Privacy policy

Controller and contact

Fermium GmbH is responsible for the processing of personal data on this website.

Fermium GmbH
Hardeggweg 3
3326 Krauchthal
Switzerland

E-mail: contact@fermium.ch
Phone: +41 78 914 41 45

Send all questions about data protection to this address. We did not appoint a data protection advisor.

Scope

This privacy policy applies to the website https://fermium.ch in English and German. It tells you which personal data we process when you visit the website, when you send an inquiry and when you give consent to Google Analytics and Google Ads. It is based on the Swiss Federal Act on Data Protection (FADP, in German DSG). For persons to whom the EU General Data Protection Regulation (GDPR) applies, see the section “Information under the GDPR”.

This privacy policy also applies to our test addresses on azurestaticapps.net. On these test addresses, the contact form stores inquiries in the same storage account in Switzerland North, but sends no notification e-mail. The server function stores the message as a file on the server instead.

Visiting the website

When you open a page, your browser sends technical data to the server. These data include your IP address, the date and time, the requested address, the browser type (user agent) and the address of the previous page (referrer). The server needs these data to deliver the page.

Microsoft hosts the website with Azure Static Web Apps. Microsoft delivers the static content (pages, images, fonts) from locations around the world. A location outside Switzerland can therefore process your page request.

We did not activate a logging or monitoring service (for example Application Insights) that stores these request data for us. Microsoft can process request data to operate and protect its service.

When you open https://fermium.ch without a language in the address, a script in your browser selects the German or the English homepage. The script reads the language settings and the time zone of your browser for this selection. It does not send these data to us. When you select a language with the language switch, the website stores your choice in the local storage of your browser, under the key fermium-language. The value is “de” or “en”. The address https://fermium.ch then opens the homepage in this language. The website sets no expiry date for this entry. The entry stays until you select the other language or delete the website data in your browser. Your browser can delete the entry earlier. For example, Safari deletes it after seven days of use without a visit to this website.

The website itself sets no cookies. It loads fonts and images only from its own domain. It embeds no videos, maps or social media content. Without your consent, the website loads no Google script and sends no data to Google (see “Consent for Google Analytics and Google Ads”).

The website contains links to other websites. The other website receives data from your browser only when you click the link. In this case, our website sends only the origin https://fermium.ch as referrer.

Contact form and e-mail

Data

You can send us an inquiry with the contact form. The form asks for these data:

• Name (required)
• Work email (required)
• Company (optional)
• Project stage (required)
• What do you need?, for example hardware or firmware (optional)
• Short description of the project (required)
• Request for a non-disclosure agreement (NDA) (optional)
• PDF file (optional, see “File uploads”)

Without the required data, we cannot receive and answer your inquiry.

With the inquiry, the website also sends the language of the page and the page address. Our server adds an identifier, the date and time of receipt, a hash of your IP address (see “Spam and abuse protection”) and the user agent of your browser.

Purpose

We use these data to answer your inquiry, to prepare an offer and to manage a business relationship that can follow.

Processing

1. Your browser sends the form to our server function at https://fermium.ch/api/contact. This function is part of Azure Static Web Apps (Microsoft).
2. The function saves the inquiry in Azure Table Storage (Microsoft). The storage account is in the Azure region Switzerland North and keeps no copy in another region.
3. The function sends a notification e-mail through Azure Communication Services (Microsoft) to our mailbox contact@fermium.ch. The data location of this service is Switzerland.
4. Our mailbox is hosted in Microsoft 365 (Exchange Online).

The notification e-mail contains all form data, the language, the page address, the date and time, the IP hash and the user agent. If you attached a file, the e-mail contains the file size, a download link and the file name. With JavaScript, the file name is the random storage name. Without JavaScript, it is the original file name. The e-mail does not contain the file itself. You receive no copy of the notification e-mail. We answer from our mailbox to the e-mail address that you entered.

The notification e-mails contain no open tracking and no click tracking.

File uploads

You can attach one PDF file with a maximum size of 20 MiB (about 21 MB) to your inquiry. We store the file in Azure Blob Storage (Microsoft) in the region Switzerland North. The storage container is not publicly accessible.

When JavaScript is active, the upload works as follows:

1. Your browser sends the file name, the file size and the file type to our server function. The server function does not store the original file name.
2. The server function returns a link that allows the upload of one file for 10 minutes.
3. Your browser uploads the file directly to the storage account under a random name.
4. When you send the form, the server function checks the type and the size of the file. It deletes a file that fails the check.

Without JavaScript, the form sends the file together with the inquiry. The server function then stores the file and the original file name.

The notification e-mail contains a read-only download link to the file. The link is valid for 7 days. Any person who has the e-mail can download the file during these 7 days. We send the e-mail only to our own mailbox.

