Privacy notice

1 Controller and contact

The controller for the processing of your personal data described in this notice is Zero Knowledge GmbH, c/o Benedikt Schuppli, Stauffacherstrasse 163, 8004 Zürich, Switzerland. Datalpin is a business unit of Zero Knowledge GmbH (‘we’).

For any question about data protection or to exercise your rights, please write to hello@datalpin.ch.

We have not appointed a data protection adviser under the Swiss Federal Act on Data Protection or a data protection officer under the GDPR; neither is required for us.

This notice is written to meet the Swiss Federal Act on Data Protection (FADP) and, where it applies, the EU General Data Protection Regulation (GDPR). Personal data means any information relating to an identified or identifiable natural person.

2 Scope

This notice covers the website datalpin.ch (temporarily available at datalpin.vercel.app), the contact form, correspondence by e-mail and business contacts, including referrals by third parties and our request list for AI labs.

It does not cover datasets that companies license through Datalpin. These data are not processed via the website. They are governed by the individual contracts, in particular the licence agreements and the data protection terms and data processing agreements agreed in them. The statutory rights of data subjects remain unaffected.

3 Visiting the website (server logs, hosting)

The website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. Pages are delivered through Vercel’s global edge network, usually from a data centre near you.

Each visit involves the processing of technically necessary connection data: your IP address, the date and time, the address requested (URL) and your browser’s identifier (user agent). Without these data the website cannot be delivered.

Purpose: delivering the website, stability, security and defence against misuse and attacks. Legal basis under the GDPR: Art. 6(1)(f); our legitimate interest is the secure and reliable operation of the website.

The logs available to us are kept for no more than one day and are then deleted automatically. Vercel also processes these connection data as an independent controller for the operation and security of its own service and keeps them only as long as needed for that purpose; Vercel’s privacy policy at vercel.com/legal/privacy-policy applies.

Fonts are delivered with the website; no data are sent to Google or any other font provider when you visit it.

4 Contact form

When you write to us through the form, we process the following details: your type of enquiry (archive assessment or general enquiry / data protection), company, number of employees (size band), how long your company has kept digital records (period), the systems in use, your name (optional), your work e-mail address and your message (optional for an archive assessment, required for a general enquiry). We also store the language of the page and the time of receipt.

If you choose 'General enquiry / data protection', company, size and years are not required and are not sent; you can then write to us with just your e-mail address and a message.

Two invisible fields serve only to protect against automated spam: a timestamp and a field that only software fills in. They are checked on submission and not stored.

Purpose: to answer your enquiry, give you a first assessment and, where relevant, prepare a contract. We do not use the details for advertising, a newsletter or profiling.

Legal basis under the GDPR: Art. 6(1)(b) (pre-contractual steps) where your enquiry concerns a contract with you. If you write to us as the contact person of a company, we rely on Art. 6(1)(f); our legitimate interest is answering business enquiries and initiating business relationships.

Mandatory fields are marked. Without these details we cannot answer your enquiry. There is no statutory or contractual obligation to provide them.

The data are transmitted in encrypted form (HTTPS). They are received by a server function in Frankfurt am Main (Germany, EU) and stored there, encrypted with AES-256-GCM, in a Vercel storage service.

We delete the details at the latest 12 months after receipt if no business relationship follows, or earlier at your request.

5 E-mail and business contacts

If you send us an e-mail, we process your e-mail address, your name, the content of the message including any attachments, and technical details of the message such as date and time, in order to deal with your request. Purpose, legal basis and deletion are the same as for the contact form (section 4). We use an e-mail provider as our processor for e-mail (section 8).

Referrals: third parties, such as business partners or customers, sometimes recommend a company and a contact person to us. We then receive the name, role, company and business contact details of the person recommended from the person making the referral. We use these details only to contact the company and introduce Datalpin. We write to a recommended person by e-mail only if the person making the referral has confirmed to us that the recommended person agrees to be contacted. When we first get in touch, we state where the details came from, refer to this notice and point out your right to object. Legal basis under the GDPR: Art. 6(1)(f); our legitimate interest is initiating business relationships on recommendation. You may object to this at any time without giving reasons (section 13).

If a business relationship follows, we process the business contact details of the people involved in order to perform the contract. The legal basis under the GDPR is Art. 6(1)(b) where you are yourself a party to the contract, and otherwise Art. 6(1)(f); our legitimate interest is performing the contract with your company.

We keep records where Swiss law requires it (for example Art. 958f of the Swiss Code of Obligations). The legal basis under the GDPR for this is Art. 6(1)(f); our legitimate interest is complying with our statutory obligations in Switzerland.

6 Request list for AI labs

AI labs and other licensees that tell us about a data need are added to a request list. It holds the contact person’s name, role and business contact details, the organisation and a description of the need.

Purpose: to handle your request, that is, to look for suitable data owners and to contact you once a dataset matches the need you registered. We do not send you any other advertising.

Legal basis under the GDPR: Art. 6(1)(f); our legitimate interest is handling and carrying out the licence request of the contact person’s organisation. If you act in your own name, for example as a sole trader, the legal basis is Art. 6(1)(b) (pre-contractual steps at your request).

You may ask us at any time to stop contacting you; we will then delete the entry. In any case we delete it at the latest 24 months after the last contact.

