Privacy Policy

Lavanchy Automation — Version: 09.09.2026

This is a free translation for information purposes. Only the German version is legally binding and prevails in case of discrepancies.

1. Controller

Lavanchy Automation
Rue du Centre 53
1025 St-Sulpice VD
Switzerland

Email: lo.lavanchy@gmail.com
Phone: +41 79 687 81 28

2. General

The protection of your data is important to me. This privacy policy explains which data is processed when you visit this website and within automation and consulting projects, for what purpose and on what basis. It also informs about the rights of persons whose data is processed.

The Swiss Federal Act on Data Protection (FADP) applies. Insofar as personal data of persons from the EU is processed, the European General Data Protection Regulation (GDPR) applies in addition.

Technical and organisational measures have been implemented to ensure the most complete possible protection of personal data processed via this website. Nevertheless, internet-based data transmissions can in principle have security gaps, so absolute protection cannot be guaranteed. For this reason, every data subject is free to transmit personal data by alternative means, for example in writing or by telephone.

3. Categories of data processed

The personal data processed is that which is required to provide the offering in a lasting, user-friendly, secure and reliable manner. Such personal data may in particular include the following categories:

• Master and contact data (e.g. name, email address, phone number)
• Browser and device data (e.g. IP address, browser type, operating system)
• Usage data (e.g. pages visited, time of access)
• Contract and payment data within client projects

Personal data is processed for the period required for the respective purpose or by law. Data whose processing is no longer required is anonymised or deleted (see also section 11).

4. Server and hosting

This website is operated on a server. Technical access data may be processed in the process, for example IP address, date and time of access, page accessed, browser type and operating system. The basis for this is the legitimate interest in secure and stable operation of the website (Art. 31 para. 1 FADP or Art. 6 para. 1 lit. f GDPR).

The VPS used is provided by Hostinger and located in Germany. Server logs are retained for a maximum of 30 days, unless security-relevant incidents require longer retention.

5. Plausible Analytics

This website uses Plausible Analytics Community Edition for the statistical analysis of website usage. Plausible is self-hosted and runs on a dedicated VPS in Germany (Hostinger).

Plausible does not use cookies, does not store IP addresses permanently and does not create personal user profiles. There is no tracking across websites or devices. The basis is the legitimate interest in privacy-friendly statistical analysis of website usage in order to improve the website (Art. 31 para. 1 FADP or Art. 6 para. 1 lit. f GDPR).

6. Contact form (Tally)

The contact form on this website uses the service Tally (Tally Technologies, Belgium). The form is integrated as an embedded element (iframe). Tally processes the data entered directly on its own infrastructure with servers located in the EU.

When the contact form is used, name, email address and message are processed. The basis for this is handling your enquiry, where applicable as a pre-contractual measure (Art. 31 para. 2 lit. a FADP or Art. 6 para. 1 lit. b GDPR).

Loïc Lavanchy is additionally notified automatically of new form submissions in an internal Slack workspace in order to be able to respond promptly. No form content (name, email address, message) is transmitted to Slack, only the notice that a new submission has been received.

The data collected via the contact form is deleted as soon as it is no longer required for handling the enquiry, but no later than after 24 months without further contact, unless statutory retention obligations prevent this.

7. Appointment booking (meetergo)

meetergo, an appointment booking tool with servers located in Germany, is used to book an initial call, specifically via cal.meetergo.com/loic-lavanchy. The booking link opens the meetergo page externally in a new tab. No booking content is embedded in this website.

When booking an appointment, name, email address, appointment details and other information you enter may be processed. The basis for this is arranging the initial call as a pre-contractual measure (Art. 31 para. 2 lit. a FADP or Art. 6 para. 1 lit. b GDPR). meetergo’s privacy provisions apply in addition.

8. Data processing within automation projects

Within specific automation projects (e.g. setting up n8n workflows), Lavanchy Automation may access clients’ systems on their behalf (e.g. Excel files, third-party CRM or project management tools) and process data there. This processing takes place exclusively on the instructions of the respective client and within the scope of the agreed engagement.

Insofar as personal data of the client or its end clients is processed, the respective client is responsible for the lawfulness of this data processing towards its own end clients. Lavanchy Automation processes this data as a processor or vicarious agent within the meaning of Art. 9 FADP or Art. 28 GDPR, where applicable.

If AI services are used within a project (see section 9), no client, personal or project data is transmitted to these AI services unless this has been expressly agreed in writing for the specific project.

9. Use of AI tools in project implementation

AI-assisted tools may be used to support the technical development when building automation processes. As a matter of principle, no data from client systems is passed on to these AI tools. Any existing connection to AI tools is disconnected again once setup is complete.

10. Managed AI consulting (e.g. headwAI)

Within managed AI consulting, third-party solutions such as headwAI may be used, depending on the project and by express agreement with the client. Data protection, the GDPR and the requirements of the EU AI Act are taken into account when selecting and setting up such solutions. The specific data processing is governed by the agreement made for the respective project and the privacy provisions of the respective third-party provider.

11. Retention period

Personal data is only retained for as long as necessary for the respective purposes or as required by statutory retention periods (e.g. commercial and tax retention obligations of generally 10 years for business correspondence and accounting records).

12. Links to other websites

References and links to third-party websites lie outside our own area of responsibility and control. No liability whatsoever is accepted for such websites. Access to and use of such websites is at the visitor’s own risk. There is no separate notice when users leave this website. In the event of a redirect to another website, the privacy policy of the respective provider applies.

13. Data security

For visits to this website, the widely used SSL/TLS method (Secure Socket Layers or Transport Layer Security) is used in conjunction with the highest level of encryption supported by the browser in use.

In addition, appropriate technical and organisational security measures are taken to protect data against accidental or intentional manipulation, partial or complete loss, destruction or unauthorised access by third parties. These security measures are continuously reviewed and improved in line with technological developments.

14. Rights of data subjects

Where the statutory requirements are met, data subjects have the following rights:

• Right of access: to request information about the personal data processed, in particular about the purposes of processing, the categories of personal data, the categories of recipients, the planned retention period, the existence of a right to rectification, erasure, restriction of processing or objection, the existence of a right to lodge a complaint and the origin of the data, if it was not collected directly.
• Right to rectification: to request the rectification of inaccurate or the completion of stored personal data.
• Right to erasure: to request the erasure of stored personal data, unless processing is necessary for exercising the right of freedom of expression and information, for compliance with a legal obligation, for reasons of public interest or for the establishment, exercise or defence of legal claims.
• Right to restriction of processing: to request the restriction of processing where the accuracy of the data is contested, the processing is unlawful but erasure is opposed, the data is no longer needed but is still required for the establishment of legal claims, or an objection to processing has been lodged.
• Right to data portability: to receive personal data one has provided in a structured, commonly used and machine-readable format or to request its transmission to another controller.
• Right to review of automated individual decisions: in the case of exclusively automated decisions, to present one’s own point of view and to request that the decision be reviewed by a natural person.
• Right to lodge a complaint: to lodge a complaint with the competent supervisory authority.

The competent supervisory authority in Switzerland is the Federal Data Protection and Information Commissioner (FDPIC); in the EU, it is the respective competent data protection authority.

For data protection questions or to exercise these rights: lo.lavanchy@gmail.com

15. Changes to this privacy policy

This privacy policy may be amended to adapt it to changes in the legal situation or to changes to the website or the services offered. The version published on the website at any given time applies.