As of August 18, 2026

1. General

1.1 Responsible bodies

The controllers pursuant to Art. 5 lit. j of the Federal Act on Data Protection (DSG) are:

Netstream AG
Richtistrasse 2, 8304 Wallisellen, Switzerland

Netstream Cloud AG
Auenstrasse 10, 8600 Dübendorf, Switzerland

Legal representative: Alexis Caceda

This privacy policy applies to Netstream AG as well as Netstream Cloud AG.

Contact:netstream

1.2 Scope

This privacy policy provides information about the processing of personal data:

• on our website netstream
• as part of all Netstreamservices
• within the framework of our business relationships with customers, prospective customers and suppliers
• in our social media profiles
• as part of application procedures

1.3 Terms

Personal data: All information relating to an identified or identifiable natural person (Art. 5 lit. a GDPR).

Processing: Any handling of personal data, regardless of the means and procedures used, in particular the acquisition, storage, use, modification, disclosure, archiving, deletion or destruction of data (Art. 5 lit. d GDPR).

Controller: The private individual or federal body that, alone or together with others, decides on the purpose and means of processing (Art. 5 lit. j DSG).

Processorag: A private person or a federal body that processes personal data on behalfag controller (Art. 5 lit. k DSG).

2. Rights of the data subjects

2.1 Your rights

Affected persons have the following rights vis-à-vis us:

• Right to information (Art. 25 GDPR): You have the right to know whether and which personal data we process about you.
• Right to rectification (Art. 32 para. 1 GDPR): You can request the rectification of inaccurate personal data.
• Right to erasure: You can request the erasure of your personal data, provided that there are no legal retention obligations to the contrary.
• Right to dataag(Art. 28 GDPR): to another controllerag.
• Right to object: You can object to the processing of your personal data at any time, especially if the processing is for direct marketing purposes.

2.2 Enforcement

To exercise your rights, please contact us using the contact details provided in section 1.1. We reserve the right to verify the identity of theagperson.

2.3 Right to lodge a complaint with the FDPIC

You have the right to lodge a complaint with the Federal Data Protection and Informationag(FDPIC):

Federal Data Protection and Informationag(FDPIC)
Feldeggweg 1, 3003 Bern
www.edoeb.admin.ch

3. Website netstream

3.1 Server log files

When you use our website for informational purposes only, i.e., when you do not explicitly provide us with information, we collect the personal data that your browser transmits to our server. This serves to ensure the stability and IT security of our website.

The following data will be collected:

• IP address
• Date and time of theag
• Time zone difference to Greenwich Mean Time (GMT)
• Content of theag(specific page)
• Access status and HTTP status code
• amount of dataagin each case
• Website from which theagoriginates (referrer)
• Browser, operating system and its interface
• Language and version of the browser software

This data is stored in log files. We host our website ourselves.

3.2 Cookies and Consent

Through our website, we process data on external devices using telecommunicationsag. We use cookies for this purpose, which are divided into the following categories:

• Necessary cookies: Required for the technical operation of the website.
• Statistics cookies: These allow us to analyze website usage.
• Marketing cookies: Used for personalized advertising and conversion tracking.

Visitors can refuse processing or manage their consent via the cookie banner, for example by making appropriate settings in their browser and thus blocking or deleting cookies.

3.3 Analysis Tools

Google
provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
Data location: USA

Services: Google Analytics for analyzing website usage behavior, Googleagagfor managing websiteagand tracking codes.

Microsoft
provider: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland.
Data location: USA

Service: Microsoft Clarity for analyzing user behavior with heatmaps and session recordings.

HubSpot
provider: HubSpot Germany GmbH, Am Postbahnhof 17, 10243 Berlin, Germany.
Data location: EU

Service: HubSpot tracking code for website analytics, lead tracking, and behavioral analysis.

3.4 Marketing Tools

Google, data location USA. Services: Google Marketing Platform for advertising campaignsagremarketing, Google Conversion Tagag measuring advertising success, Google reCAPTCHA for form abuse protection. Google has acted as the data processor for reCAPTCHA since April 2,ag.

LinkedIn
provider: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland.
Data location: EU

Service: LinkedIn Ads and Insightag for advertisingagand conversion tracking.

3.5 Contact forms, calculator and live chat

When you contact us via the contact form on our website, we process the dataagand the content of your message in order to handle yourag. Website visitors can also book appointments through our website.

HubSpot, data location EU. Service: HubSpot LiveChat for real-time communication with website visitors.

ConvertCalculator
provider: ConvertCalculator, Hoeveneind 60, 4847 NG Teteringen, Netherlands.
Data location: EU

Service: ConvertCalculator for interactive calculators and configurators on our website, including the information entered.

3.6 Embedded content

Google, data location USA. Services: YouTube videos for embedding video content, Google Webfonts for providing fonts.

