Privacy policy

1. Data controller

UnitedIT
8853 Lachen, Switzerland
support@unitedit.ch

2. Scope

This privacy policy governs the processing of personal data by UnitedIT at unitedit.ch and in related services. The applicable law is the revised Swiss Data Protection Act (revDPA (revised Swiss Data Protection Act)); for persons in the EU/EEA, the GDPR applies in addition.

3. What data we process

When you visit our website, technically necessary data is processed automatically (IP address, user agent, request timestamp). This data is required to deliver our website to you.

When you use our contact form, we process the information you submit (name, email address, optionally company, message content). We use this data solely to process your enquiry.

4. Cookies and web analytics

We use technically necessary cookies to store basic website functions (for example, your cookie preference). These cookies contain no personal data and are set without consent.

Specifically, we use the following cookies and browser storage:

• “ui_cookie_consent” (local storage) and “ui_consent_category” (cookie, approx. 180 days): store your cookie preference.
• “NEXT_LOCALE” (cookie, 1 year): remembers your language choice (German/English).
• “ui_admin_session” (cookie, 7 days, httpOnly): login session for the internal admin area. Set only for the operator's own login, never for website visitors.
• Cookies from Google Tag Manager and Google Analytics 4 (e.g. “_ga”, “_gid”): only set after you consent to the analytics category, see below.
• “ui-chat” and “ui-chat-teaser” (session storage, not a cookie): conversation history and display status of the AI chat teaser, see section 8. Cleared when the browser tab is closed.

Own web analytics (with your consent only)

With your consent, we collect usage statistics on our own infrastructure. We do not share data with third parties and do not set tracking cookies. The legal basis is your consent (Art. 6(1)(a) GDPR / Art. 6(6) revDPA).

Per page view we collect the following fields:

• Timestamp and path of the page visited
• Referring domain (e.g. google.com), without the full URL
• Campaign parameters (UTM), if present
• Country (derived from IP, without storing the IP itself)
• Device type (mobile / tablet / desktop), browser and operating system family
• A daily-refreshed, pseudonymous visitor identifier. This identifier is generated by a cryptographic hash of IP, user agent, and a secret daily-rotating value. Re-identification across multiple days is therefore technically not possible.

What we do not collect: We do not store your IP address or the full user agent. No profiling takes place. This first-party analytics system shares no data with advertising networks or similar third-party services. Our use of Google Analytics 4 is described separately in the section below.

Retention period: Individual events are stored for a maximum of 90 days and then deleted automatically. Aggregated daily statistics (without personal reference) are retained beyond that for long-term analysis.

Storage location: This data is stored in our own PostgreSQL database at Neon (Neon Inc., data centre in Frankfurt am Main, Germany, AWS region eu-central-1). No data is shared with third parties.

Withdrawal: You can withdraw your consent at any time by reopening the cookie settings via the banner or by deleting the preference cookie in your browser. Withdrawal takes effect immediately; anonymously collected aggregates are not affected.

Google Analytics 4 via Google Tag Manager (with your consent only)

We use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (with Google LLC, Mountain View, CA, USA acting as sub-processor). The service is loaded via Google Tag Manager. The purpose of the processing is to analyse reach and usage behaviour in order to improve our offering. Google Analytics 4 processes cookies, online identifiers, device and browser information, and usage events. Full IP addresses are not logged by Google Analytics 4; the IP is truncated and anonymised prior to storage.

Google Tag Manager and Google Analytics 4 are loaded only after you have given your explicit consent to the use of analytics cookies (Consent Mode v2, default: denied). No data is transmitted to Google before your consent.

The legal basis is your consent pursuant to Art. 6(1)(a) GDPR / Art. 6(6) revDPA.

Processing may take place in the USA. For transfers of data to the USA, appropriate safeguards exist under the EU–US Data Privacy Framework and standard contractual clauses (SCCs) pursuant to Art. 46 GDPR.

