As of August 18, 2026

1. General Information

1.1 Responsible Entities

The data controllers pursuant to Art. 5(j) of the Federal Data Protection Act (DSG) are:

Netstream
AGRichtistrasse 2, 8304 , Switzerland Wallisellen

Netstream Cloud
AGAuenstrasse 10, 8600 , Switzerland Dübendorf

Legal Representative: Alexis Caceda

This Privacy Policy applies to both Netstream AG and Netstream Cloud AG.

Contact: hello@netstream.ch

1.2 Scope

This Privacy Policy provides information about the processing of personal data:

• on our website netstream.ch
• as part of all Netstream services
• in the context of our business relationships with customers, prospective customers, and suppliers
• on our social media profiles
• in the context of application procedures

1.3 Definitions

Personal data: Any information relating to an identified or identifiable natural person (Art. 5(a) of the DSG).

Processing: Any handling of personal data, regardless of the means and methods used, in particular the collection, storage, use, modification, disclosure, archiving, deletion, or destruction of data (Art. 5(d) of the DSG).

Data Controller: The private individual or federal agency that, alone or jointly with others, determines the purposes and means of processing (Art. 5(j) of the Data Protection Act).

Processor: A private individual or a federal agency that processes personal data on behalf of the controller (Art. 5(k) of the Data Protection Act).

2. Rights of Data Subjects

2.1 Your Rights

Data subjects have the following rights with respect to us:

• Right of Access (Art. 25 DSG): You have the right to know whether we process any personal data about you and, if so, what data we process.
• Right to Rectification (Art. 32(1) DSG): You may request the rectification of inaccurate personal data.
• Right to Erasure: You may request the erasure of your personal data, provided that there are no legal obligations to retain it.
• Right to Data Portability (Art. 28 DSG): You may request that we provide you with your personal data in a commonly used electronic format or transfer it to another data controller.
• Right to Object: You may object to the processing of your personal data at any time, particularly if the processing is carried out for direct marketing purposes.

2.2 Assertion of Claims

To exercise your rights, please use the contact information provided in Section 1.1. We reserve the right to verify the identity of the person making the request.

2.3 Right to File a Complaint with the EDÖB

You have the right to file a complaint with the Federal Data Protection and Information Commissioner (FDPIC):

Federal Data Protection and Information Commissioner (FDPIC)
Feldeggweg 1, 3003 Bern
www.edoeb.admin.ch

3. Website netstream.ch

3.1 Server Log Files

When you use our website for informational purposes—that is, when you do not specifically provide us with any information—we collect the personal data that your browser transmits to our server. This is done to ensure the stability and IT security of our website.

The following data is collected in this process:

• IP address
• Date and time of the request
• Time zone difference from Greenwich Mean Time (GMT)
• Content of the request (concrete page)
• Access Status and HTTP Status Code
• Data volume transferred in each case
• Website from which the request originates (referrer)
• Browser, operating system, and its user interface
• Language and Version of the Browser Software

This data is stored in log files. We host our website ourselves.

3.2 Cookies and Consent

Through our website, we process data on third-party devices via telecommunications transmission. In doing so, we use cookies, which are divided into the following categories:

• Essential cookies: Required for the technical operation of the website.
• Statistics cookies: Enable the analysis of website usage.
• Marketing cookies: Used for personalized advertising and conversion tracking.

Visitors can refuse the use of cookies or manage their consent via the cookie banner, for example, by adjusting their browser settings to block or delete cookies.

3.3 Analysis Tools

Google
Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
Data location: United States

Services: Google Analytics for analyzing website usage patterns, Google Tag Manager for managing website tags and tracking codes.

Microsoft
Provider: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland
Data location: United States

Service: Microsoft Clarity for analyzing user behavior using heat maps and session recordings.

HubSpot
Provider: HubSpot Germany GmbH, Am Postbahnhof 17, 10243 Berlin, Germany
Data location: EU

Service: HubSpot tracking code for website analytics, lead tracking, and behavioral analysis.

3.4 Marketing Tools

Google, data location: U.S. Services: Google Marketing Platform for advertising campaigns and remarketing; Google Conversion Tag for measuring advertising performance; Google reCAPTCHA for protecting forms against abuse. For reCAPTCHA, Google has been acting as a processor since April 2, 2026.

LinkedIn
Provider: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland
Data location: EU

Service: LinkedIn Ads and Insight Tag for advertising campaigns and conversion tracking.

3.5 Contact Forms, Calculators, and Live Chat

When you contact us via the contact form on our website, we process the data requested there and the content of your message in order to handle your inquiry. Website visitors can also book appointments through our website.

HubSpot, data location: EU. Service: HubSpot LiveChat for real-time communication with website visitors.

ConvertCalculator
Provider: ConvertCalculator, Hoeveneind 60, 4847 NG Teteringen, Netherlands
Data location: EU

Service: ConvertCalculator for interactive calculators and configurators on our website, including the information entered there.

3.6 Embedded Content

Google, data location: U.S. Services: YouTube videos for embedding video content; Google Web Fonts for providing fonts.

