Privacy policy
This site sets no cookies, measures no audience and calls no third-party service. Here, in detail, is what it nevertheless processes.
Controller
HSP Engineering Sàrl
Route des Dragons 7
1033 Cheseaux-sur-Lausanne, Suisse
info@hsp-engineering.ch
For any question concerning data protection, please write to the address above. The firm is not required to appoint a data protection adviser within the meaning of art. 10 FADP, and has not appointed one.
What this site does not do
The technical approach taken for this site is a frugal one. Specifically:
- no cookie is set, at any time, and no consent banner is therefore necessary;
- there is no analytics, no visitor statistics and no tracking pixel;
- there is no third-party script, no social media button, no video or map embedded from another site;
- fonts, images and code are served from our own server: your browser sends no request to any other domain;
- there is no user account, no advertising, no profiling and no sale of data.
Data processed
Server logs
- Data
- IP address, date and time of the request, address requested, response code, volume transferred, browser and operating system, referring page where applicable.
- Purpose
- Delivering the site, keeping it secure and functioning, detecting and blocking abuse.
- Legal basis
- Overriding legitimate interest in operating a secure service (art. 31 para. 1 FADP; art. 6(1)(f) GDPR).
- Retention
- 90 days, then automatic deletion.
- Necessity
- These data arise from the very operation of a web server; they cannot be avoided when a page is requested.
Contact form
- How it works
- The form sends nothing by itself. It composes a message and opens it in your own mail client. Until you send that email, no data you have typed leaves your device, and nothing is transmitted to our server or to any third-party service.
- Data
- Once the email has been sent: name, company, email address, telephone number, type of project and the content of your message.
- Purpose
- Answering your enquiry and, where applicable, preparing an offer.
- Legal basis
- Pre-contractual steps taken at your request and legitimate interest in handling enquiries received (art. 31 FADP; art. 6(1)(b) and (f) GDPR).
- Retention
- For as long as needed to handle the enquiry, then at most twenty-four months. If the enquiry leads to an engagement, the correspondence follows the project file and the statutory retention period for accounting records (ten years, art. 958f CO).
Emails and calls received directly
- Data
- The contact details and content you send us.
- Purpose
- Replying, and managing the working relationship.
- Legal basis
- Same as for the contact form.
- Retention
- Same as for the contact form.
Recipients and processors
Your data is neither sold, nor rented, nor disclosed to third parties for advertising purposes. It is accessible only to those in the firm who need it in order to deal with your enquiry, and to the following providers, bound by contract and by confidentiality:
- the operator of the server hosting the site, in Germany, for technical logs;
- Infomaniak Network SA, Geneva, Switzerland, for the domain name and business email.
Disclosure to an authority may occur where the law requires it.
Disclosure abroad
The server hosting the site is located in Germany. Switzerland recognises the member states of the European Union as providing an adequate level of data protection (annex 1 DPO), so this disclosure requires no additional safeguards. Business email is hosted in Switzerland.
Security
The site is served over HTTPS only: the connection between your browser and the server is encrypted. Access to the server is restricted and logged, software is kept up to date, and data is backed up. No measure guarantees absolute security on a public network; those taken are proportionate to the nature of the data processed, which is limited in volume and not sensitive.
Your rights
Within the limits of the applicable law, you may at any time:
- request access to the data concerning you and a copy of it (art. 25 FADP; art. 15 GDPR);
- request its rectification where it is inaccurate (art. 32 FADP; art. 16 GDPR);
- request its erasure or destruction (art. 32 FADP; art. 17 GDPR);
- object to a processing operation or request its restriction (art. 30 and 32 FADP; art. 18 and 21 GDPR);
- request that your data be handed over in a common electronic format, or transferred (art. 28 FADP; art. 20 GDPR);
- withdraw a consent given, without affecting the lawfulness of processing carried out beforehand.
Requests are made by email to the address given above. In order to avoid disclosing data to an unauthorised person, proof of identity may be requested. A reply will be given as quickly as possible, in principle within thirty days; exercising these rights is free of charge.
You may also contact the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, Switzerland. If you live in the European Union, you may lodge a complaint with the supervisory authority in your country.
Automated decisions and profiling
No automated individual decision within the meaning of art. 21 FADP or art. 22 GDPR is taken on the basis of the data processed, and no profiling is carried out.
Changes to this policy
This policy may be adapted as the site evolves or the legal framework changes. Only the version published on this page is authoritative; its revision date appears below.
Last updated : 6 September 2026