Privacy policy.

Last updated

25 August 2026

1. Who we are

Sustema AG is responsible for the personal data described in this policy.

Sustema AG
Sihlquai 125
8005 Zurich
Switzerland

For privacy questions or to exercise your data-protection rights, contact privacy@sustema.io.

2. What this policy covers

This policy explains how we handle personal data when you visit sustema.io, contact us or submit a website enquiry. It does not describe personal data processed within a separately contracted Sustema product or customer service; the applicable agreement and service-specific information govern those activities.

3. Visiting the website

When your browser requests a page or asset, our hosting and content-delivery providers may process operational information such as your IP address, request time, requested URL, browser or user-agent information, response status and security diagnostics. We use this information only to deliver, protect, troubleshoot and maintain the website.

The public website is hosted through Fly.io and currently serves some website images through Google Cloud Storage. Those providers may process limited request information when delivering the site or an image.

We use Umami Cloud to understand, in aggregate, which public pages are useful and whether key website journeys work. Umami records page views, referrer, broad device/browser and country information, and these controlled events: call-to-action selected, enquiry form opened and enquiry submitted successfully. The tracker does not use cookies, fingerprint visitors, create advertising profiles, replay sessions or track people across websites.

We do not send Umami names, email addresses, organisations, roles, enquiry text, request or intake identifiers, receipt tokens, or any other form-field content. We do not use the public website to make solely automated decisions about you.

Our basis for this processing is our legitimate interest in operating and improving a secure and reliable public website. Where Swiss law applies, we process this information in accordance with the Swiss Federal Act on Data Protection.

4. Website enquiries

If you submit an enquiry, we collect the information you choose to provide, which may include:

• the Sustema solution or general topic you select;
• your description of what you are working on, your current approach and what you would like to improve, or your general message;
• relevant jurisdiction information where the form asks for it;
• your name, work email address and organisation;
• your role or responsibility, if supplied;
• your privacy acknowledgement and any separate optional updates choice; and
• limited context about how the form was opened, such as the originating Sustema page and call-to-action.

How we use enquiry information

We use this information to receive, route, assess and respond to your enquiry, maintain an appropriate business record, prevent duplicate processing and protect the form from misuse. An enquiry does not create product access, approve a commercial relationship or make a solely automated qualification or contracting decision.

Where the EU or UK GDPR applies, we rely on steps taken at your request before entering a contract, our legitimate interests in responding to business communications and managing potential customer or partner relationships, compliance with a legal obligation where necessary, and consent only for separate optional updates.

Please do not submit passwords, credentials, secret keys, special-category or sensitive personal data, or confidential client information through the form.

5. Optional updates

You can separately choose to receive occasional Sustema updates by email. This choice is optional, is not required to submit an enquiry and is unchecked by default. You can withdraw at any time by using the unsubscribe method in a message or contacting privacy@sustema.io.

6. How enquiries are handled

Website enquiries are transmitted to Sustema's controlled Google Workspace environment using Google Apps Script and recorded in a restricted Google Sheet used as Sustema's first-stage customer-relationship tracker. Google Workspace email may send a receipt to you and a data-minimised alert to the limited Sustema team responsible for responding.

Access to the full enquiry is limited to authorised Sustema personnel and the dedicated, file-specific automation identity used to operate the transport. We do not sell enquiry data or disclose it to third parties for their own advertising.

7. Service providers and international processing

We use service providers where necessary to operate the website and enquiry workflow:

• Fly.io for public website hosting;
• Google Cloud Storage for delivery of certain public website images;
• Umami Software, Inc. for cookie-free, aggregate website measurement; and
• Google Workspace, including Apps Script, Google Sheets and email, for website enquiries.

International processing

These providers and their authorised subprocessors may process data outside Switzerland, the European Economic Area or the United Kingdom. Where required, recognised safeguards apply, such as an adequate-country determination and approved contractual transfer clauses.

Sustema uses Workspace Enterprise Plus and currently sets covered data at rest to Europe. The separate setting to process data in that selected region is off. We therefore do not claim that all Workspace processing remains in Switzerland or the European Union.

8. Retention

We retain personal data only for as long as reasonably necessary for the purpose for which it was collected and for applicable legal, security or record-keeping requirements.

• We delete or anonymise an unqualified or closed website enquiry and its linked working records no later than 24 months after the last meaningful interaction, unless needed for a current relationship, legal requirement or dispute.
• If an enquiry becomes an active customer, supplier, partner or contractual matter, we move only the necessary information under the retention rule that applies to that relationship and remove redundant enquiry detail.
• We retain an active optional-updates record while the consent is in use. After withdrawal, we retain only the minimum evidence and suppression information needed to respect the choice.
• We retain technical receipt and retry information only for reconciliation and a short operational assurance period, normally no more than 90 days.
• Operational hosting and security logs are retained for the shortest practical provider or security period.
• Recovery copies follow Sustema's controlled backup rotation and provider deletion cycles.

9. Security

We use proportionate technical and organisational safeguards, including encrypted transmission, restricted file sharing, protected CRM ranges, limited named-user access, a file-specific automation identity, stable request identifiers, duplicate prevention, data-minimised notifications and a controlled pause and rollback procedure.

No internet transmission or storage system can be guaranteed to be completely secure. Please use the form only for the requested business information and not for secrets or sensitive material.

10. Your rights

Depending on the law that applies, you may have rights to request information about your personal data and to ask for access, correction, deletion, restriction, objection or portability. Where processing relies on consent, you may withdraw it at any time. You may object at any time to direct marketing.

To make a request, contact privacy@sustema.io. You may also complain to the competent data-protection authority, including the Swiss Federal Data Protection and Information Commissioner where applicable.

11. External links

The website may link to third-party sites such as LinkedIn or Google Maps. If you follow an external link, the third party's privacy information applies. Sustema does not load those third-party services merely because a normal text link appears on a page.

12. Changes to this policy

We may update this policy when the website, enquiry process, providers or legal requirements change. We will publish the updated version and revision date on this page and provide additional notice where appropriate.