Privacy

Website visits

Cloudflare, Inc. in the United States hosts and delivers this website. Connection data include your IP address, request time, requested URL, browser information and response status. They are processed to deliver pages, operate the service and investigate errors, attacks and misuse.

Tidira uses no advertising trackers, behavioural analytics, external fonts or embedded social or appointment tools. Images are served with the site. Cloudflare security functions can use cookies needed to distinguish legitimate requests from attacks. These are separate from advertising or audience tracking. Cloudflare also processes network data for its own network security and service operation under its privacy policy.

• Cloudflare privacy policy
• Cloudflare security cookies

Enquiries and appointments

Tidira uses the contact details, business information and correspondence you provide by email or phone to respond, discuss a project and prepare or carry out an assignment. If a colleague or business partner supplies your details, this can include your name, role, employer and business contact information for the same purposes. Contact details are voluntary, but a response or appointment may not be possible without them.

The optional appointment link opens Microsoft Bookings on a separate website. It handles the details entered there, the selected time, calendar entry and confirmation messages. Microsoft 365 supplies business email and calendars. Direct email or phone contact is available if you prefer not to use Bookings.

Tidira does not use the processing described here for profiling or decisions with legal or similarly significant effects based solely on automated processing.

• Microsoft privacy statement
• Microsoft Bookings privacy information

Providers and processing countries

Cloudflare and Microsoft, their group companies and authorised subprocessors handle data for the services above. Necessary disclosures can also be made to accounting or legal advisers and competent authorities for an assignment, business administration or a legal obligation.

Cloudflare operates a worldwide delivery and security network. The country used for a connection depends on routing and service operation. Its delivery network and its support or platform suppliers have different locations. The lists below identify their published countries and territories, rather than claiming that every visit passes through every country.

Microsoft currently reports Switzerland as the storage location for the relevant Exchange Online customer data. The account also permits regional storage within the EU and EFTA. This identifies where data are stored. It does not mean that all processing takes place in Switzerland. Microsoft discloses controlled remote access for service operation, security and support from the countries below. Its global delivery infrastructure can also handle technical connection data.

• Cloudflare network locations
• Cloudflare service subprocessors and locations
• Microsoft EU/EFTA storage boundary
• Microsoft remote-access locations
• Microsoft service subprocessors
• Microsoft transfers outside its EU/EFTA boundary

Safeguards for transfers abroad

Swiss law permits transfers to countries recognised as providing adequate protection. Where that recognition does not cover a transfer, the provider data-processing terms use the EU standard contractual clauses, with the provisions needed for Switzerland. Covered transfers to certified US recipients can also rely on the recognised Swiss-US Data Privacy Framework. This does not make every recipient or every operation in the United States adequate.

The provider agreements below describe these safeguards. You can contact Tidira for information about the safeguards relevant to your data and a copy of the applicable clauses. The safeguards do not mean that foreign processing has no risk.

• Cloudflare data-processing agreement, including Swiss provisions
• Microsoft data-processing agreement

Retention

Ordinary business email is not automatically deleted after a fixed period. Retention criteria include the time needed to respond and follow up, any resulting business relationship, applicable recordkeeping duties and the need to establish, exercise or defend legal claims. Data no longer needed for those purposes must be deleted or anonymised. You can ask Tidira to review whether your data still need to be kept.

Relevant accounting records are subject to Swiss statutory retention, normally ten years from the end of the financial year. That rule does not require every ordinary enquiry or appointment to be kept for ten years.

Provider security logs and recoverable copies follow the service-specific security, recovery and legal-retention rules. Cloudflare uses purpose and legal-obligation criteria rather than one universal retention period. Microsoft permits customer deletion during the subscription. Its separate end-of-subscription rule generally provides 90 days for extraction followed by deletion within a further 90 days, subject to its contractual exceptions. That is not an automatic expiry period for an enquiry in an active mailbox.

Legal grounds and your rights

Swiss data protection law applies. Where the EU GDPR applies, legitimate interests under Article 6(1)(f) support secure website delivery, business-contact correspondence, project preparation and the protection of legal claims. Article 6(1)(b) applies to requested pre-contract steps or performance where you personally are the contracting party. Article 6(1)(c) applies where an EU or Member State legal obligation requires the processing. Consent, if used for a separate purpose, can be withdrawn for the future.

Depending on the legal conditions, you can request access or information, correction, erasure, restriction or data portability and object to processing. For processing based on legitimate interests, you may object for reasons relating to your situation. Contact Fabian Ecker using the details above. Access requests are normally answered free of charge within 30 days under Swiss law. Where GDPR applies, its one-month response rule and any lawful extension apply. Identity will be checked only as needed to protect your data.

You may contact the Swiss Federal Data Protection and Information Commissioner or, where applicable, a competent EU/EEA supervisory authority, including in your place of residence or work. These rights can be limited by statutory retention and the rights of other people.

• Swiss data protection authority
• EU/EEA data protection authorities

External websites and updates

LinkedIn and other external links open separate websites. Those operators handle data under their own privacy notices. This website embeds no LinkedIn feed or social plugin.

This notice is reviewed when the website, providers or processing change. Version: 26 October 2026.