Privacy Policy

1. Controller

The party responsible for the processing of personal data in connection with this website is:

Digital Discovery: a specialist network for digital transformation
Frank-Buchserstrasse 12
4532 Feldbrunnen
Switzerland
Contact: our contact page

For any privacy questions and to exercise your rights, you can reach us at this address at any time.

2. Scope and principles

This policy applies to all personal data processed via this website (web.digitaldiscovery.ch). The governing law is the revised Swiss Federal Act on Data Protection (revFADP). Where visitors from the EU/EEA are concerned, we additionally observe the relevant requirements of the European General Data Protection Regulation (GDPR). We process personal data lawfully, in good faith, proportionately, transparently and for the stated purposes, and protect it with appropriate technical and organisational measures.

3. Processing when you visit the website

When you access the website, technically necessary connection data is processed: IP address, date and time of access, the page/resource requested, browser type and operating system, and, where applicable, the referring page. The purpose is the secure and stable delivery of the website. The site runs on our own infrastructure in Switzerland and is delivered via Cloudflare (content-delivery network and protection against attacks), which processes technically necessary connection data (including the IP address). We use IP addresses only in shortened or pseudonymised form (as a hash value) to prevent misuse and to limit request rates. From this connection data we derive, without cookies and without recognising you across days: aggregated reach figures (pages requested, reading time and scroll depth per page, sections viewed, clicks on links and buttons, referring domain, country, device type) and distinguish automated requests (search engines, AI crawlers, scanners) from human visits in order to detect attacks and improve the website (legitimate interest). The pseudonymised log data is deleted after 90 days at the latest.

Fonts: The "Inter" typeface used is served from our own infrastructure. It is not loaded from external servers and no data is transmitted to third parties in the process.

4. Contacting us

If you write to us by e-mail or via the callback/contact function, we process the data you provide (e.g. name, e-mail address, content of the message) solely to handle and answer your enquiry and for any follow-up communication.

4a. Requesting documents (PDF download)

On the Solutions page you can request specialist documents as PDFs. To do so you provide your first name, last name and e-mail address, optionally your company, and you expressly agree that we may contact you about the topic concerned. We process these details solely to provide the document and to follow up once on that topic, no sharing with third parties, no newsletter subscription. We store the details, the document requested and the time of your consent (as a record). The data sits on the same Swiss server as the rest of the website data and is deleted automatically after two years. You may withdraw your consent at any time by a plain e-mail to [email protected] and request deletion; we will then remove the entry without delay.

4b. Enquiry about the Digital Discovery Assessment

If you request an on-site appointment via the Assessment page, we process the details from the form, company, first and last name, e-mail address, optionally telephone number, location, preferred date and your description of the task: to arrange and prepare the appointment. Because the assessment is carried out and invoiced by a partner firm from our network depending on the task, we pass on the details required for delivery to that firm; we name it to you in advance in the confirmation. We delete the enquiry itself after five years. The invoice and its supporting records are held by the executing firm and are subject to the ten-year commercial retention obligation there.

4c. Booking the initial call

The time selection on the Assessment page is rendered by us; our server retrieves the free slots from the calendar service OneCal. When you book, we transmit your name, e-mail address, the chosen time and your time zone to that service so the appointment can be entered and the confirmation sent to you. We ask for nothing further.

A bot check runs before submission (sec. 4d).

4d. Bot check on forms

Every form on this website: contact, document requests, assessment enquiries and appointment booking, is protected by a bot check using Cloudflare Turnstile. It prevents automatically generated submissions and is invisible in the vast majority of cases; only where there is suspicion does a brief interaction appear.

Turnstile sets no advertising cookies and builds no user profile. It processes technical characteristics of your browser and connection. We do not additionally transmit your IP address to Cloudflare. The check script is only loaded once you actually use a form, merely reading does not trigger it. Without a successful check we do not accept the submission; you can still reach us at the address given in the imprint.

