PRIVACY POLICY

Last updated: 9 October 2026

This privacy policy describes which personal data is processed on regulabadertscher.com, for what purposes, and which rights data subjects have. It takes into account Swiss data protection law (revFADP) and - for visitors from the EU/EEA - the GDPR.

1. Data controller

Regula Badertscher
Practice for body-oriented support & PBSP
Phone: +41 76 483 63 13
Email: hello@regulabadertscher.com
Web: https://regulabadertscher.com

Practice addresses

– Subtenant at Meriel Stanton, Lavaterstrasse 103, 8002 Zurich Enge, Switzerland
– Raum Feldegg, Feldeggstrasse 3, 9113 Degersheim, Switzerland

2. Hosting, TLS/SSL and server logs

Hosting is provided by ALL-INKL.COM – Neue Medien Münnich (DE). When you access the website, server-side log data is collected (e.g., IP address, date/time, requested URL, referrer, user agent). Purpose: operational security, abuse/error analysis. Legal basis: legitimate interests in the secure and stable operation of the website (Art. 6(1)(f) GDPR; under the revFADP, where needed, overriding interest, Art. 31(1)). Logs are deleted after a short period. Data transmission is encrypted (TLS/SSL).

To protect the login area, the security plugin Loginizer logs failed login attempts on the same server, with IP address, the user name entered, time and the address called, and temporarily blocks after repeated failures. The lockout counters are reset after 24 hours; the entries remain stored until they are deleted in the plugin. Purpose: defending the website against attacks. Legal basis: legitimate interests in the security of the website (revFADP; Art. 6(1)(f) GDPR).

3. Contact (form & email)

When you use the contact form (Contact Form 7), we process the data you enter (name, email, message) to handle your request (revFADP; Art. 6(1)(b) GDPR - pre-contractual communication).

Form entries are not stored on the website: the web server at ALL-INKL sends them as an email to hello@regulabadertscher.com, via the hosting’s mail server and without any other email service.

When you send emails to hello@regulabadertscher.com, we process the sender address, content/subject, and technical metadata.

Retention: Contact enquiries are generally stored for 12 months and then deleted, unless legal obligations require otherwise.

4. Email service (Zoho Mail)

Business email, including messages from the contact form, is handled via Zoho Mail. A data processing agreement (DPA) is in place with Zoho. The mailbox is located in Zoho’s data centre in the USA. Zoho processes, transfers and stores data in the USA, the EEA and other countries where Zoho operates, and bases such transfers on the European Commission’s standard contractual clauses.

5. Newsletter (Brevo)

On the Newsletter page you can subscribe to Regula’s letters by email. We process your email address, the language of the sign-up page (German or English) and the time you signed up. The form sends this data to Brevo only when you submit it; merely opening the page loads nothing from Brevo.

  • Double opt-in: After you submit the form, you receive an email with a confirmation link. You only receive letters once you have clicked it.

  • Email service: Brevo GmbH, Köpenicker Str. 126, 10179 Berlin, Germany (Brevo group, parent company Sendinblue SAS, Paris). Brevo processes the data on our behalf under a data processing agreement (DPA) and stores it on servers in France and Belgium. Sub-processors and group companies of Brevo that may have access for network protection, support and maintenance are also based in the USA and in India. The basis for this is standard contractual clauses, for the USA partly also the EU-U.S. Data Privacy Framework.

  • Open and click tracking: The letters contain an invisible tracking pixel and links routed through Brevo. Brevo records whether and when a letter was opened and which link was clicked, with IP address and time. This shows us roughly which letters arrive and are read (some email programs load images by themselves, which counts as an open that is not one), and helps us make the letters better; Brevo also uses this data for the security and statistics of its own service.

  • Legal basis: your consent (revFADP; Art. 6(1)(a) GDPR), which you can withdraw at any time.

  • Unsubscribing and retention: You can unsubscribe at any time via the link in every letter or by email to hello@regulabadertscher.com. Your data and the open and click data are kept for as long as you receive the newsletter. After you unsubscribe, your email address remains stored at Brevo with a note of the unsubscription so that you receive no further letters (legitimate interests, Art. 6(1)(f) GDPR); on request, we delete your contact entirely, with all open and click data.

