Privacy Policy

Version of the document: April 2026

1. Data protection

This privacy policy ("Privacy Policy") applies to the websites of VSHN AG, which are available under the domains vshn.ch, servala.com, appuio.ch, codey.ch, and various product and service landing pages operated by VSHN (hereinafter collectively referred to as the "Websites"). We are committed to the protection of your personal data, and treat your personal data confidentially, and in compliance with the Swiss Federal Act on Data Protection (nDSG/FADP), the EU General Data Protection Regulation (GDPR) where applicable, and this Privacy Policy.

This Privacy Policy informs you of our practices regarding the collection, use and disclosure of personal data when you use our Websites, and the choices you have associated with that data. By accessing the Websites, you ("User", "you", "your" or "yours") agree to the collection, usage, and disclosure of information in accordance with this Privacy Policy.

2. About us

2.1. Name and address of the controller

The controller within the meaning of the applicable data protection regulations is:

VSHN AG
Neugasse 10
8005 Zürich
Schweiz

2.2. Name and address of the data protection officer

The data protection officer responsible for processing is:

Patrick Mathers
VSHN AG
Neugasse 10
8005 Zürich
Schweiz

E-Mail: datenschutz@vshn.ch

Every data subject may contact our data protection officer directly at any time in case of questions or suggestions regarding data protection.

3. Personal data we collect

It is generally possible to browse our Websites without entering any personal data. You may actively provide us with your contact details (e.g. name, address, or email address) (see Section 4 for an overview of how we collect personal data).

Personal data that is collected when using our web pages is limited, as far as possible, to that which is provided voluntarily. This data is not shared with third parties without your express permission.

4. How we collect personal data

We collect information about you when you undertake certain actions on our Websites.

4.1. Contact form

If you send us an inquiry via a contact form on any of our Websites, the details that you enter (name, email address, phone number, company, role, subject, and message) will be stored in our customer relationship management system (CRM) in order to process your inquiry, manage our business relationship, and for follow-up questions. We do not share this data without your consent.

When you submit a contact form, we additionally collect:

  • UTM parameters and referrer URL: If you arrived via an advertising link, we store the campaign source, medium, and campaign name alongside your inquiry to measure advertising effectiveness. We also store the referring website URL.

  • Geolocation: We use your IP address to derive your approximate geographic location (country, region, city) via a third-party geolocation service (ipinfo.io). We store only the derived location, not your IP address. The IP address is used transiently for the lookup and is not persisted.

4.2. Booking a meeting

If you book a meeting via our scheduling tool (SimplyMeet.me), your name and email address are transmitted to us and stored in our CRM. If you arrived via an advertising link, the booking is attributed to the advertising campaign for measurement purposes.

4.3. Newsletter data

If you wish to subscribe to our newsletter, we require that you submit an email address as well as information that allows us to confirm that you are the owner of the email address provided and that you consent to receiving the newsletter. We do not collect any further data. We use this data exclusively to send the requested information and do not share it with third parties. You can, at any time, withdraw your consent to the saving of your data and email address, as well as its use to deliver the newsletter – for instance, via the 'Unsubscribe' link in the newsletter.

4.4. Advertising and remarketing

We use advertising platforms (Google Ads, LinkedIn) to reach potential and existing customers with relevant B2B advertising. This involves the following data processing:

  • Website retargeting: We use the LinkedIn Insight Tag and Google Ads tracking to identify visitors to our Websites and show them relevant advertising on these platforms. The tracking works through cookies and tracking pixels that are only activated with your consent (see Cookie Policy below).

  • Matched audiences: We may upload pseudonymised identifiers (email addresses hashed with SHA-256) derived from our existing business relationships to advertising platforms. This serves two purposes: (1) to show relevant advertising to professionals at organisations we already work with, and (2) to exclude existing customers from acquisition campaigns so they do not see irrelevant advertisements. The advertising platform cannot read the original email addresses. You can opt out of personalised advertising via your LinkedIn ad preferences or Google ad settings.

  • Company-level targeting: We may upload company names from our business relationships to advertising platforms for account-based marketing. Company names are not personal data.

  • Conversion tracking: When you click on one of our advertisements and subsequently fill out a contact form or book a meeting, we report this conversion event (with hashed email address) back to the advertising platform that served the ad. This helps us measure advertising effectiveness and optimise our campaigns.

5. Legal basis and purposes

Our legal basis for collecting and using the personal data described in this Privacy Policy depends on the personal data we collect and the specific purposes for which we collect it.

Contract: To perform our contractual obligations or take steps linked to a contract with you for the following purposes:

  • To deliver our services.

  • To provide you with customer support.