7 No cookies, no tracking, no automated decisions

This website uses no cookies and stores no information on your device; there is no tracking and no web analytics. Fonts are delivered with the website through our hosting provider; no font service such as Google Fonts is contacted.

There are no social media plug-ins, no embedded third-party content such as videos or maps, and no newsletter.

We do not take automated individual decisions (Art. 21 FADP, Art. 22 GDPR) and do not carry out profiling.

If we change any of this in future, we will update this notice beforehand and obtain your consent where required.

8 Recipients and processors

Vercel Inc., USA: hosting of the website, the form’s server function and encrypted storage of form data in Frankfurt (EU). Vercel acts as our processor (Art. 28 GDPR) under its data processing agreement (Data Processing Addendum, vercel.com/legal/dpa). The sub-processors used by Vercel are listed at vercel.com/legal/sub-processors. Vercel is itself responsible for the connection data it processes for its own service (section 3).

Infomaniak Network SA, Rue Eugène-Marziano 25, 1227 Les Acacias (Geneva), Switzerland: receiving, sending and storing our e-mails (addresses at datalpin.ch), as our processor. The e-mails are stored in data centres in Switzerland.

Our accountants, tax advisers and legal advisers, where needed for our accounting or to protect our rights; they are bound by confidentiality. Authorities and courts, where we are legally obliged to disclose data.

We do not sell personal data from this website, the form or our correspondence, and we do not pass them on to third parties for their own purposes. We pass your contact details to an AI lab or a data owner only if you have consented (Art. 6(1)(a) GDPR) or if this is necessary for a contract with you. You may withdraw consent at any time with effect for the future (Art. 7(3) GDPR).

9 Disclosure abroad

Form data are stored in Frankfurt am Main (Germany). Under Annex 1 of the Swiss Data Protection Ordinance, Germany provides an adequate level of data protection.

Vercel Inc. is based in the USA, so access from the USA, for example for maintenance and support, cannot be ruled out. In addition, connection data may be processed in Vercel’s edge data centres worldwide, usually at a location near the place from which you access the website. The network locations are listed at vercel.com/docs/regions.

Safeguards: Vercel Inc. is certified under the EU-U.S. Data Privacy Framework and the Swiss-U.S. Data Privacy Framework (checked in October 2026; list at dataprivacyframework.gov). Transfers from the EU to the USA are covered by adequacy decision (EU) 2023/1795; for disclosures from Switzerland, the Swiss Federal Council has added the USA, for organisations certified in this way, to Annex 1 of the Swiss Data Protection Ordinance (in force since 15 September 2024).

In addition, Vercel has agreed to the European Commission’s standard contractual clauses (Implementing Decision (EU) 2021/914) in its data processing agreement; the FDPIC has recognised these clauses for disclosures from Switzerland. Under that agreement they apply to transfers from the EU, the EEA and Switzerland to Vercel Inc. in the USA and to Vercel’s sub-processors in other countries, including countries without adequate protection. A copy is available at vercel.com/legal/dpa.

Transfers from the EU to us in Switzerland are covered by the European Commission’s adequacy decision for Switzerland (Decision 2000/518/EC).

10 Retention and deletion

Server logs: the logs available to us, no more than one day; for Vercel’s own processing see section 3.

Contact form, e-mails and referrals: at the latest 12 months after receipt if no business relationship follows.

Request list for AI labs: until you ask for deletion, at the latest 24 months after the last contact.

Business relationships: for their duration and afterwards for as long as we need the data to establish or defend legal claims, at most until the limitation period expires (usually ten years, Art. 127 of the Swiss Code of Obligations). Accounting vouchers are kept for ten years from the end of the financial year under Art. 958f of the Swiss Code of Obligations.

At your request we delete data earlier, unless a statutory retention duty prevents this. We review our records regularly and delete data that are due for deletion.

11 Data security

We protect your data with appropriate technical and organisational measures: the website is transmitted in encrypted form (HTTPS), form data are stored encrypted with AES-256-GCM, and only the members of our team who handle enquiries can decrypt them.

No one can guarantee completely secure transmission over the internet. Ordinary e-mails are usually not end-to-end encrypted, so please send us confidential documents only after agreeing this with us.

12 Your rights

Under the FADP you have in particular the right of access to your personal data (Art. 25 FADP), the right to receive or transfer your data (Art. 28 FADP), the right to have incorrect data corrected (Art. 32(1) FADP) and the right to object to processing and to request the deletion of your data (Art. 30(2)(b), Art. 32(2) FADP).

Where the GDPR applies, you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21, see section 13), and the right to withdraw consent at any time with effect for the future (Art. 7(3)).

To exercise these rights, simply write to hello@datalpin.ch. To make sure we do not disclose data to the wrong person, we may ask you to prove your identity. We reply without undue delay and within 30 days at the latest. If a request is particularly complex, we may extend this period; we will tell you so, with reasons, within 30 days. Access is generally free of charge.

14 Complaints to a supervisory authority

In Switzerland: Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, www.edoeb.admin.ch.

In the EU and the EEA you may lodge a complaint with a data protection supervisory authority, in particular in the member state of your habitual residence, your place of work or the place of the alleged infringement (Art. 77 GDPR), for example the Austrian Data Protection Authority (www.dsb.gv.at) or the data protection authority of your German federal state.

You are of course always welcome to contact us directly first.

15 Changes

We update this notice when our processing or the law changes. The version published on this website at the time applies.

Last updated: 18 October 2026