Privacy policy

Controller

tomventures GmbH
Dohlenzelgstrasse 2b
5210 Windisch, Switzerland
Email: hello@thomasgaechter.ch

Principle

The public part of this website is purely informational: no customer accounts, no shop, no tracking cookies. I process personal data where it is technically necessary to run the site, where you actively send it to me (e.g. via a form or by email), or where I record a business for an initial business approach (see the section on business contacts and outreach).

Under /admin I also run a password-protected administration tool that only I use. There is no account there for you.

Server log files

When the site is accessed, the web server stores technically necessary data in log files: IP address, date and time, requested page, HTTP status code, transferred volume, referrer and user agent. This data is used exclusively for security and stability (e.g. defending against attacks). Log files are deleted automatically after a maximum of 14 days and are not merged with other data sources.

Processing basis: overriding private interest in security and operation, Art. 31 (1) FADP. Where the GDPR applies: Art. 6 (1) lit. f GDPR.

Hosting

The site is hosted on a dedicated server at Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen, Germany). The server is located in Germany (EU). Hetzner is a processor within the meaning of Art. 9 FADP; in addition, a data processing agreement under Art. 28 GDPR is in place.

Backups

Once a day, the server automatically backs up the database behind this website: messages from the forms, measurement data and the contact list. The last 14 versions are kept, older ones are deleted automatically. I also copy these backups to my own computer. Deleted data can therefore still be contained in a backup for up to 14 days.

Processing basis: overriding private interest in data security, Art. 31 (1) FADP and Art. 6 (1) lit. f GDPR.

Fonts

This website uses the typeface Geist. It is served locally from my own server. No connection to Google Fonts or other external CDN services takes place. That also holds for the preview and draft pages described further below: their fonts are served from my server too.

Cookies and consent

This website sets no marketing or tracking cookies. On your first visit, a banner lets you choose between strictly necessary cookies and additional statistics (granular consent). Your choice is stored in your browser (localStorage) and remains valid for six months. You can change it at any time via the cookie button at the bottom left. The choice concerns Plausible only. My own cookieless measurement on my own server runs regardless of it, see the next section.

Basis: for Plausible your consent, Art. 6 (1) lit. a GDPR. For storing your choice in the browser: notice and possibility to refuse under Art. 45c lit. b of the Swiss Telecommunications Act, and overriding private interest under Art. 31 (1) FADP.

First-party audience measurement

To improve the website, I collect anonymous usage figures with a solution of my own on my own server, without third parties and without cookies. This measurement runs regardless of your cookie choice.

For each page view, the following is recorded: the page visited, the referring domain (only the domain, not the full address), the device type (mobile, tablet or desktop) and the time. In addition, I record individual interactions: clicks on email and phone links, clicks on links to other websites (target host and path only), file downloads (file name only), clicks on marked buttons, the scroll depth reached (25, 50, 75 and 100 percent) and the campaign origin from the parameters utm_source and utm_campaign, if the address called up contains them.

Neither the IP address nor the user agent is stored in the process. To roughly distinguish returning visits within a day, a non-reversible daily hash is derived and only that hash is kept. Identifying individual persons is not possible. Measurement data older than 400 days is removed automatically. The areas /admin/, /demo/, /check/ and /maintenance/ are not measured. For personally addressed quote pages, the exception further below applies.

Processing basis: overriding private interest in an understandable website, Art. 31 (1) FADP and Art. 6 (1) lit. f GDPR.

Audience measurement with Plausible

With your consent, I use Plausible Analytics (Plausible Insights OÜ, Estonia). Plausible works without cookies, without cross-site tracking and without personal data. Only aggregated, anonymous values are recorded (page views, time on page, country of origin, browser, device type). The servers are located in the EU. Without your consent, Plausible is not loaded.

Basis: your consent, Art. 6 (1) lit. a GDPR. Plausible is a processor within the meaning of Art. 9 FADP. You can withdraw your consent at any time via the cookie button.

Getting in touch

When you contact me by email or phone, your details (name, contact information, content of the inquiry) are stored solely for the purpose of handling your request and are not passed on to third parties. The data is deleted as soon as the request has been dealt with and no statutory retention obligations apply.

Forms on this website

On the contact page you can write to me via a form. The details you enter are processed: name, email address, an optional phone number, topic and your message. In addition, your IP address and the time you sent it are stored to fend off spam. I use this data solely to handle and answer your inquiry and do not pass it on to third parties for advertising purposes.

Two further forms ask only for the address of your website and your email address: the free SEO analysis on the SEO page and the website check. With the website check, my server calls up your website automatically and assesses it technically; I store the result together with your inquiry, along with where the inquiry came from if the address called up contains campaign parameters. Your details from the website check are additionally stored as an entry in my list of prospects, see the next section. I do not store your IP address for these two forms; to limit bulk submissions, only a non-reversible daily value is derived from it, and that is removed automatically once it is older than two days.

No form uses an external form service. Your message is delivered as an email from my own server; the Swiss provider Metanet AG (a processor within the meaning of Art. 9 FADP) handles the mail dispatch. In addition, every submission is stored in a password-protected inbox on my server so that no inquiry gets lost. To protect against spam, a hidden field is checked (honeypot); no external captcha is used.

Processing basis: pre-contractual steps and overriding private interest in being reachable and in fending off spam, Art. 31 (1) FADP and Art. 6 (1) lit. b and f GDPR. Retention until the inquiry has been dealt with, then deletion, unless statutory retention obligations apply.

Business contacts and outreach

For acquiring new clients, I keep an internal list of businesses. The details come from publicly available sources: from the businesses' own websites, from open directories such as OpenStreetMap, and from public directory and map services. Recorded are company name, town, industry, website, a publicly named contact person, email address, phone number and any social media profile, plus my own notes on the state of the contact. Anyone who uses the website check is also added as an entry.

The sole purpose is an initial business approach and following it up. I do not pass this data on and I do not sell it. An entry is deleted as soon as it is clear that there is no interest.

You would rather not be approached, or you want to know what is stored about your business? An informal email to hello@thomasgaechter.ch is enough. I will tell you and delete the entry right away.

Information under Art. 19 FADP, which also applies to data not obtained from the person concerned. Processing basis: overriding private interest in initiating business, Art. 31 (1) FADP and Art. 6 (1) lit. f GDPR.

Preview and draft pages

Under /demo/, /check/, /angebot/ and /offerte/ there are drafts, assessments and quotes for individual prospects. These pages are not linked, are blocked for search engines and can only be reached via the direct link. The audience measurement described above does not run there.

On personally addressed, password-protected quote pages I additionally log the opening together with the IP address, so that I can tell whether and when the quote was viewed.

Processing basis: overriding private interest in being able to follow an ongoing quote, Art. 31 (1) FADP and Art. 6 (1) lit. f GDPR.

External content

Apart from the optional Plausible script (only with your consent, see above), this website does not embed any external scripts, maps, videos or social media plugins. Neither Google Analytics nor Facebook pixels nor any other trackers are loaded.

Your rights

You have the right to information about the data stored about you, to rectification, deletion or restriction of processing, and to data portability. Please send any requests by email to the controller listed above. You also have the right to lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC) or, where the GDPR applies, with the competent supervisory authority.

Changes

This privacy policy may be updated to reflect changes to the offering or to the legal situation. The version published on this page applies.

Last updated: August 2026