Privacy Policy

Last updated: 20.10.2026

This privacy policy explains how TONYTONY Sàrl (“we”, “us”, “our”) collects, processes and protects personal data when you use tonytony.ch. It is based on the Swiss Federal Act on Data Protection (FADP/nDSG), in force since 1 September 2023, and, where applicable, the EU General Data Protection Regulation (GDPR). Cookies and similar technologies are listed one by one in our Cookie Policy.

§ 1 Who we are and how to reach us

The data controller responsible for the processing of your personal data is:

TONYTONY Sàrl
Chemin de la Mounta 24
3961 St-Luc
Switzerland

Email: legal@tonytony.ch

For any question about this policy or about how your personal data is processed, write to that address. We answer data protection requests ourselves; there is no intermediary.

§ 2 What data we collect

Data you give us

  • Contact form: your name, email address, the topics you tick, your message, and your confirmation that you have read this policy.
  • Email: whatever you write to hey@tonytony.ch or legal@tonytony.ch, together with your email address and name.
  • Booking a call: the “Book a call” links open our booking page on Cal.com. There you enter your name, email address, the slot you choose and any notes. If you arrive there from one of the free audit tools on this site, the website address you tested is pre-filled in the notes. The tools themselves run in your browser and send nothing to us.

Data collected automatically

Whenever a page loads, your browser transmits technical data: your IP address, browser type and version, operating system, the requested URL, the referring URL, date and time, and language settings. This data reaches our hosting provider and the providers whose content a page loads (see § 4).

With your consent only, Google Analytics also records how you use the site (pages viewed, session duration, approximate location, device type). Our cookieless statistics tool, Fathom, records page views and events without identifying you.

What we do not do

  • No user accounts, no newsletter, no marketing emails.
  • No advertising or retargeting pixels (no Meta, LinkedIn or Google Ads tags).
  • No social media plugins: the share buttons on blog articles are plain links that do nothing until you click them.
  • No external font services: our fonts are hosted on our own server.
  • No sale of personal data and no profiling.

§ 3 Why we process it, and on what legal basis

Swiss law does not require a legal basis for every processing operation; the bases below are given for visitors to whom the GDPR applies.

  • Answering inquiries and preparing offers: to reply to your messages, schedule calls and manage the business relationship. Legal basis: pre-contractual measures or performance of a contract; legitimate interest.
  • Delivering the website securely: hosting, content delivery, security logs and protection against abuse. Legal basis: legitimate interest.
  • Cookieless audience statistics (Fathom): to know which pages are read, in aggregate. Legal basis: legitimate interest.
  • Detailed analytics (Google Analytics): to understand how visitors move through the site. Legal basis: your consent, which you can withdraw at any time.
  • Spam protection (reCAPTCHA): to keep the contact form free of automated submissions. Legal basis: legitimate interest.
  • Showing our work (video and map): to present projects on video and show where the studio is. Legal basis: legitimate interest.
  • Legal compliance: bookkeeping and retention duties. Legal basis: legal obligation.

§ 4 Who we share it with

We do not sell your personal data. It is shared only with the providers below, each limited to what its function requires. Most act as processors on our behalf; where a provider acts as an independent controller for its own purposes, this is stated.

Service providers we use for this website

Hosting and edge delivery (Netlify)

This website is hosted by Netlify, Inc. (512 2nd Street, Suite 200, San Francisco, CA 94107, USA). To serve pages and to protect against malicious traffic and distributed denial-of-service (DDoS) attacks, Netlify processes network traffic metadata, including your IP address, the requested URL, your browser user-agent and timestamps, and keeps server logs for diagnostic and security purposes for a limited operational period.

Requests are routed through Netlify’s global edge network and processed in the United States. Netlify, Inc. is certified under the Swiss–U.S. Data Privacy Framework (Swiss–U.S. DPF), which supports an adequate level of protection for transfers under Art. 16 FADP. We have a Data Processing Agreement (DPA) with Netlify under which your data is processed strictly on our instructions. Netlify sets no cookies on this site.

