Privacy policy

1. Data controller

Romandia Labs Sàrl
Canton of Vaud, Switzerland
Email: contact@romandia.ch

Romandia Labs Sàrl acts as the data controller within the meaning of the Federal Act on Data Protection (FADP) and, where applicable, the General Data Protection Regulation (GDPR) for visitors located in the European Union.

2. Data collected

Romandia Labs collects only the data necessary for the purposes described below:

• Forms (Your idea, Contact) : first name, last name, email, phone (optional), company (optional), description of your project or message, stage of progress, indicative budget, how you found us.
• Technical data : IP address, user agent, timestamp — the IP is used for rate limiting (in memory only) and is retained solely as a salted-hash fingerprint for audience measurement.
• Audience measurement : in-house, cookieless measurement: each page view is stored with its path, referrer, user agent and a pseudonymous fingerprint of the IP address (salted SHA-256 hash; the IP is never stored in clear). No third-party tracking tool.

3. Purposes of processing

• Respond to your requests (forms, emails).
• Provide an initial assessment of your project.
• Secure the site (preventing spam and abuse).
• Improve the site (pseudonymised audience measurement).
• Comply with our legal and accounting obligations.

4. Legal bases

• Consent (art. 6 para. 6 FADP; art. 6.1.a GDPR): submission of a form with an explicit consent checkbox.
• Legitimate interest (art. 31 FADP; art. 6.1.f GDPR): site security, pseudonymised audience measurement.
• Contractual performance (art. 6.1.b GDPR): following up on your request with a view to collaborating.
• Legal obligation (art. 6.1.c GDPR): accounting retention, requests from authorities.

5. Retention period

• “Your idea” submissions without follow-up : 12 months maximum, then deletion.
• Client exchanges : duration of the contractual relationship + 10 years (Swiss accounting obligations).
• Technical security data : 30 days.
• Audience measurement : individual pseudonymised records, automatically deleted after 12 months.

6. Data recipients

Your data is never sold or transferred. It is accessible only to authorised personnel of Romandia Labs Sàrl and, where applicable, to the strictly necessary technical processors:

• Site host (Infomaniak, Switzerland).
• Mailbox host and SMTP relay (Infomaniak, Switzerland).
• No processor for audience measurement: it is performed in-house, on our own servers.

All processors are bound by an agreement compliant with art. 9 FADP and art. 28 GDPR.

7. International transfers

Romandia Labs favours hosting and services in Switzerland or the European Union. No transfer to a country without an adequate level of protection is carried out without appropriate safeguards (standard contractual clauses, adequacy decision).

8. Your rights

You have the following rights at any time:

• Right of access to your data.
• Right to rectification of inaccurate data.
• Right to erasure (“right to be forgotten”).
• Right to restriction of processing.
• Right to portability of your data.
• Right to object to processing.
• Right to withdraw your consent at any time, without affecting the lawfulness of prior processing.

To exercise your rights, write to contact@romandia.ch. We will respond within 30 days. You may also lodge a complaint with the FDPIC (Federal Data Protection and Information Commissioner) or the competent supervisory authority of your EU member state.

9. Cookies

Romandia Labs strictly limits the use of cookies. The site uses:

• Strictly necessary cookies : security, technical operation. No consent required.
• Cookieless audience measurement : no tracking cookies; visits are counted via a pseudonymous fingerprint of the IP address (salted hash), which cannot be reversed to the IP.

No marketing or advertising cookies are used. No third-party tracking tool (Google Analytics, Meta Pixel, etc.) is deployed.

10. Security

Romandia Labs implements appropriate technical and organisational measures: systematic HTTPS, firewall and key-based SSH server access, an administration interface protected by credentials, IP addresses retained only in hashed form.

11. Changes

Romandia Labs may update this policy to reflect legal, technical or organisational developments. The update date is shown at the top of the document. For substantial changes, a notification will be sent to the data subjects whose contact details are known.

12. Contact

Any question regarding this privacy policy or your personal data may be addressed to contact@romandia.ch.