Privacy Policy

1. Controller

Natus AG, Zählerweg 6, 6300 Zug, Switzerland, is the controller of the personal data collected through this site (Article 5 letter j of the Federal Act on Data Protection, FADP). Questions about this policy and requests under Section 9 (Rights) are received at info@natusgroup.ch and at the postal address above.

2. Data Collected

The site collects exclusively the following personal data.

Contact form. The form requires the message, the name, and the email address, and accepts the company and the telephone number where provided. The visitor’s browser sends the form directly to Formward, which converts the IP address of the device into a one-way code on receipt and keeps it with the message.

Visits. For each request, the server records the IP address and the reported browser and operating system of the visitor’s device, the time, and the page requested, and keeps these details in its access, error, and security logs. Each request reaches the server through Cloudflare, which processes the same details.

3. Purposes

Natus AG uses the content of the contact form to read and answer each message, and for any business relationship that follows. The request details serve the operation, delivery, and security of the site, and Formward uses the code derived from the IP address to detect spam and misuse of the form.

4. Recipients

Personal data from the site are disclosed exclusively to:

• Studio Zerotredici SRL, Verona, Italy, which administers the hosting and the email system of Natus AG.
• Hetzner, whose data center in Germany houses the server and its logs.
• Cloudflare, which protects the site and accelerates its delivery.
• Formward, operated by EGF Fastighetsservice AB, Stockholm, Sweden, which receives the messages from the contact form, keeps a copy, and forwards them by email to Natus AG.
• Microsoft, whose email service holds each message once it reaches the inbox of Natus AG.
• The professional advisers of Natus AG, and public authorities where the law requires disclosure.

Studio Zerotredici, Hetzner, Formward, and Microsoft act on behalf of Natus AG as its processors (Article 9 FADP). Cloudflare holds the same role for the requests to the site, and is a controller in its own right for the data it derives from them, such as threat scores for IP addresses used to secure its network.

5. Disclosure Abroad

Formward stores the messages in Sweden and sends its notification emails through a provider in France, and the Microsoft 365 data of Natus AG are held in Switzerland or the European Union. Germany, Italy, Sweden, France, and every other State of the European Economic Area (EEA) hold an adequacy finding under Article 16 paragraph 1 FADP, listed in Annex 1 to the Data Protection Ordinance (DPO).

Cloudflare processes each request in the data center nearest to the visitor, which may lie in any State, and stores its logs and security data mainly in the United States and the EEA. Cloudflare and Microsoft are groups based in the United States and are certified under the Swiss-U.S. Data Privacy Framework, which brings certified companies within the entry for the United States in Annex 1 DPO. Where Cloudflare processes data in a State absent from Annex 1, the transfer rests on the standard contractual clauses in its data processing addendum (Article 16 paragraph 2 letter d FADP).

6. Retention

• Messages and the correspondence that follows them: 24 months from the last exchange.
• The copy of each message held by Formward: 30 days.
• The code that Formward derives from the IP address: 24 hours.
• Server logs: 30 days at the most.

Each period ends with deletion (Article 6 paragraph 4 FADP), and a longer one applies where the law requires it.

7. Security

Transmission between the visitor’s browser and the site is encrypted, and access to the data is limited to the persons who need it. Each processor named in Section 4 (Recipients) is bound by contract to keep the data secure (Article 9 FADP).

8. Cookies

The only data written to the visitor’s device are the strictly necessary cookies that Cloudflare may set: __cf_bm, which expires after 30 minutes of inactivity, and cf_clearance, which records that the browser has passed a Cloudflare challenge. Their sole purpose is to distinguish people from automated traffic. Visitors can refuse these cookies in the browser settings (Article 45c letter b of the Telecommunications Act), in which case a challenge may fail.

9. Rights

Under the FADP, visitors may obtain access to the personal data concerning them and receive the information they disclosed in a common electronic format (Articles 25 and 28). They may also have inaccuracies corrected, object to a particular processing, and demand deletion (Articles 30 and 32), within the limits the Act sets. Natus AG answers access requests within 30 days, as a rule (Article 25 paragraph 7 FADP). The Federal Data Protection and Information Commissioner (FDPIC), Bern, receives reports of suspected violations (Article 49 FADP).

10. Amendments

Natus AG amends this policy when the site or its providers change. The date at the top identifies the version in force.