Legal Notice – Imprint & Privacy Policy

1. Scope

This Privacy Policy explains how we process personal data when you visit our website, use embedded content, or contact us.
It is intended to meet the requirements of the Swiss revised Federal Act on Data Protection (revFADP / nFADP) and,
where applicable (e.g. if we offer services to individuals in the EU/EEA), the EU General Data Protection Regulation (GDPR),
including the Dutch implementation (AVG).

2. Controller

HERR Pluto AG, Churerstrasse 58, 8852 Altendorf, Switzerland
Email: diverto@ditec-bms.de

3. Data we process

• Technical and log data: IP address, date/time, requested URL, referrer URL, browser/device information, server logs.
• Communication data: information you provide when contacting us (e.g. email address and message content).
• Form submissions: data you enter into forms (Gravity Forms), plus metadata such as submission time; IP address may be recorded depending on configuration.
• Consent and cookie data: your cookie preferences and consent status (stored via our consent tool).

4. Purposes of processing

• Provide and deliver the website content, ensure stability and security.
• Respond to enquiries and handle communications.
• Provide forms and process user requests submitted via forms.
• Manage cookie preferences and (where required) obtain and store consent.
• Load embedded third-party content (Google Maps) if enabled and/or consented to.

5. Legal bases (GDPR, if applicable)

Where GDPR applies, we process personal data based on one or more of the following legal bases:

• Legitimate interests (Art. 6(1)(f) GDPR): secure operation of the website, prevention of abuse, technical administration.
• Contract / pre-contractual measures (Art. 6(1)(b) GDPR): handling enquiries that relate to a potential contract.
• Consent (Art. 6(1)(a) GDPR): for non-essential cookies and for loading third-party embedded content where required.
• Legal obligation (Art. 6(1)(c) GDPR): if statutory retention obligations apply.

Under Swiss law (revFADP/nFADP), we process personal data lawfully, in good faith, proportionately and for the stated purposes.

6. Hosting and website infrastructure

Our website is hosted with STRATO. When you access our website, technical log data may be processed to deliver the website and ensure security.
STRATO operates data centres in Germany.

The website is built with WordPress and uses, among others: WPBakery, Bridge Core, Gravity Forms, LayerSlider,
UpdraftPlus, All-in-One WP Migration and Backup, Disable Emojis, and CookieYes. These components are used to provide site functionality.

7. Contact and forms (Email & Gravity Forms)

If you contact us by email or submit a form, we process the data you provide to respond to your request and to handle follow-up communication.
Form submissions may be stored in the website database and in email notifications, depending on the configuration.

8. Backups and migrations

We create backups for security and recovery purposes (e.g. via UpdraftPlus and All-in-One WP Migration). Backups can include database contents,
which may contain form submissions if those are stored in the database.

Backups may be stored on the hosting environment and/or on external storage configured by us. Access to backups is restricted and protected with
appropriate measures (e.g. strong authentication, access controls, encryption and/or password protection depending on the storage method).

9. Cookies and consent management (CookieYes)

We use cookies and similar technologies to operate the website and, where applicable, to enable additional features.
We use CookieYes to request, store and manage cookie preferences. This includes recording your consent status
so we can demonstrate compliance where required.

Cookie categories

• Essential cookies: necessary for core website functionality and security.
• Functional cookies: improve usability and remember preferences (only used if enabled/required).
• Embedded third-party content cookies: may be set when third-party content (e.g. maps) is loaded.

No analytics / no advertising tracking: We do not use analytics tools (e.g. Google Analytics) or advertising tracking on this website.
Third-party cookies may still be set when embedded third-party content is loaded (e.g. Google Maps), depending on your settings and region.

Netherlands / EU visitors: Non-essential cookies and comparable technologies are only used after your consent where required.
You can change your cookie preferences at any time using the cookie settings available on this website.

10. Google Maps (embedded content)

We may embed Google Maps to display interactive maps. When Google Maps is loaded, your IP address and technical information
may be transmitted to Google and cookies may be set. Depending on your region and consent settings, the map may only load after you consent
to embedded third-party content.

International transfers: Google may process data outside Switzerland and/or the EU/EEA. Where required, we rely on recognised
safeguards and additional measures as appropriate.

11. Recipients and processors

We may disclose personal data to service providers that support us in operating the website (e.g. hosting, backup tooling, consent management),
acting as processors under contractual obligations and only to the extent necessary.
Embedded third-party providers (e.g. Google) may process data as independent controllers when their content is loaded.

12. Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss and misuse.
However, no method of transmission over the internet is completely secure.

13. Retention

We retain personal data only as long as necessary for the purposes described in this policy and in accordance with applicable legal retention
obligations (if any). Technical logs are typically retained for a limited period for security and troubleshooting purposes.

14. Your rights

Switzerland (revFADP / nFADP)

• Right to information/access and to receive a copy of personal data processed about you.
• Right to have inaccurate personal data corrected.
• Right to object and to request deletion or restriction where applicable.

EU/Netherlands (GDPR, if applicable)

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object (Art. 21 GDPR)
• Right to withdraw consent at any time (Art. 7(3) GDPR)

To exercise your rights, please contact us at
diverto@ditec-bms.de.
We may request reasonable proof of identity.

15. Complaints / supervisory authorities

Switzerland: You may contact the Federal Data Protection and Information Commissioner (FDPIC).
Submitting a complaint to the FDPIC

Netherlands / EU (if applicable): You may lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
Submitting a complaint to the AP

16. No accounts, checkout, newsletter

This website does not offer user accounts, a checkout process, or a newsletter subscription.

17. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. The current version is published on this page and indicated by the “Last updated” date.

18. Contact