Skip to main content
Sréter Studio

Privacy Policy

Introduction and responsibility

With this privacy policy I inform you about which personal data I collect, how I use it and which rights you have. This information is provided under both the Swiss Federal Act on Data Protection (FADP) and the EU General Data Protection Regulation (GDPR). For better readability I use the terminology of the GDPR, for example “personal data” rather than the FADP's “personal data of natural persons”.

Controller

Sréter Studio, Annamária Sréter
9656 Alt St. Johann
Switzerland
Phone
+41 76 208 78 29
Email
sreterannamaria1@gmail.com
Website
www.sreter-studio.ch

General information and security measures

SSL or TLS encryption

To protect the transmission of confidential content, such as enquiries sent through the contact form, this website uses SSL or TLS encryption. You can recognise it by “https://” and the padlock symbol in your browser's address bar. The encryption protects data from unauthorised reading during transmission. Data transmission over the internet, for example by email, may nevertheless have security gaps; complete protection against access by third parties is not possible.

General retention period and deletion

Unless a more specific retention period is stated below, I keep your data only until the purpose of the processing ceases to apply. If you make a justified request for deletion or withdraw a consent, I delete your data without delay – unless statutory obligations require retention, in particular retention periods under commercial and tax law. In that case, deletion takes place once those periods have expired.

Your rights as a data subject

Under the GDPR and the corresponding provisions of the FADP you have the following rights:

Access (Art. 15 GDPR)

You may at any time request, free of charge, information on whether and which personal data about you I process – including the purpose, origin, recipients and planned retention period.

Rectification (Art. 16 GDPR)

You may request the rectification of inaccurate data or the completion of your data.

Erasure (Art. 17 GDPR)

You may request the erasure of your data as soon as the purpose ceases to apply, you withdraw your consent or the processing is unlawful. Statutory retention obligations are excepted.

Restriction (Art. 18 GDPR)

Under certain conditions you may request the restriction of processing.

Data portability (Art. 20 GDPR)

Data that I process by automated means on the basis of your consent or for the performance of a contract will be provided to you on request in a structured, commonly used and machine-readable format.

Withdrawal (Art. 7(3) GDPR)

You may withdraw a consent you have given at any time with effect for the future. The lawfulness of the processing carried out until then remains unaffected.

Objection (Art. 21 GDPR)

Where processing is based on my legitimate interest, you may object on grounds relating to your particular situation.

Complaint (Art. 77 GDPR)

You may lodge a complaint with a data protection supervisory authority. In Switzerland this is the Federal Data Protection and Information Commissioner (FDPIC).

For any request, an email to sreterannamaria1@gmail.com is sufficient.

Server log files

Nature and purpose of processing

Each time this website is accessed, the systems of the server infrastructure automatically record technical log data: the IP address of the requesting device, the date and time of access, the path requested, the HTTP status code, the amount of data transferred, the referrer URL and the user agent (browser type and operating system). The purpose is to ensure IT security, stability and load balancing, in particular the detection and prevention of attacks. No evaluation for marketing purposes and no profiling takes place.

Legal basis

Legitimate or overriding interest under Art. 6(1)(f) GDPR and Art. 31(1) and (2)(a) FADP: the secure and available operation of the website and the duty to ensure data security (Art. 32 GDPR).

Recipients

See the section “External web hosting and infrastructure”.

Retention period

Up to 30 days, followed by automatic deletion. Longer retention takes place only if a specific security incident requires investigation.

Provision

The recording is an automatic part of internet communication and cannot be opted out of; without it, the website cannot be delivered technically.

External web hosting and infrastructure

Nature and purpose of processing

The technical operation of this website is handled by my technology partner Woop MAAN Technology, Dorfstrasse 9, 9656 Alt St. Johann, Switzerland. All data generated when you visit the website or that you enter into forms is processed on its server infrastructure.

Legal basis

Legitimate or overriding interest under Art. 6(1)(f) GDPR or Art. 31(1) FADP in a stable, secure and high-performing provision of the website.

Recipients

Woop MAAN Technology processes the data as a processor strictly in accordance with my instructions. The servers are located at netcup GmbH, Daimlerstrasse 25, 76185 Karlsruhe, Germany, in certified data centres within Germany (EU); netcup is bound by a data processing agreement. Administrative access takes place from Switzerland; this data flow is covered by the EU Commission's adequacy decision for Switzerland. No transfer to insecure third countries takes place through the hosting.