Weglot
Provider: Weglot SAS, 138 rue Pierre Joigneaux, 92270 Bois-Colombes, France
Data location: EU

Service: Guide to translating website content.

3.7 WordPress Plugins and Technical Services

Defiant (Wordfence), 1700 Westlake Ave N, Suite 200, Seattle, WA 98109, USA. Data location: USA. Service: Wordfence, a security plugin designed to protect the website.

4. Netstream- Services

As part of our business operations—in particular, to provide our services in the areas of streaming, Cloud , and IT services, as well as to manage customer relationships—we use third-party services. These providers are recipients of personal data in connection with the processing activities described below.

The following list is organized by provider. For each provider, the list includes the products used, the purpose of processing, the individuals affected, and the location of the data. This list is not exhaustive.

No.	Provider	Services	Data Location	Affected Individuals
4.1	Microsoft Ireland Operations Limited	Microsoft 365	EU	Customers, Users, Third Parties
4.2	Atlassian Pty Ltd	Jira, Confluence	EU	Customers, prospective customers, users, third parties
4.3	Slack Technologies Limited	Slack	EU	Customers
4.4	HubSpot Germany GmbH	Marketing, Sales, Service, Content, Data, and Commerce Hub	EU	Customers, Prospective Customers
4.5	Skribble AG	Electronic Signatures	Switzerland	Customers, Prospective Customers
4.6	Fyxer AI Limited	Fyxer.ai	United Kingdom	Customers, Prospective Customers, Third Parties
4.7	Cloudian Inc.	Cloudian S3	Dedicated Servers in Switzerland	Customers, Users
4.8	VMware by Broadcom	VMware	Dedicated Servers in Switzerland	Customers, Users
4.9	Rubrik, Inc.	category	Dedicated Servers in Switzerland	Customers, Users
4.10	Acronis International GmbH	Acronis Cyber Protect Cloud	Dedicated Servers in Switzerland	Customers, Users
4.11	Scalstrm AB	Streaming Platform Component	Dedicated Servers in Switzerland	Customers, Users
4.12	bexio AG	bexio	Switzerland	Customers
4.13	SME Trexpert AG	Trexpert	Switzerland	Customers
4.14	Stripe Inc.	Stripe	United States	Customers
4.15	Swiss Post AG	ePost	Switzerland	Customers
4.16	TELAG AG	Telephone service that includes answering calls and creating tickets	Switzerland	Customers, Prospective Customers
4.17	Ascio Technologies	Domain Registration and Management	EU	Customers
4.18	Loom, Inc.	Creation and distribution of videos for sales purposes, including recipients' view and playback data	EU	Customers, Prospective Customers
4.19	Anthropic PBC	Claude AI for assistance with text, analysis, and research tasks	United States	Customers, Prospective Customers
4.20	Functional Software, Inc. (Sentry)	Sentry	United States	Customers, Users
4.21	Meta Platforms Ireland Limited	WhatsApp Business	EU and the U.S.	Customers, Prospective Customers

With Sentry, technical data such as IP addresses, device information, browser data, and error contexts may be transmitted as part of error analysis. Processing outside of Switzerland is limited to error and diagnostic reports related to streaming services. With WhatsApp Business, messages, contact information, and metadata are processed by Meta.

At Claude AI, no customer data is entered in accordance with our internal guidelines. However, individual pieces of information may be included incidentally, such as when an email with a signature is inserted.

Note regarding streaming devices. As part of our TV and streaming services, device data—such as device ID, software version, and usage data—may be transmitted to the respective device manufacturer, depending on the selected solution. The specific data recipients will be communicated on a customer-specific basis as part of the respective service agreement.

Note on data processing on our own servers. For the products listed in sections 4.7 through 4.11, data is stored, backed up, and processed on our own servers in Switzerland. The providers listed merely supply the software and normally do not have access to personal data. If we are unable to resolve a malfunction and it is necessary to involve the manufacturer as a third level of support, limited access—both in terms of time and scope—may be required. Such access is granted only after prior approval by the customer. Only in this case will data be transferred to the provider’s data location.

Note regarding customer-specific data processing. Under individual customer agreements, additional data processing activities and recipients may be added that go beyond the list provided above. Any deviating or supplementary provisions regarding data processing will be agreed upon on a customer-specific basis as part of the respective service agreement or a data processing agreement.

5. Newsletters and Direct Marketing

5.1 Existing Customers

We reserve the right to inform customers who have previously used our services about our offers from time to time via email or other means, provided they have not objected to this. This data is processed for direct marketing purposes. Recipients may object to the use of their email address or other contact information for promotional purposes at any time at no additional cost.

5.2 Newsletter Sign-Up

Interested parties can subscribe to a free newsletter. We process the data provided during registration for the purpose of sending the newsletter. Consent may be withdrawn at any time.

5.3 Analysis

We analyze the open and click-through rates of our newsletters to understand what content is relevant to our subscribers. This helps us improve our direct marketing efforts.

5.4 Email Marketing Service

We use a service provided by HubSpot Germany GmbH to send out our newsletter. The provider processes personal data within the EU.

