Legal information
Privacy
We explain the processing of contact details, enquiries and documents and the intended retention for Production operation of the new Calcvero website.
01 / Responsibility
Controller and contact
The controller is Marcel Häfeli, proprietor of the Calcvero sole proprietorship. Calcvero Marcel Häfeli Wiesentalstrasse 19 9242 Oberuzwil UID: CHE-312.392.955 Switzerland Contact us at info@calcvero.com for privacy matters.
02 / Information and purposes
Handling enquiries and assessing cooperation
We process the business and contact details, project description, requested services, timing and any technical documents supplied in the relevant form. Partner applications also include location, capabilities, qualification and commercial information. Contact submissions include a subject and message. Required fields allow us to identify and handle the enquiry; without them it cannot be submitted through the form. Optional information is voluntary.
We use this information to handle your enquiry, prepare an offer, assess possible cooperation and communicate directly. A partner application is not automatic qualification. No automated decision is made on entering a contract.
03 / Legal framework
Processing for defined purposes
We observe the principles of the Swiss Federal Act on Data Protection. Where the GDPR applies, Article 6(1)(b) may support pre-contractual steps requested by the data subject; Article 6(1)(f) may support business communication with contact persons and protection against abuse. Legally required processing may rely on Article 6(1)(c). Where consent is actually required, it is obtained for a specific purpose and may be withdrawn for the future.
Acknowledging the privacy notice is not consent to advertising. Whether the GDPR applies is assessed under the relevant statutory criteria in each case.
04 / Website and forms
Infomaniak hosting and private Supabase Storage
For the intended Production operation, Infomaniak delivers website content and server-side form endpoints. Infomaniak describes its hosting infrastructure as operated in Switzerland. Delivery involves technically necessary connection information such as IP address, requested URL, time, browser and error data. Following server validation, form information is stored in the dedicated Calcvero Supabase project in Frankfurt, Germany. Documents are uploaded through server-authorised, time-limited uploads to private Storage. There is no public file listing or public document link. Authorised server-side processes manage the data.
The public data-processing agreements of INFOMANIAK NETWORK SA (Switzerland) and Supabase Pte. Ltd (Singapore) form part of their respective service terms. This does not claim a separately signed personalised agreement. The Supabase EU project region does not promise exclusively EU processing; the linked provider materials describe subprocessors and potential international access. Specialist review of the specific contracting chain remains possible.
05 / Communication and recipients
Internal notifications through Infomaniak
Internal form notifications are sent to info@calcvero.com through authenticated Infomaniak SMTP using STARTTLS. They contain enquiry details and, where applicable, file counts and original filenames, but no attached documents or system-generated private file links. Automatic acknowledgement emails to submitters are disabled. Direct email is processed through the relevant email service; Infomaniak describes its mail hosting as operated in Switzerland.
Access is limited to the people responsible for handling the enquiry and necessary technical service providers. Later disclosure to engineering or supply partners is not performed automatically by the form; scope, purpose and recipients must be established for the engagement. External partner coordination may include Serbia, requiring a separate assessment of transparency and any cross-border transfers.
06 / Security and browser
Limited access and abuse prevention
The form server uses origin checks, draft ownership proofs, file validation, idempotent finalisation and request limits. A keyed HMAC identifier is derived from the connection address for rate limiting; raw IP addresses are not stored in form or rate-limit tables. This identifier remains pseudonymous security data, not anonymous data. Platform logs may contain IP addresses.
The new website embeds no marketing trackers or external fonts. Form drafts and selected files are held in browser memory; this implementation does not use persistent browser storage for them. Necessary functionality and any Preview access protection are distinct from marketing tracking. No absolute security guarantee is made.
07 / Confirmed Production periods
Retention by data category
- Unfinished or invalid stored drafts: 24 hours from creation. Inputs rejected before storage are not retained as form content.
- Completed project and contact enquiries: 365 days from successful finalisation.
- Uploaded project documents: 180 days from successful finalisation; associated file metadata in the form records is then removed as well.
- Partner applications and their documents: 365 days from successful finalisation.
- Rate-limit metadata: until the relevant security window expires, followed by deletion within 24 hours.
These periods cover the operational website form records. The cleanup routine must be scheduled and monitored before Production collection. It deletes private files before associated database records. The periods determine when deletion becomes due; physical removal follows on the next daily run, potentially almost another day during normal operation. Failures are monitored and retried; the separate 24-hour rate-limit purge requirement remains. Internal notification emails: maximum 30 days from delivery. Calcvero-controlled application/server logs: maximum 14 days. Our encrypted backups have a seven-day target, preferably in CH/EU. Provider-operated logs and backups follow separate rules. Statutory business records are assessed separately. Form data is not automatically extended.
08 / Rights and supervision
Access, correction and further rights
Contact us to request access to, correction or deletion of your personal information. Depending on the applicable law and conditions, further rights may include restriction, objection, data delivery or portability and withdrawal of consent for the future. Statutory retention duties and third-party rights may limit deletion. We verify your identity only as necessary.
You may contact the Swiss Federal Data Protection and Information Commissioner (FDPIC) or, where the GDPR applies, a competent European supervisory authority.
09 / Publication status
Effective date
Privacy notice calcvero-privacy-2026-09-v1. Effective date: 2026-09-24. The confirmed Production retention periods apply from this date.