6. Cookies, consent & multilingual setup

  • Consent management: The cookie banner by Complianz runs on this website itself, without any connection to third parties, and asks for your consent on your first visit. You can change/withdraw your choice at any time via “Cookies” in the footer.

  • Strictly necessary cookies: Polylang (language cookie pll_language, 1 year) and, as soon as you make a choice in the banner, the Complianz cookies cmplz_banner-status, cmplz_consented_services, cmplz_policy_id, cmplz_functional, cmplz_preferences, cmplz_statistics and cmplz_marketing (1 year each). They store your choice, also when you deny.

  • Optional cookies: are set only when you consent in the banner (e.g., with “Accept”): Google Analytics 4 via MonsterInsights (cookies _ga and _ga_VHRWRKN023, see web analytics). Without your consent, the website makes no connection to Google.

7. Web analytics

Google Analytics 4 via MonsterInsights

With your consent, we use Google Analytics 4 via the MonsterInsights plugin for statistical analysis of website usage. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

  • Types of data: e.g., page views, interactions, approximate location data (country, region, city), device/browser.

  • IP address: According to Google, Google Analytics uses the IP address of visitors from the EU and Switzerland only to derive their approximate location and then discards it immediately; it is not stored.

  • Cookies/storage: _ga and _ga_VHRWRKN023 (2 years by default, according to Google). Activation only after consent via the cookie banner: until then, the Google script is blocked and no request is sent to Google.

  • Transfer to the USA: Google may also process the data through Google LLC in the USA. Google LLC is certified under the EU-U.S. and the Swiss-U.S. Data Privacy Framework; for companies certified in this way, the level of protection is deemed adequate (European Commission adequacy decision 2023/1795; Annex 1 of the Swiss Data Protection Ordinance). Where necessary, Google also uses standard contractual clauses.

  • Settings: Google Signals/ads features only with consent.

  • Retention: User-level and event-level data is deleted after the retention period set in Google Analytics (Google offers 2 or 14 months); aggregated reports without reference to individual users remain.

  • Withdrawal: You can change your consent at any time via “Cookies” in the footer.

    Legal basis: consent (Art. 6(1)(a) GDPR / revFADP).

8. Appointment booking (Calendly)

We use Calendly to schedule appointments. On this website, Calendly is only linked; data goes to Calendly only when you follow the link and book an appointment there. Depending on what you enter, name, email address, and appointment details are processed; confirmations are sent by email. Legal bases: consent (Art. 6(1)(a) GDPR) and pre-contractual communication (lit. b). Calendly, LLC is based in the USA and certified under the EU-U.S. and the Swiss-U.S. Data Privacy Framework; Calendly also uses standard contractual clauses.

9. Embedded content & fonts

At present, no external content (YouTube, Google Maps, Instagram) is embedded. Fonts and scripts (e.g., for animations) are loaded from this web server, without external loading (no remote Google Fonts requests).

10. SEO plugin

Yoast SEO supports the markup of metadata/structured information and does not process personal usage profiles for marketing purposes.

11. Recipients / data processors

Data is only shared to the extent necessary, with consent, or due to legal requirements. Service providers used (including ALL-INKL, Zoho, Brevo for the newsletter, Google for GA4, Calendly) process data on the basis of data processing agreements; for third-country transfers, appropriate safeguards are implemented.

12. Storage period

We process personal data only for as long as necessary for the respective purposes and/or as required by statutory retention obligations. After that, data is deleted or anonymised. Examples: contact enquiries 12 months; newsletter data for as long as you receive the newsletter (afterwards only the unsubscription note, see newsletter); user-level and event-level analytics data according to the retention period set in GA4 (2 or 14 months).

13. Rights of data subjects

Within the scope of applicable law, you have rights of access, rectification, erasure, restriction, where applicable data portability, as well as the right to object to processing based on overriding interests. Please send requests to hello@regulabadertscher.com. The competent authority in Switzerland is the FDPIC. You can also lodge a complaint with a data protection supervisory authority in the EU, in particular in the member state of your habitual residence, your place of work or the place of the alleged infringement (Art. 77 GDPR).

14. Data security

We protect data through appropriate technical and organisational measures (access control and protection, encryption, data minimisation).

15. Changes to this policy

If services or legal requirements change, this policy will be updated; the current version is available here.