Privacy notice

1. Controller

The controller responsible for processing personal data in connection with this website is:

Strategic Board Advisors AG Sennweidstrasse 43 6312 Steinhausen Switzerland

Email: info@strategicboardadvisors.com UID: CHE-370.477.627

For questions about data protection or to exercise your rights, please contact us at the above address or by email.

2. General information and legal basis

We process personal data in accordance with the Swiss Federal Act on Data Protection (FADP, revised as of 1 September 2023) and the Data Protection Ordinance (DPO).

Under the FADP, consent is generally not required for processing personal data, provided the processing complies with the statutory principles (Art. 6 FADP) and does not infringe privacy, or such infringement is justified.

Where the EU General Data Protection Regulation (GDPR) applies in individual cases, its provisions apply in addition. This privacy notice primarily fulfils the duty to inform under Art. 19 FADP. In the event of differences between the language versions, the German version prevails.

3. Personal data we process and why

We collect and process personal data only to the extent necessary to operate the website, respond to enquiries and comply with legal obligations.

a) Visiting the website

When you visit our website, technically necessary data is recorded (in particular IP address, date and time, page accessed, browser and device information). This data is processed to ensure operation and security and to defend against attacks.

Legal basis: legitimate interest in a secure and functional website.

b) Contact form and enquiries

When you contact us via the contact form or by email, we process the data you provide (name, company, email address, selected topic, message and any optional details). Contact form enquiries are transmitted to us through our email service; the form does not create a separate enquiry database.

Purpose: handling and answering your enquiry and, where applicable, initiating a contractual relationship.

Legal basis: legitimate interest or pre-contractual measures.

We treat enquiries confidentially. Further processing or storage only takes place where necessary for handling the matter or asserting rights.

c) Mandate-related data

Data arising within an advisory mandate is processed exclusively on the basis of the respective contract, our professional duties of confidentiality and statutory requirements. This privacy notice primarily governs the website; mandate relationships are governed by the contractual terms and statutory secrecy obligations.

d) Invitations and event registration

For invitations and event organisation, we process contact and organisation details, attendance or decline status, and optional information about accompanying guests, dietary requirements and comments. This data comes from our business contacts and the information you provide when registering. Personal invitation links provide access to the respective registration and should not be shared.

Dietary requirements may reveal information about health or religion. Please provide only information necessary for organising the event, and supply details about accompanying guests only with their knowledge and agreement.

e) Protected internal area

The internal area supports website administration, business contact management, and mandate, time and billing administration. For Google sign-in, we process identification and profile data supplied by Google, in particular the user identifier, name and email address, together with session and permission data for access control. Sign-in is not required to visit the public website.

f) Displaying typefaces

We load the Manrope and Cormorant Garamond typefaces through Google Fonts. Your browser connects to Google and transmits, in particular, your IP address and technical details about the request and browser. This provides a consistent appearance for our website; processing by Google may also take place in the USA.

4. Cookies and tracking

Our website uses technically necessary cookies or similar technologies (in particular for security and operation, including via Cloudflare).

In the protected area, session data is stored in browser local storage to keep you signed in. If you enable the optional device lock, a WebAuthn credential reference and the activation setting are also stored locally. Biometric verification takes place through your device; the website receives no facial or fingerprint data.

You can delete or block cookies and local website data in your browser settings. This may affect sign-in and the local device lock.

We currently use no analytics or marketing cookies that enable tracking beyond our website or create profiles. Should we use such tools in future, we will inform you transparently and obtain consent where legally required.

5. Recipients and processors

We only disclose personal data to third parties where necessary for the stated purposes or where legally required.

Technical service providers currently used:

• Lovable for website operation and Lovable Cloud as the managed database and storage service: business contacts, event registrations, internal user and permission data, mandate, time and billing data, and website content and profile images
• Hosting and security infrastructure, in particular Cloudflare (USA)
• Email and communication infrastructure, including the managed email service for contact form enquiries
• Google Fonts (Google, USA) for displaying typefaces and Google for authorised internal users to sign in; the data described in section 3 is processed in the course of these services

All processors are contractually obliged to process data only on our behalf and according to our instructions.

6. Transfers abroad

Personal data may be processed outside Switzerland in connection with our technical service providers, in particular in the USA by Google and Cloudflare. Database, storage and email services may also involve storage or access from abroad.

Transfers only take place where adequate data protection is ensured (adequacy decision of the Federal Council, standard contractual clauses or equivalent safeguards under Art. 16 FADP). For the USA, this applies in particular to recipients certified under the Swiss-US Data Privacy Framework.

7. Retention

We store personal data only as long as necessary for the respective purpose or as required by statutory retention obligations.

• Technical log data: for as long as needed for operation, troubleshooting and security; retention also depends on the settings of the service providers used.
• Contact enquiries: until the enquiry has been fully handled, then deleted or anonymised unless statutory retention obligations or legitimate interests (e.g. defence against claims) prevent this.
• Event data: for as long as necessary for organising, running and following up the event or meeting legal obligations.
• Internal user and permission data: for as long as necessary for access management, security or legal obligations.
• Mandate, time and billing data: in accordance with contractual and statutory requirements.

8. Your rights

Under the FADP you have in particular the following rights:

• Access to the data processed about you (Art. 25 FADP)
• Rectification of inaccurate data
• Erasure or restriction of processing under the statutory conditions
• Objection to processing in certain cases
• Release or transfer of data (where applicable)

An informal notice to the above address is sufficient to exercise your rights. We reserve the right to request proof of identity. Statutory retention obligations, the enforcement or defence of legal claims and overriding interests may prevent complete erasure.

You also have the right to lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC) (www.edoeb.admin.ch).

Where processing is based on your consent, you may withdraw it at any time with effect for the future. Where the GDPR applies, you also have the rights provided for by it and the right to lodge a complaint with the competent data protection supervisory authority.

9. Data security

We take appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse or alteration, including encryption (HTTPS), access restrictions and regular security reviews. Absolute security cannot, however, be guaranteed.

10. Changes

We reserve the right to amend this privacy notice as required (e.g. due to changes in legislation or our processing activities). The current version is always available on the website. We will communicate material changes in an appropriate manner.