Privacy

Controller and scope

The controller is C&W Software Labs AG, Bundesplatz 4, 6300 Zug, Switzerland. Privacy enquiries: dennis@cundw.io. We process personal data under the Swiss Federal Act on Data Protection (FADP). The GDPR also applies where its territorial and material scope is met. This notice describes the static website in its current preview mode.

Hosting and technical access data

When you access the website, technical data such as your IP address, time, requested file and browser details are transmitted to the server delivering the site. Logging supports the operation and security of the website. Hosting provider: DigitalOcean, LLC, 105 Edgeview Drive, Suite 425, Broomfield, CO 80021, USA. The website runs on a server in the Frankfurt am Main data centre (Germany); a data processing agreement including standard contractual clauses is in place. Logged data: IP address, time, requested file, status code, browser details and referring page. Access is limited to the persons at C&W Software Labs AG responsible for operations. Logs are deleted after six weeks at the latest, unless a security incident requires individual entries to be retained longer.

Local resources and no tracking

Fonts, images and other page resources are served with the website. No external font services, analytics, advertising trackers, maps or social media plugins are embedded. This website does not set cookies or embed third-party services. External links connect to their destination only when opened.

Language, colour scheme and cookie settings on your device

The website does not set cookies. It stores only your chosen language, your colour scheme and your choice in the cookie dialog in your browser’s localStorage. These settings serve the requested presentation, are not combined into a usage profile and are not sent to us by the application code. They remain in the browser until you change or delete the site data; the cookie dialog choice is requested again after twelve months and can be changed at any time via “Cookie settings” in the footer. Optional analytics services run only with your consent – none are active at present.

Contact form

Through the contact form you submit your name, email address, optionally company and phone number, your selection of focus, stage and timing, and your message. The legal basis is answering your enquiry and, where relevant, preparing a contract; you give your consent to processing by ticking the box. The details are transmitted to our web server over an encrypted connection and forwarded from there to our mailbox by email; they are not stored on the web server. To protect against automated abuse, the server checks a field invisible to humans, the time taken to complete the form and a rate limit per sender; for this purpose the IP address is kept in pseudonymised form for no more than 24 hours. No external captcha or form service is used. While the form is not yet enabled, you can reach us by email or phone.

Direct contact by email or phone

When you contact us directly, we process the information you provide to reply and, where relevant, to prepare or perform a contract. Email is transmitted through your email service and ours. Our mailboxes are operated via GoDaddy Operating Company, LLC (2155 E. GoDaddy Way, Tempe, AZ 85284, USA) on the basis of Microsoft 365 (Microsoft Ireland Operations Limited, One Microsoft Place, Dublin 18, Ireland); processing takes place in data centres in the EU and the USA under standard contractual clauses and the Data Privacy Framework. Enquiries sent through the contact form are forwarded to us by email and are not stored on the web server; to prevent abuse, the sender’s IP address is kept on the web server in pseudonymised form (hash with a daily rotating random value) for no more than 24 hours. We keep enquiries only as long as necessary for their purpose, statutory duties or the protection of legitimate claims: enquiries that do not lead to a collaboration are deleted no later than twelve months after the last communication; if a contract is concluded, the statutory retention period of ten years applies (Art. 958f Swiss Code of Obligations).

Recipients and international disclosure

Contracted hosting and email providers receive data where necessary for the stated purposes. Other disclosures take place only as permitted by law, for example to perform a contract or meet legal duties. Recipients abroad are our hosting provider (USA, servers in Germany) and our email provider (USA and Ireland). For the USA we rely on the providers’ certification under the Swiss-U.S. Data Privacy Framework or on the standard contractual clauses recognised by the FDPIC; Ireland provides an adequate level of data protection.

Your rights

Subject to applicable law, you may request access, correction or deletion and object to processing. You may request data delivery or portability and, where applicable, restriction of processing when the respective statutory requirements are met. You may withdraw consent with future effect. Contact: dennis@cundw.io. You may raise privacy concerns with the Swiss Federal Data Protection and Information Commissioner (FDPIC, www.edoeb.admin.ch) and, where the GDPR applies, the competent supervisory authority.

Changes and approval

Last updated: 16 September 2026. We update this notice whenever processing or legal requirements change; the version published here applies.