Legal
GDPR compliance
Last review: 26 October 2026
This page explains, requirement by requirement, how l45suisse.ch complies with Regulation (EU) 2016/679 (GDPR). L45 Suisse Sagl is based in Switzerland: the GDPR applies when the site is used by people in the European Union or the European Economic Area (art. 3(2)). For simplicity and transparency we apply the same level of protection to every visitor. The resulting notices are the privacy policy, the cookie policy and the legal notice; compliance with Swiss law is described on the FADP page.
In short
The site is static, uses no cookies of its own or tracking tools, loads no third-party resources when pages open and processes a single category of personal data on its own behalf: the technical logs of the requests, recorded by our server in Italy, in the European Union, and by the Cloudflare network that protects and delivers the site. That is why no consent banner, no impact assessment and no data protection officer are needed. Visitors can exercise every right under the GDPR by writing to info@l45suisse.ch.
Requirements and how we meet them
| Requirement | Reference | How we meet it | Status |
|---|---|---|---|
| Territorial scope | Art. 3(2) | Controller based in Switzerland; the GDPR applies to visitors in the EU and EEA and we apply it to everyone. | Compliant |
| Principles: data minimisation, purpose limitation, storage limitation | Art. 5(1) | We process only the technical server logs and the correspondence of people who write to us; no data is collected for future use; data no longer needed is deleted. | Compliant |
| Legal basis | Art. 6(1)(b) and (f) | Legitimate interest in running and securing the site and in answering those who contact us; pre-contractual measures or a contract when a collaboration starts. No processing relies on consent, because we ask for none. | Compliant |
| Information to data subjects | Art. 13 | The privacy policy states the controller and contact details, purposes, legal bases, recipients, transfers, retention periods, rights and supervisory authority. | Compliant |
| Cookies and consent | Directive 2002/58/EC, art. 5(3) | No cookies of our own, no browser storage, no identifiers: there is nothing to ask consent for. The only possible cookie is Cloudflare's security cookie (cf_clearance), which is strictly necessary and therefore exempt from consent. YouTube videos load only after an explicit action by the visitor. | Compliant |
| Rights of the data subject | Art. 12-22 | Access, rectification, erasure, restriction, objection and portability exercisable by email; reply within one month; identity may be verified. | Compliant |
| Processors | Art. 28 | Cloudflare (protection and delivery of the site) and the email provider process data on our behalf, bound by contract; the server hosting the site is run directly by us and no other provider processes data of the site. | Compliant |
| Records of processing activities | Art. 30 | The exemption of paragraph 5 applies (fewer than 250 employees, occasional processing without particular risks). This page nevertheless documents purposes, data categories, recipients, transfers, retention periods and security measures. | Compliant |
| Security of processing | Art. 32 | Technical and organisational measures described in the table below. | Compliant |
| Personal data breaches | Art. 33-34 | Assessment within 72 hours and notification to the supervisory authority when there is a risk to individuals; communication to data subjects if the risk is high. The exposed surface is minimal: no database, no data entered by visitors. | Compliant |
| Data protection by design and by default | Art. 25 | Static architecture without tracking, self-hosted fonts and resources, third-party content loaded only on request: the default setting is to collect nothing. | Compliant |
| Transfers to third countries | Art. 44-46 | The server is in Italy. Cloudflare, Inc. may process request data in the United States and is certified under the EU-U.S. Data Privacy Framework, covered by the Commission's adequacy decision of 10 July 2023 (art. 45). Starting a YouTube video involves processing by Google LLC, at the visitor's request and under the safeguards stated by Google. | Compliant |
| Data protection impact assessment | Art. 35 | Not required: no profiling, no special categories of data, no systematic monitoring. | Not applicable |
| Data protection officer | Art. 37 | Not required: no large-scale monitoring and no large-scale processing of special categories of data. | Not applicable |
| Representative in the European Union | Art. 27 | Exemption of paragraph 2(a): occasional processing, not on a large scale and without special categories of data. | Not applicable |
Technical and organisational measures
| Measure | How it is implemented | Effect on data |
|---|---|---|
| Static site | Pages are generated in advance and served as files: no database, no restricted area, no forms, no accounts. | The site neither receives nor stores data entered by visitors. |
| No cookies of our own and no browser storage | The site sets no cookies of its own and uses no local storage or identifiers; there are no analytics, profiling or advertising tools. Cloudflare may set a security cookie only after an anti-abuse check. | No tracking; no consent banner needed. |
| No third-party resources on page load | Fonts, scripts, images and chapter videos are hosted on our own domain. YouTube videos in the articles load from youtube-nocookie.com only after a click on the preview. | No data sent to third parties until the visitor asks for it. |
| Encrypted transport | HTTPS on every page, with a certificate managed by Cloudflare and HSTS (one year, subdomains included) preventing any fallback to HTTP; an encrypted tunnel between Cloudflare and our server. | Data in transit protected from interception. |
| Security headers | X-Content-Type-Options nosniff, X-Frame-Options SAMEORIGIN, Referrer-Policy strict-origin-when-cross-origin, Permissions-Policy with camera, microphone, geolocation, payments and USB disabled. | Reduces attack surfaces and the leakage of information to other sites. |
| Hosting | Server run directly by us, in Italy, reachable only through Cloudflare's encrypted tunnel (no port open to the internet); administrative access with personal keys and file transfer over an encrypted channel. | Data in the European Union, a country with adequate protection for Switzerland as well. |
| Protection and delivery | Cloudflare, Inc. filters attacks and abuse, including DDoS attacks, and delivers the pages from its data centres; it is certified under the EU-U.S. and Swiss-U.S. Data Privacy Framework. | IP address and technical request data processed on our behalf; transfer to the United States with adequate protection. |
| Server logs | Our server and Cloudflare record IP address, date and time, requested page, referring page and browser type; our server's logs are deleted automatically after about two weeks. | The only personal data processed by the site itself; not used for profiling. |
| Mailboxes protected by authenticated access; correspondence is kept for the time needed by the request or the contractual relationship. | Data of people who write to us stays in our mailboxes and with providers bound by contract. |
What would trigger new obligations
Analytics with cookies or identifiers, a contact form run by an external service, an advertising pixel or tag, a video or font loaded automatically from third-party servers, a newsletter. In each of these cases we will first update this page, the privacy policy and the cookie policy and, where the law requires it, ask for consent.
References
Regulation (EU) 2016/679 (GDPR); Directive 2002/58/EC (ePrivacy), art. 5(3). We review this page at every change of the site and at least once a year; the date at the top shows the last review. Questions: info@l45suisse.ch.