5. Chat and AI assistant (the "digital engineer")

The chat widget is voluntary and only starts after your explicit consent. Your text inputs and, in voice mode: your voice recordings are processed exclusively in Switzerland: speech recognition (Whisper) and the AI language model that generates the answers run at Infomaniak Network SA (Geneva) in their Swiss data centres; in addition we operate a language model on our own server in Switzerland as a fallback. Infomaniak does not use the transmitted content to train its own models. Only for voice output (reading the answer aloud) is the finished answer text transmitted to ElevenLabs Inc. (USA) and converted into speech there: your question and your voice recording are not sent there.

6. Voice mode (microphone)

If you use voice mode, we access the microphone only after your explicit permission in the browser. The recording of your spoken request is transmitted to our server and forwarded from there to Infomaniak (Geneva, Switzerland) for speech recognition; if that service is unavailable, recognition runs locally on our own server. The recording does not leave Switzerland. The recognised request is then processed as described in section 5.

7. Recording for quality and training purposes

To improve the assistant and speech recognition, we store the chat content (your questions and our answers) and use this material for training and quality purposes. In voice mode, only the recognised text is stored, not the audio recording itself: the recording is discarded after speech recognition. Stored conversations are deleted automatically after one year. Processing takes place exclusively in Switzerland, on our own infrastructure and at Infomaniak (Geneva). Use of the chat is voluntary; please do not enter any sensitive personal data (e.g. health or financial data). Training data is stored without any directly identifying reference to you (only with an anonymous session identifier); a targeted subsequent deletion of individual records is therefore only possible if the record in question can be unambiguously identified. You may object to future use for training purposes at any time: a message via our contact page is sufficient.

8. Live chat with our contact person

If you use the live chat, your messages are delivered to our contact person via the Telegram service (Telegram Messenger Inc./Telegram FZ-LLC) so that they can respond. Please do not transmit any sensitive data this way. Any contact details you optionally provide (e.g. an e-mail address for a callback) are used only to respond to you.

9. Client login (portal)

In the protected area we process access data (name, company, e-mail address) and access logs in order to provide you with the agreed content and to safeguard the security of the area. The underlying system is operated locally in Switzerland.

Invitation and one-time code. Access is granted by personal invitation: a contact from our network enters your e-mail address, and you receive a personal invitation link (valid for seven days, usable once). By clicking it you confirm that you own the mailbox. For every sign-in we send a one-time code to this address (valid for five minutes). Visitors have no password; we store your e-mail address, the time of confirmation and the validity of the share.

Consultant profiles. Consultants in our network can share their profile (career, projects, certifications) with you for a defined period, with or without PDF download and with a watermark carrying your e-mail address. You may forward a share to colleagues in the same e-mail domain; each forwarded person receives their own invitation. Client names in projects are shown only where the consultant has released them.

Per-person evaluation. For shared consultant profiles we log, per invitation: invitation, confirmation, sending of a one-time code, sign-in, views, visited pages with reading time, PDF download and forwards. No IP addresses, no device or browser identifiers. Only the person whose profile it is and the administration of our network see this evaluation; it serves to gauge interest in the profile and to manage shares. Logs are deleted after 365 days; when a share is revoked or expires, your access ends immediately. The legal basis is our overriding interest in managing and securing shares (Art. 31 para. 1 revFADP); you can object to the evaluation by not using the share or by letting us know.

10. Cookies and local storage

We use no marketing or advertising cookies, embed no third-party analytics services and do not carry out profiling. For technical necessity, your browser stores your chat consent (localStorage) and a random session identifier (sessionStorage, discarded when the tab is closed) so that the chat works.

