# Privacy Policy

> How Gray Matter collects, uses, and protects your personal data. Cookie-less analytics and language preference, data subject rights, and contact information.

- Canonical: https://graymatter.ch/privacy-policy/
- Locale: en
- Body language: en

---

**Effective Date: September 2026**

Gray Matter GmbH ("we", "our", or "us") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, and safeguard your information when you visit our website graymatter.ch.

## 1. Data Controller

**Gray Matter GmbH**
Ufem Feld 21
3303 Münchringen
Switzerland

Email: hello@graymatter.ch
Phone: +41 31 536 12 77

## 2. Data We Collect

### 2.1 Contact Form Submissions

When you submit our contact form, we collect:
- Name
- Email address
- Company name (required)
- Message content

### 2.2 Analytics Data

We use Cloudflare Web Analytics, a privacy-focused, cookie-less analytics solution. This means:
- **Cloudflare Web Analytics does not use cookies**
- We receive aggregated, anonymized reports about page views and visitor counts
- Cloudflare may process limited technical data (e.g., truncated IP addresses, device and request metadata) to provide analytics and security services
- This processing is covered by our legitimate interest in website security and improvement

### 2.3 Server Logs

Our hosting provider (Cloudflare) may collect standard server log data including:
- IP address (anonymized)
- Browser type
- Referring page
- Time of access

This data is used solely for security purposes and is not linked to your identity.

### 2.4 Bot Protection Data

When you interact with our contact form, Cloudflare Turnstile collects:
- Browser fingerprint data
- Interaction patterns
- Device characteristics

This data is used solely for distinguishing humans from automated bots and is processed by Cloudflare according to their privacy policy.

## 3. Purpose of Processing

We process your data for the following purposes:

| Purpose | Legal Basis (nFADP Art. 31 / GDPR Art. 6) |
|---------|-------------------------------------------|
| Responding to contact form inquiries | Legitimate interest / Contract performance |
| Website security and fraud prevention | Legitimate interest |
| Anonymized website analytics | Legitimate interest |

## 4. Data Retention

- **General inquiries:** 12 months after resolution of the inquiry
- **Contract-related correspondence:** 10 years (Swiss commercial law OR 958f)
- **Server logs:** Maximum 90 days
- **Analytics data:** Anonymized and aggregated, no personal data retained

## 5. Data Sharing

We do not sell, rent, or trade your personal information. We may share data with:

### Service Providers
- **Cloudflare:** Website hosting, security, and analytics on its global network
- **Resend** (email delivery): Processes contact form submissions to deliver emails. Resend states that its primary processing operations are in the United States and publishes contractual safeguards for international transfers. Its privacy policy is available at resend.com/privacy.

### Legal Requirements
We may disclose your information if required by law or to protect our legal rights.

## 6. Data Transfers

Cloudflare operates a global network, and Cloudflare and Resend may process data outside Switzerland and the European Economic Area (EEA).

Cloudflare publishes a Data Processing Addendum that provides transfer mechanisms including the EU Standard Contractual Clauses and the Swiss-U.S. Data Privacy Framework where applicable.

Resend's published Data Processing Addendum identifies its primary processing operations in the United States and provides Standard Contractual Clause mechanisms for transfers from the EEA and Switzerland.

## 7. Your Rights

Under GDPR and the Swiss Federal Act on Data Protection (nFADP), you have the right to:

- **Access** your personal data
- **Rectify** inaccurate data
- **Erase** your data ("right to be forgotten")
- **Restrict** processing of your data
- **Data portability** - receive your data in a structured format
- **Object** to processing based on legitimate interest
- **Withdraw consent** at any time (where applicable)

To exercise these rights, contact us at: hello@graymatter.ch

## 8. Cookies

Cloudflare Web Analytics does not use cookies. When you choose a language, this website stores one functional `lang_pref` cookie so it can remember that choice. The cookie contains only the validated language code, is restricted to secure connections with SameSite=Lax, applies to this website, and expires after a maximum of one year. It contains no identity or contact information and is not joined to analytics or a user profile.

## 9. Third-Party Links

Our website may contain links to third-party websites. We are not responsible for the privacy practices of these sites. Please review their privacy policies before providing personal information.

## 10. Automated Decision-Making

We do not use automated decision-making or profiling that produces legal effects or similarly significant effects on individuals. Bot detection via Cloudflare Turnstile is used solely for security purposes and does not affect your ability to contact us.

## 11. Children's Privacy

Our services are not directed at individuals under 16 years of age. We do not knowingly collect personal data from children.

## 12. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated effective date.

## 13. Contact & Complaints

For questions about this Privacy Policy or to exercise your data protection rights:

**Gray Matter GmbH**
Email: hello@graymatter.ch
Phone: +41 31 536 12 77

You also have the right to lodge a complaint with a supervisory authority:

**Swiss:** Federal Data Protection and Information Commissioner (FDPIC)
**EU:** Your local data protection authority