Privacy and data.
This site collects the strict minimum, does not track you and sells nothing it learns. This document describes precisely what is processed, why, by whom and for how long.
Controller
The controller for personal data collected by this site is CIABATTI, sole proprietorship (UID CHE-254.984.262), Mike Ciabatti, c/o Swiss Tower GmbH, Bachstrasse 100, 3920 Zermatt, Switzerland, reachable at hello@ciabatti.ch. Processing is subject to the Swiss Federal Act on Data Protection of 25 September 2020 (FADP) and its implementing ordinance (DPO). Where persons located in the European Union or the European Economic Area use the site, the General Data Protection Regulation (GDPR) may apply in addition; the rights described below are granted to them to the same extent.
Principles
The firm applies the principles of lawfulness, proportionality, purpose limitation and transparency. It collects only the data necessary for the stated purpose, does not use it for other purposes, neither sells nor transfers it, and carries out no profiling. No automated decision is taken on the basis of data processed by this site.
What the site does not do
The site uses no advertising tracker, no social-network pixel and no cookie, first-party or third-party, during public browsing. Fonts and scripts are hosted on the site itself; viewing the pages loads no resource from a third-party service. No third-party videos or maps are embedded. Viewing the site therefore requires no consent and triggers no banner.
Audience measurement without tracking. The site uses its host's audience measurement (Vercel Web Analytics), which counts page views, referring page, country, device and browser type, in aggregate form. It sets no cookie, uses no persistent identifier, does not follow visitors across sites and cannot recognise them from one visit to the next; the IP address is used for the duration of the request to determine the country and is not retained. Legal basis: legitimate interest in knowing the site's traffic.
Data processed and purposes
Contact form. When you use the form, the firm processes your name, your company name if given, your email address, your phone number if given, the content of your message, and the originating IP address and time of sending. This data is used exclusively to reply to your request and, where a first conversation warrants it, to prepare an engagement proposal. The IP address is used only to prevent abusive submissions. Legal basis: the firm's legitimate interest in answering requests addressed to it and, where applicable, the performance of pre-contractual steps at your request.
Acknowledgement. After sending, a confirmation email is sent to you automatically, restating the content of your message. It has no other purpose.
Technical logs. The host records, for each request, the IP address, the page requested, the timestamp, the browser type and the response code. These logs serve security, abuse detection and the operation of the service; they are not used for audience analysis. Legal basis: legitimate interest in the security and proper operation of the site.
Private area. The private area, accessible only to the publisher, sets a signed technical session cookie valid for twelve hours, which is indispensable for authentication. It is not set during public browsing of the site. Login attempts are logged with their IP address to limit brute-force attacks.
Newsletter. The newsletter "Le métier de décider" is distributed on LinkedIn. Subscription takes place on LinkedIn, under the terms and privacy policy of LinkedIn Corporation; the firm collects no data of its own there.
Recipients and processors
Data is not disclosed to any third party for its own purposes. It is processed, on behalf of the firm and on its instructions, by the following providers, bound by data processing agreements in accordance with Article 9 FADP.
Vercel Inc. (Covina, United States): hosting of the site, execution of server functions in the European Union (Frankfurt region) and delivery of static pages through a global content delivery network. Resend (Plus Five Five, Inc., United States): delivery of contact-form emails and acknowledgements, with processing in the European Union. GitHub, Inc. (Microsoft, United States): hosting of the source code and of published documents; no visitor personal data is stored there.
Transfers abroad
The providers above are established in the United States. Transfers of personal data to that country rest, depending on the provider, on their certification under the Swiss-U.S. Data Privacy Framework, recognised by the Federal Council as providing an adequate level of protection, or on the standard contractual clauses adopted by the Federal Data Protection and Information Commissioner, in accordance with Article 16 FADP. Contact-form data is in practice processed and stored in the European Union; its passage through servers outside Europe is limited to what routing requires.
Retention periods
Messages received through the form are kept in the firm's mailbox for as long as needed to handle the request, then for at most twelve months after the last exchange where no engagement results. Where an engagement is concluded, the exchanges are kept with the engagement file for its duration, then for ten years under the retention obligations of Swiss commercial law (Art. 958f CO). The host's technical logs are kept for at most thirty days. Logs of login attempts to the private area are deleted after fifteen minutes.
Security
The site is served exclusively over HTTPS with HSTS. A strict content security policy prohibits the execution of third-party scripts. Form submissions are rate-limited per IP address, protected by a honeypot and validated server-side. Access to the private area is protected by a username, a password, attempt limiting and a signed session cookie. Engagement working documents do not pass through this site.
Your rights
You have the right to obtain access to the data concerning you (Art. 25 FADP), to request its rectification or erasure, to object to its processing, to restrict its use and to obtain its delivery or transfer to a third party in a common electronic format (Art. 28 FADP). You may exercise these rights by email to hello@ciabatti.ch; a reply is sent within thirty days, free of charge, subject to the exceptions provided by law. You also have the right to lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, or, if you reside in the European Union, with the supervisory authority of your country.
Confidentiality of engagements
This document governs the site. Data processed in the course of an advisory engagement is governed by the confidentiality clause of the accepted proposal, which prevails. The firm cites no engagement and names no client, on this site or elsewhere.
Changes
This policy may be adapted as the site, its providers or the law evolve. The version in force is the one published on this page; the date of the last update appears below.
Last updated: September 2026.