Legal
Privacy policy
As of: October 2026
Controller
The controller for the data processing under revFADP and GDPR is Holenweg Architekten GmbH, Rütistrasse 9, 9658 Wildhaus, Switzerland. For questions about data protection you can reach us at info@holenweg.ch.
We have not appointed a data protection officer; a studio of our size is not required to. [If an EU representative is appointed, add it here - placeholder]
What data we process
When you use our contact form, we collect only the data you actively provide:
- Contact form: name, email address, optional phone number, type of project and your message.
- Technical: Cloudflare processes information including IP address, time and requested URL to deliver and secure the website. Consistent truncation of IP addresses in provider logs has not been confirmed.
- Locally in your browser: your preferred language, your appearance (light or dark) and your cookie choices. These never leave your device.
- Google Analytics 4 (only after you consent): pseudonymous online identifiers, pages viewed, interactions and technical information about browser, device and approximate region.
Purpose & legal basis
We process your contact details to answer your enquiry and to initiate a possible collaboration. Technical data supports website operation and protection against abuse; web analytics takes place only after your consent.
Under the GDPR we rely on the following legal bases: your consent (Art. 6(1)(a)), the initiation or performance of a contract (Art. 6(1)(b), e.g. for a project enquiry) and our legitimate interest in a secure, functioning website (Art. 6(1)(f)). Under the revFADP, processing is based on your consent and our overriding interest in communication and security. You can withdraw any consent given at any time with effect for the future.
Processors & hosting
The providers listed below participate in operating the website and delivering contact enquiries. The contractual data protection arrangements and the legal role of each provider still require final verification.
- Hosting and form processing: Cloudflare Pages and Pages Functions. The contact form submits to /api/contact on this website. Processing takes place in Cloudflare infrastructure; exclusive processing in Switzerland has not been confirmed.
- Email delivery and receipt: the Pages Function sends the validated enquiry to Hostpoint (asmtp.mail.hostpoint.ch) over a STARTTLS-encrypted SMTP connection. The email contains contact details, project type, message, language, form source, page path and time and is sent to info@holenweg.ch. The current website does not use Convex for contact enquiries and does not create a form database.
- Abuse protection: a private Cloudflare Durable Object stores an HMAC-SHA-256 value of the IP address and timestamps for the ten-minute limit, plus global send timestamps for a 24-hour window. Expired entries are regularly cleared. Names, email addresses, messages and raw IP addresses are not stored there.
- Web analytics (only with consent): Google Analytics 4, provided by Google Ireland Limited. Processing by Google LLC in the United States cannot be excluded.
International transfers
Cloudflare and Google may process data outside Switzerland and the EEA, including in the United States. The applicable contracts, destination countries and safeguards still require legal review and verification against provider agreements. This technical review does not constitute final confirmation of an adequate level of protection.
No sharing, no selling
We do not sell your data and do not pass it on to third parties for advertising purposes. Data is only shared where necessary to process your enquiry (for example with specialist planners we bring in) or where we are legally obliged to do so.
Retention
We keep your data only for as long as necessary for the respective purpose or required by statutory retention obligations.
- Contact enquiries are handled as emails. Actual deletion periods, including mailbox backups and statutory retention obligations, must be established and checked organisationally; the website does not automatically delete emails.
- Local browser storage (language, appearance, cookie choices): until you clear or reset it.
- Google Analytics cookies: by default up to two years; the actual duration may be shorter due to browser settings and the retention configured in Google Analytics.
Your rights (GDPR & revFADP)
Within the scope of applicable law you have the following rights:
- Access to the data processed about you
- Rectification of inaccurate data
- Deletion of your data, where no retention obligation applies
- Restriction of processing
- Data portability in a common, machine-readable format
- Objection to processing based on a legitimate interest
- Withdrawal of a given consent, at any time and with effect for the future
- Complaint to a supervisory authority - in Switzerland the Federal Data Protection and Information Commissioner (FDPIC), in the EU the data protection authority responsible for you
Notice for California residents (CCPA/CPRA)
If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) as amended by the CPRA. In the last twelve months we have collected the following categories of personal information: identifiers (name, email, optional phone) and content you submit (your message), as well as technical internet activity data (server logs and, after consent, web analytics data). These come directly from you or your device.
You have the right to know what data we collect (Right to Know), to request its deletion (Right to Delete) and to have inaccurate data corrected (Right to Correct). We will not discriminate against you for exercising these rights (Non-Discrimination).
- Do Not Sell or Share My Personal Information: we do not sell your personal information and do not share it for cross-context behavioural advertising - neither within the meaning of the CCPA/CPRA nor otherwise.
- Global Privacy Control (GPC): if your browser sends a GPC signal, we treat it as a valid opt-out; the statistics and marketing categories then remain off by default.
- We do not process sensitive personal information for the purposes restricted by the CPRA.
Google Analytics 4 & cookies
We use Google Analytics 4 with measurement ID G-M24D1RW9KH to evaluate website usage statistically and improve our offering. The Google tag is loaded only after you consent to the "Statistics" category. Before that, no requests are sent to Google and no analytics cookies are set.
After you consent, Google Analytics may set the cookies "_ga" and "_ga_M24D1RW9KH". We do not transmit our own user ID. Google signals, advertising storage, advertising personalisation and the transmission of user data for advertising are disabled in our technical configuration.
You can withdraw consent at any time through "Cookie settings" in the footer. Further measurement is then blocked and accessible Google Analytics cookies are deleted. Our cookie policy provides further details.
Privacy contact
For access, rectification, deletion, a "Do Not Sell or Share" request or any other data protection matter, please write to us at info@holenweg.ch. To process a requested right we may verify your identity to a reasonable extent. We will handle your request as quickly as possible, usually within the statutory time limits.