Privacy Policy

Last updated: 4 November 2026

This Privacy Policy explains how Carlavia AG (“Carlavia”, “we”, “us”) handles personal data when you visit this corporate website, contact us, enquire about our services, apply for a position, or otherwise communicate with us. It applies to this corporate website, not automatically to separate customer platforms or third-party products linked from it. Such services may have their own privacy notices.

1. Who is responsible for your data?

Carlavia AG
Schindellegistrasse 73
8808 Pfäffikon, Canton of Schwyz
Switzerland
Company identification number (UID): CHE-402.814.412
Email: [email protected]

For privacy questions and requests concerning your personal data, contact us using the email address above. Where a separate data protection contact or representative is required by applicable law, the relevant details will be provided through the appropriate channel.

2. Applicable data protection law

We process personal data in accordance with the Swiss Federal Act on Data Protection (FADP) and its implementing rules. Where the EU or UK data protection rules apply to a particular processing activity, we also observe the relevant requirements, including the EU General Data Protection Regulation (GDPR), as applicable. The legal bases described below refer to the GDPR where it applies; Swiss law does not require an identical legal-basis classification for every ordinary private-sector processing operation.

3. Personal data we may collect

• Information you provide: name, business email, telephone number, organisation, position, project requirements and the content of messages or files you choose to send.
• Recruitment information: CV, employment history, professional skills, qualifications and information you supply in connection with an application.
• Website and technical information: IP address, access time, requested pages, browser and device details, referring page, technical logs and security events, as generated by ordinary website operation.
• Preferences and communications: your subscription preferences, correspondence history and, where applicable, consent preferences for optional technologies.
• Business relationship information: information about prospective customers, suppliers or partners, including relevant contact details and professional communications.

Please do not send sensitive personal data unless it is necessary for a specific request and we have provided an appropriate secure channel.

4. Why we process personal data

• Enquiries and communications: to respond to requests, arrange meetings, provide proposals and manage potential or existing business relationships.
• Website delivery and security: to provide access to this website, maintain technical availability, detect misuse and protect systems.
• Recruitment: to evaluate applications, communicate with candidates and manage recruitment decisions.
• Business administration and compliance: to keep necessary records, protect legal rights, comply with applicable duties and resolve disputes.
• Communications and newsletters: to send updates you have requested or otherwise receive lawfully, subject to the applicable marketing and opt-out requirements.
• Optional analytics or embedded services: only to the extent actually implemented, with consent where required and as explained in the Cookie Policy.

5. Legal bases where GDPR applies

Depending on the activity, we rely on steps taken at your request before entering into a contract or performance of a contract (Article 6(1)(b)); compliance with legal obligations (Article 6(1)(c)); our legitimate interests in secure operations, communications, recruitment and business administration (Article 6(1)(f)), where these are not overridden by your rights; or your consent (Article 6(1)(a)), where required, including for certain optional cookies and marketing activities. A specific processing activity may involve more than one purpose or basis.

6. Who may receive personal data?

Information may be accessible, on a need-to-know basis, to authorised Carlavia personnel, relevant group entities, advisers and service providers supporting website hosting, IT operations, communications, recruitment, security or business administration. They receive only information necessary for their role and are subject to appropriate contractual, professional or legal safeguards. We may also disclose information where legally required or necessary to establish, exercise or defend legal claims. We do not sell personal data.

7. International data transfers

Carlavia is established in Switzerland and may work with service providers or group members outside Switzerland. If personal data is disclosed internationally, we assess the destination and use appropriate safeguards where required, such as an adequacy decision, recognised standard contractual clauses with necessary supplements, or a legally permitted exception. Where Swiss law requires it, information on the destination countries and safeguards will be provided in an appropriate manner. You can request further information about transfers relevant to your data.

8. How long we keep information

We retain personal data only for as long as reasonably necessary for the purpose for which it was collected, including responding to enquiries, managing business relationships, considering applications, protecting systems and meeting statutory retention or limitation requirements. Retention depends on the type of record, applicable law, ongoing relationships and potential legal claims. When the relevant purpose and obligations end, information is deleted or anonymised in accordance with applicable requirements.

9. Security

We apply technical and organisational measures appropriate to the risks, including measures intended to protect confidentiality, integrity and availability. No transmission or storage method is entirely risk-free. If you believe information has been exposed or misused, please contact us promptly.

10. Your rights

Subject to the requirements and exceptions of applicable law, you may request information about or access to your data, correction of inaccurate data, deletion, restriction of processing, objection to certain processing and portability where available. Where processing is based on consent, you may withdraw consent for the future without affecting prior lawful processing. Under the GDPR, you may also object to direct marketing at any time. We may need to verify your identity before acting on a request.

Send requests to [email protected]. You may also contact the Swiss Federal Data Protection and Information Commissioner (FDPIC) or, where the GDPR applies, lodge a complaint with a competent data protection supervisory authority.

11. Cookies and similar technologies

This website may use cookies, local storage and comparable browser technologies to support functionality and, where enabled, optional analytics or integrations. Their purposes and your available choices are explained in our Cookie Policy. Non-essential technologies requiring consent under applicable law must not be activated before the necessary consent has been obtained.

12. Third-party websites and services

Links to other websites and products are provided for convenience. Their operators are responsible for their own content and data-processing practices. Please review the notices of the relevant service before providing personal data.

13. Children

This corporate website is intended for professional audiences and is not directed at children. We do not knowingly seek personal data from children through this website.

14. Updates to this notice

We may revise this Privacy Policy when our processing activities, service providers, website features or legal requirements change. The updated version will be made available on this page with a revised date.