Privacy Policy & Data Protection Notice

01. Scope & Underlying Principles

This Privacy Policy and Data Protection Notice transparently describes how personal data is collected, processed, retained, and safeguarded when visiting or using the services provided via the website https://www.navasoft.ch/ (hereinafter referred to as the "Website").

Data privacy and intellectual integrity are foundational pillars of our software engineering consultancy. All processing operations comply strictly with applicable legal frameworks, specifically:

The Swiss revised Federal Act on Data Protection (nLPD / revFADP) and its accompanying Data Protection Ordinance (DPO);
The General Data Protection Regulation (GDPR - Regulation EU 2016/679) for users accessing our services from the European Union (EU) or European Economic Area (EEA).

02. Data Controller & Contact Details

The data controller responsible for the processing of personal data collected through this Website is:

NavaSoft

Headquarters: Ticino, Switzerland (CH)

Website: https://www.navasoft.ch/

Direct Privacy Inquiries: info@navasoft.ch

03. Categories of Personal Data Processed

A. Technical Navigation Data & Server Logs

When accessing the Website, our servers automatically record technical telemetry essential for network security, DDoS mitigation, and server stability. This data includes:

Anonymized or pseudonymized IP address of the requesting device;
Date, exact timestamp, and time zone of the HTTP/HTTPS request;
Target URI path and HTTP status code returned by the web server;
User Agent strings (operating system, browser type, and software version).

B. Data Provided via Consultation Forms & Direct Email

When submitting an architectural consultation request or contacting us via email, we collect only the information strictly required to assess technical feasibility and respond:

Full name;
Company or organization name;
Business email address;
Primary technical focus or service scope of interest;
Project brief details, current technical stack, and anticipated timeline.

04. Purposes & Legal Grounds for Processing

Processing Purpose	Swiss Legal Basis (nLPD)	EU Legal Basis (GDPR)
Website availability, technical diagnostics & cyber defense	Overriding legitimate interest (Art. 31 para. 1 nLPD)	Legitimate interest (Art. 6(1)(f) GDPR)
Handling project briefs, inquiries & consultation requests	Pre-contractual measures or explicit consent (Art. 31 para. 2(a) nLPD)	Pre-contractual measures or explicit consent (Art. 6(1)(b) or (a) GDPR)
Statutory accounting and regulatory record-keeping	Legal statutory obligation (Art. 31 para. 1 nLPD)	Legal compliance obligation (Art. 6(1)(c) GDPR)

05. Processors & Cross-Border Data Transfers

NavaSoft never sells, rents, or commercializes personal data. Data is shared exclusively with technical infrastructure providers bound by rigorous Data Processing Agreements (DPAs):

Hosting & Content Delivery Infrastructure: Our edge infrastructure and web servers are hosted within Switzerland and/or the European Union, benefiting from mutual adequacy decisions.
Consultation Form Ingestion Service (Web3Forms): We utilize the Web3Forms API relay solely to transport form submissions. Data is encrypted in transit via modern TLS 1.3 cryptographic protocols and delivered directly to info@navasoft.ch without ongoing third-party database retention.
Bilateral Non-Disclosure Agreements (NDAs): Any architectural blueprint, proprietary algorithm, or business requirement communicated during discovery is covered by bilateral confidentiality obligations.

If personal data is transferred to a jurisdiction outside of Switzerland or the EEA that lacks an adequacy decision by the Swiss Federal Council or EU Commission, such transfers are safeguarded via certified Standard Contractual Clauses (SCCs) supplemented by technical encryption measures.

06. Cookie Governance & Local Storage

Our Website applies a granular, privacy-by-default consent framework in accordance with the Swiss nLPD and the European ePrivacy / GDPR standards.

Strictly Necessary Cookies: Essential for cryptographic HTTPS handshakes, core DOM rendering, and remembering your privacy consent preferences. These cannot be deactivated;
Performance & Diagnostics Cookies (Optional): Deployed strictly on an opt-in basis to evaluate latency, asset load times, and technical system health in aggregated, non-personally identifiable formats;
Session & Form Personalization Cookies (Optional): Preserves consultation form field progress locally to prevent duplicate ticket transmissions.

You maintain complete autonomy over your consent settings. You can re-open and adjust your preferences at any time by clicking the "Cookie Preferences" link located in the Website footer.

07. Data Retention Schedules

Personal data is retained only for as long as strictly required to fulfill the stated operational purposes:

Inquiries and Architecture Briefs: Kept for the duration of the technical evaluation or pre-contractual negotiations. If no engineering contract is established, records are permanently erased within 12 months;
Contractual & Accounting Records: Retained for 10 years following contract completion pursuant to the statutory obligations of the Swiss Code of Obligations (CO / OR);
Technical Access Logs: Automatically purged or irreversibly pseudonymized on a rotating cycle between 7 and 30 days.

08. Technical & Organizational Measures (TOMs)

Reflecting Swiss high-assurance engineering standards, we implement robust Privacy by Design and Security by Design safeguards (Art. 7 nLPD and Art. 32 GDPR):

End-to-end TLS 1.3 cryptographic transit protocols across all digital touchpoints;
Strict HTTP security response headers including HSTS, Content Security Policy (CSP), and anti-clickjacking directives;
Hardened, immutable containerized deployment pipelines with zero unnecessary attack surfaces;
Access governance restricted strictly to the lead engineer protected by multi-factor hardware authentication (MFA).

09. Your Rights as a Data Subject

Under the Swiss nLPD (Articles 25–29) and the EU GDPR (Articles 15–22), you are entitled to the following rights regarding your personal information:

Right of Access: Obtain confirmation as to whether your personal data is processed, alongside a copy of the recorded data;
Right to Rectification: Request immediate correction of inaccurate, outdated, or incomplete records;
Right to Erasure ("Right to be Forgotten"): Demand the deletion of personal records, subject to statutory retention mandates;
Right to Restriction & Objection: Object to or restrict specific processing operations based on legitimate interests;
Right to Data Portability: Request delivery of your submitted personal data in a structured, commonly used, and machine-readable format;
Right to Withdraw Consent: Revoke any previously granted consent at any time, without affecting processing executed lawfully prior to revocation.

To exercise any of these rights, please submit a written request accompanied by verification of identity to: info@navasoft.ch.

10. Competent Supervisory Authorities

If you believe your data protection rights have been infringed, you retain the right to lodge a formal complaint with the competent supervisory body:

Switzerland: Federal Data Protection and Information Commissioner (FDPIC / EDÖB), Feldeggweg 1, CH-3003 Bern, Switzerland (edoeb.admin.ch);
European Union: The Data Protection Authority (DPA) of the specific EU Member State in which you reside, work, or where the alleged infringement took place.

11. Policy Revisions & Updates

We reserve the right to revise this Privacy Policy periodically to reflect technological adjustments, software upgrades, or evolving statutory requirements. The version published on this page constitutes the prevailing legal version.