Privacy Policy for the Website klaumo.ch

1. What this is about and who is responsible

We handle personal data with care and comply with the law that applies to us. This is primarily the Swiss Federal Act on Data Protection (FADP/DSG) together with the Data Protection Ordinance (DPO/DSV). For persons in the EU and the EEA, we also apply the General Data Protection Regulation (GDPR/DSGVO) where it applies to us, for example because our services are also aimed at companies in those countries.

Scope. This policy applies to the website klaumo.ch with all its subpages and language versions, to the industry pages, to the conversation window of our AI advisor Kaia and to our test pages. It does not apply to the AI agents we operate for our customers. The relevant company is responsible for conversations with those agents; it provides information in its own privacy policy.

Data subjects. This policy is addressed to:

• visitors to the website;
• persons who speak or write to Kaia;
• persons who write to us, call us or request an appointment;
• contact persons at prospects, customers and suppliers;
• persons who visit our social media profiles.

The controller for the processing described here is:

Tyche Consulting GmbH (brand «Klaumo»)
Tobelstrasse 13
5445 Eggenwil
Switzerland
E-mail: info@klaumo.ch
Telephone: +41 78 619 96 55

For all questions about data protection and to exercise your rights, write to info@klaumo.ch. We have not appointed a data protection advisor under Art. 10 FADP; your request goes directly to the management.

Representative in the EU. We have not appointed a representative in the EU under Art. 27 GDPR. Please also send requests from the EU and the EEA to info@klaumo.ch.

What this policy answers. For each purpose, you will find below:

• why we process data;
• which data this is;
• what legal basis we rely on;
• who processes the data on our behalf or receives it from us;
• how long we keep it;
• anything else you should know.

2. Our principles

• Only what is necessary. We collect only the data we need for the purpose concerned.
• Statistics and advertising only with consent. Without your consent, we only use cookies and storage that are necessary for the website. We load Google Analytics and the Meta Pixel only after you have agreed in the cookie banner. You can change your choice at any time using the «Cookie settings» link at the bottom of every page.
• No selling. We do not sell personal data. Data goes to advertising networks only if you have consented to marketing cookies (section 4.4).
• Clear time limits. We delete or anonymise data we no longer need. We delete enquiries that do not lead to a business relationship after 30 days.
• Storage location. Our database is located in Switzerland (Zurich). AI processing of speech and text takes place in the EU and in the USA. We do not promise that all data stays in Switzerland.
• Service providers under contract. Anyone who processes data on our behalf may use it only for us and in accordance with our instructions.

3. Legal bases

Switzerland. Under the FADP, personal data may be processed if the principles of the Act are complied with (Art. 6 FADP). Consent is only required in certain cases. Where processing could infringe your personality rights, we rely on a justification under Art. 31 FADP, in particular your consent, the conclusion or performance of a contract with you, or our overriding interest. We obtain your consent for statistics and marketing cookies.

EU and EEA. Where the GDPR applies, we rely on:

• consent (Art. 6 para. 1 lit. a GDPR), for example for recording the conversation with Kaia as text, for Google Analytics and for the Meta Pixel;
• contract or pre-contractual steps (lit. b), for example if you want a quote or an appointment;
• legal obligation (lit. c), for example the retention of accounting records;
• legitimate interest (lit. f), for example the secure operation of the website or replying to an enquiry. Where we rely on this, we name the interest for the purpose concerned.

4. Why we process personal data

4.1 Website hosting and server logs

To make the website available, fast and secure, it is hosted by a hosting provider. When your browser requests a page, it automatically transmits technical information. Without it, no page can be delivered.

Data: IP address, date and time of the request, address requested, referrer URL, browser and operating system, status code and amount of data transferred, technical error messages.

Legal basis: overriding or legitimate interest (GDPR: Art. 6 para. 1 lit. f). Our interest: to deliver the website reliably, find errors and fend off attacks or misuse.