You may withdraw your consent at any time via the cookie settings banner. Upon withdrawal, Google Tag Manager and Google Analytics 4 will no longer be loaded. Further information on privacy and data usage at Google: Google Privacy Policy.

Map (OpenStreetMap)

On our contact page we optionally show a map based on OpenStreetMap. The map is not loaded automatically; it loads only once you choose to display it, or once you consent to the marketing category in the cookie banner. Loading it transmits your IP address to the OpenStreetMap Foundation. The legal basis is your consent.

5. Hosting

Our website is hosted by Vercel Inc. (USA). Vercel processes technical connection data to deliver the website. Appropriate contractual and technical safeguards exist for data transfers to third countries.

Login to the internal admin area works exclusively via a magic link sent by email, for the operator only; this does not affect visitors to the website.

6. Email delivery

Enquiries submitted via the contact form, the website check and the briefing assistant are forwarded to us by email via an SMTP service provider. You also automatically receive a confirmation email at the address you provided. We keep your enquiry only for as long as necessary to process it (see section 10 “Retention”); no fixed automatic deletion period is technically enforced for emails.

In addition, we store your enquiry — the information you entered, the time, language, page visited and campaign parameters, if present — in our own database (PostgreSQL at Neon, Frankfurt am Main, see section 4) so that we can process and answer it. These records are not deleted automatically; we keep them for as long as necessary for the enquiry and a possible business relationship, and delete them on request (see section 9 “Your rights”).

7. Spam protection with Google reCAPTCHA

To protect against automated requests, we use Google reCAPTCHA v2 (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) in the contact form, the website check and the briefing assistant. The script is loaded only when you actually use the respective form. reCAPTCHA analyses user behaviour using various characteristics (including IP address, mouse and keyboard inputs, time on page) to distinguish human from automated requests. Data is transmitted to Google and may be processed in the USA. The legal basis is our overriding interest in protecting our website from misuse.

Further information: Google Privacy Policy.

8. AI chat on the website

On our website you can ask questions to an AI assistant. Use is voluntary. Your messages are sent to OpenAI (OpenAI OpCo, LLC, USA) to generate the reply and may be processed in the USA. Appropriate contractual safeguards exist for the data transfer. Please do not enter sensitive data in the chat.

For quality review we store the conversation together with language, page visited, country and device class for 90 days in our own database. The IP address is not stored; it is used only to prevent abuse (request limit) and to derive a daily rotating anonymous identifier. If you leave an enquiry in the chat (name, phone or email, request), we send these details together with the conversation to ourselves by email and use them solely to handle your enquiry. The history in your browser ends when the tab is closed. The legal basis is our overriding interest in reliable information and in improving the assistant.

We additionally store such an enquiry together with the conversation in our own database (see section 6). Here, too, there is no automatic deletion: we keep the details for as long as necessary for the enquiry and a possible business relationship, and delete them on request (see section 9 “Your rights”).

Further information: OpenAI Privacy Policy.

The chat launcher is only shown after you have made a choice in the cookie banner.

9. Your rights

You have the right to access the personal data processed about you, to rectify inaccurate data, to erasure of your data, and to restriction of processing. To exercise your rights, please contact us at support@unitedit.ch.

You also have the right to data portability and the right to object to the processing of your data. If you are not satisfied with our response, you may contact the competent supervisory authority: in Switzerland, the Federal Data Protection and Information Commissioner (FDPIC); in the EU, the data protection authority of your country of residence.

10. Retention

We process your personal data only for as long as is necessary for the relevant purpose or as required by statutory retention obligations.

An exception applies to enquiries from the contact form, website check, briefing assistant and chat: these enquiries stored in our database (see sections 6 and 8) are not deleted automatically. We keep them for as long as they are necessary for handling the enquiry and a possible business relationship, and delete them at your request (see section 9 “Your rights”).

11. Changes

We reserve the right to update this privacy policy at any time. The version currently published on this page is the authoritative one.

If you have questions about data protection, please visit our contact page.