Privacy Policy

1. Controller

Holzbau Ostschweiz GmbH

Hauptstrasse 23, 9656 Alt St. Johann, Schweiz

Telephone: +41 76 608 57 36

Email: info [at] holzbau-ostschweiz.ch

Website: https://holzbau-ostschweiz.ch

2. Scope and legal bases

The Swiss Federal Act on Data Protection (FADP) applies. The General Data Protection Regulation (GDPR) also applies where its territorial scope is met in an individual case.

Where the GDPR applies, we process data to take steps before entering into or to perform a contract, to comply with legal obligations, on the basis of legitimate interests in secure and economic website operation, or on the basis of your consent to analytics.

Consent can be withdrawn at any time for the future through the privacy settings.

3. Data categories, sources and purposes

We process data you provide and technical data generated while using the website: contact and project data, message content, IP address, browser and device data, timestamps, requested URL, referrer, and security and consent information.

Purposes are providing and securing the website, handling enquiries, preparing and performing offers and contracts, troubleshooting and, only after consent, statistical improvement of the website.

We do not use mailbox or quotation-system data for website tracking and do not make automated decisions producing legal or similarly significant effects.

4. Hosting, email and Cloudflare

Website hosting and email services are provided by Infomaniak Network SA in Switzerland. In particular, technical connection data and content required for email communication are processed.

Cloudflare, Inc. accelerates the website and protects it against attacks and abusive requests. It processes IP addresses, HTTP requests, and device and security characteristics for these purposes.

Before analytics consent, Cloudflare may set the technically necessary “cf_clearance” cookie to record a passed security check. This cookie is not used for our audience analytics.

5. Contact form, quotations and contract evidence

When you submit the contact form, we receive your details through Infomaniak’s email services and send a confirmation to your email address. The website does not maintain a separate enquiry database.

We retain enquiry and contractual correspondence for as long as required to handle the matter, perform the contract, establish or defend legal claims, or comply with statutory retention duties.

For quotations and contracts for work, we process customer, contact, project, property, service and payment data. As contract evidence, we retain the issued PDF with its document ID, revision and checksum, the GTC version, project modules and payment schedule, and receipt of the signed order page.

The signed order page may contain a name, company, function, place, date and signature. We link it to the unchanged issued document as evidence of the contract, its performance, billing and any claims. These records are neither published nor used for website analytics.

6. Cloudflare Turnstile verification

Cloudflare Turnstile protects the forms against automated abuse. We send a verification code, your IP address and technical security information to Cloudflare for this purpose.

This processing is necessary for form security and is not optional audience analytics.

7. HBOS Privacy and storage technologies

“HBOS Privacy” separates necessary functions, optional analytics and optional Google Ads performance measurement. No optional category is preselected. Your choice is stored for 365 days in the “hbos-privacy” cookie on your device, without an individual consent ID.

“Necessary only” prevents Google measurement requests. Analytics and advertising measurement can be allowed separately or together. Google Tag Manager loads only after at least one of these permissions; tags may send only for the permitted purpose. Previous choice versions do not authorise the new advertising measurement. Earlier interactions are not transmitted retrospectively.

Use “Privacy settings” to change your choice and select “Necessary only” to withdraw optional measurement. On withdrawal the page reloads and known first-party Google measurement cookies are deleted. This does not automatically delete data already sent to Google; necessary security cookies may remain. The enquiry form works independently of your measurement choices.

8. Google Tag Manager, Analytics and Ads measurement

With analytics consent, Google Analytics 4 (G-H4MBRJ7HL1) measures page views, session and device information, language, permitted campaign sources, scroll depth, content and reference views, contact clicks, and form starts, attempts, error types and successful submission. Success means acceptance of the internal notification by our SMTP server, not inbox delivery or an order. Form contents, names, email addresses and phone numbers are not transmitted for analytics; there is no session recording.

With separate advertising-measurement consent, we use Google Ads to attribute a successfully submitted terrace-roof enquiry to an ad interaction. Processing may include ad click identifiers, reduced page information, technical device/network data and a random identifier to prevent duplicate counting. Internal submission identifiers and contact details are not uploaded. Google measurement cookies such as “_gcl_aw” may persist for up to 90 days; the click attribution window is 30 days. Google determines further retention of its measurement data under the linked terms.

Ads personalisation, Google Signals, remarketing, enhanced conversions and Meta/OpenAI tracking remain disabled. Google analytics cookies persist for no more than 395 days without renewal on every visit; GA4 event and user data are retained for 14 months. Recipients include Google Ireland Limited, Google LLC and affiliates, including outside Switzerland and the EEA. Details: https://policies.google.com/privacy and https://business.safety.google/adsprocessorterms/.

With your consent to ad measurement, Google may replace our phone number with a Google forwarding number after an ad visit. Calls are forwarded to our existing business number. Google may process the start, duration, connection status, attribution identifiers and available phone-number information; calls of at least 60 seconds count as measured contact. We do not enable call recording. Our integration does not additionally cache the forwarding number in a cookie. Withdrawal restores the original number and removes any existing phone-measurement cookie. Details of processing and retention by Google: https://policies.google.com/privacy. Without consent you can still use our regular phone number.

With analytics consent, we distinguish clicks on email, telephone and WhatsApp links by page, language and link position. A click does not confirm a sent message or a connected call. We count explicit grants of analytics consent, but not rejections or all banner displays; these counts cannot establish a complete acceptance rate.

9. Cloudinary, local fonts and external links

Images are delivered through Cloudinary Ltd. This may involve processing the IP address, requested file, device and browser data, referrer and timestamp. Fonts are served locally by our website; loading a page therefore creates no connection to Google Fonts.

Links to WhatsApp, Facebook and Instagram connect to the respective provider only after you click. From that point the provider's privacy terms also apply and it may process IP address, account and usage data.

10. Recipients and international transfers

Recipients are, where required for the relevant purpose, Infomaniak, Cloudflare, Google and Cloudinary, IT service providers engaged by us, and public authorities where legally required. We do not disclose data for third-party advertising purposes.

Processing may take place in Switzerland, the EU/EEA, the United States and other locations of the named providers. Where an adequate level of data protection is not recognised, transfers rely in particular on recognised standard contractual clauses with Swiss supplements and, where applicable, valid certification under the Swiss-U.S. Data Privacy Framework.

11. Retention and security

We retain personal data only for as long as required for the relevant purpose, ongoing business relationships, the establishment or defence of claims, or statutory retention obligations. We then delete or anonymise it unless a lawful exception applies.

We use appropriate technical and organisational measures, including TLS transport encryption, access restrictions, firewall and abuse protection, logging, data minimisation, updates and backups. Absolute protection cannot be guaranteed technically.

12. Your rights and complaints

Subject to applicable law, you may request access, rectification, deletion, restriction or release of your data and object to processing. Where the GDPR applies, you may also have a right to data portability.

Send requests to info [at] holzbau-ostschweiz.ch. We may request suitable proof of identity and apply statutory restrictions. You may also complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC) or, where the GDPR applies, to a competent EU/EEA supervisory authority.

13. Version

Last updated: 21 September 2026. Version 1.4 “HBOS Privacy”. Updates are published on this page.