Consent: We may rely on your freely given consent at the time you provided your personal data for the following purposes:

  • To provide you with news, special offers, newsletters, and general information about goods and services which we offer (with your explicit consent).

  • To set advertising and analytics cookies (Google Analytics, Google Ads, LinkedIn Insight Tag) when you accept cookies via our cookie consent banner.

Legitimate interests: We may rely on legitimate interests based on our evaluation that the processing is fair and reasonable for the following purposes:

  • To provide and maintain our Websites, as well as to detect, prevent and address security threats.

  • To analyse, improve, personalise, and monitor the usage of our Websites and communications.

  • To create matched audiences on advertising platforms using pseudonymised identifiers derived from existing business relationships, for the purpose of serving relevant B2B advertising to organisations we have an existing commercial relationship with.

  • To measure advertising effectiveness through conversion tracking.

Public interest: To meet regulatory and public interest obligations for the following purposes:

  • To maintain records in accordance with applicable regulation and legislation.

6. Data storage and retention

We retain your personal data only for as long as is necessary for the purposes set out in this Privacy Policy, and to the extent necessary to comply with our legal obligations, resolve potential disputes and enforce our legal agreements and policies.

Customer data (contact form submissions, meeting bookings, CRM records) is stored in VSHN’s self-hosted CRM system on VSHN-managed infrastructure in Switzerland. No third-party CRM provider has access to this data.

7. Service providers and data transfers

We may employ third party companies ("Service Providers") to facilitate the operation of our Websites or perform related services. These third parties have access to your personal data only and insofar as necessary to perform these tasks on our behalf, and are required to safeguard it in accordance with our contractual obligations and applicable data protection legislation.

The following Service Providers are currently used:

  • Plausible Analytics (EU) — Privacy-focused website analytics. Does not use cookies or collect personal data. Data is processed in the EU.

  • Google LLC (USA) — Google Analytics 4 for website analytics and Google Ads for advertising and conversion tracking. Data processing is governed by Google’s data processing terms and the EU-US Data Privacy Framework.

  • LinkedIn Corporation (USA) — LinkedIn Insight Tag for website retargeting and audience matching. LinkedIn Ads for B2B advertising. Data processing is governed by LinkedIn’s data processing agreement and Standard Contractual Clauses.

  • ipinfo.io (USA) — IP-based geolocation lookup. IP addresses are sent transiently for the lookup; only the derived location (country, region, city) is stored by VSHN.

  • SimplyMeet.me (SimplyBook.me Ltd., EU) — Meeting scheduling. Name and email address are shared when you book a meeting. Data is processed in the EU.

For transfers to Service Providers outside the European Economic Area and Switzerland, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs), the EU-US Data Privacy Framework, or other mechanisms recognised by the Swiss Federal Data Protection and Information Commissioner.

8. Data disclosure

We may disclose your personal data in the good faith belief that such action is necessary to:

  • To comply with a legal obligation (i.e. if required by law or in response to valid requests by public authorities, such as a court or government agency);

  • To protect the security of the Websites and defend our rights or property;

  • To prevent or investigate possible wrongdoing in connection with VSHN;

  • To protect ourselves against legal liability.

9. Data security

We take reasonable technical and organizational security measures that we deem appropriate in order to protect your stored data against manipulation, loss, or unauthorized third-party access. Our security measures are continually adapted to technological developments.

We also take internal data privacy very seriously. Our employees and the Service Providers that we retain are required to maintain secrecy and to comply with applicable data protection legislation. In addition, they are granted access to personal data only insofar as this is necessary for them to carry out their respective tasks or mandate.

The security of your personal data is important to us but remember that no method of transmission over the Internet or method of electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your personal data, we cannot guarantee its absolute security. We recommend that you use antivirus software, a firewall, and other similar software to protect your system.

10. Data protection rights

Depending on your country of residence, you may have the below data protection rights. To exercise any of these rights, please contact us at datenschutz@vshn.ch. We may ask you to verify your identity before responding to such requests.

10.1. Right to access

You have a right to request a copy of your personal data, which we will provide to you in electronic form.

10.2. Right to amendment

You have the right to ask us to correct our records if you believe they contain incorrect or incomplete information about you.

10.3. Right to withdraw consent

If you have provided your consent to the collection, processing, and transfer of your personal data, you have the right to fully or partly withdraw your consent. This includes cases where you wish to opt out from marketing communications.

Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose(s) to which you originally consented unless there is another legal basis for processing. To stop receiving emails from us, please click on the 'unsubscribe' link in the email you received from us.

10.4. Right to erasure

You have the right to request that we delete your personal data when it is no longer necessary for the purposes for which it was collected, or when it was unlawfully processed.

