01Controller and contact
The controller for the processing described here is CodezWerk – Ivan Rodrigues da Silva, Seebleichestrasse 9a, 9404 Rorschacherberg, Switzerland. Email: info@codezwerk.ch.
This policy covers codezwerk.ch, enquiries to CodezWerk and the associated client portal. Processing within separately supplied customer applications is governed by the respective agreements and privacy notices.
02Purposes and applicable law
We process personal data to provide the website, maintain its security, respond to enquiries, prepare quotes and perform agreed services. In particular, the Swiss Federal Act on Data Protection (FADP) applies.
Where the EU General Data Protection Regulation (GDPR) additionally applies in a particular case, processing relies, depending on its purpose, on pre-contractual steps or performance of a contract (Article 6(1)(b)), legal obligations (c), legitimate interests in secure operation and handling business enquiries (f), or required consent (a).
03Website, hosting and technical data
When you access the website, technically necessary data is transmitted to the servers involved. This includes IP address, time, requested URL, browser and device information and technical connection and error data. Depending on your browser, the previously visited page may also be sent as a referrer.
The website runs as a Next.js application behind Nginx Proxy Manager. Technical logs may be processed for delivery, troubleshooting and abuse prevention. The proxy is software within the infrastructure; using it alone does not transmit data to its manufacturer.
We use a server supplied by Contabo GmbH, Germany, located in Germany. Data required to operate the website is processed there. Further information: https://contabo.com/de/legal/privacy/.
04Contact form and email
When you contact us, we process your name, email address, optional company name and message content to respond to and handle your enquiry. The form cannot be sent without the fields marked as required.
After successful validation, the enquiry is emailed to info@codezwerk.ch. Your email address is used as the reply address. The application does not maintain a separate contact-enquiry database; however, messages are processed and may be stored in the email system and its backups.
The SMTP connection is configured for encrypted transmission. Ordinary email is not automatically end-to-end encrypted. Please do not submit passwords or particularly sensitive data through the form.
For domain and email services we use Hostpoint AG, Neue Jonastrasse 60, 8640 Rapperswil, Switzerland. Hostpoint states that its hosting and email infrastructure is operated in Switzerland. Provider information: https://www.hostpoint.ch/hostpoint/kontakt-agb.html. Your chosen email provider also participates in transmission and storage of correspondence.
05Our CAPTCHA and necessary cookie
The form uses a simple arithmetic question to prevent automated enquiries. The question is generated and checked on our application server. No external CAPTCHA service is integrated.
The cw-contact cookie stores a random session identifier for the /api/contact form area and lasts one hour from the last renewal. In production it is marked HttpOnly, Secure and SameSite=Strict. It is not used for advertising or cross-site recognition.
The question is valid for at most ten minutes and is consumed on a corresponding answer attempt. Questions and temporary request counters are kept in memory. Counting windows are one or 15 minutes; expired entries are cleaned during further checks and deleted on restart. Names and messages are not stored in these counters.
You may block or delete cookies in your browser. The form cannot send without its required cookie. You can contact us directly by email instead.
06Customer accounts, projects and invoices
In the client portal we process contact information, billing addresses, language preferences, project information, messages, quotes, contract versions, recorded acceptances or refusals, invoices and payment and booking references. This supports collaboration, contract performance, invoicing and evidence of business transactions. Data is stored in the database on our server infrastructure. Customers access projects assigned to their account; administrators manage business processes.
Quotes may be emailed as PDFs. A personal, random access link allows viewing and expressly confirmed acceptance or refusal of that quote. We store only a hash of the link, along with recipient, delivery status, decision timestamp, associated customer account, decision channel and checksum of the issued version. The link does not grant access to other customer data and should not be shared.
