Four people are seated at a table in a meeting room, while a presenter speaks in front of a screen.

Data Protection

Version: July 2026 (draft)

Privacy Policy

This Privacy Policy (“Privacy Policy”) explains how we process and protect your personal data when you use this website or our services offered through https://www.odcus.com/ (collectively, “our Services”).

The website is operated by ODCUS AG, Grabenstrasse 15a, 6340 Baar, Switzerland (the “Company”, “we”, “our” or “us”). The Company is the controller of the data processing described below.

Unless otherwise defined in this Privacy Policy, terms used in this Privacy Policy have the same meaning as in the Swiss Federal Act on Data Protection (“DSG”) or the EU General Data Protection Regulation (“GDPR”).

1. Personal Data We Collect

When you use our services, we may collect or receive personal data for a range of purposes related to our business operations. This includes the following:

  • Usage and analytics data (e.g., pages visited, aggregated access statistics without personal reference)
  • Contact data (e.g., name, address, phone number, date of birth)
  • Payment data (e.g., billing information, account information)
  • Inquiry details (e.g., details and content of your inquiries to us)
  • Website visitor data (e.g., IP address, log files of the hosting provider)

There is no obligation to provide your personal data. Please note, however, that our services cannot be provided if you do not provide the necessary data that is absolutely necessary for the fulfillment of the contract between you and us.

2. How We Collect Personal Data

We collect information about our users when they use our services, including certain actions on our website.

Directly

  • Through our website and electronic communication
  • When you use our services
  • When you provide us with services
  • When you correspond with us electronically
  • When you browse, fill out a form, or make an inquiry while using our services

Indirectly

  • From public sources
  • From public registers (e.g., commercial registers), news articles, and internet searches
  • When our business customers hire us to provide professional services and share personal data that they control in the course of that assignment
  • From external service providers

3. Legal Bases and Purposes of Data Processing

Our legal basis for collecting and using the personal data described in this Privacy Policy depends on the personal data we collect and the specific purposes for which we collect it.

Contract: To fulfill our (pre-)contractual obligations or take actions related to a contract with you. In particular:

  • To assist you with inquiries
  • To provide our services

Consent: We may rely on your consent, which you give voluntarily at the time of providing your personal data. Specifically:

  • When you voluntarily submit data to us via a form, such as our contact form or a linked whitepaper form

Legitimate Interests: We may rely on legitimate interests based on our assessment that the processing is fair and reasonable and where your interests or fundamental rights and freedoms do not override it. Specifically:

  • To analyze the use of our website with cookieless, anonymous statistics
  • To develop new services
  • To maintain and improve our services as well as to prevent, identify, and address security vulnerabilities

Necessity for Compliance with Legal Obligations: To fulfill legal and public interest obligations. Specifically:

  • To inform you about changes to our services and our Privacy Policy
  • To comply with applicable regulations and laws
  • For the legal enforcement of claims and rights

4. Retention Periods

We retain personal data for as long as necessary for the purposes for which it was collected, and in accordance with legal and regulatory requirements or contractual agreements. After this period, we delete your personal data or fully anonymize it.

5. Recipients of Personal Data

We engage third-party companies (“service providers”) to facilitate the operation of our services, assist with the analysis of service usage, or provide necessary services such as payment processing and IT services. These third parties have access to your personal data only to the extent necessary to fulfill these tasks.

Types of service providers who may access your personal data:

  • Professional advisors we use, such as accountants, auditors, and attorneys
  • Third parties we engage in the provision of our services for you, like consultants, banks, and other payment service providers, KYC/AML providers, as well as postal and courier services
  • Third parties that support us with IT and software solutions
  • Third parties that help us gain customer insights and support marketing activities

6. Transferring Data to Third Countries

We and/or our service providers may transfer and process your personal data in the following locations:

  • EU and EEA
  • USA

We may use service providers that are partly located in so-called third countries (outside the European Union or the European Economic Area or Switzerland) or process personal data there, i.e., in countries whose level of data protection does not correspond to that of the EU or Switzerland.

We protect your personal data according to our contractual obligations and applicable data protection laws when we transfer data abroad.

Such safeguards may include:

  • Transferring to countries that provide an adequate level of protection as recognized by the Federal Council or for which there is an adequacy decision by the European Commission
  • Using standard contractual clauses, binding corporate rules, or other standard contractual obligations that ensure adequate data protection

If a third-country transfer occurs and no adequacy decision or suitable safeguards exist, there is a possibility and a risk that authorities in the third country (e.g., intelligence services) may access the transferred data and that enforceability of data subject rights may not be guaranteed.

6.1 Hosting (Netlify)

Our website is a static website and is hosted by Netlify, Inc. (San Francisco, USA). When you access the website, Netlify processes technical access data in server log files, such as

  • IP address,
  • Date and time of access,
  • Page accessed,
  • Browser type/version.

This data is required to deliver the website and to ensure its stability and security.

Legal basis: Legitimate interest in the reliable and secure operation of the website. Privacy policy: https://www.netlify.com/privacy/

6.2 Plausible Analytics

For website analytics, we exclusively use Plausible Analytics (Plausible Insights OÜ, Estonia). Plausible does not set cookies, does not create personal usage profiles, and the data remains in the EU. The analytics script is loaded from plausible.io. Our website itself does not set any cookies and does not use any advertising or tracking cookies; a consent banner is therefore not required.