Recipients: Vercel Inc., USA (hosting, delivery via Vercel's global network, server functions). Our server functions run in Frankfurt (Germany); Vercel may also process data in the USA. Basis for the USA: Swiss-U.S. Data Privacy Framework.

Retention: On our plan, Vercel stores the server function logs for a maximum of 30 days and then deletes them automatically.

4.2 Program library via a content delivery network (CDN)

We serve fonts (Onest) and the animation library from our own server. Your browser does not load anything from Google Fonts or other font services for this.

However, your browser loads one program library from the public CDN jsDelivr: the ElevenLabs library, as soon as you start the conversation with Kaia. On two internal graphics test pages that are not linked from the website, your browser also loads the 3D library three.js from there.

In doing so, the CDN operator learns your IP address, the file requested, the time and information about your browser. Personal data from the conversation does not go to the CDN.

Legal basis: legitimate interest (GDPR: lit. f) in fast and reliable delivery of tested libraries in a fixed version.

Recipients: Volentio JSD Limited (England and Wales), operator of jsDelivr. The files are delivered via the networks of Cloudflare, Fastly and Gcore, including from data centres in the USA. According to its privacy policy, jsDelivr uses the data for statistics and security and does not track individual users.

Retention: in accordance with the CDN operator's rules, for as long as necessary for statistics and security; we do not receive any data from this.

4.3 Cookies, local storage and session storage

Without your consent, we only use cookies and storage that are necessary for the website. We set statistics and marketing cookies only after you have given your consent in the cookie banner (section 4.4). A complete list of all cookies, providers and durations is set out in our Cookie Policy.

Necessary cookies and storage:

Information in local storage and session storage stays on your device and is not transmitted to us.

Legal basis: overriding or legitimate interest (GDPR: lit. f) in a working website that is protected against misuse; for the cookies relating to Kaia, also pre-contractual steps (lit. b), because you start the conversation yourself.

Your choice: You can delete or block cookies and storage in your browser settings. Without the two cookies klaumo_ok and klaumo_v, the conversation with Kaia does not work.

4.4 Statistics and marketing with your consent

Cookie banner. On your first visit, we ask you which cookies we may set. There are three groups: «Necessary» (always active), «Statistics» (Google Analytics) and «Marketing» (Meta Pixel). Without your consent, statistics and marketing remain switched off. We store your choice in your browser for 12 months (klaumo-consent); after that we ask you again. We operate the banner ourselves, without third-party providers. You can change or withdraw your choice at any time using the «Cookie settings» link at the bottom of every page. Withdrawal applies for the future.

Google Analytics 4 (statistics). If you agree, we use Google Analytics 4 to measure how the website is used: which pages are viewed, where visitors come from, how long they stay and which important steps they take: opening the conversation with Kaia, sending an appointment request, clicking on our telephone number or the WhatsApp button, opening a question with prices. This helps us improve content and usability. Google Analytics is only loaded after you have given your consent; we use Google's consent mode (Consent Mode v2) for this. Only if you have also agreed to «Marketing» do we allow Google to link the data with signed-in Google accounts (Google Signals) and to use it for personalised advertising.

• Data: truncated information about device, browser, language and approximate location (country, region, city), pages viewed, time and duration, origin of the visit, clicks and events on the website, a random identifier in the cookies _ga and _ga_<ID>. According to Google, Google Analytics 4 does not store IP addresses; the IP address is used only briefly to determine the approximate location and is then discarded.
• Legal basis: your consent (Art. 31 para. 1 FADP; GDPR: Art. 6 para. 1 lit. a; for cookies on your device, also Art. 45c of the Telecommunications Act (TCA/FMG) and, for persons in the EU, Art. 5 para. 3 of Directive 2002/58/EC).
• Recipients: Google Ireland Limited, Dublin, Ireland, as our processor; data also goes to Google LLC in the USA. Basis for the USA: Swiss-U.S. Data Privacy Framework (Google LLC is certified).
• Retention: We delete the event data in Google Analytics after 14 months. The cookies _ga and _ga_<ID> expire after 2 years unless you delete them earlier.
• More information: policies.google.com/privacy and business.safety.google/privacy.

