Privacy policy

The controller for data processing on this website is G6 Agency AG, Bahnhof-Park 2, 6340 Baar, Switzerland (UID: CHE-333.056.061 MWST).

For questions about data protection you can reach us at info@zertify.ch.

We process personal data in accordance with the Swiss Federal Act on Data Protection (FADP). Where our offer is directed at persons in the European Union or the European Economic Area, we also comply with the General Data Protection Regulation (GDPR).

Depending on your use, we process the following categories of personal data:

• Technical data when you visit the website, for example IP address, date and time, pages viewed, browser type and operating system (server log files).
• Account and contact data, for example name, email address, company and billing address.
• Assessment data, meaning your answers in the self-assessment, the result and the chosen standards.
• Order and payment data, for example purchased certificates, amounts, invoices and payment status. We do not receive card data, it is processed directly by the payment provider.
• Certificate data shown on the public verification page: company name, standard, certificate number, issue and expiry date and status.
• The content of your inquiries, for example through the contact form or by email.
• With your consent: data for audience measurement and advertising, for example cookie identifiers and campaign parameters.

We process personal data to offer the self-assessment and the issuing of certificates, to perform contracts, to handle payments, to answer inquiries, to ensure the security and stability of the website, to meet legal obligations and to improve our offer.

Legal bases under the GDPR are performance of a contract (Art. 6(1)(b)), our legitimate interests in the secure and efficient operation of the website (point f), legal obligations (point c) and your consent (point a), in particular for tracking and advertising. Under the FADP we rely on proportionality of the processing and on your consent where it is required.

We use Supabase for the database, authentication and file storage. Your account, assessment, order and certificate data are stored there. We operate the infrastructure with a hosting provider we have engaged.

Data processing agreements are in place with the service providers involved. Access is limited to what is necessary.

We process payments through Stripe (Stripe Payments Europe, Ltd., Ireland, and Stripe, Inc., USA). During payment you are redirected to a Stripe page. Stripe processes your payment data as an independent controller or on our behalf under Stripe's privacy terms.

We receive information from Stripe about payment status, amount and invoice, but not your full card data.

We send transactional emails such as confirmations, invoices, certificate delivery and replies to inquiries through Resend (Resend, Inc., USA). Your email address, the content of the message and technical delivery data are processed in the process.

If you order the optional audit report, it may be prepared with the support of an AI service. For this we transmit your assessment answers, usually without name and contact details. Please do not enter sensitive personal data in free text fields.

We use necessary cookies, for example for sign-in, the language setting and your cookie choice. These are required to operate the website.

We only use cookies and similar technologies for audience measurement and advertising if you consent in the cookie notice. You can change or withdraw your choice at any time, and you can delete or block cookies in your browser settings.

With your consent we use services to measure the success of our advertising and to serve ads:

• Google Ads (Google Ireland Limited, Ireland, or Google LLC, USA) for conversion measurement and ad delivery.
• Meta Pixel (Meta Platforms Ireland Limited, Ireland) for measuring conversions and serving ads on Facebook and Instagram.
• LinkedIn Insight Tag (LinkedIn Ireland Unlimited Company, Ireland) for conversion measurement and audience building.

In this process, identifiers such as cookie IDs, click identifiers from ads (for example gclid or fbclid), campaign parameters and information about your visit and orders may be transmitted to the providers. Without your consent these services are not loaded.

The providers partly process data as independent controllers. You can find more information in their privacy policies.

Some of the service providers named above are based in the USA or process data there. Disclosure takes place on the basis of an adequacy decision (for example the Data Privacy Framework for certified companies) or with appropriate safeguards, in particular the EU standard contractual clauses, which are also recognized by the Swiss Federal Data Protection and Information Commissioner (FDPIC).

We store personal data only as long as necessary for the stated purposes or as required by law. We keep accounting records for ten years. Certificate data remain stored for the duration of validity and afterwards for evidence purposes. Log files are deleted after a short time.

We take appropriate technical and organizational measures to protect your data, including encrypted transmission, access restrictions and separated roles. Complete security on the internet cannot be guaranteed, however.

Within the framework of applicable law you have the following rights:

• Access to the personal data we process about you.
• Rectification of inaccurate data.
• Erasure of your data, unless a retention obligation applies.
• Restriction of processing and objection to processing.
• Receipt or transfer of your data in a common format (data portability).
• Withdrawal of a given consent with effect for the future.

To exercise your rights, write to info@zertify.ch. We may ask for proof of identity.

You may also lodge a complaint with a data protection authority, in Switzerland with the FDPIC, in the EU with the supervisory authority of your place of residence.

We may adapt this privacy policy at any time, for example when introducing new services or when regulations change. The version published on the website applies.