Incident
Incident? Contact us.

Data & Privacy Policy

Last revision: 21. October 2026

 

  1. Controller and Contact Information

This Privacy Policy outlines how Arco IT GmbH collects, uses, and protects your personal data in compliance with the revised Swiss Federal Act on Data Protection (revDSG) and the EU General Data Protection Regulation (GDPR).

The responsible body within the meaning of the Data Protection Act is:

Arco IT GmbH

Bertram Dunskus

Albulastrasse 34

8048 Zurich

Switzerland

+41 44 244 02 20

info@arco-it.ch

 

For any privacy-related inquiries, please use the contact details provided above.

 

  1. Scope and Collection of General Information (Server Logs)

When you access our website, information is automatically collected by us or our hosting provider. This information (server log files) is technically necessary to securely and reliably deliver the website to you.

  • Collected Data: Name of the displayed website, file, date and time of access, amount of data transferred, web browser and version, operating system, referrer URL, and IP address.
  • Legal Basis: Our legitimate interest in the technical administration, security, and optimization of our website.
  • Retention: Server logs are automatically deleted after 180 days, unless required longer for the investigation of a specific security incident.

 

  1. Handling Personal Data: What We Collect and Why

Personal data is any information relating to an identified or identifiable individual. We process data that you explicitly provide to us or that we collect through your use of our website. This includes:

  • Master Data & Contact Information: Name, address, phone number, email address.
  • Financial Data: Account details (if applicable for transactions).
  • Technical & Online Identifiers: IP addresses, cookie IDs, location data, traffic data.

Legal Bases for Processing:

We only process your data when we have a valid legal justification:

  • Consent: When you actively agree to processing (e.g., subscribing to a newsletter, accepting tracking cookies).
  • Contractual Necessity: To fulfill a contract with you or take pre-contractual steps (e.g., processing a service request).
  • Legitimate Interest: For business operations, security, and marketing, provided your fundamental rights do not override these interests.
  • Legal Obligation: To comply with statutory requirements (e.g., accounting laws).

 

  1. Data Disclosure and International Transfers

We do not sell your data. We may use third-party service providers (processors) to help operate our business, such as IT hosting, cloud services, analytics, and accounting. We ensure these partners are bound by strict data protection agreements.

Cross-Border Transfers:

Some of our service providers (e.g., Google, HubSpot, LinkedIn) are located outside of Switzerland and the EU/EEA, particularly in the United States. When transferring data to these countries, we ensure appropriate safeguards are in place by relying on: Adequacy decisions recognized by the Swiss Federal Council and the European Commission (e.g., the Swiss-US / EU-US Data Privacy Framework).

 

  1. Your Rights as a Data Subject

Under the revDSG and GDPR, you have the following rights regarding your personal data:

  • Right of Access: To request information about what personal data we hold about you.
  • Right to Rectification: To have inaccurate or incomplete data corrected.
  • Right to Erasure (Right to be Forgotten): To request the deletion of your data, subject to legal retention obligations.
  • Right to Restriction of Processing: To limit how we use your data under certain conditions.
  • Right to Data Portability: To receive your data in a structured, commonly used, and machine-readable format.
  • Right to Object: To object to processing based on legitimate interests or for direct marketing.
  • Right to Withdraw Consent: You can revoke your consent at any time (e.g., via the contact email above), which will apply to future processing.

To exercise these rights: Contact us at the email provided in Section 1. You also have the right to lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC) or your local EU supervisory authority.

 

  1. Contact Forms and Comments
  • Contact/Chat/Email: When you contact us, we store your provided information (name, email, phone, message content) to process and answer your inquiry.
    • Retention: This data is deleted in accordance with the Federal Act on Data Protection.
  • Comments: If you leave a comment on our website, we store your IP address, username, and timestamp. This is based on our legitimate interest in security, allowing us to trace illegal content (e.g., insults, propaganda).
    • Retention: This data is deleted in accordance with the Federal Act on Data Protection.

 

  1. Cookies and Tracking Technologies

We use cookies and similar technologies. Essential cookies are required for the website to function. Non-essential cookies (for analytics, marketing, and external media) are only set if you give your explicit consent via our Cookie Banner.

You can manage or withdraw your consent at any time via the Privacy & Cookies Policy tab.

 

  1. Third-Party Services and Content Integration

Based on your consent (or our legitimate interest for purely functional integrations), we utilize the following third-party services. Note that these providers may process your IP address and other online identifiers.

  • Google Analytics: A web analytics service by Google. IP anonymization is active on our site, meaning your IP is truncated before being stored in the US. Used to evaluate website usage and compile reporting.
  • Google Tag Manager: A tool that manages tracking tags on our site without independently processing personal data.
  • Google Maps: Embedded maps to display locations. Google processes your IP address to deliver the map.
  • reCAPTCHA: A Google service to protect our forms from spam and automated bots by distinguishing human users from machines.
  • LinkedIn Social Plugin: Features provided by LinkedIn. If you interact with these plugins while logged into LinkedIn, your visit may be associated with your profile.
  • HubSpot Ecosystem (HubSpot, Conversations, Messages): We use HubSpot for marketing, sales software, managing website content, live chat, and CRM. This helps us communicate with you, manage inquiries, and optimize our marketing.
  • Leadfeeder: An analytics service that uses IP addresses and Google Analytics data to identify which companies visit our website, providing us with B2B sales leads.
  • US Privacy User Signal Mechanism: We respect tools that give users control over online privacy, allowing you to opt-out of certain tracking signals.
  • Calendly: We use Calendly to allow users to book appointments and consultations online. When scheduling an appointment, Calendly may process personal data such as your name, email address, phone number (if provided), company name, and appointment details. Calendly acts as a data processor and may transfer data to the United States or other countries where it operates.
  • monday.com: We use monday.com as a project management and customer relationship management platform to organize customer projects, service requests, and internal business processes. Personal data such as contact details, communication records, project information, and task-related information may be processed within monday.com for the purpose of contract fulfillment, service delivery, and efficient business operations.