Privacy policy

1. Who is responsible

The controller for this website is EVOCEAN GmbH, Grundstrasse 8, 6343 Rotkreuz, Switzerland, phone +41 41 790 78 88, info@evocean.com.

Where you are a customer or prospect with your registered office in Germany, EVOCEAN Deutschland GmbH, Adams-Lehmann-Strasse 56, 80797 München, Germany, phone +49 89 215 525 34, is the controller for the related contract and customer data. EVOCEAN GmbH and EVOCEAN Deutschland GmbH also process enquiry data together as joint controllers within the meaning of Article 26 GDPR: EVOCEAN GmbH operates this website and receives enquiries, EVOCEAN Deutschland GmbH handles customer relationships in Germany. The responsibilities are set out in a joint arrangement recorded by EVOCEAN GmbH; its essence is made available on request.

Data protection questions: info@evocean.com. EVOCEAN has not appointed a data protection officer: neither Swiss law nor § 38 BDSG requires one for EVOCEAN Deutschland GmbH, and no appointment is required for EVOCEAN GmbH.

2. Visiting this website

When you open a page, our hosting provider automatically processes technical data: IP address, date and time, page requested, referring page, browser and operating system. We use it to deliver the website, keep it secure and investigate faults. Under the GDPR the legal basis is our legitimate interest in a secure, working website (Art. 6(1)(f)). Log data is deleted after 7 days.

Fonts are served directly from our website; no font or design resources are loaded from third-party servers.

Content Delivery Network and hosting infrastructure: To deliver web pages quickly and protect against cyberattacks (such as DDoS attacks), this website uses a globally distributed edge network / Content Delivery Network (CDN). Requests from visitors in Switzerland and the European Union are answered from regional edge locations close to the visitor. Due to the nature of global network routing and security filtering, technical connection data may be routed through international network nodes. Appropriate data transfer safeguards (including Standard Contractual Clauses) apply where data is processed outside Switzerland or the EU/EEA. Application data entered into contact forms is transmitted encrypted (HTTPS) and handled separately from website delivery caching.

3. Cookies and similar technologies

EVOCEAN plans to use Google Analytics, Google Search services, Google Business Profile and LinkedIn. These integrations are not described as active in this draft. Their final configuration and data handling must be confirmed before activation. Storage or access to information on your device that is strictly necessary to provide a service you expressly request may be exempt from consent under § 25(2) TDDDG. Non-essential analytics, tracking and third-party embeds will be enabled only after your prior consent; where the GDPR applies, the associated personal-data processing relies on Art. 6(1)(a). The planned consent controls must allow you to accept or reject non-essential processing and later withdraw consent as easily as you gave it, without affecting earlier lawful processing. [PENDING: consent tool, categories, cookie/storage inventory, lifetimes and withdrawal control; verify implementation under German TDDDG/GDPR and Swiss FADP requirements.]

Google Analytics (planned). We intend to use Google Analytics to understand website visits and improve content. Depending on configuration, it processes online identifiers, device/browser information, page views, interaction events and technical connection data, including an IP address during collection. Under the GDPR, analytics processing will rely on consent, not legitimate interests. No analytics tags or consent-denied measurement requests are to run before consent. [PENDING: confirm GA4, responsible Google entity, data-processing terms, events, retention, cookie lifetimes, IP handling, Google Signals, user IDs, advertising links and any Consent Mode configuration. Do not send enquiry text or directly identifying contact details to Analytics.]

Google Search (planned). This draft provisionally understands Google Search Engine to mean visibility in Google Search and use of Google Search Console, not an embedded search box. Search Console provides search-performance reports and indexing information; its use and a site-verification token do not by themselves install visitor-tracking code on this website. When you use Google Search, Google processes data under its own privacy policy. [PENDING: confirm Search Console only or identify any embedded Google search functionality; assess any embed separately before loading it.]

Google Business Profile (planned). We intend to maintain company profiles for discovery through Google Search and Maps. Google processes profile visits, reviews and other interactions under its own privacy policy. EVOCEAN processes information you choose to share with us, such as a review or enquiry, to respond and manage its business presence; where the GDPR applies, the basis is our legitimate interest in that activity (Art. 6(1)(f)), or pre-contractual steps where applicable (Art. 6(1)(b)). An ordinary external profile link does not itself load a Google embed on this website.