Meta Pixel (marketing). If you agree, we embed the Meta Pixel. It reports to Meta which pages you view and whether you send an appointment request or contact us by telephone or WhatsApp. We do not pass on names, telephone numbers or form content to Meta. This allows us to measure whether our advertising on Facebook and Instagram is effective (conversion measurement) and to show targeted advertising there to people who have visited our website (Custom Audiences).

• Data: IP address, information about browser and device, pages viewed and events, time, the identifiers in the cookies _fbp and _fbc. If you are signed in to Facebook or Instagram, Meta may link the visit to your account.
• Joint controllership. We are joint controllers with Meta Platforms Ireland Limited for collecting the data on our website and transmitting it to Meta (Art. 26 GDPR; judgment of the Court of Justice of the EU «Fashion ID», C-40/17). Meta's addendum for controllers applies to this (Controller Addendum, www.facebook.com/legal/controller_addendum). Under it, Meta is responsible for providing you with the information under Art. 13 GDPR and for fulfilling your rights; however, you can also contact us. Meta alone is responsible for further processing, for example for advertising and profiles.
• Legal basis: your consent (Art. 31 para. 1 FADP; GDPR: Art. 6 para. 1 lit. a; for cookies, also Art. 45c of the Telecommunications Act and Art. 5 para. 3 of Directive 2002/58/EC).
• Recipients: Meta Platforms Ireland Limited, Dublin, Ireland; data also goes to Meta Platforms, Inc. in the USA. Basis for the USA: Swiss-U.S. Data Privacy Framework (Meta Platforms, Inc. is listed; its re-certification is under review), otherwise Meta's standard contractual clauses.
• Retention: The cookies _fbp and _fbc expire after 90 days. How long Meta keeps the data is governed by Meta in its privacy policy.
• More information: www.facebook.com/privacy/policy.

4.5 Contact by e-mail, telephone or WhatsApp

If you write to us or call us, we process your details to respond to your request.

Data: name, e-mail address, telephone number, company, content of your message, time and history of the communication.

Legal basis: pre-contractual steps (GDPR: lit. b) if it concerns our services; otherwise legitimate interest (lit. f) in replying to enquiries.

Recipients:

• E-mails to info@klaumo.ch are handled by Infomaniak Network SA, Geneva (Switzerland). The data stays in Switzerland.
• If you write to us using the WhatsApp button, the message is handled by WhatsApp Ireland Limited (Meta). WhatsApp's rules apply to this. Please choose e-mail or telephone instead if you do not wish to use WhatsApp.

Retention: 30 days if no business relationship results. Business correspondence that we are required to keep is kept for 10 years (Art. 958f of the Code of Obligations (CO/OR)).

Please note: Do not send us sensitive personal data, for example about health, religion, political opinions, trade union membership, genetic or biometric characteristics, intimate life or criminal proceedings. If we receive such data unsolicited, we delete it unless we need it for your request.

4.6 Appointment request via the form

Using the «Book an appointment» window, you can send us your name and telephone number so that we can call you to arrange an appointment.

Data: name, telephone number, language of the page, page on which you filled in the form, time. A hidden field helps us detect automatic entries by bots.

Legal basis: pre-contractual steps (GDPR: lit. b).

Recipients: Vercel (server function in Frankfurt). At present, the server function receives your details but does not store them; the form then shows you the option of contacting us via WhatsApp or telephone. As soon as we store the requests in our database, we will update this policy.

Retention: no storage beyond processing the request.

Further information: We use the details only to call you about the appointment and not for advertising.

