptions in applicable law, you may:

• request access to the personal data we hold about you, and a copy of it;
• request correction of data that is inaccurate or incomplete;
• request deletion of your data in the cases provided for by law;
• request restriction of processing in the cases provided for by law;
• object to processing based on our legitimate interests, including profiling. You may object to direct marketing at any time, without giving a reason;
• request portability — receive the data you provided to us in a structured, commonly used, machine-readable format, or have it transmitted to another controller where technically feasible;
• withdraw consent at any time, without affecting the lawfulness of processing carried out before the withdrawal. For newsletters, the unsubscribe link in each message is sufficient.

‍

13. How to exercise your rights

Write to info@octotronic.com. We respond within one month of receiving your request. If a request is complex, or if we receive several from you, we may extend that period by up to two further months and will tell you within the first month if we do.

We may ask for information needed to confirm your identity. We use that information only to verify the request.

‍

14. Children

Our website and public applications are directed at business users. We do not knowingly collect personal data from children.

‍

15. Complaints

If you believe we have processed your personal data unlawfully, you may lodge a complaint with:

• the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, Switzerland; or
• where EU or UK data protection law applies to you, the supervisory authority of your habitual residence, place of work, or the place of the alleged infringement.

We would appreciate the opportunity to address your concern first.

‍

16. Changes to this policy

We update this policy when our processing or the applicable law changes. The current version and its effective date are shown at the top of this page.