Content and images (Sanity)

The content of this site is managed in Sanity. Pages are generated in advance, but most images are served from Sanity’s content delivery network (cdn.sanity.io), so your IP address and request data reach Sanity when a page with images loads. Sanity sets no cookies on this site.

Open-source scripts (jsDelivr)

A few open-source libraries, such as smooth scrolling and the video player, are loaded from jsDelivr, a public delivery network for open-source code. jsDelivr receives your IP address and request data in order to deliver the file. Every script is loaded with an integrity check, so the file cannot be altered in transit. jsDelivr sets no cookies.

Cookieless statistics (Fathom Analytics)

We measure page views and a few events (for example a click on “Book a call” or a form submission) with Fathom Analytics, a service of Conva Ventures Inc. (Canada), through its EU endpoint. Fathom sets no cookies, stores nothing on your device and does not store your IP address: it is used only briefly, in hashed form, to tell unique visits apart, and then discarded. The statistics we see contain no personal data. Because nothing identifies you, Fathom runs without a consent prompt. Canada is recognised by the Swiss Federal Council as offering an adequate level of data protection.

Analytics with consent (Google Analytics 4)

If, and only if, you click “Accept all” in the cookie banner, we load Google Analytics 4, a service of Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) and Google LLC (Mountain View, California, USA). Google Analytics sets the cookies listed in our Cookie Policy and processes data on page views, session duration, device, browser and approximate location. Google Analytics 4 does not log or store IP addresses. If you reject non-essential cookies or make no choice, Google Analytics is never loaded.

Data may be transferred to the United States; Google LLC is certified under the Swiss–U.S. and EU–U.S. Data Privacy Frameworks. Analytics data is kept for no longer than 14 months. You can withdraw consent at any time with the cookie settings link in the Cookie Policy.

Contact form (Basin)

When you send the contact form, your submission (name, email address, topics, message and confirmation of this policy) is processed on our behalf by our form provider, Moonshot Ventures, Inc. (Basin), located in Canada, and forwarded to us by email. Data is encrypted in transit and at rest. Where data passes through infrastructure in third countries, such as servers or delivery networks in the United States, transfers rely on adequacy (Canada) or on Standard Contractual Clauses (SCCs) and data protection framework certifications. Basin’s script is loaded on the contact page only.

Spam protection (Google reCAPTCHA)

The contact form is protected against automated submissions by reCAPTCHA, a service of Google Ireland Limited and Google LLC. reCAPTCHA is loaded on the contact page only, as soon as the page opens. To tell a person from a bot, it processes your IP address, browser and device information and interaction signals such as mouse movement and time on the page, and it may set a cookie on Google’s own domain. The content of your message is not assessed.

Legal basis: legitimate interest in protecting the form against abuse. Data may be transferred to the United States under the Data Privacy Frameworks mentioned above. Google acts as an independent controller for this processing, and its own privacy policy applies: policies.google.com/privacy.

Project videos (Mux)

Case-study pages show short videos delivered by Mux, Inc. (USA). When such a page loads, the video player (from jsDelivr) fetches the poster image and the video stream from Mux, and Mux receives your IP address and request data. Mux also records playback quality metrics (for example start-up time and buffering), together with device and browser type and a coarse location; Mux shortens IP addresses before storing them and keeps this data for up to 100 days. The player is configured not to set cookies.

Studio film (Vimeo)

The studio page shows a film hosted by Vimeo.com, Inc. (USA). Until you press play, only the poster image is loaded from Vimeo’s image server, which receives your IP address. The Vimeo player itself loads only when you press play, and it runs in Vimeo’s “do not track” mode, in which Vimeo states it does not track session data or set cookies. Vimeo’s own privacy policy applies to that playback.

Studio map (Google Maps)

The studio page shows our location on a map from the Google Maps JavaScript API (Google Ireland Limited / Google LLC). The map loads when it scrolls into view; from that moment Google receives your IP address and request data in order to deliver the map. We do not ask Google Maps to set cookies on tonytony.ch. Google’s own privacy policy applies to that processing, including any data transferred to the United States.

