Privacy Policy

1. General

1.1 Controllers

The controllers within the meaning of Art. 5 let. j of the Swiss Federal Act on Data Protection (FADP) are:

Netstream AG
Richtistrasse 2, 8304 Wallisellen, Switzerland

Netstream Cloud AG
Auenstrasse 10, 8600 Dübendorf, Switzerland

Legal representative: Alexis Caceda

This Privacy Policy applies to Netstream AG as well as to Netstream Cloud AG.

Contact: hello@netstream.ch

1.2 Scope

This Privacy Policy provides information on the processing of personal data:

• on our website netstream.ch
• in connection with all Netstream services
• in connection with our business relationships with customers, prospective customers and suppliers
• on our social media profiles
• in connection with application procedures

1.3 Definitions

Personal data: Any information relating to an identified or identifiable natural person (Art. 5 let. a FADP).

Processing: Any handling of personal data, irrespective of the means and procedures used, in particular the collection, storage, use, revision, disclosure, archiving, erasure or destruction of data (Art. 5 let. d FADP).

Controller: The private person or federal body that, alone or jointly with others, determines the purpose and the means of the processing (Art. 5 let. j FADP).

Processor: A private person or federal body that processes personal data on behalf of the controller (Art. 5 let. k FADP).

2. Rights of data subjects

2.1 Your rights

Data subjects have the following rights vis-à-vis us:

• Right of access (Art. 25 FADP): You have the right to know whether we process personal data about you and, if so, which personal data.
• Right to rectification (Art. 32 para. 1 FADP): You may request the rectification of inaccurate personal data.
• Right to erasure: You may request the erasure of your personal data, provided that no statutory retention obligations preclude this.
• Right to data portability (Art. 28 FADP): You may request that we hand over your personal data to you in a commonly used electronic format or transfer it to another controller.
• Right to object: You may object to the processing of your personal data at any time, in particular where the processing is carried out for the purposes of direct marketing.

2.2 Exercising your rights

To exercise your rights, please use the contact details set out in section 1.1. We reserve the right to verify the identity of the requesting person.

2.3 Right to lodge a complaint with the FDPIC

You have the right to lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC):

Federal Data Protection and Information Commissioner (FDPIC)
Feldeggweg 1, 3003 Bern
www.edoeb.admin.ch

3. Website netstream.ch

3.1 Server log files

When you use our website for information purposes only, i.e. when you do not otherwise transmit information to us, we collect the personal data that your browser transmits to our server. This serves to ensure the stability and IT security of our website.

The following data is collected in this context:

• IP address
• Date and time of the request
• Time zone difference from Greenwich Mean Time (GMT)
• Content of the request (specific page)
• Access status and HTTP status code
• Amount of data transferred in each case
• Website from which the request originates (referrer)
• Browser, operating system and its interface
• Language and version of the browser software

This data is stored in log files. We host our website ourselves.

3.2 Cookies and consent

Via our website, we process data on third-party devices by means of telecommunications transmission. In doing so, we use cookies, which are divided into the following categories:

• Necessary cookies: Required for the technical operation of the website.
• Statistics cookies: Enable the analysis of website usage.
• Marketing cookies: Used for personalised advertising and conversion tracking.

Visitors may refuse the processing or manage their consent via the cookie banner, for example by making the corresponding settings in their browser and thereby blocking or deleting cookies.

3.3 Analytics tools

Google
Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
Data location: USA

Services: Google Analytics for analysing website usage behaviour, Google Tag Manager for managing website tags and tracking codes.

Microsoft
Provider: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland
Data location: USA

Service: Microsoft Clarity for analysing user behaviour with heatmaps and session recordings.

HubSpot
Provider: HubSpot Germany GmbH, Am Postbahnhof 17, 10243 Berlin, Germany
Data location: EU

Service: HubSpot Tracking Code for website analytics, lead tracking and behavioural analysis.

3.4 Marketing tools

Google, data location USA. Services: Google Marketing Platform for advertising campaigns and remarketing, Google Conversion Tag for measuring advertising success, Google reCAPTCHA for protection against misuse of forms. For reCAPTCHA, Google has acted as a processor since 2 April 2026.

