+41 76 710 91 39 St. Gallerstrasse 49, 9100 Herisau

Privacy notice

Controller

The controller responsible for processing personal data on this website within the meaning of Art. 5 let. j of the Swiss Data Protection Act (DSG) is:

VES-TECH Swiss
Martin Veselovsky
Bildfeldstrasse 24
9552 Bronschhofen
Switzerland

Telephone: +41 76 710 91 39
Email: info@ves-tech.ch

VES-TECH Swiss is a sole proprietorship under Swiss law. Telephone hours are Monday to Friday, 07:30 to 17:00. We provide advice in German, Czech and English. No data protection adviser has been appointed. Please address all enquiries directly to the contact above.

Scope and applicable law

This notice applies to www.ves-tech.ch in all five language versions (German, French, Italian, English and Spanish) and to enquiries received through this website.

The revised Swiss Data Protection Act (DSG), in force since 1 September 2023, is the relevant legislation. The processing of personal data includes every operation involving data, from collection to deletion.

Our delivery area includes Liechtenstein as well as Switzerland. Liechtenstein is part of the European Economic Area. Where we address individuals there, the European General Data Protection Regulation (GDPR) also applies. The two frameworks are not identical; differences are indicated in the text.

Website and local storage

The website uses no advertising cookies. With your consent, Google Analytics 4 uses pseudonymous analytics cookies. Their use and withdrawal of consent are described below. Fonts and product images are hosted locally; manufacturer images may load as a fallback.

The enquiry list remains in your browser's localStorage. Form details are not stored there. Search terms are processed in your browser; when you open a results page, the search term appears in the URL and may appear in the hosting provider's server logs.

Optional analytics load only after your consent. Your choice is stored locally for no more than 180 days. You can decline or withdraw consent through Privacy settings. Data already collected are not deleted retrospectively. We do not send names, email addresses, telephone numbers, form messages, optional additional details or free-text search terms to analytics. Identifiers for selected versions or individual used machines are not sent either. Search pages, unknown page addresses and unsafe URL parameters or referring links are excluded from measurement. Approved campaigns are analysed only using predefined identifiers.

Cloudflare Web Analytics measures page views and technical performance, particularly loading times. Cloudflare receives the technical browser requests needed for this purpose. The analytics script does not use cookies and is not used to analyse individual form actions or campaign parameters.

Ahrefs Web Analytics measures page views and selected actions such as product interest, opening the enquiry list and confirmed acceptance of an enquiry by the submission service. It receives the canonical page address, optionally containing only pre-approved campaign parameters, and predefined details such as language, product identifier, category, form type and recognised campaign. Ahrefs receives technical browser data and a previously checked reference to the referring page. Public link destinations, download document types, broad product-count groups and predefined error types may also be recorded as events. According to the provider, no analytics cookies are used; the IP address is processed to determine an approximate location and a visitor identifier that changes daily, but is not stored. An enquiry is not evidence of a sale. To attribute a recognised campaign or entry page, we store only those details in the tab's sessionStorage after consent, for no more than 24 hours. They contain no customer data and are not combined into a persistent visitor identifier.

With your consent, Google Analytics 4 (Google Ireland Limited) records page views, technical browser data and predefined enquiry actions. Its analytics cookies last no more than 180 days. Page addresses are checked and cleaned beforehand. Names, email addresses, telephone numbers, messages and free-text searches are not sent. Google Signals, personalised advertising and automatic form measurement are disabled. Technical requests may also be processed in the United States. Consent is optional and can be withdrawn in Privacy settings; the analytics cookies we set are then removed. This does not retrospectively delete data already collected. User and event data associated with pseudonymous identifiers are retained for two months, without extending the period for new activity. Aggregated standard reports may remain available longer.

We use Brevo (Sendinblue SAS, France) for our optional newsletter. The linked sign-up form loads at Brevo only when you open it. Your email address, selected language and evidence of sign-up and confirmation are processed there to manage your subscription. You become a subscriber only after confirming the link received by email. Every newsletter includes an unsubscribe link. An equipment enquiry does not automatically subscribe you. Email addresses and confirmation links are not sent to website analytics. The Brevo form uses Cloudflare Turnstile to prevent automated signups. Cloudflare processes technical signals, such as IP addresses and browser information, to detect bots and improve this protection. Opens and clicks in confirmation emails are analysed anonymously; delivery and subscription records are processed to manage the subscription.

Hosting and server logs

The website is hosted on GitHub Pages, a service provided by GitHub Inc., USA (part of Microsoft).

