Privacy Policy

Ribbsaeter Systems (“we”, “us”, “our”) is the data controller responsible for the personal data we process about you when you use our website, contact us, or engage us for services.

For privacy-related questions or to exercise your rights, contact privacy@ribbsaetersystems.com.

We collect only the data we genuinely need:

• Contact data — name, email, company, phone, project description provided through forms or email.
• Engagement data — billing details, contracts, communications, project artefacts and meeting recordings (only with consent).
• Technical data — IP address, browser, device, referrer and pages visited, collected through privacy-friendly analytics.
• Cookies — limited to what is required for the site to work and, with consent, basic analytics. See our Cookie Policy.

We do not sell, rent or trade personal data. Ever.

We process personal data to:

• respond to inquiries and prepare proposals;
• negotiate, perform and account for contracts with you;
• deliver, support and maintain our services;
• send transactional and (with consent) occasional marketing emails;
• understand site usage and improve our offering;
• comply with legal, tax and regulatory obligations;
• detect, prevent and respond to fraud or abuse.

• Contract — to take steps at your request before entering a contract and to perform a contract with you.
• Legitimate interests — to run, secure and improve our business, including responding to inquiries and analysing aggregated site usage.
• Consent — for non-essential cookies, marketing emails and recording of meetings. You may withdraw consent at any time.
• Legal obligation — for accounting, tax and AML/KYC requirements.

Your data stays with us and a small set of carefully chosen processors who help us run the business:

• cloud and hosting providers (e.g. Netlify, Cloudflare, AWS);
• email and CRM (e.g. Google Workspace, HubSpot);
• analytics (e.g. Plausible, Vercel Analytics);
• billing, accounting and tax advisors;
• legal counsel where strictly necessary.

Each processor is bound by a data processing agreement and processes data only on our documented instructions.

Some of our processors are based outside the EU/EEA. Where this is the case, we rely on European Commission adequacy decisions or Standard Contractual Clauses (SCCs) supplemented by additional safeguards as required by the Schrems II ruling.

• Inquiries that don't lead to contracts: up to 24 months, then deleted.
• Active client records: for the duration of the engagement.
• Closed engagements: 7 years after closure for accounting and statutory limitation periods.
• Marketing consent: until you unsubscribe or withdraw consent.
• Server logs: typically up to 30 days unless retained for security investigation.

Under the GDPR you have the right to:

• access the personal data we hold about you;
• rectify inaccurate or incomplete data;
• erase data (right to be forgotten) where applicable;
• restrict or object to processing;
• data portability;
• withdraw consent at any time without affecting prior processing;
• lodge a complaint with the supervisory authority in your country (in Switzerland: Federal Data Protection and Information Commissioner · FDPIC).

To exercise any of these rights, email privacy@ribbsaetersystems.com and we will respond within 30 days.

We protect personal data with industry-standard technical and organisational measures: TLS in transit, encryption at rest where applicable, least-privilege access, MFA on all critical systems, regular backups, vulnerability monitoring and staff training. No system is perfectly secure, but we treat your data the way we want ours to be treated.

Our services are intended for businesses and adults. We do not knowingly collect personal data from children under 16. If you believe a child has provided us data, please contact us so we can delete it.

We may update this policy when our practices, the law, or our processors change. The “Last updated” date at the top reflects the current version. Material changes will be communicated in advance where required.