Privacy Notice

1. Who handles your data

Controller: Oliver Camponovo, c/o IBEX SERVICES SA, Via Serafino Balestra 6, 6830 Chiasso, Switzerland. For anything concerning your data, write to oliver.camponovo@ibex.services.

This site also addresses visitors in the European Union, so both the Swiss Federal Act on Data Protection (revFADP) and Regulation (EU) 2016/679 (GDPR) apply.

I am established in Switzerland, not in the Union. The processing described below is occasional, involves no special categories of data and is not likely to result in a high risk, so no representative in the Union has been designated (Art. 27(2)(a) GDPR).

2. What I collect, and nothing else

If you fill nothing in, I store nothing about you beyond technical server logs. There is no analytics, there are no advertising cookies, and there is no cross-site tracking.

• Server logs — date and time, the page requested, the response code and your browser's user-agent string. Your IP address is not among them: the application runs behind a reverse proxy on the same machine, so it only ever records that proxy's own address, and the proxy keeps no access log of its own. Used to keep the site running and to spot abuse. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
• Waitlist — if you submit the form: your email address, the answers you gave in the self-assessment, the resulting level and score, the site language, the time of submission and your browser's user-agent string. Legal basis: your consent (Art. 6(1)(a) GDPR), which you may withdraw at any time.
• Form IP address — stored truncated: I keep the network it belongs to, not the address (e.g. 203.0.113.0/24 for IPv4, 2001:db8:1234::/48 for IPv6). Enough to notice automated submissions, not enough to identify you.

3. Cookies

One cookie, strictly necessary: csrftoken, which protects the form against forged submissions from other sites. It does not profile you and needs no consent. Signing into the admin area adds a session cookie.

4. The self-assessment score

The questions produce an indicative level, calculated in your own browser from your answers alone. It is an illustrative exercise: it is not advice, it has no legal effect, and it is not used for automated decision-making about you within the meaning of Art. 22 GDPR.

5. Where the data sits

On a dedicated server in Frankfurt, Germany — inside the European Economic Area. The controller is resident in Switzerland, so the data crosses that border in both directions.

Neither direction needs additional safeguards. Germany is on the Federal Council's list of states with adequate data protection (Annex 1 to the Data Protection Ordinance), which is what the revised Federal Act on Data Protection requires before data is disclosed abroad. In the other direction, the European Commission recognises Switzerland as providing an adequate level of protection.

6. Who else sees it

I do not sell, rent or share your data for commercial purposes, and I disclose it to no one for their own use. There is one processor, which I am required to name: DigitalOcean, which supplies the server the site runs on and therefore holds the data at rest. It acts only on my instructions and for no purpose of its own. There is no analytics provider, no advertising network, no email marketing platform and no CRM.

No third-party service loads when you visit this page: even the typefaces are served from this server, specifically so that your IP address never reaches an outside provider.

The site links to third-party sites (Calendly, LinkedIn, X, Medium, the Federal Supreme Court). Following those links takes you off this site, where their own notices apply and mine does not.

7. How long I keep it

Server logs: held in the operating system's journal, which is bounded by size rather than by age — older entries are discarded as newer ones arrive. They carry no IP address. Waitlist signups: 24 months from signup. Withdrawing consent deletes the signup.

8. Your rights

You may request access, rectification, erasure, restriction and portability of your data, object to processing, and withdraw consent at any time — by writing to oliver.camponovo@ibex.services. None of this costs anything and I answer within one month.

Every message sent to the waitlist carries an unsubscribe link that works in one click — no reply to write, no account to sign into. Clicking it deletes the signup, along with the answers stored with it.

You may also complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC, Bern) or, if you are in the European Union, to the supervisory authority in your country.

9. Changes

If this notice changes, the date at the top of the page is updated.