Privacy policy

1. Controller

Aidan Faes Rorschacher Strasse 32, 9000 St. Gallen, Switzerland Phone: +41 79 954 21 00 Email: founders@vidimas.com

The controller decides alone on the purposes and means of processing personal data that arises in connection with the operation of this website and the services offered.

2. Scope

This privacy policy applies to the website at vidimas.com and all its subdomains, and to data processing within our AI platform, unless agreed otherwise in a separate data processing agreement with a customer.

We align our data processing with the EU General Data Protection Regulation (GDPR) where it applies to our offering – for example towards customers and website visitors in Germany, Austria and the rest of the European Economic Area. As a provider established in Switzerland, the Swiss Federal Act on Data Protection (revFADP, in force since 1 September 2023) applies to us in addition. In Austria, the Data Protection Act (DSG) supplements the GDPR.

3. What data we process

We process personal data only to the extent necessary to operate the website and deliver our services. In detail, this may include:

• Server log data: IP address, date and time of access, user agent, referrer URL, resource requested, HTTP status code, volume of data transferred. This is recorded technically by our hosting provider.
• Contact: if you write to us by email, you transmit your name, email address and the content of your message. We process this data in order to answer your enquiry.
• Appointment booking: when booking a demo through our Cal.com booking page, you transmit your name, email address, preferred time and any further information you choose to provide.
• Contract data: within a customer relationship we process the business contact details of the people involved as well as contract information (services, terms, fees, correspondence).
• Platform account and usage data: when the AI platform is used, we process name, business email address, roles and workspace log data. Content that customers enter into the platform (inputs, documents, connected sources) is processed by us solely as a processor under a separate data processing agreement; it is not used to train AI models.
• Applications: if you apply for an advertised position, we process the application documents you send us (CV, cover letter, references) until the selection process is complete and delete them no later than six months afterwards, unless you have agreed to longer storage.

4. Purposes and legal bases

We process personal data for the following purposes:

• Provision and security of the website (legitimate interest in a stable and secure web presence – Art. 6(1)(f) GDPR / Art. 31(2)(d) revFADP).
• Answering enquiries and initiating contracts (pre-contractual measures – Art. 6(1)(b) GDPR / Art. 31(2)(a) revFADP).
• Performance of existing contracts with our customers, including provision of the AI platform (Art. 6(1)(b) GDPR / Art. 31(2)(a) revFADP).
• Compliance with statutory retention obligations (e.g. under commercial, tax or VAT law – Art. 6(1)(c) GDPR / Art. 31(1) revFADP).
• Where applicable: audience measurement and usage analysis to improve our offering, on the basis of consent (Art. 6(1)(a) GDPR / Art. 6(6) revFADP), should such a tool be used; this will be disclosed transparently in section 7.

5. Processors and third-party providers

To operate our website and deliver our services we rely on carefully selected service providers acting as processors within the meaning of Art. 28 GDPR and Art. 9 revFADP:

• Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA – hosting and delivery of the website including server logs and global delivery via the Vercel edge network. Vercel is certified under the EU standard contractual clauses and registered under the EU-US Data Privacy Framework.
• Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA – domain management, DNS and, where applicable, CDN and security functions. Cloudflare acts as a processor and is certified under the EU standard contractual clauses.
• Cal.com, Inc. – embedded appointment booking widget at cal.com. When you make a booking, the data you enter is transmitted to Cal.com. Cal.com routes requests from the EU to EU data centres and is certified under the EU standard contractual clauses.
• Sending and receiving email: business email communication runs through standard email providers. The exact set-up will be published here as soon as the business infrastructure is finalised (planned: Cloudflare Email Routing in combination with a mailbox provider with servers located in the EU).
• AI platform: we use infrastructure and model providers for the platform. This processing takes place under the data processing agreement concluded with the respective customer, not via this website.

6. Retention periods

We store personal data only for as long as is necessary for the respective purpose:

• Server logs: a maximum of 30 days, then deleted or anonymised.
• Email enquiries: until your enquiry has been dealt with conclusively and, where applicable, until the end of any resulting business relationship, but at most for as long as statutory retention periods require (generally six to ten years).
• Contract data: for the duration of the contract and thereafter until statutory retention periods expire.
• Platform data: for the duration of the contract; after the contract ends, customer data is deleted unless statutory retention obligations prevent this.
• Application data: until the selection process is complete and at most six months beyond that, provided no appointment is made and no longer storage has been expressly requested.

7. Cookies and tracking

At present, this website uses no analytics cookies and no advertising cookies. Technically necessary cookies or local storage mechanisms may be set by our hosting provider or by embedded third parties (e.g. Cal.com) where this is strictly necessary for the function of the page in question.

Should we use web analytics or marketing tools in future – for example for audience measurement, A/B optimisation or conversion tracking – we will update this policy accordingly and obtain consent in advance through a consent banner that meets the legal requirements.

8. Your rights as a data subject

Under the applicable data protection legislation you have the following rights:

• the right to information about the data we process about you;
• the right to rectification of inaccurate data and completion of incomplete data;
• the right to erasure;
• the right to restriction of processing;
• the right to receive your data or have it transferred;
• the right to withdraw consent once given, with effect for the future;
• the right to object to the processing, in particular where it is based on legitimate interests.

An informal message to founders@vidimas.com is enough to exercise your rights. We may request suitable evidence to verify your identity.

Irrespective of this, you have the right to lodge a complaint with the competent supervisory authority – in Germany the data protection authority of your federal state or the BfDI, in Austria the Data Protection Authority (dsb.gv.at), elsewhere in the EEA the respective national authority, and in Switzerland the Federal Data Protection and Information Commissioner (FDPIC, edoeb.admin.ch).

9. Data security

We take appropriate technical and organisational measures to protect your data against accidental or deliberate manipulation, loss, destruction or unauthorised access. These measures are continuously adapted to the state of the art. Data transmitted over the internet is encrypted in transit (TLS).

10. Changes to this policy

We reserve the right to amend this privacy policy so that it always meets current legal requirements or to reflect changes to our services. The version published at the time of your visit applies.

11. Authoritative version

This English text is a translation provided for convenience. The German version of this privacy policy is authoritative; in the event of any discrepancy, the German text prevails.