Retention period

Until the purpose ceases to apply; server log files as described above for up to 30 days.

Provision

Without this processing, the website cannot be displayed technically.

Contact form and communication

Nature and purpose of processing

When you write to me via the contact form, I process the details you provide: name, email address, company or brand, website, the chosen service, your project description, the budget range, the desired start and how you became aware of Sréter Studio. The purpose is to handle your enquiry, to get in touch with you and, where applicable, to prepare a quote. The same applies when you email me directly.

Legal basis

If your enquiry serves the preparation of a contract, the legal basis is Art. 6(1)(b) GDPR or Art. 31(2)(a) FADP; in all other cases my legitimate or overriding interest in a prompt reply under Art. 6(1)(f) GDPR or Art. 31(1) FADP.

Recipients

Your details are transmitted in encrypted form to my technology partner's server infrastructure and stored there (see “External web hosting and infrastructure”); no external delivery service is involved. My reply and any further correspondence go through my email mailbox at Gmail, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Retrieval and handling take place in Switzerland; this data flow is covered by the EU Commission's adequacy decision for Switzerland. As Google has a US parent company, access from the USA cannot be entirely ruled out – see “International data transfers”.

Retention period

Your enquiry remains on the server and in my mailbox until the purpose ceases to apply or you request deletion. Statutory retention periods for business correspondence remain reserved.

Provision

Providing the details is voluntary. Without a name and a valid email address, however, I cannot answer your enquiry.

Ordering the Website Check and payment

Nature and purpose of processing

When you order the Website Check, I process your name, your email address, the address of the website to be reviewed and what you would like to achieve. The purpose is to handle the purchase: payment, confirmation, the review of your website and the report. Until the order is complete, your entries are also stored in your browser's local storage («sreter.websiteCheck.order») so the form is not empty after a cancellation; the confirmation page deletes the entry.

Legal basis

The processing serves to perform the contract you enter into with the order – Art. 6(1)(b) GDPR and Art. 31(2)(a) FADP. Retaining the payment and order data fulfils the statutory retention obligation under Art. 958f CO – Art. 6(1)(c) GDPR.

Recipients

Payment is handled by Stripe (Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Dublin, Ireland; for the United States Stripe Inc.). Stripe receives your name, email address, website address and the payment details you enter there. Stripe does not receive your stated goal; it stays with me. I never see your card details – they are entered and processed solely at Stripe. Stripe is independently responsible for processing the payment and for its obligations under anti-money-laundering law. The order data is stored on the same server infrastructure as the website; emails about your order come from my mailbox at Gmail (see “Contact form and communication”).

Retention period

I keep order and payment data for ten years (statutory retention obligation). Data that only serves the review – your goal and the findings – is deleted six months after the report is handed over. Stripe's own privacy policy applies to the data held there.

Provision

Your name, email address and the address of your website are required so that I can carry out the check and deliver the report. Without them the order is not possible.

Launch notification

On the “Coming soon” page you can ask to be notified as soon as the website is online. For this I process your email address, your first name if you provide it, and the language of the page. The legal basis is your consent (Art. 6(1)(a) GDPR or Art. 31(1) FADP). The details are transmitted in encrypted form to my technology partner's server infrastructure and stored there in a file (see “External web hosting and infrastructure”). At launch I send you a single email from my mailbox at Gmail, after which I delete the details. I do not use a newsletter service. You may withdraw your consent at any time by email – I then delete your details immediately.

Links to social networks

This website links to my profiles on Instagram, LinkedIn and Behance. These are simple links without embedded content: data is transmitted only when you click a link. From that point on, the privacy policy of the respective network applies.

International data transfers

For my email mailbox I use Gmail; Google's parent company is based in the USA. The following applies to transfers to the USA:

Google's terms

Gmail is subject to Google's Terms of Service and Privacy Policy. Google does not offer a data processing agreement for Gmail; Google itself is responsible for operating the service.

Data Privacy Framework

In the assessment of the EU Commission and the Swiss Federal Council, the USA is considered adequate provided the company has certified itself. Google is certified under the EU-U.S. and the Swiss-U.S. Data Privacy Framework.

Standard contractual clauses

In addition, the transfer relies on the standard contractual clauses of the EU Commission, which are recognised by the FDPIC.

Currency and amendments

This privacy policy is current as of October 2026. If the website, the services used or the legal requirements change, I will adapt it. The version published here at any given time applies. Where changes affect consent-based processing, I will obtain new consent – to the extent required by law.

Last updated: October 2026