Legal basis: Legitimate interest in analyzing website usage to improve our offer. Privacy policy: https://plausible.io/privacy

6.3 Contact Form (Netlify Forms)

When you use our contact form, we process the data you provide: email address, name, company (optional), and your message. The form is technically handled via Netlify Forms; Netlify processes your details in order to deliver the message to us. We use this data exclusively to handle your inquiry.

Legal basis: Implementation of pre-contractual measures or your consent by submitting the form. Privacy policy: https://www.netlify.com/privacy/

6.4 Whitepaper Downloads (HubSpot Forms)

For whitepaper downloads, we link to external forms provided by HubSpot (HubSpot Inc., USA; processing in the EU region via share-eu1.hsforms.com). The processing of your details (e.g., name, email address, company) takes place on HubSpot's pages, which are linked from our website. On our website itself, HubSpot does not set any cookies and does not perform any tracking. We use the data provided via such a form to deliver the whitepaper to you and to manage your request.

Legal basis: Your consent by submitting the form. Privacy policy: https://legal.hubspot.com/privacy-policy

6.5 Meeting Booking (Microsoft Outlook)

For booking meetings, we link to the external "Book with me" booking page of Microsoft Outlook (outlook.office.com; Microsoft Corporation or Microsoft Ireland Operations Limited). The processing of your details (e.g., name, email address, requested time slot) takes place on Microsoft's pages.

Legal basis: Implementation of pre-contractual measures. Privacy policy: https://privacy.microsoft.com/en-us/privacystatement

7. Data Disclosure

We may disclose your personal data if we believe in good faith that such action is necessary to:

  • Comply with a legal obligation (i.e., if it is required by law or in response to legitimate requests from authorities, such as a court or government agency)
  • Protect the security of the website and defend our rights or property
  • Prevent or investigate possible misconduct in connection with us

8. Data Security

We use appropriate technical and organizational security measures to protect your stored data against manipulation, loss, or unauthorized third-party access. Our security measures are continually adapted in line with technological developments.

We also take internal data protection very seriously. Our employees and the service providers hired by us are obliged to maintain confidentiality and to comply with applicable data protection laws. Additionally, they only receive access to personal data to the extent necessary for the fulfillment of their respective tasks or their mandate.

The security of your personal data is important to us, but remember that no method of transmission over the Internet or method of electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your personal data, we cannot guarantee its absolute security. We recommend using antivirus software, a firewall, and other similar software to protect your system.

9. Your Rights

You have the following data protection rights. To exercise these rights, you can contact the address above or send an email to: contact@odcus.com. Please note that we may ask you to verify your identity before responding substantively to such requests.

  • Right of Access: You have the right to request a copy of your personal data, which we will provide to you in electronic form.
  • Right to Rectification: You have the right to ask us to correct our records if you believe they contain inaccurate or incomplete information about you.
  • Right to Withdraw Consent: If you have given consent to the processing of your personal data, you have the right to withdraw that consent for the future. This applies if you wish to unsubscribe from marketing communications. Once we have received notification that you have withdrawn your consent, we will no longer process your data for the purpose(s) you originally agreed to, unless another legal basis for processing applies.
  • Right to Erasure: You have the right to request that we delete your personal data, provided these are no longer necessary for the purposes for which they were collected or are unlawfully processed.
  • Right to Restrict Processing: You have the right to request the restriction of processing of your personal data if you believe the data is inaccurate, the processing is unlawful, or we no longer need the data for the original purpose, but we cannot delete it due to a legal obligation or because you do not want it to be deleted.
  • Right to Data Portability: You have the right to request that we transfer your personal data in a standard format such as Excel to another controller, provided it is data you have provided to us and we process it based on your consent or to fulfill our contractual obligations.
  • Right to Object to Processing: If the legal basis for processing your personal data is our legitimate interest, you have the right, for reasons related to your specific situation, to object to this processing. We will comply with your request unless we have a compelling legal basis for the processing that outweighs your interests, or we must continue to process the personal data to exercise or defend a legal claim.
  • Right to Lodge a Complaint with a Supervisory Authority: You have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data violates data protection law. In the EU and EEA, you may, for example, exercise this right with a supervisory authority in the Member State of your residence, workplace, or place of alleged infringement. You can find a list of relevant authorities at: https://edpb.europa.eu/about-edpb/about-edpb/members_de. The competent supervisory authority in Switzerland is the Federal Data Protection and Information Commissioner, Feldeggweg 1, CH – 3003 Bern, info@edoeb.admin.ch.

10. Social Media and Links to Third-Party Apps and Websites

Our services contain links to websites or apps not operated by us. If you click on a third-party link, you will be directed to that third-party's website or app. We have no control over the content, privacy policies, or practices of third-party websites or services. Our website does not embed any external content (no video embeds, no external fonts; all fonts are loaded from our own server).

We maintain an online presence on social networks to communicate with customers and prospects and inform them about our products and services. If you have an account with the same network, the information and media you make available may be visible to us, for example when we view your profile. The social network may also allow us to contact you under certain circumstances. Once we transfer personal data to our own systems, we are independently responsible for it. This is done for the implementation of pre-contractual measures and to fulfill a contract. The legal bases for the data processing carried out on their own responsibility by the social networks can be found in their respective privacy policies. Below is a list of the social networks where we maintain an online presence (our website only contains outbound links to them):

11. Changes to this Privacy Policy

We may update our Privacy Policy from time to time. We therefore recommend that you regularly review this Privacy Policy for changes.

Changes to this Privacy Policy become effective when they are published on this page.

12. Contact Us

If you have any questions about this Privacy Policy, do not hesitate to contact us:

ODCUS AG, Grabenstrasse 15a, 6340 Baar, Switzerland, contact@odcus.com