What this site collects, and why.

DO Innovations SA is the controller for the personal data described here. We comply with the Swiss Federal Act on Data Protection (FADP) and, where it applies, the EU General Data Protection Regulation (GDPR). Hayanezu is the name of its Brand & Web Studio.

DO Innovations SA
Chemin de Bon-Abri 26a
1007 Lausanne, Switzerland
Email: hello@hayanezu.com

• Enquiry form. The type of work and optional package you select, your business or project name, an existing website address if you give one, what you are trying to achieve, a target launch if you give one, a budget range if you give one, your name and your email address.
• Client data. If you instruct us, the identification, contact, billing and project data we need to act for you.
• Correspondence. The emails you send us and our replies.
• Advertising measurement. If you opt in, Google may receive your IP address, page URL and browser information; the tag may store measurement cookies.
• Server logs. Your IP address, the time, the page requested, the referring page, and your browser and operating system.

With JavaScript enabled, an unsent enquiry is kept in memory and in this tab’s session storage so internal navigation and language changes preserve your answers. It is not sent until you submit. A successful submission clears the draft; browser session restoration may keep a tab’s stored draft.

Please do not put health data, information about criminal proceedings or other sensitive details into the enquiry form. Send those another way once we are in touch.

Under the GDPR, each purpose has the legal basis shown. Under the FADP, a private controller does not need a legal basis in the same sense; where a justification is required we rely on the contract, or on an overriding private interest (Art. 31 FADP).

• Measuring visits from our advertising with the Google Ads tag after your choice - your consent (Art. 6(1)(a) GDPR).
• Answering your enquiry - steps taken at your request before a contract (Art. 6(1)(b) GDPR).
• Acting for you under an instruction - performance of the contract (Art. 6(1)(b) GDPR).
• Accounting, tax and professional obligations - legal obligation (Art. 6(1)(c) GDPR).
• Running the website securely, including logs and spam filtering - our legitimate interest (Art. 6(1)(f) GDPR).
• Establishing or defending legal claims - our legitimate interest (Art. 6(1)(f) GDPR).

With your consent, this site loads the Google Ads tag (AW-18289814686) to measure visits from our advertising and successful project enquiries. The conversion event does not include the contents of your enquiry. Google may receive your IP address, page URL and browser information, and may use cookies for this measurement. No tag is loaded before you choose to allow it. We do not enable ad personalisation or Google Analytics. Your choice is stored in your browser for up to 180 days. Use “Cookie settings” in the footer to change it at any time. Declining does not affect access to the site.

We do not sell personal data. We share it only with providers acting on our instructions under a contract, and with:

• Formspree - receives enquiry-form submissions and forwards them to us by email.
• Google - receives advertising measurement data only after you opt in. See Google’s privacy policy.
• Our hosting and email providers - they operate the server and carry our correspondence.

Formspree is based in the United States. Google may also process advertising measurement data outside Switzerland and the EEA. Where a provider is outside Switzerland and the EEA we transfer data only if the country is recognised as providing adequate protection, or under the Standard Contractual Clauses, or because the transfer is necessary to perform our contract with you or to pursue a legal claim (Art. 16 and 17 FADP; Art. 45, 46 and 49 GDPR).

• Enquiries: for as long as it takes to answer them and, where a project follows, for the life of the engagement.
• Where a contract is concluded: the accounting records Swiss law requires us to keep for ten years.
• Server logs: a short period, by our host, for security and diagnostics.

Subject to the conditions in the applicable law, you may ask us to:

• give you access to your data and a copy of it (Art. 25 FADP; Art. 15 GDPR);
• correct it if it is wrong (Art. 32 FADP; Art. 16 GDPR);
• delete it where we have no valid reason to keep it (Art. 32 FADP; Art. 17 GDPR);
• restrict processing while a dispute about it is resolved (Art. 18 GDPR);
• hand it over in a structured, machine-readable format, or send it to another controller where that is technically feasible (Art. 28 FADP; Art. 20 GDPR);
• stop processing based on our legitimate interests, on grounds relating to your situation (Art. 30(2)(b) FADP; Art. 21 GDPR).

You can withdraw consent at any time without affecting what was done beforehand (Art. 7(3) GDPR). We do not make automated decisions about you and do not profile you.

Write to hello@hayanezu.com. We may need to confirm your identity first, and we answer within 30 days, or one month where the GDPR applies.

You can complain to the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, CH-3003 Berne, www.edoeb.admin.ch. In the EU or EEA you may instead go to the supervisory authority where you live, where you work, or where the problem occurred. You can also go to the civil courts.

The site is served over HTTPS with HSTS, and we apply technical and organisational measures to protect personal data against loss, misuse and unauthorised access.

We may update this policy. The date at the top shows when it last changed.