Privacy Policy

Grifo Development, Luca Grifo, based in Switzerland, is the data controller responsible for your personal data. For data protection inquiries, please use the contact button below on this page.

We collect the following types of personal data: Contact Information (name, email address, phone number, company name) when you contact us or use our services. Technical Data collected through Google Analytics (Firebase), only if you have consented to analytics cookies (browser type, device information, pages visited, time spent on site; Google Analytics 4 does not store IP addresses). Communication Data (messages, support requests, service inquiries). Service Data (information about services requested, project details, technical requirements). We only collect data that is necessary for providing our services and improving your experience.

We process your personal data based on the following legal grounds under GDPR Article 6: Consent (Article 6(1)(a)) - for website analytics with Google Analytics, marketing communications and non-essential cookies. Contract Performance (Article 6(1)(b)) - to provide our IT services and fulfill contractual obligations. Legitimate Interest (Article 6(1)(f)) - for security and business development. Legal Obligation (Article 6(1)(c)) - for tax records and legal compliance. You have the right to withdraw consent at any time where processing is based on consent.

We use your personal data for the following purposes: Service Delivery - to provide IT support, website development, and technical services. Communication - to respond to inquiries, provide customer support, and send service-related updates. Analytics - to understand website usage and improve our services using Google Firebase Analytics. Marketing - to send promotional materials (only with your consent). Legal Compliance - to meet our legal and regulatory obligations. Security - to protect our systems and prevent fraud. We do not sell, rent, or share your personal data with third parties for their marketing purposes.

We use Google Firebase services for website analytics and functionality, which may involve data processing by Google LLC in the United States. Firebase services we use include: Google Analytics for website usage statistics, Firebase Hosting for website delivery, Firebase Functions for backend processing. Google Analytics is only loaded after you have consented to analytics cookies. It records the pages visited (without parameters in the address, except campaign identifiers such as utm_source), page titles, the referrer, page loading measurements, clicks on phone, e-mail or WhatsApp links (only the kind of link, never the number or address), the successful submission of the contact form (without its content) and general device and usage data; Google Analytics 4 does not store IP addresses. For visitors from Switzerland and the EU, the data is collected on servers in the EU. Any transfer to Google LLC in the United States is based on the Swiss-U.S. and EU-U.S. Data Privacy Framework, under which Google is certified. You can withdraw your consent at any time through the "Cookie Settings" link in the website footer. For more information, see Google's Privacy Policy at https://policies.google.com/privacy

On our website you can ask an AI chatbot about our services. Before your first message is sent, Cloudflare Turnstile checks that it comes from a human (see below). We store your messages and the chatbot's answers in Google Firebase (Cloud Firestore) under a random session identifier, without your name, a user account or your IP address. So that no one can use up the chatbot's daily message allowance alone, we also count messages per IP address and day. For this we do not store the address itself, only a check value formed with a secret key, which changes every day and is deleted automatically after two days. To generate an answer, the conversation is sent to a Gemini language model on Google Cloud (Vertex AI). Google processes it in data centres that may be located outside Switzerland and the EU, in particular in the United States; the transfer relies on the Swiss-U.S. and EU-U.S. Data Privacy Framework. Google does not use the messages to train its models. A conversation is deleted automatically 30 days after its last message. The legal basis is our legitimate interest in answering your questions (Article 6(1)(f) GDPR). Please do not enter sensitive personal data in the chat. The answers are generated by a computer program; they may contain errors and are not a binding offer.

To prevent spam and automated abuse, our forms and the chatbot use Cloudflare Turnstile, a service of Cloudflare, Inc. (USA). The check widget loads only once the form or the chat is shown. It evaluates technical characteristics of your browser and connection, including your IP address, and sets no cookies for advertising or tracking. Cloudflare is certified under the Swiss-U.S. and EU-U.S. Data Privacy Framework. The legal basis is our legitimate interest in operating the website securely (Article 6(1)(f) GDPR). More information: https://www.cloudflare.com/turnstile-privacy-policy/

We use cookies and similar technologies to enhance your browsing experience. Types of cookies we use: Essential Cookies - necessary for website functionality (no consent required). Analytics Cookies - Google Analytics to understand website usage (consent required). Preference Cookies - to remember your settings and preferences. You can manage cookie preferences through our cookie banner or your browser settings. Disabling certain cookies may affect website functionality. We do not use cookies for advertising or tracking across other websites.

We retain your personal data only as long as necessary for the purposes outlined in this policy: Contact inquiries - 3 years from last contact. Service contracts - 10 years for tax and legal compliance. Analytics data - at most 14 months (Google Analytics). Marketing data - until you unsubscribe or withdraw consent. Technical logs - 12 months for security purposes. Chatbot conversations - 30 days from the last message. The copies of sent emails in our sending queue are deleted automatically after one year. After the retention period, data is securely deleted or anonymized. You can request earlier deletion of your data at any time.

Your data may be transferred to and processed in countries outside Switzerland and the EU, particularly the United States through Google Firebase services. We ensure adequate protection through: the Swiss-U.S. and EU-U.S. Data Privacy Framework, under which Google is certified. Standard Contractual Clauses. Adequacy decisions by the European Commission where applicable. Your data is always protected by appropriate safeguards regardless of location.

Under GDPR and Swiss FADP, you have the following rights: Right of Access - request copies of your personal data. Right to Rectification - correct inaccurate or incomplete data. Right to Erasure - request deletion of your data ('right to be forgotten'). Right to Restrict Processing - limit how we use your data. Right to Data Portability - receive your data in a structured format. Right to Object - object to processing based on legitimate interests. Right to Withdraw Consent - for consent-based processing. Right to Lodge a Complaint - with supervisory authorities. To exercise these rights, please use the contact button below on this page. We will respond within 30 days.

We implement comprehensive technical and organizational measures to protect your personal data: Technical Measures - encryption in transit and at rest, secure hosting infrastructure, regular security updates, access controls and authentication. Organizational Measures - staff training on data protection, data processing agreements with suppliers, regular security assessments, incident response procedures. Despite our security measures, no system is 100% secure. We will notify you and relevant authorities of any data breaches as required by law.

Our services are not directed to children under 16 years of age. We do not knowingly collect personal data from children under 16. If you are a parent or guardian and believe your child has provided us with personal data, please contact us immediately. We will take steps to remove such information and terminate any accounts created by children under 16.

We may update this privacy policy from time to time to reflect changes in our practices or legal requirements. We will notify you of any material changes by: Posting the updated policy on our website with a new 'Last Updated' date. Sending email notifications for significant changes (if you have provided your email). Obtaining fresh consent where required by law. We encourage you to review this policy periodically to stay informed about how we protect your data.

If you have any questions about this privacy policy or our data practices, please use the contact button below to get in touch with us. For complaints about data processing, you can also contact the Swiss Federal Data Protection and Information Commissioner (FDPIC) or your local supervisory authority.