Privacy Policy
candea GmbH · Under the Swiss FADP and EU GDPR · As of October 2026
This English version of the Privacy Policy is provided for your convenience. In the event of any discrepancy, the German version shall prevail and be legally binding.
01Data controller
The data controller as defined by the Swiss Federal Act on Data Protection (FADP / nDSG) and the EU General Data Protection Regulation (GDPR) is:
Susenbergstrasse 172, 8044 Zurich, Switzerland
Email: info@candea.ch
Data protection contacts:
Ramona Leuener – ramona.leuener@candea.ch
Frank Powa – frank.powa@candea.ch
For individuals residing in the EU or EEA, the GDPR applies additionally. For inquiries regarding your GDPR rights, please contact one of the email addresses listed above.
02Principles of data processing
candea processes personal data only to the extent necessary to provide our consulting services. We follow these principles:
- Lawfulness – We process data only on legal grounds or with your consent.
- Purpose limitation – Data is collected only for specified, clearly defined purposes and not processed beyond them.
- Proportionality – We collect only the data actually required for the respective purpose.
- Accuracy – We take appropriate measures to correct or delete inaccurate data.
- Data security – We protect personal data through appropriate technical and organizational measures.
- Transparency – You are informed about the data processing that concerns you.
03What data we process
Depending on the nature of your contact with candea, we process different categories of personal data:
| Category | Examples | Context |
|---|---|---|
| Contact data | Name, email, phone, company name, role | Initial contact, engagements |
| Communication data | Email content, meeting notes | Inquiries, consulting |
| Contract data | Engagement details, fee agreements, project documents | Engagement execution |
| Financial data | Billing address, payment details (for invoicing only) | Accounting |
| Usage data | IP address, browser type, page views, timestamps | Website operation |
| HR-related data | Organizational charts, anonymized employee data (within HR engagements) | HR engagements (confidential) |
We generally do not process sensitive personal data unless expressly agreed for a specific engagement and legally permissible.
04Purposes and legal bases
| Purpose | Legal basis (FADP / GDPR) |
|---|---|
| Responding to inquiries and initial calls | Legitimate interests / pre-contractual measures (Art. 6(1)(b) GDPR) |
| Concluding and executing consulting engagements | Performance of a contract (Art. 6(1)(b) GDPR) |
| Invoicing and accounting | Legal obligation / performance of a contract (Art. 6(1)(b) and (c) GDPR) |
| Operating and improving the website | Legitimate interests (Art. 6(1)(f) GDPR) |
| Statutory retention and documentation obligations | Legal obligation (Art. 6(1)(c) GDPR) |
| Relationship management and networking | Legitimate interests (Art. 6(1)(f) GDPR) |
05Website operation and technical data
When you visit www.candea.ch, the web server automatically records technical data (“server log files”): IP address, date and time of access, pages viewed, browser type and version, and operating system. This data is used exclusively for the technical operation of the website and deleted after 30 days at the latest.
The website is hosted by a Swiss hosting provider. Fonts and all other content are loaded directly from our server – there is no connection to third parties such as Google Fonts. We use no analytics tools, no advertising technologies, and no social media tracking pixels. The link to LinkedIn is a plain link without an embedded plugin.
06Contact by email
When you contact us by email, we process your data to respond to your inquiry and to prepare a possible collaboration. This data is not passed on to third parties and is deleted once the purpose no longer applies and there is no statutory retention obligation.
Email is not a fully encrypted communication channel. For particularly confidential information, we recommend agreeing on the method of transmission with us in advance.
07Consulting engagements and contract data
Within consulting engagements, we process contact details of designated contacts, employee HR data (where contractually agreed), financial data, and engagement-related communication. Where we process data on behalf of a client, we conclude a corresponding agreement under the FADP or Art. 28 GDPR. The confidentiality of all information obtained during an engagement is secured by NDA agreements.
08Disclosure of personal data
candea does not generally pass on your personal data to third parties. Disclosure only takes place to processors (e.g. hosting providers), where required by law, with your explicit consent, or where necessary for a commissioned engagement. We do not share personal data for advertising purposes and never sell it.
09International data transfers
Personal data is generally processed in Switzerland or within the EU/EEA. For international engagements, we ensure an adequate level of data protection through appropriate measures.
The European Commission recognizes Switzerland as providing an adequate level of data protection (Art. 45 GDPR). Data transfers between Switzerland and the EU/EEA are therefore permitted without additional safeguards.
10Retention and deletion
| Data category | Retention period |
|---|---|
| General inquiries (without engagement) | 12 months after the end of communication |
| Contract data / engagement documents | 10 years after the end of the engagement (Swiss Code of Obligations, Art. 958f) |
| Invoices / accounting | 10 years (Swiss tax and commercial law) |
| Server log files (website) | Maximum 30 days |
| Engagement-related HR data of third parties | Deleted or returned after the end of the engagement |
11Data security
candea takes appropriate technical and organizational measures to protect your personal data:
- Encrypted data transmission via HTTPS (TLS)
- Password protection and access control for engagement documents
- Confidentiality obligations for everyone with data access
- Regular review of security measures
- Careful selection and review of processors
12Your rights
Under the Swiss FADP and – where applicable – the GDPR, you have the following rights:
| Right | Description | Legal basis |
|---|---|---|
| Access | Information about the data processed | Art. 25 FADP; Art. 15 GDPR |
| Rectification | Correction of inaccurate data | Art. 32 FADP; Art. 16 GDPR |
| Erasure | Deletion of data (unless retention is required) | Art. 32 FADP; Art. 17 GDPR |
| Restriction | Restriction of processing | Art. 18 GDPR |
| Data portability | Data in a machine-readable format | Art. 28 FADP; Art. 20 GDPR |
| Objection | Objection to processing based on legitimate interests | Art. 30 FADP; Art. 21 GDPR |
To exercise your rights, please contact us in writing. We will process your request within 30 days, free of charge.
13Cookies and tracking
The website www.candea.ch does not set cookies and does not use any analytics, marketing, or social media services. Should we introduce such services in the future, we will inform you and – where required – obtain your consent.
14Changes to this policy
candea reserves the right to amend this privacy policy at any time. The version published on www.candea.ch and valid at the time of processing applies.
15Contact and right to lodge a complaint
For questions about data protection or to exercise your rights, please contact the persons listed above. You also have the right to lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC):
Feldeggweg 1, 3003 Bern, Switzerland
www.edoeb.admin.ch
Individuals residing in the EU or EEA may additionally contact the competent national data protection authority (Art. 77 GDPR).