1. Who is responsible
SRABS · Email: hello@srabs.com
We have not appointed a data protection officer.
2. What we collect, and why
a) When you use the contact form
| Data | Required? |
|---|---|
| Name | Yes |
| Work email | Yes |
| Company | No |
| Wells under operation | No |
| Intent (e.g. Pilot, Reseller / partner, Investor) | Preselected |
| Your message | No |
| The page you sent the form from, and the time | Added automatically |
We use this data to answer your enquiry and to prepare and follow up on a possible business relationship, for example a pilot, purchase, partnership or investor conversation.
To stop spam, we also check a hidden field, how long the form was open, and your IP address (no more than five submissions per ten minutes). We don't store the IP address or these check results with your enquiry. The IP address is held only in server memory for a few minutes.
Without a valid email address we can't reply, so the form won't send without one.
b) When you email us We process your email address, the content of your message and anything you attach, for the same purposes.
c) When you visit the site Our host, Vercel, processes the technical data every request contains: IP address, date and time, the page requested, referrer, browser and operating system, and the response status. We need this to deliver the site, to keep it secure, and to find and fix errors. Our server logs also record browser reports about blocked content (security policy reports: the page URL and the blocked resource). If the form can't be delivered, the error log may contain the email address you entered.
d) Site statistics We use Vercel Web Analytics and Vercel Speed Insights to see which pages are read and how fast they load. These tools don't set cookies and don't follow you to other websites. Vercel processes page address, referrer, country, device type, browser and operating system, and load-time measurements. According to Vercel, visitors are counted using a hash of request data that is discarded after 24 hours, and we see only aggregated figures.
e) On your device The site sets no cookies. If you switch to dark mode, your browser stores that choice under `srabs-theme` in its local storage, so the site remembers it next time. It never leaves your device. You can delete it at any time by clearing your browser's site data.
We don't use advertising tools, social media plugins or tracking pixels. Fonts are served from our own host. Links to LinkedIn, Crunchbase and other sites send data to those services only when you click them.
3. Legal basis
Under the FADP, we process personal data in line with its principles. Where a justification is needed, we rely on our overriding interest in answering enquiries, running a secure website and understanding its use, or on your consent where we ask for it.
Under the GDPR, we rely on:
- Art. 6(1)(b): steps you ask for before a possible contract (your enquiry);
- Art. 6(1)(f): our legitimate interests in answering business contacts, keeping the site secure and working, and measuring its use in aggregate;
- Art. 6(1)(c): legal obligations, for example keeping business records.
You can object to processing based on legitimate interests at any time (section 7).
4. Who receives your data
We use these service providers. They process data on our behalf and under our instructions:
| Provider | What they do | Where |
|---|---|---|
| Vercel Inc. | Website hosting, server functions, logs, Web Analytics, Speed Insights | USA, with a global delivery network |
| Formagrid Inc. (Airtable) | Database where form submissions are stored | USA |
| Hostpoint AG | Sends the notification email for each form submission; email hosting | Switzerland |
We may also share data with our professional advisers (legal, tax, audit), with authorities where the law requires it, and with a buyer or investor as part of a sale, merger or financing of our business, under confidentiality. We don't sell or rent personal data.
5. Transfers abroad
Vercel and Airtable process data in the USA. Switzerland and the EU recognise the USA as providing adequate protection for companies certified under the Swiss-US and EU-US Data Privacy Framework. Where a provider isn't certified, or as a fallback, we rely on the Standard Contractual Clauses of the European Commission, adapted for Swiss law, in our data processing agreements. You can ask us for a copy of the safeguards.
6. How long we keep data
| Data | Kept for |
|---|---|
| Form submissions and related emails, if no business relationship follows | 24 months after our last contact, then deleted |
| Records of an actual business relationship | For its duration, then as long as Swiss law requires business records to be kept (usually 10 years, Art. 958f Code of Obligations) |
| Rate-limit IP address | A few minutes, in memory only |
| Submissions caught by the spam checks | Not stored |
| Server and error logs | At most 30 days |
| Statistics | Aggregated only. No individual visitor profiles are kept. |
| Theme setting on your device | Until you delete it |
We may keep data longer where we need it to establish or defend legal claims.
7. Your rights
Under the FADP and, where it applies, the GDPR, you can:
- ask whether we process your data, and get a copy (access);
- have wrong data corrected;
- have data deleted, or its processing restricted;
- object to processing, including for direct marketing;
- receive data you gave us in a common electronic format, or have it sent to someone else (portability);
- withdraw consent at any time, without affecting earlier processing.
Email hello@srabs.com. We may ask you to prove your identity. We answer within 30 days. These rights have legal limits, for example where we must keep records.
If you disagree with how we handle your data, you can complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, www.edoeb.admin.ch. If you are in the EU or EEA, you can also complain to the data protection authority where you live or work.
8. Automated decisions
We don't make decisions about you based solely on automated processing.
9. Security
The site is served only over HTTPS. Access to form data is limited to the people at SRABS who need it. Our providers are bound by contract to protect it.
10. Children
The site is for business users. It isn't directed at anyone under 16, and we don't knowingly collect their data.
11. Visitors from the United States
We don't sell personal information, and we don't share it for cross-context behavioral advertising. We don't collect sensitive personal information through the site. To ask about your data, use the contact details in section 1.
12. Changes
We update this notice when our processing changes. The date at the top shows the current version.