1. Data controller

Eartheffect AG Baslerstrasse 10 4600 Olten Switzerland Email: raeber@eartheffect.ch Data protection officer: Martin Räber

2. General information on data processing

We process personal data in accordance with the revised Swiss Data Protection Act (FADP) and, where applicable, the EU General Data Protection Regulation (GDPR). Principles: – processing in good faith, proportionate and for a specific purpose, – transparency for data subjects, – use of appropriate technical and organisational measures to ensure data security.

3. Processing of data when visiting our websites

3.1 Hosting & infrastructure This website (eartheffect.ch) runs on our own server infrastructure hosted by Infomaniak (Switzerland). The domain is also registered with Infomaniak. Technical data such as IP address, browser type, access time and pages visited is automatically processed in server logs. This data is used to operate, secure and troubleshoot our website and is deleted after 30 days at the latest, unless needed to investigate a specific security incident. 3.2 Cookies & tracking We currently do not use any analytics or tracking tool (e.g. Google Analytics) and no marketing cookies. Only the technical server logs mentioned in 3.1 are processed. 3.3 Contact forms Data entered via contact forms (e.g. name, email, area of interest, message) is processed to handle your enquiry and is forwarded internally to our project management system so the responsible person can get back to you. If you sign up for the newsletter via the contact form, section 4.1 also applies.

4. Communication & marketing

4.1 Newsletter We currently use Sendinblue (Brevo) and vtiger CRM for our newsletter. This involves processing email addresses and voluntary information (e.g. name) to send information about our offerings and projects. You can unsubscribe at any time via the unsubscribe link in the newsletter or by email. 4.2 Business communication We use Microsoft Teams and email for client and project communication. This may involve processing metadata (e.g. time of communication, sender, recipient) as well as content data.

5. Customer data management

5.1 CRM & accounting We currently store customer data in vtiger (hosted by Infomaniak, Switzerland). Management will move to Bexio (incl. add-ons) in the future. Data processed: names, addresses, contact details, communication content, contract data. 5.2 Project and collaboration tools We use our own, self-hosted project management system (projects.eartheffect.org, hosted by Infomaniak, Switzerland) as well as Asana as a supplement. This involves storing contact data and project-related notes in particular. When using Asana, data may be transferred to the USA. 5.3 Cloud storage Our internal cloud is based on Seafile (server location Switzerland). Microsoft 365 and Google Drive are used as a supplement in some cases.

6. E-learning / Moodle

We operate learning platforms on Moodle. By default, the following data is processed: – master data (name, email, username), – login data, – course data (e.g. completed modules, learning progress), – interactions within the platform. Hosting is provided by our IT partner Oetiker + Partner AG (Olten, Switzerland). Oetiker + Partner is contractually obliged to process the data exclusively on behalf of Eartheffect and to implement appropriate security measures.

7. Disclosure of data and transfer abroad

We only disclose personal data to third parties if this is necessary to provide our services or if there is a legal basis for doing so. Transfer to third countries (e.g. the USA for Asana, Google, Microsoft) only takes place if: – an adequacy decision by the Federal Council or the EU Commission exists, or – appropriate safeguards (e.g. standard contractual clauses) are in place.

8. Data security

We use technical and organisational measures to protect personal data against loss, misuse, unauthorised access and other risks. These include encrypted transmission (HTTPS), access controls and regular backups.

9. Storage period

We only store personal data for as long as necessary for the purposes for which it was collected, or as required by statutory retention obligations.

10. Use of AI tools

We use AI-assisted tools when creating and maintaining our website and in internal work processes, including Claude (Anthropic), ChatGPT (OpenAI) and DeepL. These tools are used for programming, editorial text, translations and image material. Where personal data is processed in this context (e.g. when automatically translating form entries), the same principles apply as described in the other sections of this privacy policy – in particular with regard to data transfer abroad (see section 7).

11. Rights of data subjects

Under the FADP and, where applicable, the GDPR, data subjects have the right to: – information on whether and what data we process, – correction of inaccurate data, – deletion of data, unless statutory obligations prevent this, – restriction of processing, – data portability, – object to processing (where permitted). To exercise these rights, please contact: raeber@eartheffect.ch

12. Changes to this privacy policy

We may amend this privacy policy if our data processing activities or legal requirements change. The version published on our website at the time is the applicable one.