Privacy Policy

Controller

The controller responsible for data processing is AstraSana Holding AG, Gerbegasse 2, 8302 Kloten, Switzerland. For data protection questions, contact us at info@astrasana.com.

What data we process and why

We only process data required for the respective purpose:

• Visiting the website: when you access our pages, technically necessary data is processed (IP address, date and time, page visited, referrer URL, browser and operating system). Purpose: provision, stability and security of the website.
• Contact and registration forms (contact, pharmacies, physicians): name, email address, and optionally phone number, company, pharmacy or practice, canton and your message. Purpose: responding to your enquiry and, where applicable, initiating a business relationship.
• Applications via the career form: name, email address, phone number and your message. Purpose: carrying out the application process.
• Spam protection: technical characteristics of your browser and device to detect automated requests (see Cloudflare Turnstile).
• Audience measurement: anonymised usage statistics without cookies (see Web analytics).

Basis for processing

We process personal data in accordance with the processing principles of the FADP (Art. 6 FADP). Processing takes place to respond to your enquiry, to initiate or perform a contract, based on our legitimate interest in a secure and functional website and, where required, with your consent. Providing data in our forms is voluntary. Without the fields marked as required, however, we cannot process your enquiry.

Processors and recipients

We use carefully selected service providers that process data on our behalf and according to our instructions (processors under Art. 9 FADP):

• Vercel Inc., San Francisco, USA: website hosting and processing of server log data. The website and server-side functions (including form processing) run in the Frankfurt region (Germany).
• Resend, Inc., San Francisco, USA: delivery of form contents to us by email. Emails are sent via the EU region Ireland (eu-west-1).
• Cloudflare, Inc., San Francisco, USA: spam protection with Cloudflare Turnstile.

Disclosure abroad

The website and email delivery run in data centres in the EU (Vercel: Frankfurt, Germany. Resend: Ireland). Switzerland recognises EU member states as providing adequate data protection (Annex 1 DPO). As Vercel, Resend and Cloudflare are headquartered in the USA, access from the USA, for example for support, account management or due to orders by authorities, cannot be completely ruled out. Cloudflare Turnstile is provided via Cloudflare’s global network, and data may also be processed in the USA. For companies certified under the Swiss-U.S. Data Privacy Framework, the Federal Council considers the USA to provide adequate data protection (Annex 1 DPO). Where no such certification exists, we base the disclosure on the European Commission standard contractual clauses recognised by the Federal Data Protection and Information Commissioner (FDPIC) (Art. 16 para. 2 FADP).

Contact and registration forms

The information you enter in our forms is transmitted via our server to the email service Resend and delivered to us as an email. Form data is not stored on the website itself. We use the data solely to handle your request and do not pass it on to third parties for advertising purposes.

Spam protection (Cloudflare Turnstile)

To protect our forms from spam and automated access, we use Cloudflare Turnstile, a service of Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. Turnstile uses technical characteristics of your browser and device (e.g. IP address, browser information and interaction signals) to check whether a request comes from a human. This data is transmitted to Cloudflare and may be processed in the USA. According to Cloudflare, it is used solely to detect abuse and not for advertising. Processing is based on our legitimate interest in protecting the website against abuse. More information: https://www.cloudflare.com/privacypolicy/

Web analytics

To understand and improve the use of our website, we compile anonymised usage statistics. No cookies are set and no user profiles are created. We record pages visited, referrer, browser, operating system, device type, approximate location (country, region, city) and clicks on selected elements. Your IP address is used only briefly to generate an anonymised identifier that changes regularly and is not stored. We cannot identify you personally. The data is not shared with third parties.

Cookies

This website does not use tracking or advertising cookies. Cloudflare Turnstile may store technically necessary data in your browser to detect abuse. You can delete or block cookies and site data in your browser settings at any time. This may, however, limit the use of the forms.

Retention period

We retain personal data only as long as required for the respective purpose or as required by statutory retention obligations. We generally delete enquiries no later than 24 months after the correspondence ends, unless a business relationship results. Business-relevant correspondence is retained for up to 10 years in accordance with statutory obligations (Art. 958f Swiss Code of Obligations). Application documents are deleted no later than 6 months after the process ends, unless you consent to longer retention. Server log data is automatically deleted by our hosting provider after a short period.

Data security

We take appropriate technical and organisational measures to protect your data against loss, misuse and unauthorised access. Transmission between your browser and our website is encrypted (HTTPS).

Automated individual decisions and profiling

We do not make automated individual decisions within the meaning of Art. 21 FADP and do not carry out profiling. The automatic spam check serves only to protect against abuse and has no legal consequences for you.

Your rights

Under applicable data protection law, you have in particular the following rights:

• Access to information on whether and which personal data we process about you (Art. 25 FADP)
• Rectification of inaccurate data (Art. 32 FADP)
• Erasure or destruction of your data and restriction of processing
• Objection to processing and withdrawal of consent with effect for the future
• Receiving or transferring your data in a common electronic format (Art. 28 FADP)

Exercising your rights and complaints

To exercise your rights, simply send a message to info@astrasana.com. We may request proof of identity to prevent misuse and generally respond within 30 days. You also have the right to lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, www.edoeb.admin.ch.

Changes

We may amend this privacy policy at any time, in particular if our data processing or the legal situation changes. The version published on this page applies.