4.7 Conversation with Kaia, our AI advisor

Kaia is an artificial intelligence, not a human being. She answers questions about our services, shows suitable solutions and, on request, prepares an appointment or a quote.

How the conversation works:

1. Before starting, you confirm your telephone number with a code (see 4.8).
2. Next to the start button, we inform you that Kaia is an AI and that the conversation is recorded as text.
3. The conversation only begins when you start it yourself and allow access to the microphone. You can end it at any time. Instead of speaking, you can also type.

Data:

• your voice, only during the conversation for speech recognition; we do not store an audio recording;
• the transcript of the conversation;
• what you say about yourself and your company, for example name, company, industry, size, contact details and requirements;
• an automatic analysis and summary, for example your request, your interest and the next step;
• technical connection data (time, duration, language, random browser identifier).

Legal basis:

• pre-contractual steps (GDPR: lit. b) for the advice and any quote or appointment you request;
• legitimate interest (lit. f) in advising prospects, preventing misuse and improving Kaia;
• your consent (lit. a) for the recording as a transcript; you give it by starting the conversation after the notice. You can end the conversation at any time and request deletion.

Recipients:

• Eleven Labs Inc., USA: speech recognition, voice, conversation management and storage of the transcript. For the voice connection in the browser, ElevenLabs uses the infrastructure of LiveKit Inc. (USA). Basis for the USA: Swiss-U.S. Data Privacy Framework (both companies are certified).
• Anthropic (USA): The language model Claude formulates the answers and analyses the conversation. The fallback model in the event of an outage is also a Claude model from Anthropic. ElevenLabs obtains Claude from Anthropic as its own service provider and passes the texts on to it for this purpose; Anthropic processes them in the USA and other countries. This onward transfer is governed by ElevenLabs' contracts with Anthropic and by the Data Privacy Framework rules on onward transfers to third parties.
• Vercel Inc. (server functions in Frankfurt) and Supabase Pte. Ltd. (data centre in Zurich): storage of the summary as an enquiry in our database.

Retention:

• Audio recording: none.
• Transcript: ElevenLabs deletes it automatically after 30 days.
• Summary and contact details: deletion after 30 days if no business relationship results. If a business relationship results, we keep them for its duration and thereafter in accordance with the statutory retention periods.

Further information:

• Under its contract, Anthropic does not use the data to train AI models. Under its own terms, ElevenLabs may also use content to improve its services, unless this use is switched off in the account.
• Kaia does not accept files and does not follow instructions to change her rules.
• Do not mention sensitive personal data, passwords or account numbers in the conversation.

4.8 Confirmation of your telephone number with a code

Only persons who have confirmed their telephone number can talk to Kaia. This protects the service against misuse and automated requests.

Data: telephone number, country code, chosen channel (WhatsApp or SMS), the code, time, number of attempts, your consent to the code being sent.

Process: The code is valid for 10 minutes. After confirmation, you receive the cookie «klaumo_ok» (see 4.3). One confirmation allows up to 4 conversations. We only send codes to numbers from Switzerland, its neighbouring countries, the EU, the EEA and the United Kingdom.

Legal basis: your consent when requesting the code (GDPR: lit. a) and our legitimate interest (lit. f) in protection against misuse.

Recipients: ZERNIO SOFTWARE SL, Palamós (Spain), sends and checks the code via WhatsApp or SMS. Zernio processes the data in the United Kingdom and Western Europe; some of Zernio's service providers are based in the USA, and the EU standard contractual clauses in Zernio's contract apply to them. When the code is sent via WhatsApp, WhatsApp (Meta) is also involved; for SMS, the mobile networks are involved.

Retention: We do not store your number in plain text, only as an irreversible check value for the duration of the cookie (2 hours). Zernio stores the code only as a check value and, according to Zernio, deletes the confirmation record 24 hours after it is created. Zernio keeps sending and log data in accordance with its own retention periods, at most for as long as necessary for billing, security and legal obligations.