When you open a page, your browser sends technically necessary information to GitHub's servers. This generally includes:

  • the IP address of your device or connection;
  • the date and time of access;
  • the address requested;
  • browser and operating system identification (User-Agent).

GitHub creates these logs. We have no access to them. We cannot inspect, analyse or delete them. Their scope and retention period are determined solely by GitHub's policies.

The enquiry list in your browser

You can add equipment to an enquiry list. This list is not a shopping basket. The website has no prices, ordering function or payment facility.

The list is stored in your browser's local storage (localStorage, key vt.cart.v2). Only product identifiers, selected versions or individual machines and quantities are stored. Recognised entries from the previous list are migrated automatically. The list remains on your device and reaches us only when you submit the enquiry. It is not a cookie: the details are not automatically sent with page requests.

Storage on your device is governed by Art. 45c let. b of the Telecommunications Act (FMG). We must inform you about the processing and its purpose and explain how to refuse it. The purpose is to retain your selection while you browse the catalogue. You can refuse by not using the enquiry list, clearing it with the page's controls, deleting website data in your browser or blocking local storage in browser settings. The website remains usable in all these cases. We cannot access these locally stored details.

Contact form and enquiries

When you write to us through a form or submit an enquiry list, we process the details you enter:

  • name or company;
  • email address;
  • telephone number, available only in the contact form and optional;
  • your message;
  • selected products, versions or individual machines, with quantities, the selected service or the optionally selected topic.

Depending on the enquiry, you may optionally provide your preferred timeframe, material, thickness, power supply, existing model, fault symptoms, number of machines or intended application. These details help us prepare advice or a quotation. They are sent with your enquiry but are not analysed in web analytics or saved in local browser storage. After confirmed submission, a copyable summary remains visible on the open page.

Name, email address and message are required in the contact form. Only name and email address are required in the enquiry list form; its message is optional. We cannot reply without the required details. All other information is optional.

An enquiry submitted this way is non-binding. It is neither an order nor an offer to enter into a contract, but a first step towards a possible contract.

The contractual consequences of an enquiry are governed by the terms and conditions.

Sending your enquiry

When you submit the form, your browser sends your name, email address, telephone number (if provided), message, selected products or services and any optional additional details to Web3Forms so that the service can deliver your enquiry to us by email. If an error occurs, the text remains available to copy. If you use the email fallback, you send the message through your own email application. Web3Forms stores submitted messages in its dashboard for the configured retention period of up to three years. Delivered emails also remain in our mailbox.

Email and telephone

Our business mailbox is a Google Mail account. Enquiries received by email are therefore stored on Google LLC servers in the USA.

Unencrypted email is comparable to a postcard. Do not send sensitive personal data by email. For confidential matters, please call instead.

When you call, we see your telephone number unless you withhold it. We do not record calls.

Contact via WhatsApp

The contact link opens WhatsApp as an external service. WhatsApp's terms of use and privacy policy apply there. No WhatsApp chat is embedded in this website. The link contains no pre-filled message.

Only after your consent to optional analytics do we record a click on our WhatsApp contact. Telephone numbers and message contents are not sent to web analytics. A click confirms neither the sending nor the receipt of an enquiry.

Purposes of processing

We process your details solely to:

  • answer your enquiry and prepare a quotation;
  • fulfil an order if your enquiry leads to a purchase outside the website: delivery, invoicing and warranty;
  • meet legal obligations, particularly retention of accounting records;
  • maintain the website's operation and security.
  • analyse page views and selected interactions with your consent;
  • send the optional newsletter after confirmed sign-up and manage unsubscribes;

We do not sell personal data or share them for advertising. You will receive neither newsletters nor advertising from us without your consent.

Legal framework

Under Swiss law. The DSG does not require private businesses to identify a specific legal basis for every processing operation. Processing is generally permitted provided the principles are observed: good faith, a recognisable purpose, proportionality, accurate data and appropriate security (Art. 6 and Art. 8 DSG). We comply with these principles. This notice informs you about collection of your data (Art. 19 DSG).

Under the GDPR, where it applies to you, the same activities are classified as follows: enquiries and contract fulfilment rely on Art. 6(1)(b) GDPR, retention of records on Art. 6(1)(c) GDPR, and secure operation of the website on Art. 6(1)(f) GDPR.

