1. Controller and contact
ICON CONSULTING GmbH, Schifflände 26, 8001 Zürich, Switzerland, is responsible for the processing described here. Contact: info@iconconsulting.ch. This notice concerns this website and enquiries sent to ICON; linked services have their own notices.
2. Visiting the website
When you request a web page, technical information such as your IP address, request time, requested resource, response status and browser information is transmitted to the hosting infrastructure. Technical processing supports delivery, reliability and protection against misuse. Whether and for how long request data is logged depends on the hosting configuration.
3. The project-brief composer
The project-brief composer prepares an email in your browser. Its fields are not submitted to an ICON server by the page, and the page does not save them in cookies, local storage or a database. Your browser may separately offer autofill. If you choose “Copy draft”, the draft is copied to your device clipboard. If you choose “Open email app”, the draft is passed to your selected email application. You decide whether to send it.
4. Correspondence
If you send an email, ICON receives the information you choose to provide, such as your name, email address, organisation and project overview, together with email metadata. It is used to respond, assess the enquiry, prepare a proposal and, where an engagement follows, administer the agreed work. Please do not include sensitive personal information or confidential project documents in an initial enquiry.
5. Service providers and recipients
Hosting, email and IT service providers may process information as necessary to operate these services. Information may also be disclosed to professional advisers or competent authorities where necessary for legal obligations or the establishment, exercise or defence of rights. This website does not automatically route enquiries to collaboration partners.
6. International processing
The location of processing depends on the hosting and email services used and their subprocessors. Where personal data is disclosed abroad, applicable Swiss requirements govern the destination and any necessary safeguards. Specific provider locations and transfer arrangements must correspond to the services in operation; contact ICON for information about the handling of your enquiry.
7. Retention
Correspondence is retained for as long as needed to handle the enquiry and any resulting engagement, and for applicable legal recordkeeping or the establishment, exercise or defence of rights. Data that is no longer needed should be deleted or anonymised. Technical-log retention follows the hosting configuration. No visitor profile or project-brief history is stored. Payment records are described below.
8. Cookies, analytics and external services
General content pages do not set cookies or load analytics, advertising pixels, third-party maps, social widgets or remote fonts. The support-payment flow uses a necessary session cookie for request security. It does not use marketing tracking. Images, scripts and styles are served with the website. Amazon and Helpygram are ordinary outbound links: opening one takes you to another service, whose processing is governed by its own notice. See the Cookie Policy and Support Terms.
Support contributions and payment processing
If you start a support payment, the website processes your chosen amount, a random transaction reference, payment status, and your acceptance of the Support Terms with its time and version. These records support payment creation, reconciliation, accounting and error handling. The site uses a necessary session cookie (ICON_SUPPORT) to protect payment requests. Temporary rate-limit records use a keyed hash of the connection address; these are removed after their one-hour window when the endpoint is next used.
Mollie B.V., Keizersgracht 126, 1015 CW Amsterdam, the Netherlands, processes checkout and may receive payment, identity, device and fraud-prevention information according to the payment method and its own Privacy Statement. Information sent from this integration includes the amount, currency, description and transaction reference. Card details and banking credentials are entered with the payment provider, not in this website. The Netherlands is the payment-provider destination; Mollie’s current statement describes its subprocessors and any further international processing.
ICON processes transaction records for the contribution, statutory accounting and the establishment, exercise or defence of rights. Where the GDPR applies, the relevant bases may include Article 6(1)(b), 6(1)(c) and, for necessary security, 6(1)(f). Accounting records may need to be retained for ten years under Swiss recordkeeping rules. Records unnecessary for these purposes should be deleted under the company’s retention schedule. Payment records are stored on the server in a protected location.
9. Automated decisions
The website does not score enquiries, profile visitors or make automated individual decisions with legal or similarly significant effects. Preparing an email locally is not an automated decision about your enquiry.
10. Your rights
Subject to the applicable law and its conditions, you may request information about your personal data and seek correction, deletion, restriction or transfer of eligible data, or object to processing. Where processing relies on consent, you may withdraw it for the future. ICON may need proportionate information to verify your identity. Write to the contact above. You may also contact the Swiss Federal Data Protection and Information Commissioner or another competent supervisory authority.
11. Where the GDPR applies
Where processing falls within the territorial scope of the EU GDPR, handling pre-contractual enquiries or an engagement may rely on Article 6(1)(b), legal duties on Article 6(1)(c), and necessary site operation, security or business correspondence on legitimate interests under Article 6(1)(f), subject to the required balancing of interests. Consent, where required, is addressed separately. The GDPR does not apply solely because a website can be viewed from the EU.
12. Security and updates
Reasonable technical and organisational measures should protect personal data in accordance with the risks. Ordinary email is not a secure document room; a suitable exchange method can be arranged for sensitive material. This notice must be updated when the actual processing changes.