Privacy Policy
Short version, without the legalese: this website sets no cookies, uses no personal tracking, has no forms and sells no data. What does occur are server logs at the host and a cookieless visitor count. Fonts and images are served from our own server. Everything else is set out below.
The controller is ODCUS AG, Grabenstrasse 15a, 6340 Baar, Switzerland.
1. Controller
The controller for the processing of personal data on this website within the meaning of the Swiss Federal Act on Data Protection (FADP, revised version in force since 1 September 2023) and, where applicable, the EU General Data Protection Regulation (GDPR) is:
- Controller
- ODCUS AG, Grabenstrasse 15a, 6340 Baar, Switzerland
- UID
- CHE-316.886.794
- info@odcus.com
- Phone
- +41 43 217 86 70
We have not appointed a data protection adviser; as a private company we are not required to do so under Art. 10 FADP. The address above is responsible for all data protection matters.
2. Scope
This privacy policy applies to the website m365-soc.com including all subpages and the blog. The privacy policies published there apply to odcus.com and other ODCUS AG offerings. Processing of client data under a mandate is governed by the respective contract and its data processing agreement.
3. What data we process, and why
3.1 Server log files (hosting at Netlify)
This is a static website hosted by Netlify, Inc. (San Francisco, USA). When a page is requested, Netlify processes technical access data in server log files:
- IP address of the requesting device
- date and time of access
- URL requested and volume of data transferred
- browser type, browser version and operating system
- referrer URL, where transmitted
This data is technically necessary to deliver the website and to ensure stability, availability and security (for example to fend off attacks). We do not evaluate it on a personal level and do not combine it with other data.
Legal basis: legitimate interest in the secure and reliable operation of the website
(Art. 31(1) FADP, Art. 6(1)(f) GDPR).
Processing agreement: Netlify processes the data on our behalf on the basis of the
standard contractual clauses.
Privacy policy:
netlify.com/privacy
3.2 Audience measurement (Plausible Analytics)
For visitor statistics we use Plausible Analytics only (Plausible Insights OÜ, Tallinn, Estonia). Plausible is a cookieless analytics solution:
- No cookies are set and nothing is stored on your device.
- No IP address is stored; it is used only transiently to compute a daily rotating, non-reversible counting value.
- No user profiles are created and there is no cross-device or cross-site tracking.
- Data is processed and stored on servers within the European Union.
What is recorded are aggregated metrics such as pages viewed, page views, approximate region of origin
(country), device category, browser and referrer. In our assessment this does not permit identification of
an individual. The analytics script itself is loaded from plausible.io; for technical reasons
your IP address is transmitted to Plausible in that request, but it is not stored.
Legal basis: legitimate interest in statistical evaluation of website use to improve our
offering (Art. 31(1) FADP, Art. 6(1)(f) GDPR). Because no information is stored on or read from your
device, no consent is required.
Privacy policy:
plausible.io/privacy ·
data policy
3.3 Fonts and images
All typefaces (Public Sans and Titillium Web) as well as all images, logos and icons are served from our own server. This website embeds no external font service, in particular no Google Fonts, and loads no content from third-party content delivery networks. Opening a page therefore establishes no connection to Google or any other third party and transmits no IP address to one.
The typefaces are licensed under the SIL Open Font License 1.1 and are held as a copy in our hosting. This is additionally enforced technically by a Content Security Policy that permits fonts and images only from our own domain.
3.4 Contact by email or phone
This website contains no contact form. If you contact us by email or phone, we process the details you provide: name, email address, phone number, company and the content of your enquiry. We use these details solely to answer your enquiry and to prepare possible collaboration. Our business email runs on Microsoft 365 (Microsoft Ireland Operations Limited) with data residency in the EU.
Legal basis: performance of pre-contractual measures or contract performance (Art. 31(2)(a) FADP, Art. 6(1)(b) GDPR) and legitimate interest in answering enquiries.
3.5 Appointment booking (Microsoft Bookings)
The buttons for an introductory call link to the external "Book with me" page of Microsoft Outlook
(outlook.office.com; Microsoft Ireland Operations Limited / Microsoft Corporation). The
booking page is not embedded in this website. Your details (name, email address,
preferred slot, any message) are collected only at that point and exclusively on Microsoft's pages. We
subsequently receive the booking details in our calendar.
Legal basis: performance of pre-contractual measures (Art. 31(2)(a) FADP,
Art. 6(1)(b) GDPR).