Azure Blob Storage deletes every uploaded file 7 days after the upload. This also applies when you do not send the form, and when the server discards or rejects the form. Tell us if we should delete a file earlier.

Spam and abuse protection

We protect the contact form against spam and abuse with these measures:

• Hidden field: the form contains a field that people do not see. Automated programs often fill in this field. If the field contains a value, the server discards the inquiry.
• Time check: when JavaScript is active, your browser measures the time from the page load to the sending of the form and sends this duration with the inquiry. If the duration is less than 4 seconds, the server discards the inquiry. We do not store this duration.
• Rate limit: the server accepts at most 5 inquiries per hour and 10 upload requests per 10 minutes from the same IP address.

The server does not store your IP address. It calculates a hash from your IP address and a secret value (salt) and stores the first 32 characters of the hash. A person who knows the salt can calculate the hash of a known IP address. The hash is therefore pseudonymised data, not anonymous data.

For the rate limit, the server stores one entry for each hash, with the start time of the time window and a counter. These entries are in Azure Table Storage in the region Switzerland North. The server also stores the hash with the inquiry.

The purpose of these measures is to protect the website, our mailbox and our storage against misuse.

Consent for Google Analytics and Google Ads

We use Google Analytics 4 and Google Ads only with your consent. When you first open the website, a banner asks for your consent. The banner asks for two purposes:

• Statistics: Google Analytics 4 (see “Google Analytics 4”).
• Ad measurement: Google Ads conversion tracking (see “Google Ads”).

You can accept both purposes, reject both purposes or select each purpose in the settings of the banner. If you ignore the banner, you give no consent. Before you give consent, the website loads no Google script, sets no Google cookie and sends no data to Google. The banner shows on every page until you make a choice.

Your choice in the browser

The website stores your choice in the local storage of your browser, under the key fermium-consent. The entry contains your choice for each purpose, the date and time of the choice and a version number. The website does not send this entry to us or to Google. After 12 months, the banner asks again. Your browser can delete the entry earlier, for example when you delete the website data. The banner then asks again on your next visit. If your browser blocks local storage, the website cannot store your choice. Your choice then applies only to the current page, and the banner asks again on the next page.

Changing your choice

Use the button “Cookie settings” in the footer of every page. The banner then opens with the settings. You can change your choice or withdraw your consent at any time. The withdrawal does not affect the lawfulness of the processing before the withdrawal.

When a purpose has no consent, the website deletes the cookies and the local storage entries of this purpose on every page load. When you withdraw consent, the website also reloads the page:

• Statistics: the cookie _ga and the cookies with names that start with _ga_.
• Ad measurement: the cookies with names that start with _gac_ or _gcl_, and the entries in local storage with names that start with _gcl_.

The website cannot delete cookies that Google sets on its own domains, for example google.com. You can delete these cookies in the settings of your browser.

Google Analytics 4

We use Google Analytics 4 only with your consent for statistics (see “Consent for Google Analytics and Google Ads”).

Purpose

Google Analytics shows us how visitors use the website, for example which pages they open and how many inquiries arrive. We use the results as statistics and to measure the effect of our ads on Google (see “Google Ads”). We do not use Google Analytics for remarketing or personalised advertising.

We linked Google Analytics to our Google Ads account. In this link, personalised advertising is off. We share the key event “inquiry sent” (generate_lead) with Google Ads. Google Ads uses this event to measure our ads. We turned off Google signals. With Google signals, Google Analytics can use data that Google has about users who are signed in to their Google account.

Data and events

When you give consent for statistics, your browser loads the Google Analytics script from www.googletagmanager.com after the page has loaded.

Google Analytics records the pages that you open. The website also sends these events:

• generate_lead with the page address, when an inquiry is sent successfully
• file_upload without further data, when a PDF upload is successful
• contact_click with the value “tel” or “mailto”, when you click a phone link or an e-mail link

These events contain no content from the form. The website does not send generate_lead when the spam protection discards an inquiry (see “Spam and abuse protection”).

The Google tag receives your choice as consent settings (see “Consent settings”). Google states that Google Analytics 4 does not log or store IP addresses of users in Switzerland, the EU and the UK. According to Google, Google Analytics uses the IP address only to derive the approximate location and then discards it.

Cookies and browser storage

According to Google, Google Analytics sets these cookies on the domain fermium.ch:

Your browser can shorten the lifetime of these cookies. For the cookies of Google Ads, see “Google Ads cookies”.

When you open https://fermium.ch from another website, the script that selects the language keeps the address of that website in the session storage of your browser, under the key fermium-referrer. The next page sends this address to Google Analytics as the previous page and deletes the entry. Without this entry, Google Analytics would count the visit as a direct visit. The website stores the address only when you gave consent for statistics. Your browser deletes the session storage when you close the tab.

