Legal
Swiss FADP compliance
Last review: 26 October 2026
This page explains, requirement by requirement, how l45suisse.ch complies with the Swiss Federal Act on Data Protection (FADP, SR 235.1), in force since 1 September 2023, and its ordinance (DPO, SR 235.11). L45 Suisse Sagl is the controller, based in Lugano. The resulting notices are the privacy policy, the cookie policy and the legal notice; for visitors from the European Union the GDPR page applies as well.
In short
The site is static, uses no cookies of its own or tracking tools, profiles nobody and processes a single category of personal data on its own behalf, the technical logs of the requests. The server is in Italy and the site is delivered by Cloudflare, Inc., a US company certified under the Swiss-U.S. Data Privacy Framework: Italy and certified US companies are both on the Federal Council's list of countries with adequate protection. The rights granted by the FADP can be exercised by writing to info@l45suisse.ch, with a reply within 30 days.
Requirements and how we meet them
| Requirement | Reference | How we meet it | Status |
|---|---|---|---|
| Controller | Art. 5(j) FADP | L45 Suisse Sagl, Via Carlo Maderno 18, 6900 Lugano, UID CHE-246.385.183, identified in the privacy policy and in the legal notice. | Compliant |
| Principles: lawfulness, good faith, proportionality, purpose limitation, accuracy | Art. 6 FADP | We process only the technical logs and the correspondence of people who write to us, for stated and recognisable purposes; no data beyond what is necessary. | Compliant |
| Data protection by design and by default | Art. 7 FADP | Static site without tracking, self-hosted resources, third-party content only on request: by default nothing is collected. | Compliant |
| Data security | Art. 8 FADP; art. 1-6 DPO | Technical and organisational measures described in the table below, proportionate to the risk, which is low. | Compliant |
| Data protection adviser | Art. 10 FADP | Optional for private controllers; not appointed. The contact for every request is info@l45suisse.ch. | Not applicable |
| Record of processing activities | Art. 12 FADP; art. 24 DPO | Exemption for companies with fewer than 250 employees whose processing involves a low risk. This page nevertheless documents purposes, data categories, recipients, destination countries, retention and measures. | Compliant |
| Representative in Switzerland | Art. 14 FADP | Not needed: the controller is based in Switzerland. | Not applicable |
| Disclosure of personal data abroad | Art. 16-17 FADP; Annex 1 DPO | The server is in Italy, a country with an adequate level of protection according to the Federal Council's list. Cloudflare, Inc. (United States) is certified under the Swiss-U.S. Data Privacy Framework: since 15 September 2024 certified US companies are on the same list. No additional safeguards are needed. Starting a YouTube video involves processing by Google LLC at the visitor's request. | Compliant |
| Duty to inform | Art. 19-21 FADP; art. 13 DPO | The privacy policy states the identity and contact details of the controller, the purposes, the recipients and the destination countries, easily accessible from every page. | Compliant |
| Profiling and automated individual decisions | Art. 5(f) and (g), art. 21 FADP | No profiling and no automated decisions. | Not applicable |
| Notification of data security breaches | Art. 24 FADP; art. 15 DPO | Prompt assessment and notification to the FDPIC when the breach is likely to involve a high risk for individuals; information to the data subjects when needed for their protection. | Compliant |
| Right of access | Art. 25-27 FADP; art. 16-19 DPO | Free reply within 30 days, by email, with the information required by law; identity may be verified. | Compliant |
| Right to data portability | Art. 28-29 FADP; art. 20-22 DPO | Data provided by the data subject is delivered in a common electronic format or transmitted to another controller on request. | Compliant |
| Cookies and tracking techniques | Art. 45c TCA | No cookies of our own and no identifiers; the only possible cookie, Cloudflare's security cookie, is described in the cookie policy, which guarantees information and the possibility to refuse. | Compliant |
| Identification of the site operator | Art. 3(1)(s) UCA | Legal notice with company name, registered office, email address and UID. | Compliant |
Technical and organisational measures
| Measure | How it is implemented | Effect on data |
|---|---|---|
| Static site | Pages are generated in advance and served as files: no database, no restricted area, no forms, no accounts. | The site neither receives nor stores data entered by visitors. |
| No cookies of our own and no browser storage | The site sets no cookies of its own and uses no local storage or identifiers; there are no analytics, profiling or advertising tools. Cloudflare may set a security cookie only after an anti-abuse check. | No tracking; no consent banner needed. |
| No third-party resources on page load | Fonts, scripts, images and chapter videos are hosted on our own domain. YouTube videos in the articles load from youtube-nocookie.com only after a click on the preview. | No data sent to third parties until the visitor asks for it. |
| Encrypted transport | HTTPS on every page, with a certificate managed by Cloudflare and HSTS (one year, subdomains included) preventing any fallback to HTTP; an encrypted tunnel between Cloudflare and our server. | Data in transit protected from interception. |
| Security headers | X-Content-Type-Options nosniff, X-Frame-Options SAMEORIGIN, Referrer-Policy strict-origin-when-cross-origin, Permissions-Policy with camera, microphone, geolocation, payments and USB disabled. | Reduces attack surfaces and the leakage of information to other sites. |
| Hosting | Server run directly by us, in Italy, reachable only through Cloudflare's encrypted tunnel (no port open to the internet); administrative access with personal keys and file transfer over an encrypted channel. | Data in the European Union, a country with adequate protection for Switzerland as well. |
| Protection and delivery | Cloudflare, Inc. filters attacks and abuse, including DDoS attacks, and delivers the pages from its data centres; it is certified under the EU-U.S. and Swiss-U.S. Data Privacy Framework. | IP address and technical request data processed on our behalf; transfer to the United States with adequate protection. |
| Server logs | Our server and Cloudflare record IP address, date and time, requested page, referring page and browser type; our server's logs are deleted automatically after about two weeks. | The only personal data processed by the site itself; not used for profiling. |
| Mailboxes protected by authenticated access; correspondence is kept for the time needed by the request or the contractual relationship. | Data of people who write to us stays in our mailboxes and with providers bound by contract. |
What would trigger new obligations
Analytics with cookies or identifiers, a contact form run by an external service, an advertising pixel or tag, a video or font loaded automatically from third-party servers, a newsletter, or a provider with servers outside the countries recognised as adequate. In each of these cases we will first update this page, the privacy policy and the cookie policy and adopt the safeguards required by law.
References
Federal Act on Data Protection (FADP, SR 235.1); Data Protection Ordinance (DPO, SR 235.11); Federal Data Protection and Information Commissioner (FDPIC). We review this page at every change of the site and at least once a year; the date at the top shows the last review. Questions: info@l45suisse.ch.