6. Social Media

We are active on social media to showcase our organization and our services. The operators of these networks regularly process their users’ data for advertising purposes and create user profiles based on online behavior. It cannot be ruled out that the operators may combine this information with other data, and it is possible that the operators or their servers are located abroad and process data there. When users contact us through our profiles, we process the data provided to us in order to respond to their inquiries.

No.	Platform	Operator
6.1	LinkedIn	LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland
6.2	X	X Corp., 1355 Market Street, Suite 900, San Francisco, CA 94103, USA
6.3	Facebook	Meta Platforms Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland
6.4	Instagram	Meta Platforms Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland
6.5	YouTube	Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
6.6	Xing	New Work SE, Dammtorstrasse 29-32, 20354 Hamburg, Germany

7. Applications

When individuals apply for open positions with us or submit unsolicited applications, we process their data for the purposes of the application process. We may also contact promising candidates directly about a specific position. In this case, we process personal information, contact information, and other data that may be relevant to the specific position.

The recipients of the data are service providers engaged as part of the application process, as well as providers of “ Cloud ” software that we use. Application documents are deleted upon completion of the process, unless consent has been given for longer-term storage. In the event of a rejection, the documents are generally deleted within 6 months, provided there are no legal retention requirements.

We ask applicants to refrain from including information about political views, religious beliefs, or other similarly sensitive data in their resumes and cover letters. Such information is not required for an application.

8. Recipients and Processors

The recipients of personal data include service providers we engage, providers of Cloud software, and other external entities. The following overview summarizes the recipients by location. This list is not exhaustive.

8.1 Recipients in Switzerland: Skribble AG, bexio AG, KMU Trexpert AG, Swiss Post AG, TELAG AG, as well as Cloudian, VMware by Broadcom, Rubrik, Acronis, and Scalstrm as software running on their own servers in Switzerland.

8.2 Recipients in the EU. Microsoft Ireland Operations Limited, HubSpot Germany GmbH, Slack Technologies Limited, Atlassian Pty Ltd, LinkedIn Ireland, Meta Platforms Ireland, Google Ireland Limited, Weglot SAS, Ascio Technologies, ConvertCalculator, Loom, Inc. (data processing in the EU), New Work SE.

8.3 Recipients in the United States. Google LLC, Stripe Inc., Functional Software (Sentry), Defiant Inc. (Wordfence), Anthropic PBC, X Corp.

8.4 Recipients in the United Kingdom. Fyxer AI Limited.

8.5 Recipients in Australia. Atlassian Pty Ltd is headquartered there; data is processed in the EU.

8.6 Recipients Required by Law or Regulatory Authorities. Personal data may also be disclosed to government agencies, courts, attorneys, and the auditor to the extent required by law or necessary to protect legal claims.

9. Disclosure Abroad

To the extent that we transfer personal data to service providers or other third parties outside Switzerland, adequacy decisions by the Federal Council pursuant to Art. 16(1) of the Data Protection Act (DSG) ensure the security of the data in many cases. The Federal Council has determined that the countries listed in Art. 8(1) of the Data Protection Ordinance (DSV) in conjunction with Annex 1 meet the adequacy criteria.

9.1 EU. Adequacy decision in place. Data is transferred to, among others, Microsoft, HubSpot, Slack, Google Ireland, LinkedIn, Meta, Weglot, Ascio, ConvertCalculator, and Loom, as well as to Scalstrm in cases where the manufacturer is involved as a third-level support provider, subject to prior customer approval.

9.2 United Kingdom. Adequacy determined. Transfer to Fyxer AI Limited.

9.3 United States. No general adequacy decision. Security is ensured through standard data protection clauses pursuant to Art. 16(2)(d) of the DSG. Transfer to Google LLC, Stripe, Sentry, Defiant, Anthropic, and X Corp., as well as—in the event that the manufacturer is engaged as a third-level support provider following prior customer approval—to Cloudian, VMware by Broadcom, and Rubrik.

9.4 Australia. Atlassian’s headquarters; data processing takes place on servers in the EU; protected by standard data protection clauses.

9.5 Data Location in Switzerland. Core data is processed in our own data centers in Switzerland, particularly for the services listed in sections 4.7 through 4.11.

10. Data Security and Retention

10.1 Data Security. We take appropriate technical and organizational measures to protect personal data from unauthorized access, loss, misuse, or destruction. The TOMs are available at https://netstream.ch/tom/.

10.2 Retention. We process personal data for as long as necessary for the respective purpose or as long as a statutory retention obligation applies. Statutory retention periods are set forth, in particular, in the Swiss Code of Obligations (OR) and the Swiss Value-Added Tax Act (MWSTG).

10.3 Deletion. Once the purpose of the processing no longer applies and there are no longer any statutory retention requirements, the personal data will be deleted or anonymized. Deletion is carried out in accordance with an internal deletion policy that specifies the applicable timeframes and responsibilities.

11. Changes and Contact Information

We reserve the right to amend this Privacy Policy with future effect. The most current version is always available on our website. If you have any questions or comments, please contact us using the contact information provided in Section 1.1.