4.9 Managing customer and prospect relationships (CRM)

We keep a customer database for prospects and customers. This tells us who has asked for what, which appointments are coming up and where a project stands.

Data: name, company, position, contact details, industry, request, summaries of conversations, appointments, quotes, contracts, project status, notes made by our team.

Legal basis: contract or pre-contractual steps (GDPR: lit. b) and legitimate interest (lit. f) in an orderly customer relationship.

Recipients: Supabase Pte. Ltd. (data centre in Zurich): our database.

Retention: for prospects with no business relationship, 30 days; for customers, the duration of the business relationship and thereafter the statutory retention periods.

4.10 Payments and invoices

Data: name, company, address, invoice data, payment amount and date, payment method.

Legal basis: contract (GDPR: lit. b) and legal obligation (lit. c).

Recipients: We issue QR-bills; we receive payment through our bank in Switzerland. Invoice and accounting data is also received by our fiduciary or auditors, insofar as they need it for their work, and by authorities, insofar as the law requires.

Retention: invoices and records 10 years (Art. 958f CO).

4.11 Error analysis and protection against misuse

To find errors and fend off attacks, we analyse technical data. This includes a firewall and limits on the number of requests per IP address, per confirmed number and per day.

Data: IP address, time, function called, error messages, number of requests.

Legal basis: legitimate interest (GDPR: lit. f) in the security and availability of our services and in protecting our costs for the AI services.

Recipients: Vercel (firewall, server function logs). We do not use a separate error analysis tool.

Retention: as for the server logs (4.1); request counters only for as long as the limit concerned applies (minutes up to one day).

4.12 Our social media profiles

We have profiles on LinkedIn, Instagram, Facebook, YouTube and X. We link to these profiles on our website. We do not embed content, buttons or plug-ins from these networks; the only exception is the Meta Pixel, and only with your consent (4.4). Your browser connects to the network only when you click a link.

When you visit our profiles, the operators process your data in accordance with their own rules, including for advertising and profiling. For Facebook and Instagram, under the case law of the Court of Justice of the EU, we are joint controllers with Meta Platforms Ireland Limited for the page statistics; Meta's joint controllership agreement applies to this. It is best to send requests about the data processed by the network directly to the operator.

Data we see: your public profile name, your comments and messages to us and aggregated statistics without names.

Legal basis: legitimate interest (GDPR: lit. f) in communicating with interested parties.

Operators: LinkedIn Ireland Unlimited Company (Ireland), Meta Platforms Ireland Limited (Ireland, for Facebook and Instagram), Google Ireland Limited (Ireland, for YouTube), Twitter International Unlimited Company (Ireland, for X).

4.13 Job applications

We are not currently advertising any positions. If you apply anyway, we process your documents only to assess the application (Art. 328b CO; GDPR: lit. b). We delete them 3 months after the decision, unless you allow us to keep them for longer.

5. Retention at a glance

When the period expires, we delete or anonymise the data. Database backups are kept for 7 days and then overwritten.

6. Disclosure to third parties

We only disclose personal data if this is necessary for the purpose described, if you have consented or if we are legally obliged to do so, for example to authorities or courts.

Our service providers process data as processors only for us and in accordance with our instructions. We have concluded data processing agreements with them or accepted their standard agreements, and we review them before use. Meta processes the data from the Meta Pixel after transmission as a controller in its own right (4.4).

In the event of a sale or restructuring of our business, data may go to the acquirer, insofar as the law permits.

7. Disclosure abroad

Some service providers are based outside Switzerland or process data there, mainly in the EU and in the USA. We only disclose data abroad if the level of data protection there is adequate or if appropriate safeguards are in place (Art. 16 FADP; GDPR: Art. 44 et seq.).