LinkedIn
Provider: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland
Data location: EU

Service: LinkedIn Ads and Insight Tag for advertising campaigns and conversion tracking.

3.5 Contact forms, calculators and LiveChat

When you contact us via the contact form on our website, we process the data requested there and the content of the message in order to handle the enquiry. Site visitors can also book appointments via our website.

HubSpot, data location EU. Service: HubSpot LiveChat for real-time communication with website visitors.

ConvertCalculator
Provider: ConvertCalculator, Hoeveneind 60, 4847 NG Teteringen, Netherlands
Data location: EU

Service: ConvertCalculator for interactive calculators and configurators on our website, including the information entered in them.

3.6 Embedded content

Google, data location USA. Services: YouTube videos for embedding video content, Google Webfonts for providing fonts.

Weglot
Provider: Weglot SAS, 138 rue Pierre Joigneaux, 92270 Bois-Colombes, France
Data location: EU

Service: Weglot for translating the website content.

3.7 WordPress plugins and technical services

Defiant (Wordfence), 1700 Westlake Ave N Ste 200, Seattle, WA 98109, USA. Data location USA. Service: Wordfence as a security plugin to protect the website.

4. Netstream services

In the course of our business activities, in particular for the provision of our services in the areas of streaming, cloud and IT services and for the management of customer relationships, we use services of third-party providers. These providers are recipients of personal data in the context of the processing operations described below.

The following list is structured by provider. For each provider, the products used, the purpose of processing, the data subjects concerned and the data location are listed. The list is not exhaustive.

In the case of Sentry, technical data such as IP addresses, device information, browser data and error contexts may be transmitted in the course of error analysis. Processing outside Switzerland is limited to error and diagnostic reports in connection with streaming services. In the case of WhatsApp Business, messages, contact details and metadata are processed by Meta.

In accordance with our internal guidelines, no customer data is entered into Claude AI. Individual pieces of information may nevertheless be included incidentally, for example when an email with a signature is inserted.

Note on streaming end devices. In connection with our TV and streaming services, device data such as device ID, software version and usage data may, depending on the solution chosen, be transmitted to the respective end device manufacturer. The specific data recipients are communicated on a customer-specific basis within the framework of the respective service agreement.

Note on data processing on our own servers. For the products listed under 4.7 to 4.11, the data is stored, backed up and processed on our own servers in Switzerland. The providers named merely supply the software and, under normal circumstances, have no access to personal data. If a fault cannot be remedied by us and it becomes necessary to involve the manufacturer as third-level support, access limited in time and scope may become necessary. Such access takes place only after prior approval by the customer. Only in this case does data reach the provider’s data location.

Note on customer-specific data processing. Within the framework of individual customer agreements, further data processing operations and recipients may be added that go beyond the list above. Deviating or supplementary provisions on data processing are agreed on a customer-specific basis within the framework of the respective service agreement or a data processing agreement.

5. Newsletter and direct marketing

5.1 Existing customers

We reserve the right to inform customers who have already used our services about our offers from time to time by email or by other means, provided that they have not objected to this. The processing is carried out for the purpose of direct marketing. Recipients may object to the use of their email address or other communication data for advertising purposes at any time without incurring additional costs.

5.2 Newsletter subscription

Prospective customers have the option of subscribing to a free newsletter. We process the data provided at the time of subscription for the purpose of sending the newsletter. Consent may be withdrawn at any time.

5.3 Evaluation

We process the open and click rates of our newsletters in order to understand which content is relevant to our recipients. This serves to improve our direct marketing.

5.4 Email marketing service

For sending newsletters, we use a service of HubSpot Germany GmbH. The provider processes personal data in the EU.

6. Social media

We are present on social networks in order to present our organisation and our services there. The operators of these networks regularly process their users’ data for advertising purposes and create user profiles based on online behaviour. It cannot be ruled out that the operators combine this information with other data, and the operators or their servers may be located abroad and process data there. When users contact us via our profiles, we process the data communicated to us in order to respond to the enquiries.

