Legal
Privacy notice.
Last updated 2 September 2026, revised the same day for the cookie consent mechanism. This notice explains what personal data we collect on dfensio.com, why, and what your rights are.
1. Controller
The controller is Obsidian Technologies, Switzerland, operator of Dfensio. Contact for data protection matters: contact@dfensio.com. We process personal data in accordance with the Swiss Federal Act on Data Protection (FADP) and, where applicable to visitors in the European Economic Area and the United Kingdom, the GDPR and UK GDPR.
2. What we collect and why
| Context | Data | Purpose and legal basis | Retention |
|---|---|---|---|
| Briefing request form | Name, work email, company, role, phone, countries and domains of interest, message, IP address, timestamp | Answering your request and preparing a briefing proposal, pre-contractual steps and our legitimate interest in responding to enquiries | 24 months after our last exchange, or the duration of the contract plus statutory retention |
| Contact form | Name, work email, company, phone, subject, message, IP address, timestamp | Answering your message, legitimate interest | 24 months after our last exchange |
| Newsletter | Email, company, IP address, timestamp | Sending the quarterly report, your consent, withdrawable at any time via the unsubscribe link | Until you unsubscribe, then a suppression record |
| Server logs | IP address, user agent, requested pages, timestamps | Security, abuse prevention, rate limiting, legitimate interest | 30 days |
| Analytics | Pseudonymous usage data (pages, referrer, device, approximate location with IP anonymisation) | Measuring audience and improving the Site, on the basis of your consent given in the cookie banner and withdrawable at any time | Per provider settings, maximum 14 months |
| Advertising measurement | Ad click identifier (gclid and equivalents) carried in the link that brought you to the Site | Measuring which of our own campaigns produced a visit or a request, on the basis of your consent given in the cookie banner. Recorded with your request only if you accepted advertising cookies | Per provider settings, maximum 14 months; in our own records, with the request |
Form submissions are stored as records on our own servers hosted in the European Union and forwarded to our mailbox. We do not sell or rent personal data, and we never build advertising profiles. If you accepted advertising cookies, the ad click identifier that brought you to the Site is recorded alongside your request, for the single purpose of knowing which of our own campaigns produced it. If you did not, it is not collected at all.
3. Anti-automation measures
Our forms use a proof-of-work challenge executed in your browser, a hidden honeypot field and per-network rate limiting. These measures process technical data (challenge tokens, IP address) solely to detect automated abuse. No third-party CAPTCHA service is used.
4. Processors and recipients
- Transactional email: Brevo (Sendinblue SAS, France) transmits form notifications and newsletters. Data is processed in the European Union.
- Hosting: our servers are located in the European Union; DNS and mailbox services are provided by Infomaniak (Switzerland).
- Analytics and advertising measurement: Google Analytics 4 and Google Ads conversion measurement (Google Ireland Ltd) may be enabled with IP anonymisation and advertising storage denied by default. Google may transfer data outside Switzerland and the EEA under standard contractual clauses.
We do not disclose the identity of subscribers or the content of requests to any other party, except where required by law.
5. Cookies and consent
Nothing that requires consent is loaded before you have made a choice. Analytics and advertising tags start in a denied state through Google Consent Mode and are only activated if you accept them.
- Essential: security, anti-automation, your language preference and the record of your cookie choice. These need no consent because the Site cannot work without them.
- Analytics: Google Analytics 4, with IP anonymisation. Loaded only with your consent.
- Advertising: Google Ads conversion measurement, used to attribute a visit or a request to one of our own campaigns. Loaded only with your consent.
Accepting and refusing are one click each, on the same screen. Your choice, refusals included, is stored for six months so that you are not asked again, and you can change or withdraw it at any time: Change my cookie preferences. You can also block cookies in your browser; the Site remains fully usable.
When you refuse, Google Consent Mode still sends cookieless signals that let us count traffic in aggregate without identifying you or writing anything to your device.
6. International transfers
Where data leaves Switzerland or the EEA (for example to Google), we rely on adequacy decisions or standard contractual clauses recognised by the Swiss Federal Data Protection and Information Commissioner and the European Commission.
7. Your rights
You may request access to, rectification or erasure of your personal data, restriction of or objection to its processing, and portability, and you may withdraw consent at any time. Write to contact@dfensio.com. You may also lodge a complaint with the Swiss Federal Data Protection and Information Commissioner or your local supervisory authority.
8. Security
Data is transmitted over TLS, stored on access-controlled servers, and handled only by personnel bound by confidentiality. Form records are kept in append-only files with restricted permissions and are not exposed through any web interface.
9. Changes
We may update this notice. The date at the top indicates the current version.