• Countries with adequate protection. The Federal Council lists the countries with adequate data protection in Annex 1 DPO. These include the EU and EEA states and the United Kingdom.
• USA and Data Privacy Framework. For companies in the USA that are certified under the Swiss-U.S. Data Privacy Framework, data protection has been considered adequate since 15 September 2024. You can check for yourself whether a company is certified at www.dataprivacyframework.gov.
• Standard contractual clauses. Where there is no adequate protection, the standard contractual clauses of the European Commission of 4 June 2021 apply, with the adaptations for Switzerland recognised by the Federal Data Protection and Information Commissioner (FDPIC/EDÖB), together with an assessment of the risks of the transfer.

We check the certifications against the list at www.dataprivacyframework.gov.

8. Data security

We protect personal data with technical and organisational measures appropriate to the risk, in particular:

• encrypted connections (HTTPS with HSTS) and encrypted storage at our providers;
• access only for persons who need the data for their work, with personal accounts and two-factor sign-in;
• row-level permissions in the database, so that each query sees only the data it is allowed to see;
• keys for services only in protected environment variables, never in the program code;
• request limits and a firewall against misuse;
• daily backup of the database;
• regular review of these measures.

Transmission over the internet is never completely secure. For this reason, please do not send us confidential documents by unencrypted e-mail.

9. Your rights

In particular, you have the following rights:

• Access: You can find out whether and which data we process about you and receive a copy.
• Rectification: We correct incorrect or incomplete data.
• Erasure: You can ask us to delete your data, unless we are required to keep it.
• Objection: You can object to processing, in particular if it is based on our legitimate interest or is used for advertising.
• Restriction: Under the GDPR, in certain cases you can ask us only to store data but not to process it further.
• Data release and portability: You receive data you have given us in a common electronic format, including for transfer to another provider.
• Withdrawal: You can withdraw consent at any time with effect for the future; for cookies, via the «Cookie settings» link at the bottom of every page. Anything that happened up to that point remains lawful.

To do so, write to info@klaumo.ch. We usually reply within 30 days. To ensure that your data does not go to the wrong person, we may ask for proof of your identity. These rights apply within the limits of the law; we may restrict them, for example if there is a statutory retention obligation or if the rights of others are affected. If we refuse a request in whole or in part, we will tell you why.

Complaint. You can lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC/EDÖB, Feldeggweg 1, 3003 Bern, www.edoeb.admin.ch). If you live in the EU or the EEA, you can also contact the data protection authority in your country. It is usually quickest if you write to us first.

10. Automated individual decisions and profiling

Kaia analyses conversations automatically, for example what your request is and how strong your interest in a next step is. This assessment helps our team prepare. However, Kaia does not make any decisions that have legal consequences for you or significantly affect you. Quotes and contracts are prepared and reviewed by people.

If you have consented to marketing cookies, Meta may use your visit to show you our advertising on Facebook and Instagram (4.4). This is profiling for advertising; it has no legal consequences for you, and you can withdraw your consent at any time.

11. Children and young people

Our services are aimed at companies and their employees. They are not intended for children and young people under the age of 16. If we notice that a child has given us data, we delete it. Parents and guardians can contact info@klaumo.ch about this.

12. Persons outside Switzerland and the EU

We address companies in Switzerland and in Europe. If you live in another country, for example in the USA, the same policy applies to you. We do not sell personal data. We set statistics and marketing cookies only with your consent; without consent, we do not pass on any data for targeted advertising. You can withdraw your consent at any time via «Cookie settings». We respond to your requests about your data as described in section 9.

13. Data security breaches

If, despite our measures, a data security breach occurs, we report it to the FDPIC as quickly as possible if it is likely to result in a high risk for you (Art. 24 FADP). Where the GDPR applies, we report it to the competent authority within 72 hours. We inform you if this is necessary for your protection and tell you what you can do yourself.

14. Changes

We update this policy when our website, our service providers or the law change. The version published on klaumo.ch applies. The date is shown at the top under «Last updated». We review the policy at least once a year.

In case of discrepancies between the language versions, the German version prevails.