Privacy policy
This policy explains what personal data is processed when you visit cartorga.com, contact us or use the Cartorga platform as a customer. For the personal data of people who take part in an interview on the Cartorga platform, see the privacy notice for interview participants. Last updated .
1. Who is responsible
Cartorga AG, Hardturmstrasse 161, 8005 Zurich, Switzerland (UID CHE-433.554.023), is the controller for the processing described in this policy. Details: see the Impressum.
Privacy contact: privacy@cartorga.com. General enquiries: hello@cartorga.com.
This policy follows the Swiss Federal Act on Data Protection (revFADP) and, where it applies to you, the GDPR.
2. What data we process, why, and on what basis
| Situation | Data | Purpose | Legal basis | Storage period |
|---|---|---|---|---|
| Visiting the website (server logs at our hosting provider) | IP address, date and time, pages requested, browser and device type | Delivering the site, security, error analysis | Legitimate interest (Art. 31 revFADP; Art. 6(1)(f) GDPR) | Short period under the hosting provider's standard settings |
| Website analytics, only with consent | Pages viewed, clicks, navigation, approximate location from IP, device and browser; session recordings and heatmaps with everything you type masked | Improving the site | Your consent (Art. 31 revFADP; Art. 6(1)(a) GDPR). Nothing is loaded and no cookie is set until you accept. | 12 months |
| Trial request / contact form | Name, work email, consultancy, team size, what you want to use Cartorga for, anything else you write | Answering your request and preparing a possible contract | Steps before a contract and legitimate interest (Art. 6(1)(b) and (f) GDPR) | 24 months after the last contact |
| Email correspondence and sales contacts | Name, email, company, correspondence, meeting notes | Communication, sales, contract preparation | Steps before a contract and legitimate interest | 24 months after the last contact; contract records as the law requires |
| Customers: platform accounts and billing | Name, work email, role, organisation, invoices and payment status | Providing the platform, billing, support, security | Contract; legal obligation to keep accounting records (10 years under Swiss law) | Account data until account deletion plus 30 days; accounting records as required by law |
| Product analytics in the platform for customer accounts | Pseudonymous identifier, usage data | Improving the product | Legitimate interest | 12 months |
| Applications (only if you send us one) | CV and application documents | Assessing your application | Steps before a contract | 6 months after the process ends, unless you agree to a longer period |
We do not sell personal data, we do not build advertising profiles, and we make no automated individual decisions that have legal effect on you or significantly affect you.
3. Cookies and similar technologies
The website sets no analytics cookies or local storage until you accept them in the cookie banner. You can change or withdraw your choice at any time using the Cookie settings link in the footer. Withdrawing stops further analytics and clears the analytics identifiers.
Technically necessary storage does not need consent. We store your cookie choice in your browser's local storage until you clear it. If you accept analytics, an analytics identifier is stored in local storage and in a cookie for up to 12 months.
4. Who receives your data
We use the following categories of recipients:
- a website hosting provider;
- an analytics provider, hosted in the EU and used only with your consent;
- a form provider for the contact and trial request form;
- an email and office provider;
- professional advisers (such as lawyers, auditors and tax advisers), banks and authorities, where required by law or in a company sale or restructuring.
Providers process data on our behalf under data processing terms, or as independent controllers where their terms say so.
The notice for people who take part in an interview is at cartorga.com/privacy/participants.
5. Where data is processed
We are based in Switzerland and our platform is hosted in Germany. Some providers may process data outside Switzerland and the EU, including the USA; such transfers are protected by the Data Privacy Framework or EU Standard Contractual Clauses (Art. 16 revFADP; Art. 46 GDPR). A copy of the safeguards is available from privacy@cartorga.com.
6. How long we keep data
The periods are listed in section 2. When a period ends we delete or anonymise the data. Statutory retention duties, in particular for accounting records, take precedence.
7. How we protect your data
Encrypted connections, encrypted storage, strict separation of customer data, access limited to the people who need it with multi-factor authentication, and encrypted backups. We have a documented incident process, including notifying those concerned and the authorities where the law requires it.
8. Your rights
You can request access to your personal data, correction, deletion, restriction of processing and a copy in a usual electronic format (portability). You can object to processing based on our legitimate interests and withdraw consent at any time with effect for the future. Write to privacy@cartorga.com; we reply within 30 days and may ask you to confirm your identity.
You can also complain to a supervisory authority. In Switzerland this is the Federal Data Protection and Information Commissioner (FDPIC), edoeb.admin.ch. If you are in the EU you can contact the authority in your country.
9. Changes
We may update this policy. The version on this page applies; the date above shows the latest change.