Privacy

1. General

This privacy policy explains how personal data is processed in connection with the website manuel.sh.

We process personal data in accordance with the Swiss Federal Act on Data Protection (FADP/DSG), in particular the principles set out in Art. 6 FADP (proportionality, purpose limitation and deletion of data that is no longer needed, among others). Where we rely on consent, that consent is only valid if it is given voluntarily and on an informed basis (Art. 6 para. 6 FADP). Where consent is required for the processing of sensitive personal data or for high-risk profiling, it must be given explicitly (Art. 6 para. 7 FADP).

2. Controller

The controller responsible for processing personal data is:

Hedinger-Digital
Owner: Manuel Hedinger
Rosgartenstrasse 19
7205 Zizers
Switzerland

Email: kontakt@hedinger-digital.ch
Phone: +41 81 560 21 50
UID: CHE-459.222.930

3. Collection and processing of data

We process personal data that you provide to us (for example when you get in touch or sign up for the newsletter) and data that arises from your use of manuel.sh (for example technical log data). There are no user accounts on manuel.sh; the content of the site is open without registration.

Processing serves the following purposes:

• Providing, operating and securing manuel.sh
• Handling enquiries
• Sending the newsletter to people who have signed up for it
• Analysing and improving the site
• Complying with legal obligations

The legal bases follow from the FADP; where consent is required, we obtain it.

4. Service-specific processing

4.1 Contact form

If you contact us through a contact form or by email, we process the data you provide (in particular name, email address and the content of your message) in order to handle your enquiry and for any follow-up questions. The data is deleted or restricted as soon as it is no longer needed for that purpose and no statutory retention obligations apply.

A message sent through the contact form is not stored in a manuel.sh database; it is delivered to our mailbox as an email. Both the delivery and the mailbox run on Resend (Resend, Inc., country of domicile: USA) acting as a processor within the meaning of Art. 9 FADP. The disclosure is based on Standard Contractual Clauses (SCC) pursuant to Art. 16 para. 2 FADP.

4.2 Newsletter and email delivery

Where we send newsletters or comparable marketing emails, we do so only with your consent or within the limits permitted by law. Transactional and service emails (for example confirmations or security notices) are sent in order to operate the service. You can unsubscribe at any time using the link in every newsletter email or by sending us an informal message.

For email delivery and for managing the recipient list we use Resend (Resend, Inc., domicile: USA). This involves processing your email address, your subscription and unsubscription status and technical delivery data. The disclosure abroad is based on Standard Contractual Clauses (SCC) pursuant to Art. 16 para. 2 FADP (Art. 19 para. 4 FADP).

4.3 Analytics (self-hosted, Umami)

To measure reach and improve manuel.sh we use Umami in a self-hosted setup. The analysis runs anonymised or pseudonymised on our own infrastructure; the server used for it is located in the European Union. Umami sets no cookies for measurement and creates no cross-device identifiers. Analytics data is not disclosed to third-party providers abroad. No advertising profiles are created and no data is passed to third parties for cross-site tracking.

4.4 Hosting and log files (third-party provider)

manuel.sh is operated at Vercel (Vercel Inc., country of domicile: USA). This may involve processing server log files and operational data (for example IP address, timestamp, requested resource, user agent). The hosting provider acts as a processor within the meaning of Art. 9 FADP. The disclosure abroad is based on Standard Contractual Clauses (SCC) pursuant to Art. 16 para. 2 FADP (Art. 19 para. 4 FADP).

5. Cookies and consent

manuel.sh sets a single cookie, a technically necessary one for the language choice. It serves neither analytics nor advertising.

You can block or delete cookies in your browser at any time. The site continues to work without this cookie; the language is then derived afresh from your browser settings on every visit.

For ordinary analytics, information and an opt-out are generally sufficient in Switzerland. We obtain explicit consent (opt-in) where sensitive personal data is processed or high-risk profiling takes place (Art. 6 para. 7 FADP in conjunction with Art. 5 lit. f and lit. g FADP).

6. Disclosure abroad

Personal data is processed in Switzerland or the European Economic Area as a matter of principle, to the extent the individual service allows.

Where data is disclosed to a country without an adequate level of data protection, we ensure appropriate safeguards pursuant to Art. 16 para. 2 FADP, in particular Standard Contractual Clauses (SCC). Exceptions are governed by Art. 17 FADP.

In concrete terms this concerns:

• Resend, Inc. (USA) — email delivery, the contact form mailbox and the newsletter list; disclosure based on Standard Contractual Clauses (SCC).
• Vercel Inc. (USA) — hosting and server log files; disclosure based on Standard Contractual Clauses (SCC).
• Analytics server in the European Union — our own infrastructure; the EU provides an adequate level of data protection within the meaning of Art. 16 para. 1 FADP.

With self-hosted Umami, no analytics data is disclosed to third parties abroad.

7. Your rights

Within the limits of applicable law, you have in particular the following rights:

• Access to the personal data processed (Art. 25 FADP; free of charge and as a rule within 30 days)
• Rectification of inaccurate personal data
• Handing over and transfer of data (Art. 28 FADP), where applicable; free of charge as a matter of principle
• Deletion or restriction of processing, unless statutory or contractual retention obligations stand in the way
• Withdrawal of consent already given, with effect for the future
• Objection to certain processing, where provided for by law

To exercise your rights, contact: hello@manuel.sh.

Automated individual decisions within the meaning of Art. 21 FADP do not take place in connection with manuel.sh.

8. Data security

We take appropriate technical and organisational measures to protect personal data in accordance with Art. 8 FADP (including access controls, encrypted transmission where customary, keeping systems up to date, and access on a need-to-know basis). Absolute security cannot be guaranteed.

9. Retention and deletion

Personal data is retained only for as long as it is needed for the stated purposes or for as long as statutory retention obligations require (accounting records, for example). After that the data is deleted or anonymised.

10. Changes

We may amend this privacy policy if the site, the services used or the legal situation change. The version published on manuel.sh with the date shown below applies.