Booking a call (Cal.com)

Call bookings are handled by Cal.com, Inc. through its EU-hosted service at cal.eu. The booking page opens on Cal.com’s site, not on ours, and Cal.com processes the details you enter in order to schedule the call and send confirmations. Cal.com’s own privacy and cookie policies apply to that page.

Other disclosures

  • Legal requirements: where required by applicable law, regulation, court order or governmental request.
  • With your consent: where you have given explicit consent to a specific disclosure.

International transfers

Our providers are located in Switzerland, the EU/EEA, Canada and the United States. Canada and the EU/EEA are recognised by the Swiss Federal Council as offering adequate protection. For the United States, we rely on the Swiss–U.S. Data Privacy Framework where the provider is certified, and otherwise on Standard Contractual Clauses.

Client projects (Webflow)

Some of the websites we build and maintain for clients are hosted and delivered by Webflow, Inc. (398 11th Street, 2nd Floor, San Francisco, CA 94103, USA). On those projects the client is the data controller and we act as a processor on their instructions, with Webflow as a sub-processor. That processing is governed by the agreement with the client concerned, not by this policy, which covers tonytony.ch only.

Where a project runs on Webflow, Webflow automatically collects technical data transmitted by the visitor’s browser — IP address, browser type and version, operating system, referrer URL and access date and time — in server log files, which is necessary to display the site securely and reliably. That data may be processed on servers in the United States or globally via content delivery networks. Webflow, Inc. is certified under the Swiss–U.S. and EU–U.S. Data Privacy Frameworks, and we have concluded a Data Processing Addendum (DPA) incorporating Standard Contractual Clauses with Webflow.

§ 5 How long we keep data, and how we protect it

Retention periods

  • Contact form submissions, emails and bookings: for the duration of the business relationship, plus legally required retention periods (up to 10 years for business records under Art. 958f CO).
  • Server logs (Netlify): typically up to 90 days for security and diagnostic purposes, then deleted or anonymised.
  • Google Analytics data (with consent only): no longer than 14 months.
  • Video quality metrics (Mux): up to 100 days, with shortened IP addresses.
  • Fathom statistics: aggregated and contain no personal data.

Once a retention period expires, data is securely deleted or anonymised.

Security measures

The whole site is served over HTTPS only (HSTS), with strict security headers, and third-party scripts are loaded with integrity checks. We review these technical and organisational measures regularly. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security.

§ 6 Cookies and third-party content

This site sets one cookie of its own, which remembers your cookie choice, and keeps two small entries in your browser’s storage for the language suggestion. Google Analytics cookies are set only with your consent, and reCAPTCHA may set a cookie on Google’s domain on the contact page. Every cookie and storage entry, its purpose and its lifetime is listed in our Cookie Policy, where you can also change your choice at any time.

Links to third-party sites

Our website contains links to other websites, such as LinkedIn, Webflow, Cal.com or client sites. We have no control over their content or privacy practices; their own policies apply once you follow a link.

§ 7 Your rights

Under the FADP and, where applicable, the GDPR, you have the following rights regarding your personal data:

  • Right of access: you may ask whether and which personal data we process about you.
  • Right to rectification: you may ask us to correct inaccurate or incomplete data.
  • Right to deletion: you may ask us to delete your data, subject to legal retention obligations.
  • Right to data portability: you may ask for your data in a commonly used, machine-readable format, for yourself or a third party.
  • Right to object: you may object to processing based on legitimate interest.
  • Right to withdraw consent: where processing is based on consent, you may withdraw it at any time, without affecting the lawfulness of earlier processing.

How to exercise them

Write to legal@tonytony.ch. We may ask you to confirm your identity before acting on a request.

You also have the right to lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC) or, if you live in the EU/EEA, with the data protection authority of your country.

§ 8 Changes to this privacy policy

We update this policy whenever the website’s technology or our practices change. The current version is always available on this page, with the date of the last update at the top.