Weglot
provider: Weglot SAS, 138 rue Pierre Joigneaux, 92270 Bois-Colombes, France.
Data location: EU

Service: Guidance for translating website content.

3.7 WordPress Plugins and Technical Services

Defiant (Wordfence), 1700 Westlake Ave N Ste 200, Seattle, WA 98109, USA. Data location: USA. Service: Wordfence as a security plugin to protect the website.

4. Netstreamservices

In the course of our business activities, particularly for providing our services in the areas of streaming, Cloud and IT services, as well as for managing customer relationships, we use third-party services. These providers are recipients of personal data within the scope of the processing described below.

The following list is organized by provider. For each provider, the products used, the purpose of processing, the data subjects affected, and the data location are listed. This list is not exhaustive.

Item.	Provider	Services	Data location	Affected persons
4.1	Microsoft Ireland Operations Limited	Microsoft 365	EU	Customers, users, third parties
4.2	Atlassian Pty Ltd	Jira, Confluence	EU	Customers, prospects, users, third parties
4.3	Slack Technologies Limited	Slack	EU	Customers
4.4	HubSpot Germany GmbH	Marketing, Sales, Service, Content, Data and Commerce Hub	EU	Customers, prospects
4.5	Skribble AG	Electronic signatures	Switzerland	Customers, prospects
4.6	Fyxer AI Limited	Fyxer.ai	Great Britain	Customers, prospects, third parties
4.7	Cloudian Inc.	Cloudian S3	Own servers Switzerland	Customers, users
4.8	VMware by Broadcom	VMware	Own servers Switzerland	Customers, users
4.9	Rubrik, Inc.	category	Own servers Switzerland	Customers, users
4.10	Acronis International GmbH	Acronis Cyber ​​Protect Cloud	Own servers Switzerland	Customers, users
4.11	Scalstrom AB	Streaming platform component	Own servers Switzerland	Customers, users
4.12	bexio AG	bexio	Switzerland	Customers
4.13	SME Trexpert AG	Trexpert	Switzerland	Customers
4.14	Stripe Inc.	Stripe	USA	Customers
4.15	Swiss Post AG	ePost	Switzerland	Customers
4.16	TELAG AG	Telephone service with call answering and ticket creation	Switzerland	Customers, prospects
4.17	Ascio Technologies	Domain registration and management	EU	Customers
4.18	Loom, Inc.	Creation and distribution of videos, including recipient view and playback data	EU	Customers, prospects
4.19	Anthropic PBC	Claude AI to support with text, analysis and research work	USA	Customers, prospects
4.20	Functional Software, Inc. (Sentry)	Sentry	USA	Customers, users
4.21	Meta Platforms Ireland Limited	WhatsApp Business	EU and USA	Customers, prospects

Sentry may transmit technical data such as IP addresses, device information, browser data, and error contexts as part of its error analysis. Processing outside of Switzerland is limited to error andagreports related to streaming services. WhatsApp Business processes messages, contact data, and metadata through Meta.

At Claude AI, no customer data is entered according to our internal guidelines. However, individual pieces of information may still be collected incidentally, for example, when an email with a signature is inserted.

Note regarding streaming devices: As part of our TV and streaming services, device data such as device ID, software version, and usage data may be transmitted to the respective device manufacturer, depending on the chosen solution. The specific data recipients will be communicated to each customer within the framework of the respective service agreement.

Note regarding data processing on our own servers: For the products listed under sections 4.7 to 4.11, data is stored, backed up, and processed on our own servers in Switzerland. The providers mentioned only supply the software and, under normal circumstances, do not have access to personal data. If a problem cannot be resolved by us and the manufacturer's involvement as a third support level is required, limited access may be necessary. Such access will only occur after prior authorization by the customer. Only in this case will data be transferred to the provider's data center.

Note regarding customer-specific data processing: Additional data processing activities and recipients beyond those listed above may be included in individual customer agreements. Deviating or supplementary data processing regulations will be agreed upon customer-specifically within the framework of the respective service agreement or aagprocessingag.

5. Newsletters and direct marketing

5.1 Existing customers

We reserve the right to inform customers who have already used our services about our offers from time to time via email or other means, unless they have objected to this. This processing is for direct marketing purposes. Recipients can object to the use of their email address or other communication data for advertising purposes at any time without additional costs.

5.2 Newsletter registration

Interested parties have the option to subscribe to a free newsletter. We process the data provided during registration for the purpose of sending the newsletter. This consent can be revoked at any time.

5.3 Evaluation

We analyze the open and click-through rates of our newsletters to understand which content is relevant to our recipients. This helps us improve our direct marketing.

5.4 Email Marketing Service

We use a service provided by HubSpot Germany GmbH for sending our newsletter. This provider processes personal data within the EU.