Earlier versions of the website used the library Partytown, which registered a service worker for the path /partytown/. The website removes this registration from your browser when you open a page.

Retention at Google

In Google Analytics, we set the retention period for user-level and event-level data to 14 months. This is the longest period that Google Analytics offers. This setting applies to explorations and funnel reports. It does not apply to aggregated standard reports.

Google Ads

We show ads through Google Ads. Google Ads conversion tracking shows us how many inquiries arrive after a click on one of our ads. We use the results to measure and improve our ads. We use no remarketing and no personalised advertising.

We use Google Ads conversion tracking only with your consent for ad measurement (see “Consent for Google Analytics and Google Ads”). The website uses Google Ads only on https://fermium.ch. On our test addresses, the website sends no conversion event to Google Ads. With your consent for statistics, Google Analytics is also active there and can share the key event “inquiry sent” with Google Ads (see “Google Analytics 4”).

Ad clicks and conversions

When you click one of our ads, Google adds a click identifier to the address of our page, for example the parameter gclid. With your consent for ad measurement, the Google tag for Google Ads loads from www.googletagmanager.com. With your consent for statistics too, it loads together with Google Analytics. The Google tag stores the click identifier in first-party cookies on the domain fermium.ch (see “Google Ads cookies”).

When you send an inquiry successfully and gave consent for ad measurement, the website sends a conversion event to Google Ads. Google Ads then counts the inquiry as a conversion of the ad click. The conversion event contains no content from the form, for example no name and no e-mail address. We do not use enhanced conversions. The website does not send the conversion event when the spam protection discards an inquiry.

Your browser sends the data to Google servers, for example www.googleadservices.com, googleads.g.doubleclick.net and www.google.com. The requests also contain technical data, for example the page address, the time, your IP address and the user agent.

Consent settings

The Google tag uses consent settings. Before the Google tag loads, the website sets all consent settings to “denied”. It then applies your choice:

• Statistics: storage for analytics (analytics_storage).
• Ad measurement: storage for advertising (ad_storage) and the sending of user data to Google for online advertising (ad_user_data).

The website never allows personalised advertising (ad_personalization). According to Google, remarketing and personalised advertising therefore receive no data from this website.

With your consent for ad measurement, the Google tag can store the click identifier in cookies. Google Ads collects your IP address. Google can also read and set its own cookies on Google domains, for example google.com and doubleclick.net. Google is responsible for these cookies.

The website also sets ads_data_redaction. According to Google, this setting has an effect only when storage for advertising is not allowed, so only without your consent for ad measurement. The Google tag then removes the click identifiers from the requests to Google Ads, also from the page addresses. Google Analytics can still receive the full page address with the click identifier. According to Google, Google Analytics uses the click identifier only for an approximate traffic measurement.

Google Ads cookies

According to Google, the Google tag can set these cookies for ad measurement on the domain fermium.ch. It sets them only with your consent for ad measurement.

Google publishes no separate purpose for each of these cookies. The Google tag can also store ad click information in the local storage of your browser, under names that start with _gcl_, for example _gcl_ls. Your browser can shorten the lifetime of these cookies. For more information, see Google’s cookie information for its advertising products.

Retention of Google Ads data

Google determines how long Google Ads keeps the data. Google publishes no fixed retention period for conversion data. According to Google, Google anonymises advertising data in server logs. Google removes part of the IP address after 9 months and the cookie information after 18 months.

Service providers

We use these service providers. Except for Google Ads, they process personal data on our behalf (processors). For Google Ads, Google is an independent controller.

Microsoft processes customer data for Azure and Microsoft 365 under the Microsoft Products and Services Data Protection Addendum. For businesses in Switzerland, the Google Ads Data Processing Terms apply to Google Analytics. According to Google, the Google Ads Controller-Controller Data Protection Terms apply to Google Ads. Under these terms, each party is an independent controller. Google decides on the purposes and means of its own processing. If we activate the data sharing setting “Google products & services” in Google Analytics, Google is an independent controller for the shared data.

Disclosure abroad

Our service providers can process personal data outside Switzerland:

• USA: our server functions run in the Azure region East US 2 (USA). Microsoft therefore processes form data, upload requests and your IP address in the USA when you send an inquiry. Microsoft can also store the content of our Microsoft 365 mailbox in the USA. Google can process data of Google Analytics and Google Ads in the USA. Microsoft Corporation and Google LLC are certified under the Swiss-U.S. Data Privacy Framework. Since 15 September 2024, Annex 1 of the Swiss Data Protection Ordinance (DSV) recognises the USA as a state with adequate data protection for companies with this certification. Google can also use standard contractual clauses.
• Other countries worldwide: Microsoft delivers static content from locations worldwide and does not publish a list of these locations. Data of Azure Communication Services can pass through other countries or be processed there. Google can process data in other countries before the data reach the USA. For these transfers, Google uses standard contractual clauses, and Microsoft applies the safeguards of the Microsoft Products and Services Data Protection Addendum.