7. Job applications

When individuals apply to us for vacancies or submit unsolicited applications, we process their data for the purposes of the application procedure. We may also approach interesting candidates directly regarding a position. In this case, we process master data, contact details and other data that may be relevant to the specific position.

Recipients of the data are service providers engaged in the application procedure and providers of cloud software that we use. Application documents are deleted after the procedure has been completed, unless consent to longer-term storage has been given. In the event of a rejection, the deletion generally takes place within 6 months, provided that there are no statutory retention obligations.

We ask applicants to refrain from including information on political opinions, religious beliefs and similarly sensitive data in their CV and cover letter. Such information is not required for an application.

8. Recipients and processors

Recipients of personal data are service providers engaged by us, providers of cloud software and other external bodies. The following overview summarises the recipients by location. The list is not exhaustive.

8.1 Recipients in Switzerland. Skribble AG, bexio AG, KMU Trexpert AG, Die Schweizerische Post AG, TELAG AG, as well as Cloudian, VMware by Broadcom, Rubrik, Acronis and Scalstrm as software on our own servers in Switzerland.

8.2 Recipients in the EU. Microsoft Ireland Operations Limited, HubSpot Germany GmbH, Slack Technologies Limited, Atlassian Pty Ltd, LinkedIn Ireland, Meta Platforms Ireland, Google Ireland Limited, Weglot SAS, Ascio Technologies, ConvertCalculator, Loom, Inc. (data processing in the EU), New Work SE.

8.3 Recipients in the USA. Google LLC, Stripe Inc., Functional Software (Sentry), Defiant Inc. (Wordfence), Anthropic PBC, X Corp.

8.4 Recipients in the United Kingdom. Fyxer AI Limited.

8.5 Recipients in Australia. Atlassian Pty Ltd as headquarters; data is processed in the EU.

8.6 Statutory and official recipients. Personal data may also be disclosed to authorities, courts, lawyers and the statutory auditor, insofar as this is provided for by law or is necessary to safeguard legal claims.

9. Disclosure abroad

Where we transfer personal data to service providers or other third parties outside Switzerland, the security of the data is in many cases guaranteed by adequacy decisions of the Federal Council pursuant to Art. 16 para. 1 FADP. The Federal Council has determined adequacy for the states listed in Art. 8 para. 1 DPO in conjunction with Annex 1.

9.1 EU. Adequacy decision in place. Transfer to, among others, Microsoft, HubSpot, Slack, Google Ireland, LinkedIn, Meta, Weglot, Ascio, ConvertCalculator and Loom and, where the manufacturer is involved as third-level support after prior customer approval, to Scalstrm.

9.2 United Kingdom. Adequacy determined. Transfer to Fyxer AI Limited.

9.3 USA. No general adequacy decision. Security is ensured by standard data protection clauses pursuant to Art. 16 para. 2 let. d FADP. Transfer to Google LLC, Stripe, Sentry, Defiant, Anthropic and X Corp. and, where the manufacturer is involved as third-level support after prior customer approval, to Cloudian, VMware by Broadcom and Rubrik.

9.4 Australia. Headquarters of Atlassian; processing on servers in the EU, safeguarded by standard data protection clauses.

9.5 Swiss data location. The core data is processed in our own data centres in Switzerland, in particular for the services listed under 4.7 to 4.11.

10. Data security and retention

10.1 Data security. We take appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse or destruction. The TOMs can be viewed at /en/toms/.

10.2 Retention. We process personal data for as long as is necessary for the respective purpose or as long as a statutory retention obligation exists. Statutory retention periods arise in particular from the CO and the VAT Act.

10.3 Erasure. As soon as the purpose of the processing no longer applies and there are no longer any statutory retention obligations, the personal data is erased or anonymised. Erasure takes place in accordance with an internal erasure concept that governs the respective periods and responsibilities.

11. Changes and contact

We reserve the right to amend this Privacy Policy with effect for the future. The current version is always available on our website. For questions or comments, we are available via the contact details set out in section 1.1.