This policy explains what personal data Vision Goal GmbH collects through visiongoal.ch, why it is collected, on what legal basis, how long it is kept, and what rights you have. It is written to satisfy the Swiss Federal Act on Data Protection (FADP, revised version in force since 1 September 2023) and, where it applies, Regulation (EU) 2016/679 (GDPR).
Controller
Vision Goal GmbH, Huobstrasse 10, 8808 Pfäffikon SZ, Switzerland (CHE-488.435.445) is the controller for the processing described here. Andreas Svoboda is the responsible contact. Written enquiries about data protection should go to office@visiongoal.ch.
We have not appointed a data protection officer, and we are not required to appoint one. We have no establishment in the European Union and have not appointed an EU representative; where a data subject in the EEA wishes to exercise GDPR rights, they may do so directly at the address above.
What we collect and why
Contact form. The contact form collects the details you enter: first and last name, email address, organisation and role where you give them, the area of interest you select, and the message you write. Forms are submitted over an encrypted connection to our server and are never transmitted in a URL. There is no application or admission process.
Dispatch subscription. The dispatch operates on a double opt-in. When you submit the form we send a confirmation link to the address you gave and nothing else happens; your address is added to the list only once you follow that link, and the link expires after seven days. We store the address together with the time of the request, the time of the confirmation, and the confirming IP address, which is the evidence that the subscription was asked for. The address inside the confirmation link is encrypted, so it is not legible in the link itself.
Technical data. Our hosting provider records standard server log data — IP address, timestamp, requested resource, user agent, and referrer — for the purposes of operating and securing the site. We also record the submitting IP address and user agent alongside each form submission as evidence of consent and as a defence against automated abuse.
Correspondence. Where you write to us by email, we keep the message and our reply.
We do not use advertising cookies, third-party tracking pixels, social plug-ins, or profiling. We do not sell, rent, or trade personal data under any circumstances.
Legal bases
Under the GDPR, we rely on: pre-contractual steps taken at your request (Art. 6(1)(b)) when you enquire about a learning experience or a Private Office introduction; consent (Art. 6(1)(a)) for the dispatch; and legitimate interests (Art. 6(1)(f)) for operating and securing the website, preventing abuse, and responding to enquiries. Under the FADP, processing is carried out in accordance with the principles of lawfulness, good faith, proportionality, and purpose limitation, and on the basis of your consent where consent is the stated basis above.
Enquiry data
What you write in an enquiry is read by Vision Goal only. Where an enquiry leads to a Private Office introduction, your details are shared with a specialist only once you have asked for that introduction, and only to the extent needed to make it. Enquiries that do not lead anywhere are deleted within twenty-four months of the last exchange.
Retention
Enquiry and contact correspondence is kept for twenty-four months from the last exchange. Dispatch subscriber records are kept until you ask to be removed, and the consent record for a further twelve months as proof that consent was given. Records forming part of a contractual relationship are retained for ten years in accordance with the Swiss Code of Obligations. Server logs are retained for a maximum of ninety days.
Recipients and processors
We use a small number of service providers, each bound by a data processing agreement:
- Vercel Inc. — website hosting and content delivery. Data may be processed in the United States under an adequacy decision or standard contractual clauses.
- Resend (Plus Five Five, Inc.) — transactional email delivery for form notifications and confirmation messages.
- Cloudflare, Inc. — spam and abuse prevention on our forms, where the Turnstile challenge is enabled.
Where personal data is transferred outside Switzerland or the EEA, the transfer is protected by the European Commission's standard contractual clauses together with the Swiss addendum recognised by the Federal Data Protection and Information Commissioner, or by an applicable adequacy decision. Beyond these providers, we disclose personal data only where we are legally obliged to do so.
Your rights
You have the right to obtain confirmation of whether we process your data and to receive a copy of it; to have inaccurate data corrected; to request erasure; to request restriction of processing or object to it; and to receive data you provided in a portable format. Where processing is based on consent, you may withdraw that consent at any time, which does not affect the lawfulness of processing carried out beforehand.
Write to office@visiongoal.ch to exercise any of these rights. I normally respond within 48 hours and complete requests within thirty days. We may ask you to confirm your identity before disclosing personal data.
If you are not satisfied with our handling of a request, you may lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, or with the supervisory authority of your EEA country of residence.
Security
The site is served exclusively over HTTPS. Form submissions are transmitted as encrypted POST requests, so personal data never appears in a URL, a browser history entry, or a referrer header. Access to submitted data is limited to the curation team members who need it. We apply rate limiting and automated-abuse detection to all form endpoints.
Automated decision-making
We do not carry out automated decision-making or profiling that produces legal effects concerning you. Every enquiry is read and answered by a person.
Changes to this policy
We may update this policy to reflect changes in our processing or in the law. The version in force is the one published here, with the date of last revision shown at the head of this page.