Privacy Policy

Ribbsaeter Systems(“we”, “us”, or “our”), headquartered at Bahnhofstrasse, 8001 Zurich, Switzerland, is the data controller responsible for the processing of personal data collected through ribbsaetersystems.com (the “Site”), our technical monograph fulfillment portals, and related enterprise communications.

For privacy inquiries, data subject access requests, or to exercise your statutory rights under the Swiss Federal Act on Data Protection (FADP / DSG) or EU General Data Protection Regulation (GDPR), contact our legal and privacy counsel at legal@ribbsaetersystems.com.

We operate under a strict data minimization standard: we process only the bare technical and transactional data strictly required to deliver our services, fulfill digital orders, and maintain the cryptographic integrity of our edge infrastructure.

• Commercial Transaction & Fulfillment Data: When you acquire a publication (e.g. THE MEMORY WALL or THE PAYWALL HAMMER), Stripe processes your payment information. We receive strictly transaction confirmation metadata (order identifier, billing email, corporate entity name, and timestamp) required to transmit your secure fulfillment link and official tax invoice. We never see or store full credit card numbers or CVV codes.
• Advisory & Inquiry Data: Contact information, enterprise email, company name, and technical project parameters submitted through our intake channels or direct correspondence.
• Technical Infrastructure Logs: Anonymized server-level telemetry (IP address, TLS cipher suite, request timestamps, and user-agent string) retained temporarily at the edge exclusively to defend against DDoS attacks, automated exploit scanners, and brute-force intrusions.

The Zero-Surveillance Sovereign: We do not track you across the web. We do not employ third-party ad pixels, cross-site trackers, or commercial data brokers. We do not sell, rent, or monetize personal data under any circumstances.

We process personal data strictly in accordance with recognized statutory legal bases:

• Contractual Performance (Art. 6(1)(b) GDPR / Art. 31 FADP): To fulfill digital publication purchases, provide download access tokens, issue VAT invoices, and execute client Statements of Work.
• Legitimate Interests (Art. 6(1)(f) GDPR / Art. 31 FADP): To protect the security and stability of our sovereign systems, defend our intellectual property against automated scraping or unauthorized reverse-engineering, and respond to commercial inquiries.
• Legal Obligations (Art. 6(1)(c) GDPR / Art. 31 FADP): To comply with Swiss and international commercial accounting, corporate tax retention, and statutory auditing mandates (Swiss Code of Obligations Art. 958f).

We rely on an elite, minimal cluster of enterprise infrastructure partners bound by rigorous Data Processing Agreements (DPAs):

• Vercel Inc. (USA / EU): Edge routing, static asset distribution, and global CDN hosting under EU Standard Contractual Clauses (SCCs).
• Cloudflare Inc. (Global / Switzerland): DNS resolution, TLS termination, and DDoS mitigation.
• Stripe Inc. (USA / EU): Certified PCI-DSS Level 1 payment gateway, automated corporate VAT/tax invoice issuance, and fraud mitigation.
• Google Workspace (Switzerland / EU): Encrypted corporate email and client communication archives.

• Digital Order & Billing Records: Retained for 10 years in strict compliance with Swiss corporate commercial code (Art. 958f OR) for statutory tax and audit defense.
• Advisory Correspondence: Retained for the duration of the active engagement plus statutory limitation periods (5–10 years under Swiss law).
• Transient Edge Security Logs: Automatically rotated and expunged within 30 days unless subject to active forensic investigation.

We enforce military-grade physical and cryptographic safeguards: strict TLS 1.3 in transit, AES-256 encryption at rest, hardware-token Multi-Factor Authentication (FIDO2/WebAuthn) across all engineer access points, continuous automated vulnerability audits, and strict principle-of-least-privilege access controls. No internet-facing service is deployed without rigorous security screening.

Under the Swiss Federal Act on Data Protection and EU GDPR, you maintain comprehensive sovereign rights over your personal data:

• Right of access and confirmation of processing (Art. 25 FADP / Art. 15 GDPR);
• Right to rectification of inaccurate records (Art. 32 FADP / Art. 16 GDPR);
• Right to erasure (“right to be forgotten”) where statutory retention rules permit;
• Right to restriction of or objection to processing (Art. 18/21 GDPR);
• Right to data portability in structured, machine-readable format;
• Right to lodge a complaint with your competent supervisory authority. In Switzerland: Federal Data Protection and Information Commissioner (FDPIC / Eidgenössischer Datenschutz- und Öffentlichkeitsbeauftragter EDÖB), Feldeggweg 1, CH-3003 Bern.

To exercise your rights, email legal@ribbsaetersystems.com. We process verified requests promptly and without undue delay.

Direct all legal, privacy, or sovereign data inquiries to: legal@ribbsaetersystems.com • Ribbsaeter Systems, Data Protection & Legal Affairs, Bahnhofstrasse, 8001 Zurich, Switzerland.