Privacy Policy.

Data controller

Jigen Sagl, registered office at Via Arboi 25, 6534 S. Vittore (GR), Switzerland. Contact for any data-protection request: hello@jigen.ch.

Data collected

• Contact form: name, email, optional company and phone, selected area of interest, message content.
• Contact-form anti-spam: visitor IP address and User-Agent, transmitted briefly to Cloudflare for the Turnstile challenge verification (no cookies, no persistent profile).
• Newsletter subscription: email address; the language and the place on the site the subscription came from; date, time and IP address of the consent, the confirmation and any unsubscribe (audit trail proving the double opt-in).
• Analytics: aggregated, pseudonymous usage data (page views, source, duration, content interactions, device, language) collected only after your consent via the cookie banner. No identifying data, no cross-device matching.

We do not collect third-party data without the data subject's explicit request.

Purposes and legal basis

• Contact form — to reply to the request submitted and organise the subsequent commercial interaction. Legal basis: pre-contractual measures taken at the data subject's request (art. 6(1)(b) GDPR · art. 31(2)(a) revFADP); for the checkbox accepting this notice: art. 6(1)(a) GDPR.
• Newsletter — to send you the articles you subscribed to. Legal basis: explicit consent collected via a checkbox at subscription time (art. 6(1)(a) GDPR · art. 6 revFADP), confirmed via double opt-in and withdrawable at any time with one click from the footer of every email.
• Analytics — to measure, in aggregate, how the site is used so we can improve it. Legal basis: consent given through the cookie banner, withdrawable from the "Cookie preferences" link in the footer.
• Anti-spam (Turnstile) — to protect the contact form from automated submissions. Legal basis: legitimate interest of the controller in preventing form abuse (art. 6(1)(f) GDPR · art. 31(2)(d) revFADP).

Data processors

Some operations are handled by external providers that process data on our behalf under a data-processing agreement (DPA):

• Resend Inc. — sending all the site's transactional emails (contact-form notifications, receipt confirmations, newsletter confirmation and welcome) and managing the subscriber list (Audiences). Resend DPA.
• Google LLC — Google Analytics 4 + Google Tag Manager (contractual entity Google Ireland Ltd.); Google Workspace for the hello@jigen.ch mailbox where contact-form notifications land. Google Signals is not enabled. Google DPA.
• Cloudflare Inc. — Turnstile anti-spam verification on the contact form. A privacy-friendly challenge, no tracking cookies. Cloudflare DPA.

Details on where these data are actually processed and under which transfer safeguard are in the section below.

Cross-border data transfers (outside Switzerland)

The revFADP (art. 16-18) requires transparency about transfers of personal data outside Switzerland. For each operation entrusted to an external provider we indicate the actual country of processing and the adequacy mechanism adopted:

The Swiss-US Data Privacy Framework has been operational since 15 September 2024 and has been recognised by the Swiss Federal Council as a mechanism providing an adequate level of protection for transfers from Switzerland to certified US organisations. Each provider's certification status can be verified on the program's public list (dataprivacyframework.gov/list).

Newsletter

Subscription follows the double opt-in model:

1. You enter your email in the form and tick the explicit-consent checkbox (mandatory — legal basis: art. 6(1)(a) GDPR · art. 6 revFADP).
2. You receive an email with a confirmation link; until you click that link you are not subscribed and receive nothing.
3. The confirmation link expires after 7 days; past that, the subscription lapses automatically.

Every newsletter email carries a one-click unsubscribe link (a single click, no login). Data stays on the list until you unsubscribe or request erasure. We retain IP and timestamp for the three moments (consent, confirmation, unsubscribe) as an audit trail proving the validity of the consent.

Analytics and cookies

The site sets no analytics cookies and runs no tracking until you give consent via the banner. By default Google's consent mode (Consent Mode v2) is set to "denied" for analytics and advertising storage; it is updated only when you accept from the banner. You can change your mind at any time from the "Cookie preferences" link in the footer. Cookies strictly necessary for the site to function (language preference, the contact form's anti-CSRF token, the consent cookie jigen_consent) require no consent and do not profile.

Retention

• Contact-form requests: up to 24 months from the last interaction, unless a subsequent contractual relationship requires longer retention.
• Newsletter subscribers: until you unsubscribe or request erasure. The audit log (IP + timestamp of consent/confirmation/unsubscribe) is kept for the minimum time needed to prove the validity of the consent in case of dispute.
• Analytics data: 14 months (the GA4 free-tier maximum), then aggregated or deleted.

Rights

The data subject can request access, rectification, erasure, restriction, objection and portability of their data by writing to hello@jigen.ch; for the newsletter, consent withdrawal is immediate via the unsubscribe link. We respond within 30 days of the request.

Complaints to the supervisory authority: Federal Data Protection and Information Commissioner (FDPIC), www.edoeb.admin.ch — or to the national authority of the data subject's country of residence.

Security

Data is processed on cloud infrastructure with at-rest and in-transit encryption; access is restricted to Jigen operating staff authenticated with 2FA. Credentials for external services (Resend, Google, Cloudflare) are managed as rotatable secrets. The external processors are bound by their respective DPAs listed above.

In the event of a personal-data breach with a likely risk to the rights and freedoms of data subjects, we will notify the FDPIC within 72 hours (art. 24 revFADP) and, where applicable, the data subjects themselves.