Disclosure to third parties

We disclose personal data only where necessary for the stated purpose or required by law. Recipients may include:

  • Schweisstechnik Scherrer AG in Switzerland, where required for the procurement, delivery or service you request; only necessary contact, equipment and order details are shared;
  • the technical providers named above: GitHub for hosting and Google for the business email account;
  • MAHE GmbH in Germany as manufacturer, if a technical enquiry or warranty case requires your details; only contact and equipment details are then transmitted;
  • the carrier where a delivery is arranged;
  • our accounting service, tax authorities and law enforcement authorities where legal obligations require disclosure.

Data are not sold or shared for advertising.

Disclosure abroad

Personal data may be disclosed abroad where the Federal Council recognises the recipient country's data protection as adequate (Art. 16 DSG). Without such recognition, an appropriate safeguard or an exception under Art. 17 DSG is required.

USA. The Federal Council added the USA to the list of countries with adequate data protection on 14 August 2024; the amendment to the Data Protection Ordinance took effect on 15 September 2024. Recognition applies only to businesses certified under the Swiss-U.S. Data Privacy Framework. GitHub Inc. and Google LLC are listed by the US Department of Commerce with active status. Hosting and email disclosure rely on this recognition.

Germany. As an EU member state, Germany is also on the Federal Council's list. Enquiries to the manufacturer therefore require no additional safeguard.

A residual risk remains: even certified providers are subject to access by US authorities.

Google Search Console

The website is registered with Google Search Console to support its appearance in Google Search. Ownership is verified through a verification file in the root directory. No script is loaded for this purpose and no data about you are collected.

The service reports only aggregated figures, such as search terms, accessed pages, country and device type, without identifying individuals.

Manufacturer content (mahe-online.de)

This website's images and texts are hosted on our own server. The manufacturer's catalogue and data sheets are hosted on mahe-online.de. When you open such a link, its server receives your IP address, the time and your browser identifier.

Your browser also attempts to load an image directly from mahe-online.de if, exceptionally, it fails to load from our website. This does not occur during normal operation.

Retention periods

We retain personal data for as long as the purpose requires or the law prescribes.

  • Enquiries without subsequent business: we delete them once it is clear that no transaction will result. We review the mailbox at least annually.
  • Business relationships: invoices and accounting records are retained for ten years (Art. 957 paras. 2 and 3 together with Art. 958f OR). The period starts at the end of the financial year.
  • Hosting server logs: these are held by GitHub. We have no control over their retention period.
  • Enquiry list in your browser: it remains until you delete it.

Data security

We take appropriate technical and organisational measures to protect personal data against unauthorised access, loss and misuse (Art. 8 DSG, Art. 32 GDPR). These include encrypted website delivery over HTTPS/TLS, protection of the business email account and avoiding collection of data we do not need. Data not collected cannot be lost.

No one can guarantee absolute protection during transmission over the internet.

Your rights

Under the Swiss Data Protection Act, you have the following rights:

  • Access (Art. 25 DSG): you may ask whether and which personal data we process about you. Information is generally free and usually provided within 30 days.
  • Correction (Art. 32 para. 1 DSG): we correct inaccurate data.
  • Deletion and prohibition of processing or disclosure: you may ask us to stop processing, refrain from disclosure to third parties or delete your data, provided no statutory retention requirement prevents this. We comply with such requests without formal proceedings. The law provides these remedies as rights of action (Art. 32 para. 2 DSG together with Art. 28 et seq. of the Civil Code, ZGB), but you do not need to sue to exercise them with us.
  • Data release and portability (Art. 28 DSG): we provide data you supplied and that we process automatically in a commonly used electronic format, or transfer them to another party at your request.

If the GDPR applies to you, its rights under Arts. 15 to 21 also apply: access, correction, erasure, restriction, portability and objection.

An informal request is sufficient: info@ves-tech.ch or the postal address above. We must verify your identity appropriately to avoid disclosing information to the wrong person.

Reporting to the FDPIC and legal remedies

If you disagree with our response, you may report the matter to the Federal Data Protection and Information Commissioner (FDPIC; German abbreviation EDÖB) under Art. 49 DSG. The Commissioner opens an investigation on their own initiative or following a report if there are sufficient indications that processing may breach data protection rules. They may refrain from investigating minor infringements. You have no entitlement to the opening of an investigation.

Federal Data Protection and Information Commissioner (FDPIC)
Feldeggweg 1
3003 Bern
www.edoeb.admin.ch

Civil remedies are also available (Art. 32 DSG). If you are subject to the GDPR, you may additionally contact the supervisory authority of your country of residence; for Liechtenstein, this is the Data Protection Authority in Vaduz.

Changes and date

We update this notice when the website's operation or service providers change. The version published here is authoritative. We do not maintain an archive of previous versions.

Dated: 8 October 2026.