Privacy Policy

1. Controller

Holzbau Ostschweiz GmbH

Hauptstrasse 23, 9656 Alt St. Johann, Schweiz

Telephone: +41 76 608 57 36

Email: info [at] holzbau-ostschweiz.ch

Website: https://holzbau-ostschweiz.ch

2. Scope and legal bases

The Swiss Federal Act on Data Protection (FADP) applies. The General Data Protection Regulation (GDPR) also applies where its territorial scope is met in an individual case.

Where the GDPR applies, we process data to take steps before entering into or to perform a contract, to comply with legal obligations, on the basis of legitimate interests in secure and economic website operation, or on the basis of your consent to analytics.

Consent can be withdrawn at any time for the future through the privacy settings.

3. Data categories, sources and purposes

We process data you provide and technical data generated while using the website: contact and project data, message content, IP address, browser and device data, timestamps, requested URL, referrer, and security and consent information.

Purposes are providing and securing the website, handling enquiries, preparing and performing offers and contracts, troubleshooting and, only after consent, statistical improvement of the website.

We do not use mailbox or quotation-system data for website tracking and do not make automated decisions producing legal or similarly significant effects.

4. Hosting, email and Cloudflare

Website hosting and email services are provided by Infomaniak Network SA in Switzerland. In particular, technical connection data and content required for email communication are processed.

Cloudflare, Inc. protects and accelerates the website as a proxy. For this purpose Cloudflare processes, among other things, IP addresses, HTTP requests, device and security characteristics for its CDN, WAF, DDoS protection, rate limiting, Bot Fight Mode and JavaScript detection.

Before analytics consent, Cloudflare may set the technically necessary “cf_clearance” cookie to record a passed security check. This cookie is not used for our audience analytics.

5. Contact form and confirmation

Contact data are transmitted to our website endpoints only when submitted and are sent via Infomaniak SMTP to us and as a confirmation to the email address provided. The website does not maintain a separate lead database.

We retain enquiry and contractual correspondence for as long as required to handle the matter, perform the contract, establish or defend legal claims, or comply with statutory retention duties.

6. Cloudflare Turnstile verification

Forms are protected against automated abuse by Cloudflare Turnstile. For verification, the Turnstile token, IP address and technical security information are sent to Cloudflare and checked server-side through Siteverify.

This processing is necessary for form security and is not optional audience analytics.

7. HBOS Privacy and storage technologies

Our own consent module “HBOS Privacy” distinguishes only necessary and analytics processing. It stores your choice without an individual consent ID in the first-party cookie “hbos-privacy” (schema 1, necessary=granted, analytics=granted or denied) for 365 days; Path=/, SameSite=Lax and Secure.

Necessary security and session functions may be used without consent. Google Tag Manager and Google Analytics are loaded only after “Allow analytics”. “Necessary only” triggers no Google, Analytics, Ads or DoubleClick request.

You can withdraw consent immediately through “Privacy settings”. This deletes “hbos-privacy” and known Google analytics cookies on this domain and shows the choice again. Technically necessary third-party cookies may remain.

8. Google Tag Manager and Google Analytics 4

After analytics consent, the website loads the Google Analytics 4 tag for measurement ID G-H4MBRJ7HL1. This records page views, session and device information and pseudonymous interactions with contact and CTA functions. Form content is not sent to GA4.

Advertising storage, ads personalisation, Google Signals, remarketing and active Google Ads measurement are disabled. GA4 is a behavioural signal and not proof of qualified enquiries.

Google first-party analytics cookies are limited to no more than 395 days and are not automatically extended on every visit. Event and user data are retained in GA4 for 14 months. Processing may be carried out by Google LLC and affiliates outside Switzerland.

9. Cloudinary, local fonts and external links

Images are delivered through Cloudinary Ltd. This may involve processing the IP address, requested file, device and browser data, referrer and timestamp. Fonts are served locally by our website; loading a page therefore creates no connection to Google Fonts.

Links to WhatsApp, Facebook and Instagram connect to the respective provider only after you click. From that point the provider's privacy terms also apply and it may process IP address, account and usage data.

10. Recipients and international transfers

Recipients are, where required for the relevant purpose, Infomaniak, Cloudflare, Google and Cloudinary, IT service providers engaged by us, and public authorities where legally required. We do not disclose data for third-party advertising purposes.

Processing may take place in Switzerland, the EU/EEA, the United States and other locations of the named providers. Where an adequate level of data protection is not recognised, transfers rely in particular on recognised standard contractual clauses with Swiss supplements and, where applicable, valid certification under the Swiss-U.S. Data Privacy Framework.

11. Retention and security

We retain personal data only for as long as required for the relevant purpose, ongoing business relationships, the establishment or defence of claims, or statutory retention obligations. We then delete or anonymise it unless a lawful exception applies.

We use appropriate technical and organisational measures, including TLS transport encryption, access restrictions, firewall and abuse protection, logging, data minimisation, updates and backups. Absolute protection cannot be guaranteed technically.

12. Your rights and complaints

Subject to applicable law, you may request access, rectification, deletion, restriction or release of your data and object to processing. Where the GDPR applies, you may also have a right to data portability.

Send requests to info [at] holzbau-ostschweiz.ch. We may request suitable proof of identity and apply statutory restrictions. You may also complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC) or, where the GDPR applies, to a competent EU/EEA supervisory authority.

13. Version

Published on 3 August 2026. Version 1.0 “HBOS Privacy”. If material changes are made, we publish the updated version on this page.