Passwords are stored as cryptographic hashes. With two-factor authentication enabled, the authenticator secret is stored encrypted and recovery codes only as hashes. For passkeys we store the public key, an identifier, your chosen name and technical verification data. Biometric data such as fingerprints or facial data is not transmitted to CodezWerk; device verification takes place on your device. The necessary cw-session cookie contains a random session identifier and lasts eight hours, or 30 days when ‘Stay signed in’ is chosen. In production it is HttpOnly, Secure and SameSite=Lax. Invitation and recovery links are single-use and valid for at most 24 hours. Logins and changes are logged for security and traceability. Technical request counters are held temporarily in the database; invitations may be sent through the email provider named above.
07QR-bills and optional Stripe payments
QR payment sections are generated on our server and include the recipient, billing address, amount and reference or message needed for a bank payment. When you use the QR section in your banking app, your financial institution processes payment under its own terms. Bank payments are recorded in the portal after verifying receipt.
If online payment is enabled and you choose it, we transmit your email address, invoice identifier, outstanding amount and technical matching information to Stripe. Payment details are entered on Stripe’s payment page. We do not store full card numbers or card verification codes. We receive payment status, references and any refund information for matching and accounting.
Depending on the service, Stripe processes data as a processor or for its own purposes, particularly payment processing, fraud prevention and legal obligations. Stripe entities, financial partners and service providers abroad, including in the USA, may be involved. The responsible Stripe entity and transfer mechanisms are determined by the applicable Stripe contracts and privacy information at https://stripe.com/privacy. Bank / QR-bill payment remains available as an alternative.
08Fonts, analytics and external services
Fonts are served with the website. Your browser does not need to load font files from Google Fonts or other external font providers.
The website code contains no analytics or advertising trackers, social-media pixels, embedded maps or videos, or external CAPTCHA services. Contact details are not automatically used for a newsletter.
Opening external links takes you away from our website. The respective provider is responsible for processing data there.
09Recipients and processing abroad
The main technical recipients are Contabo GmbH for server operation in Germany and Hostpoint AG for domain and email services in Switzerland. These providers process data for the purposes described above.
Personal data may be processed by contracted hosting, infrastructure and email providers as necessary for operation and communication. Other disclosures may be required by law or to pursue legitimate legal claims.
Operating the server in Germany entails processing outside Switzerland. Germany is recognised by the Swiss Federal Council as providing an adequate level of protection. This transfer alone therefore does not require additional standard data-protection clauses to address an inadequate third-country level. Requirements for processing on behalf of a controller and data security remain.
10Retention
Retention depends on the purpose: enquiries are retained for handling and necessary follow-up; resulting contractual and business records are additionally retained under statutory requirements. Further retention may be necessary to assert or defend legitimate legal claims. Once these grounds cease, data must be erased or anonymised.
Technical logs support secure operation, troubleshooting and, where needed, investigation of a specific security incident. Retention is limited to those purposes. Backups are overwritten according to their backup cycle; erased content may remain in backups until then. The short technical lifetimes of the CAPTCHA and cookie are described above.
11Data security
The public website uses HTTPS. The form validates entries on the server, limits request size and uses a CAPTCHA and temporary rate limits. SMTP credentials are configured server-side and are not sent to the browser. Despite technical and organisational measures, absolute security cannot be guaranteed.
12Your rights
Under applicable law you may request information about processing of your personal data and correction of that data. Depending on the conditions, you may also request erasure, restriction or cessation of processing, and delivery or transfer of certain data. Statutory retention and other overriding obligations may limit these rights.
Where processing relies on consent, you may withdraw it for the future. Where the GDPR applies, you may in particular object to processing based on legitimate interests under the statutory conditions.
Contact info@codezwerk.ch. We may request suitable information to verify your identity. You may also contact the Swiss Federal Data Protection and Information Commissioner (FDPIC), https://www.edoeb.admin.ch/en, or another competent supervisory authority.
13Changes to this policy
We update this policy when services or processing activities change. The published version bears the date shown above. We inform you of material changes where required by law.