This Privacy Policy explains how Alessandra C. Marazzi ("we", "us", "our") processes personal data of visitors to this website, prospective and existing clients, and other individuals who interact with us. It is issued in compliance with the Swiss Federal Act on Data Protection ("FADP").
1. Controller and contact
The data controller is Alessandra C. Marazzi, based in Lucerne, Switzerland. For all privacy matters, including the exercise of data subject rights, please contact us via the Contact page.
2. Scope and applicable laws
We comply with the Swiss FADP. Where the laws of more than one jurisdiction apply to a given processing activity, we apply the standard that offers the higher level of protection to the data subject.
3. Categories of personal data we collect
Depending on how you interact with us, we may process the following categories of personal data:
- Contact and business information: name, employer, role, email address, and telephone number.
- Enquiry and correspondence content: the messages and meeting notes you share with us.
- Technical and usage data: IP address (truncated where feasible), device and browser information, pages viewed, and timestamps.
- Analytics data: pseudonymous identifiers and aggregated interaction metrics collected via Google Analytics 4.
We do not knowingly collect special category or sensitive personal data and ask that you do not submit such information through our website forms.
4. Sources of data
We obtain personal data directly from you when you contact us or engage our services; automatically when you use our website; and occasionally from third parties such as referrers or professional networks where you have made your details available.
5. Purposes and legal bases
We process personal data for the following purposes, relying on the legal bases set out below:
- Responding to enquiries and providing information you request: performance of pre-contractual steps and our legitimate interest in operating our practice.
- Delivering services under engagement: performance of a contract.
- Operating, securing, and improving our website: legitimate interests and, for non-essential cookies, your consent.
- Analytics: your consent, which you may withdraw at any time.
- Record-keeping and compliance with legal, tax, regulatory, and professional obligations: legal obligation.
- Establishing, exercising, or defending legal claims: legitimate interests.
6. Cookies and similar technologies
Our use of cookies and analytics tags is described in our Cookie Policy. Non-essential cookies are loaded only after you provide consent through our cookie banner, and you can change your choices at any time.
7. Disclosure to third parties
We do not sell or rent personal data. We share personal data only with carefully selected processors, including hosting and infrastructure providers, email providers, and analytics platforms. Each processor is bound by a written agreement that requires confidentiality, appropriate security, and lawful processing. We may also disclose personal data where required by law, court order, or competent authority.
8. International data transfers
Because we use international service providers, personal data may be transferred to the United States. We rely on adequacy decisions where available and otherwise on Standard Contractual Clauses with appropriate addenda.
9. Retention
We retain personal data only for as long as necessary for the purposes set out in this policy and to meet our legal, tax, accounting, and regulatory obligations. When the applicable retention period ends, data is securely deleted or anonymised.
10. Security
We maintain technical and organisational measures appropriate to the risk, including TLS encryption in transit, role-based access controls, the principle of least privilege, and vendor due diligence. In the event of a personal data breach likely to result in a risk to data subjects, we will notify the competent supervisory authority and affected individuals within the timeframes required by applicable law.
11. Your rights
Subject to the conditions of the law that applies to you, you have the following rights:
- Access to your personal data and information about how it is processed.
- Rectification of inaccurate or incomplete data.
- Erasure ("right to be forgotten") where the legal conditions are met.
- Restriction of processing in defined circumstances.
- Objection to processing based on legitimate interests or for direct marketing.
- Data portability for data you have provided to us under contract or consent.
- Withdrawal of consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
- Right to lodge a complaint with a supervisory authority.
To exercise any of these rights, please use the Contact page. We may need to verify your identity before responding and will reply within the timeframes set by applicable law.
12. Automated decision-making
We do not carry out automated decision-making, including profiling, that produces legal or similarly significant effects on individuals.
13. Changes to this policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or applicable law. The current version is always available on this page with the date of last update. Material changes will be highlighted prominently on our website.
14. Contact and complaints
If you have questions or concerns about this Privacy Policy or our handling of your personal data, please reach out via the Contact page. If you are not satisfied with our response, you have the right to lodge a complaint with the supervisory authority of the jurisdiction that applies to you.