Recognition (cookie, after your consent in the cookie notice): If you choose "Accept" in the cookie notice, we recognise your browser on later visits and can thus understand returning visitors and their path across several visits. For this purpose your browser stores a random identifier as a cookie (ddc_vid, lifetime 180 days) which recognises your browser on a return visit without identifying you as a person. Analysis takes place exclusively on our own infrastructure in Switzerland; no data is transmitted to third-party analytics providers, and IP addresses are stored only as truncated hash values. If you choose "Essential only", no identifier is set; only the cookie-free evaluation described in section 3 remains. You can change your decision at any time via the "Cookie settings" link in the footer; if you decline, the identifier is deleted immediately. Usage data is deleted after one year at the latest.

11. Disclosure to third parties and international transfers

We do not disclose personal data for advertising purposes. To provide the service, we use carefully selected processors:

• Cloudflare, Inc. (USA/global): delivery and protection of the website (CDN) and the «Turnstile» bot check on all forms (sec. 4d).
• OneCal SHPK (Rruga Gjon Buzuku, Tirana, Albania): calendar and appointment booking service for the initial call (sec. 4c); name, e-mail address, time and time zone are transmitted.
• Infomaniak Network SA (Geneva, Switzerland): speech recognition and AI language model of the assistant; processed exclusively in Swiss data centres, content is not used for model training.
• ElevenLabs Inc. (USA): speech synthesis for the assistant's voice output (finished answer text only).
• Telegram (Telegram FZ-LLC, United Arab Emirates): delivery of live-chat messages to our contact person.

Where data is transferred to the USA (Cloudflare, ElevenLabs), we rely on recognised safeguards for an adequate level of data protection (in particular the Swiss-U.S. Data Privacy Framework or the EU Commission's Standard Contractual Clauses together with appropriate supplementary measures). Delivery via Telegram (registered in the United Arab Emirates, a country without recognised adequate data protection) only takes place if you actively use the live chat and is necessary to handle the communication you requested (Art. 17 revFADP); please do not transmit any sensitive data this way. The same applies to appointment booking via OneCal SHPK: Albania is not a country with recognised adequate data protection (list of states under Annex 1 of the Data Protection Ordinance). The transfer only takes place if you book an appointment yourself, is limited to name, e-mail address, time and time zone, and is necessary to arrange the conversation you requested (Art. 17 revFADP). If you would rather not use this route, the contact form reaches us just as well. We disclose data to authorities only where we are legally obliged to do so.

12. Retention and deletion

We retain personal data only for as long as necessary for the respective purpose:

• Chat sessions and live-chat histories: deletion after one year at the latest (together with the training/quality data, section 7): or earlier if you object.
• Server and connection logs: short-term, then deleted or anonymised.
• Data for training/quality purposes (section 7): one year from the conversation, then deleted automatically or earlier if you object.
• Details from document requests (section 4a): two years from the request, then deleted automatically or earlier if you withdraw consent.
• Portal/access data: until the end of the access authorisation or the business relationship.

13. Data security

We protect your data with appropriate technical and organisational measures: operation on our own, hardened infrastructure in Switzerland, encrypted transmission (TLS/HTTPS) and restrictive access controls.

14. Automated processing and AI notice

The assistant's answers are generated automatically by a generative AI model. No automated individual decisions with legal effect take place. AI answers may be incomplete or incorrect and do not constitute binding advice; only individual statements made in a personal conversation are binding.

The figures shown on the website (video sequences at the edge of the page) and the portrait of the digital engineer in the chat window are AI-generated and do not depict real people; no personal data of third parties is processed to create them. Further information on the use of AI on this website can be found in our legal notice.

15. Your rights

Within the scope of applicable law, you have in particular the right to information (access), rectification and deletion, as well as to restriction of or objection to certain processing, and to the handover/portability of your data. You may withdraw any consent given at any time with effect for the future. To do so, contact our contact page. You also have the right to lodge a complaint with the competent supervisory authority, in Switzerland the Federal Data Protection and Information Commissioner (FDPIC), Bern.

16. Minors

Our offering is aimed at companies and adults. We do not knowingly process data of children.

17. Changes

We may amend this privacy policy to reflect changes in the law or in functionality. The version published on this page at any given time applies. Further details can be found in our legal notice.