10.5. Right to restriction of processing

You have the right to request the restriction of our processing of your personal data where you believe that the personal data is inaccurate or that our processing is unlawful.

10.6. Right to portability

You have the right to request that we transmit your personal data to another data controller in a common format such as Excel, where this is data which you have provided to us and where we are processing it on the legal basis of your consent or in order to perform our contractual obligations.

10.7. Right to object to processing

Where the legal basis for our processing of your personal data is our legitimate interest, you have the right to object to such processing on grounds relating to your particular situation. We will abide by your request unless we have a compelling legal basis for the processing which overrides your interests, or if we need to continue to process the personal data for the exercise or defence of a legal claim.

10.8. Right to lodge a complaint with a supervisory authority

You have the right of appeal to a data protection supervisory authority if you believe that the processing of your personal data violates data protection law. The competent data protection authority in Switzerland is the Federal Data Protection and Information Commissioner (www.edoeb.admin.ch/edoeb/en/home.html).

11. Links to third-party sites

Our Websites may contain links to sites or apps that are not operated by us. If you click a third-party link, you will be directed to that third party’s site or app. We have no control over and assume no responsibility for the content, privacy policies or practices of any third-party sites or services.

12. Cookie policy

Our Websites use 'cookies'. Cookies do not damage your computer and do not contain viruses. Cookies help render our service more user-friendly, more effective, and more secure. Cookies are small text files that are stored on your computer and saved by your browser.

Our Websites display a cookie consent banner on your first visit. Advertising and tracking cookies (Google Analytics, Google Ads, LinkedIn Insight Tag) are only activated when you explicitly accept cookies. Analytics (Plausible) does not use cookies.

You can adjust your browser settings such that you are informed when cookies are saved and only allow cookies under particular circumstances, block cookies entirely or under particular circumstances, or make sure that cookies are deleted when you close your browser. Deactivating cookies may restrict the functionality of our Websites.

12.1. Server log files

The hosting provider automatically collects and stores information in 'server log files', which your browser automatically transmits to us. This information includes:

  • Browser type and version

  • Operating system

  • Referrer URL

  • Host name of the accessing computer

  • Time the server request was made

This data cannot be associated with a particular individual. We reserve the right to check this data retrospectively if we receive evidence of unlawful use.

12.2. Plausible Analytics

Our Websites use Plausible Analytics, a privacy-focused analytics service that does not use cookies, does not collect personal data, and does not track individual users across sessions. All analytics data is processed in the EU. For more information, see plausible.io/privacy-focused-web-analytics.

12.3. Google Analytics and Google Ads

Our Websites use Google Analytics 4 (GA4) to analyse website usage and Google Ads conversion tracking to measure the effectiveness of our advertising campaigns. Both services are provided by Google LLC and use the same tracking tag (gtag.js).

Google Analytics collects anonymised usage data including pages visited, time on site, and device information. When you click on a Google advertisement and visit one of our Websites, a temporary identifier may be stored (via localStorage) to attribute your visit to the advertisement. If you subsequently fill out a contact form or book a meeting, the conversion event is reported to Google Ads with a hashed version of your email address.

Google Analytics and Google Ads tracking are only activated when you accept cookies via our cookie consent banner. You can opt out of personalised advertising via Google ad settings and install the Google Analytics opt-out browser add-on. For more information, see policies.google.com/privacy.

12.4. LinkedIn Insight Tag

Our Websites use the LinkedIn Insight Tag, a lightweight JavaScript tag that enables website retargeting, conversion tracking, and anonymous website demographics. The Insight Tag is only activated when you accept cookies via our cookie consent banner. It creates a unique session identifier and records page visits, which LinkedIn uses to build retargeting audiences (groups of visitors who visited specific pages). You can opt out of LinkedIn advertising via LinkedIn ad preferences. For more information, see www.linkedin.com/legal/privacy-policy.

13. Personal data brokered from third parties

Users can choose to create a VSHN account by signing up with their existing Google, GitHub, Microsoft or Switch edu-ID account.

If they do so, we’ll query the respective third party (Google, GitHub, Microsoft or Switch edu-ID) for the user’s email address and full name in order to pre-fill the account creation form.

For GitHub, we additionally also query the user’s GitHub username.

If the user completes the sign up process, their full name, email address and user name are stored as part of their VSHN account details.

When there’s a failure in this process, the user’s name or email address may be logged in the IdP logs.

The user’s full name and email address may be accessed by services operated by VSHN when the user signs in to such a service using their VSHN account.

14. Changes

We expressly reserve the right to change this data protection policy at any time. If any such alterations are made, they will be published on our Websites immediately. It is your responsibility to remain informed of the latest version of this data protection policy. We therefore recommend that you consult this data protection policy on a regular basis.