Controller
Laggner Digital Solutions, owner Stefan Laggner
Spitalstrasse 64, 9472 Grabs, Switzerland
Email: hallo@laggner.li
Principles
We process personal data in accordance with the Swiss Federal Act on Data Protection (FADP) and, where applicable, the EU General Data Protection Regulation (GDPR). We only collect data required to operate Gewerkly, and we do not share personal data with third parties unless necessary to provide the service (processors below) or legally required.
What data we process and why
| Data category | Examples | Purpose | Legal basis |
|---|---|---|---|
| Account data | Name, email (via the login service), organization membership, role | Account and contract management, login | Contract performance |
| Usage content | Content created and files uploaded within Gewerkly | Core of the service | Contract performance |
| Payment data | Billing name/address, subscription status; we never hold card data ourselves (processed by Stripe) | Billing | Contract performance, legal obligations |
| Communication data | Support requests, system emails | Support, contract fulfillment | Contract performance, legitimate interest |
| Technical data | IP address, timestamps, error/log data | Security, operations, error analysis | Legitimate interest |
| Analytics data | Pseudonymous usage statistics (only with consent) | Improving the product | Consent (revocable) |
Processors / recipients
| Service | Purpose | Location / data residency | Note |
|---|---|---|---|
| Cloudflare, Inc. | CDN, DNS, application hosting (Workers), database (D1), file storage (R2), attack protection | USA/EU (global network) | Data transfer to the USA is possible; safeguarded via standard contractual clauses |
| Stripe Payments Europe Ltd. | Payment processing, subscription management | Ireland/USA | Card data is held exclusively by Stripe; Stripe's own privacy policy applies additionally |
| Amazon Web Services (SES) | Sending system emails | Frankfurt (eu-central-1) | — |
| Zitadel (self-hosted) | Login and authentication via the provider's central sign-in service: the customer account (name, email address, linked login providers such as Google) is stored across all of the provider's products; sign-in takes place separately per product | EU | Product and usage data remain separate with the respective product |
| Sentry (self-hosted) | Error analysis | EU | Technical error data; personal content is filtered out |
| Google Ireland Ltd. (Analytics 4) | Audience measurement — only with consent | Ireland/USA | Consent Mode v2; data transfer to the USA is possible; revoke anytime via “Cookie settings” |
Cookies and consent
Technically necessary cookies (in particular session cookies) do not require consent. We only set analytics cookies (Google Analytics) after your explicit consent via the cookie banner; no such services are loaded before consent. You can change your choice anytime via the “Cookie settings” link in the footer; declining or revoking consent deletes any tracking cookies already set.
Retention and deletion
We process account data and usage content for the duration of the contractual relationship. After an account or organization is deleted, personal data is deleted or anonymized within 30 days, unless statutory retention obligations (in particular accounting law, 10 years) require otherwise. Backups rotate automatically; deleted data also disappears from backups once the rotation cycle completes.
Data security
Transmission is always encrypted (TLS); access to production data is limited to authorized personnel; infrastructure is only reachable through secured access; regular, encrypted backups.
Your rights
Under the FADP and/or GDPR, you have the right to access, rectify, delete, and restrict the processing of your data, to receive or transfer your data, and to object to certain processing. You can revoke consent already given at any time with effect for the future. Send requests to: hallo@laggner.li. We may require proof of identity to process your request.
Supervisory authority
Switzerland: Federal Data Protection and Information Commissioner (FDPIC). Data subjects in the EU may also contact their national data protection authority.
Changes to this policy
We may amend this policy, in particular when the service or the legal situation changes. The version published on gewerkly.de applies; we will inform active users of material changes in an appropriate manner.