LinkedIn (planned). We intend to maintain a LinkedIn company presence and link to it from this website. LinkedIn processes visits and interactions on its platform under its own privacy policy; EVOCEAN processes messages, comments and contact information to respond and manage that presence, based on legitimate interests (Art. 6(1)(f)) or pre-contractual steps where applicable (Art. 6(1)(b)). An ordinary external link does not itself load LinkedIn tracking on this website. LinkedIn Insight Tag, advertising, conversion tracking and embedded posts are not confirmed by this draft; any non-essential tracking or embeds would require prior consent. [PENDING: profile URL, contracting LinkedIn entity, page-insights data and applicable joint-controller terms, any Insight Tag/advertising/embeds, data categories and retention.]

Provider privacy information: Google: https://policies.google.com/privacy; LinkedIn: https://www.linkedin.com/legal/privacy-policy. These providers may process data outside Switzerland and the EEA; see section 9. Provider notices do not replace EVOCEAN’s own disclosure duties.

4. Contacting us

When you contact us by email, phone or a contact form, we process the details you provide, such as name, company, email address, phone number and your message, to answer your enquiry and, where relevant, prepare an offer. Under the GDPR the legal basis is pre-contractual steps (Art. 6(1)(b)) or our legitimate interest in answering business enquiries (Art. 6(1)(f)). Please do not send confidential technical material in a first enquiry.

We use Salesforce as our customer relationship management (CRM) system to manage enquiries, business contacts and customer relationships. Certain website contact forms will send the details you submit directly to Salesforce to create or update enquiry and contact records. The legal basis is the same as for handling the underlying enquiry; submitting a contact form does not subscribe you to marketing. [PENDING: identify the affected forms, exact fields and recipients, any integration intermediary, responsible EVOCEAN entity, Salesforce contracting entity, processing agreement, access controls and deletion periods. Confirm storage, support access, backups and transfer safeguards under section 9. Any embedded form, device storage or tracking must also be assessed under section 3.]

We delete enquiry data when it is no longer needed, unless a business relationship follows or statutory retention duties apply.

5. Consultation and training requests

You can book a 15-minute consultation directly on this website by choosing an open time. We process the fields you complete (name, email, company, phone, topic, goal and context) and the time you selected to arrange and hold the conversation. Bookings are stored in the website’s own calendar database operated by our hosting provider, and only authorised EVOCEAN staff can view them. We send a confirmation email to you and a notification to the EVOCEAN colleague whose calendar was reserved. [PENDING: confirm the storage region of the booking database, backups, processing agreement with the hosting provider, the email delivery provider and the retention period for bookings.]

For calls we use Microsoft Teams, Zoom, Google Meet and WhatsApp, depending on the agreed channel. Depending on the service and settings, providers may process participant names, email addresses or phone numbers, meeting details, IP addresses, device and connection information, and audio, video or messages shared during the call. Where the GDPR applies, arranging and holding calls relies on Art. 6(1)(b) for steps requested by an individual before a contract or performance of that contract, or Art. 6(1)(f) for our legitimate interest in communicating with business contacts. WhatsApp is not mandatory; you can request an alternative contact channel. Recording, transcription or AI meeting assistants are not authorised by this draft; any intended use needs a separate assessment and advance participant information, with consent where required. [PENDING: confirm account types, contracting Microsoft, Zoom, Google and WhatsApp/Meta entities, processor/controller roles, meeting settings, retention and countries of processing, including international-transfer safeguards under section 9.]

6. Customers and contracts

For customers, we process contact persons' data needed to perform contracts, deliver services and training, invoice and meet accounting and tax duties. Under the GDPR the legal basis is contract performance (Art. 6(1)(b)) and legal obligations (Art. 6(1)(c)). Accounting records are kept for the statutory period: 10 years in Switzerland (Art. 958f CO) and up to 10 years in Germany (§ 147 AO, § 257 HGB).