Privacy statement:
privacy.microsoft.com
3.6 Links to third-party websites
This website contains outbound links, among others to:
- odcus.com – website of the parent company ODCUS AG
- occasional external sources cited in blog posts
Clicking such a link takes you off this website. We have no influence over the data processing carried out by the operators of those pages. Cookies may be set and data collected only there. Their respective privacy policies apply.
4. What we explicitly do not do
- We set no cookies and store nothing in local storage or session storage (see the cookie policy).
- We run no advertising, retargeting or conversion tracking and embed no pixels from Google Ads, Meta, LinkedIn or similar providers.
- We create no user profiles and make no automated individual decisions within the meaning of Art. 21 FADP or Art. 22 GDPR, including profiling.
- We do not sell, rent or trade data.
- This website addresses businesses. We knowingly collect no data from children.
- We process no sensitive personal data within the meaning of Art. 5(c) FADP through this website.
- We embed no external fonts, images, videos, maps or chat widgets. Apart from the Plausible analytics script, nothing is loaded from third-party servers.
5. Retention periods
| Data category | Retention |
|---|---|
| Server log files (Netlify) | Short-term at the host; we do not access them routinely |
| Aggregated statistics (Plausible) | As an anonymous metric without personal reference, for as long as it is useful for operations |
| Email correspondence about enquiries | Until the enquiry is resolved, thereafter within statutory retention obligations |
| Contract and invoice records | 10 years under Art. 958f of the Swiss Code of Obligations |
After that the data is deleted or irreversibly anonymised.
6. Recipients and disclosure abroad
We pass on personal data only to the extent necessary to operate the website and to answer your enquiry. The service providers involved:
| Service | Provider | Purpose | Data | Location |
|---|---|---|---|---|
| Netlify | Netlify, Inc., USA | Hosting, delivery | Server logs, IP address | USA / global |
| Plausible Analytics | Plausible Insights OÜ, EE | Cookieless statistics | Aggregated metrics | EU |
| Microsoft 365 | Microsoft Ireland Operations Ltd. | Email, calendar, booking | Contact and appointment details | EU |
In addition, personal data may be disclosed to authorities and courts where we are legally obliged to do so, and to our professional advisers (fiduciary, audit, legal counsel), who are themselves bound by confidentiality.
For disclosures to countries without adequate data protection under Annex 1 of the Swiss Data Protection Ordinance (notably the USA outside the Data Privacy Framework) we rely on the standard contractual clauses approved by the European Commission and recognised by the FDPIC. We point out that despite these safeguards there is a risk of access by authorities in the recipient country and that enforcement of data subject rights there may be more difficult.
7. Data security
The website is delivered exclusively over HTTPS and enforces encrypted connections
(HSTS). We additionally use security-relevant HTTP headers, including a Content Security Policy,
X-Content-Type-Options, Referrer-Policy and Permissions-Policy. The
website is static: there is no database, no content management system and no server-side application logic
that could be attacked.
Internally we protect personal data with appropriate technical and organisational measures and adapt them continuously to the state of the art. However, no one can guarantee complete security in transmission over the internet.
8. Your rights
Within the scope of applicable law you have the following rights. To exercise them, contact info@odcus.com. We may verify your identity before providing information.
- Access to whether and which personal data we process about you (Art. 25 FADP, Art. 15 GDPR).
- Rectification of inaccurate data (Art. 32 FADP, Art. 16 GDPR).
- Erasure or destruction, unless a statutory retention obligation stands in the way (Art. 32 FADP, Art. 17 GDPR).
- Restriction of processing (Art. 18 GDPR).
- Data portability in a common electronic format (Art. 28 FADP, Art. 20 GDPR).
- Objection to processing based on legitimate interest (Art. 30(2) FADP, Art. 21 GDPR).
- Withdrawal of consent with effect for the future, where you have given consent.
Exercising these rights is generally free of charge. We normally respond within 30 days.
9. Supervisory authorities
If you believe we are infringing data protection law, you can lodge a complaint with:
- Switzerland: Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, edoeb.admin.ch
- EU/EEA: the supervisory authority of your place of residence or work. Overview: edpb.europa.eu
We would appreciate it if you came to us first. That is usually faster.
10. Changes to this privacy policy
We adapt this privacy policy when our data processing or the legal situation changes. The version published on this page is the authoritative one. Last updated: 1 September 2026.
11. Contact
ODCUS AG
Grabenstrasse 15a
6340 Baar, Switzerland
info@odcus.com · +41 43 217 86 70