6. Social Media

We maintain a presence on social media to present our organization and services. The operators of these networks regularly process user data for advertising purposes and create user profiles based on online behavior. It is possible that the operators combine this information with other data, and that the operators or their servers are located abroad and process data there. When users contact us via our profiles, we process the data they provide in order to respond to theirag.

Item.	platform	operator
6.1	LinkedIn	LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland
6.2	X	X Corp., 1355 Market Street, Suite 900, San Francisco, CA 94103, USA
6.3	Facebook	Meta Platforms Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland
6.4	Instagram	Meta Platforms Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland
6.5	YouTube	Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
6.6	Xing	New Work SE, Dammtorstrasse 29-32, 20354 Hamburg, Germany

7. Applications

When individuals apply for open positions with us or submit unsolicited applications, we process their data for the purposes of the application process. We may also contact promising candidates directly about a specific position. In this case, we process basic personal data, contact information, and other data that may be relevant to the particular position.

Recipients of the data are service providers involved in the application process, as well as providers of Cloudsoftware that we use.agdocuments are deleted after the process is completed, unless consent has been given for longer-term storage. In the event of aag, deletion generally occurs within 6 months, provided there are no legal retention obligations.

We ask applicants to refrain from including information about political opinions, religious beliefs, and similarly sensitive data in their CV and cover letter. This information is not required for an application.

8. Recipient andagprocessor

Recipients of personal data include service providers we use, Cloudsoftware providers, and other external parties. The following overview summarizes the recipients by location. This list is not exhaustive.

8.1 Recipients in Switzerland. Skribble AG, bexio AG, KMU Trexpert AG, Swiss Post AG, TELAG AG, as well as Cloud, VMware by Broadcom, Rubrik, Acronis and Scalstrm as software on their own servers in Switzerland.

8.2 Recipients in the EU. Microsoft Ireland Operations Limited, HubSpot Germany GmbH, Slack Technologies Limited, Atlassian Pty Ltd, LinkedIn Ireland, Meta Platforms Ireland, Google Ireland Limited, Weglot SAS, Ascio Technologies, ConvertCalculator, Loom, Inc. (data processing in the EU), New Work SE.

8.3 Recipients in the USA. Google LLC, Stripe Inc., Functional Software (Sentry), Defiant Inc. (Wordfence), Anthropic PBC, X Corp.

8.4 Recipient in Great Britain. Fyxer AI Limited.

8.5 Recipients in Australia. Atlassian Pty Ltd is the headquarters; data is processed in the EU.

8.6 Legal and official recipients. Personal data may also be disclosed to authorities, courts, lawyers and the auditing body, insofar as this is provided for by law or necessary to protect legal claims.

9. Disclosure abroad

Insofar as we transfer personal data to service providers or other third parties outside of Switzerland, adequacy decisions of the Federal Council pursuant to Art. 16 para. 1 of the Federal Data Protection Act (DSG) guarantee the security of the data in many cases. The Federal Council has determined adequacy for the countries listed in Art. 8 para. 1 of the Federal Data Protection Ordinance (DSV) in conjunction with Annex 1.

9.1 EU. Adequacy decision in place. Data is transferred to, among others, Microsoft, HubSpot, Slack, Google Ireland, LinkedIn, Meta, Weglot, Ascio, ConvertCalculator and Loom, and, if the manufacturer is involved as a third support level after prior customer approval, to Scalstrm.

9.2 Great Britain. Adequacy determined. Transmitted to Fyxer AI Limited.

9.3 USA. No general adequacy decision. Security is ensured by standard data protection clauses pursuant to Art. 16 para. 2 lit. d GDPR. Transfer to Google LLC, Stripe, Sentry, Defiant, Anthropic and X Corp., and, if the manufacturer is involved as a third support level after prior customer approval, to Cloudian, VMware by Broadcom and Rubrik.

9.4 Australia. Atlassian's headquarters, processing on servers in the EU, secured by standard data protection clauses.

9.5 Swiss data location. The core data is processed in our own data centers in Switzerland, particularly for the services mentioned under 4.7 to 4.11.

10. Data security and storage

10.1 Data Security. We take appropriate technical and organizational measures to protect personal data from unauthorized access, loss, misuse, or destruction. These measures can be https://netstream.ch/tom/netstreamat .

10.2 Data Retention. We process personal data for as long as it is necessary for the respective purpose or as required by law. Statutory retention periods arise in particular from the Swiss Code of Obligations (OR) and the Swiss VAT Act (MWSTG).

10.3 Deletion. As soon as the purpose of processing ceases to exist and no legal retention obligations remain, the personal data will be deleted or anonymized. Deletion is carried out according to an internal deletion policy that regulates the respective deadlines and responsibilities.

11. Changes and Contact

We reserve the right to amend this privacy policy with effect for the future. The current version is always available on our website. Foragor comments, please contact us using the contact details provided in section 1.1.