For certain services, we use monday.com. Depending on the service, personal data used there may include business contact details, project assignments, task updates and information shared for service delivery. Where the GDPR applies, processing necessary for a contract with an individual relies on Art. 6(1)(b); processing business contacts’ data for coordination and delivery relies on our legitimate interests (Art. 6(1)(f)), subject to a balancing assessment. [PENDING: specify which services use monday.com, actual data categories, whether customers receive workspace access, responsible EVOCEAN entity, provider contracting entity and processing agreement, authorised users, retention and deletion, storage/access countries and transfer safeguards. Do not assume that sensitive personal data or confidential customer documents are included.]

7. Newsletter

The Breaking Wave newsletter is sent by EVOCEAN with our own mailing system, which is integrated into the backend of this website. No external mailing provider is involved: subscription data stays with us and is not passed to a third-party newsletter service. Subscription uses double opt-in: after you sign up, you receive a confirmation email, and the newsletter is sent only once you have confirmed the subscription through it.

We measure whether newsletters are opened and which links are clicked, to evaluate the content and improve future issues. You can unsubscribe at any time using the link in every issue; measurement for you ends when you unsubscribe. Newsletters are sent only with your consent (GDPR Art. 6(1)(a)), and consent can be withdrawn at any time with effect for the future.

8. Who receives data

We share personal data only where needed: between EVOCEAN GmbH and EVOCEAN Deutschland GmbH to handle enquiries and contracts, with IT, hosting and email providers acting on our behalf under data processing agreements, with manufacturers or distributors such as IBM or Perforce when you order licences or renewals through us, and with authorities where the law requires it. We do not sell personal data.

Salesforce receives CRM and enquiry data, including information submitted through the connected contact forms when they are enabled. monday.com receives data needed for the particular services managed there. These providers are intended to process customer data on EVOCEAN’s instructions under applicable processing agreements; exact contracting entities, service-specific roles and subprocessors remain to be verified. Only data needed for the relevant purpose should be shared.

The planned Google and LinkedIn services and the Microsoft Teams, Zoom, Google Meet and WhatsApp call services may also receive data as processors, independent controllers or, for particular activities, joint controllers, depending on their service terms. [PENDING: identify the exact contracting entities and their roles and applicable processing/joint-controller terms, alongside email, hosting, calendar and CRM providers and their locations.]

9. Transfers abroad

EVOCEAN GmbH is based in Switzerland and EVOCEAN Deutschland GmbH in Germany. The European Commission recognises Switzerland as providing adequate protection, and Switzerland recognises the EU and EEA. Salesforce and monday.com, the planned Google and LinkedIn services, and the Microsoft Teams, Zoom, Google Meet and WhatsApp call services may involve processing in the United States and other countries. Storage location, subprocessors, backups and remote support access must be checked for each service; no EU-only processing is assumed. We must identify the recipients and countries and verify the transfer basis separately under Swiss and EU law; planned website integrations must not be activated before that assessment. A Swiss-US or EU-US Data Privacy Framework adequacy basis may be used only where the relevant recipient’s current certification covers the transfer; otherwise appropriate safeguards, such as applicable standard contractual clauses with any necessary Swiss adaptations and supplementary measures, must be assessed. Cookie or analytics consent does not itself establish a lawful international-transfer basis. [PENDING: confirm recipient entities, countries (FADP Art. 19(4)), certification scope or contractual safeguards, transfer assessment and how to obtain a copy of safeguards via info@evocean.com.]

10. Your rights

You can ask for information about your personal data, a copy of it, its correction or deletion, and restriction of processing. Under the GDPR you also have a right to data portability. You can object at any time to processing based on our legitimate interests, and you can withdraw consent at any time with effect for the future.

Send requests to info@evocean.com. We may ask you to confirm your identity.

11. Right to complain

You can complain to a data protection authority. In Switzerland: Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, www.edoeb.admin.ch. In Germany, for EVOCEAN Deutschland GmbH: Bavarian Data Protection Authority (BayLDA), Promenade 18, 91522 Ansbach, www.lda.bayern.de. You can also contact the authority where you live or work.

12. Security, automated decisions and changes

We use appropriate technical and organisational measures to protect personal data, including encrypted connections (HTTPS). We make no automated individual decisions or profiling within the meaning of FADP Art. 21 or GDPR Art. 22.

We may update this policy when our services or the law change; the version published on this page applies. Last updated: [PENDING: publication date].