Retention

The website deletes uploaded files automatically after 7 days. It deletes no other data automatically. These criteria apply:

• Inquiries and notification e-mails: as long as we need them to answer your inquiry and for a business relationship that follows. If data become part of our accounting records (for example an order or an invoice), we keep them for 10 years, as Art. 958f of the Swiss Code of Obligations requires.
• Rate-limit entries: these entries contain only the IP hash, a start time and a counter. After the time window, the next request from the same IP address overwrites the entry. The entries stay stored until we delete them.
• Uploaded files: Azure Blob Storage deletes every uploaded file 7 days after the upload. This applies to the file of a sent inquiry and to the file of a form that you did not send. If we need a file to answer your inquiry, we save a copy before the deletion. This copy follows the criteria for inquiries above.
• Deleted files: a deletion removes the file at once. Azure Blob Storage keeps no copy, and we cannot restore the file.
• Download links: a download link in a notification e-mail stops working after 7 days.
• Google Analytics: see “Retention at Google”.
• Google Ads: see “Retention of Google Ads data”.
• Your consent choice: the entry is in the local storage of your browser. After 12 months, the banner asks again (see “Your choice in the browser”).

Data security

We use technical and organisational measures to protect your data. These measures include:

• Encrypted connections (HTTPS) for all pages, with HTTP Strict Transport Security (HSTS)
• TLS 1.2 or higher for connections to the storage account
• Encryption of stored files by Microsoft
• No public access to uploaded files
• Time-limited links for uploads (10 minutes) and downloads (7 days)
• A Content Security Policy that restricts the sources of scripts
• A limit on the number of requests from one IP address

No transmission over the internet is completely secure.

No automated individual decisions

We make no decisions that are based only on automated processing and that have legal effects for you or affect you significantly. The spam checks and the rate limit only reject a form submission. We do no high-risk profiling.

Your rights

Under the FADP, you have these rights:

• Access: you can ask whether we process personal data about you. If we do, we tell you the data, the purpose, the retention period, the origin, the recipients and any states abroad.
• Rectification: you can ask us to correct incorrect data.
• Deletion and objection: you can ask us to delete your data or to stop a processing. We can refuse if the law requires us to keep the data or if we need the data for legal claims.
• Data portability: if we process the data automatically on the basis of your consent or in connection with a contract, you can ask for the data that you gave us, in a common electronic format.
• Withdrawal of consent: you can withdraw your consent to Google Analytics and Google Ads at any time with the button “Cookie settings” (see “Changing your choice”).

To use your rights, send an e-mail to contact@fermium.ch or a letter to our postal address. We can ask you to prove your identity. Access is normally free of charge. We normally answer within 30 days.

You can also contact the Federal Data Protection and Information Commissioner (FDPIC): www.edoeb.admin.ch.

Information under the GDPR

In some cases the GDPR can apply to the processing of your data. In these cases, this additional information applies.

Legal bases:

• Contact form, e-mail and file uploads: steps before a contract at your request (Art. 6(1)(b) GDPR) and our legitimate interest in answering business inquiries (Art. 6(1)(f) GDPR)
• Hosting, spam protection and abuse protection: our legitimate interest in a secure and working website (Art. 6(1)(f) GDPR)
• Google Analytics: your consent (Art. 6(1)(a) GDPR). You can withdraw your consent at any time with the button “Cookie settings”.
• Google Ads conversion tracking: your consent (Art. 6(1)(a) GDPR). You can withdraw your consent at any time with the button “Cookie settings”.
• Storage of your consent choice in your browser: our legitimate interest in respecting and documenting your choice (Art. 6(1)(f) GDPR)
• Retention under Swiss statutory duties: our legitimate interest in complying with the Swiss law that applies to us (Art. 6(1)(f) GDPR)

Transfers: the European Commission recognises Switzerland as a country with adequate data protection. For transfers to the USA, Microsoft Corporation and Google LLC are certified under the EU-U.S. Data Privacy Framework.

Rights: you have the right of access, rectification, erasure, restriction of processing and data portability. You have the right to object to processing that is based on legitimate interests. You have the right to withdraw your consent at any time. The withdrawal does not affect the lawfulness of the processing before the withdrawal.

Complaint: you have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU or EEA member state where you live.

Changes to this privacy policy

We change this privacy policy when the website or the law changes. The version on this page applies. The date at the top of this page shows the last change.