Privacy Policy

1. Scope and Principles

1.1 This privacy policy describes how Xerio GmbH («Xerio», «we») processes personal data when you visit our website, contact us, use our customer portal or obtain our services.

1.2 The Swiss Federal Act on Data Protection (FADP) applies. Where the EU General Data Protection Regulation (GDPR) applies to a given processing activity, we additionally meet its requirements.

1.3 We process only the data we need for the purpose in question. We do not sell personal data and do not pass it to third parties for advertising purposes.

1.4 For data we process on behalf of our customers, clause 13 applies together with the Data Processing Agreement in Annex 2 of our GTC.

2. When You Visit This Website

2.1 Server logs

When you access our website, data is transmitted for technical reasons and recorded in log files: IP address, date and time of access, page requested, HTTP status code, volume of data transferred, referrer, and browser and operating system details. This data serves to deliver the page, to troubleshoot faults and to defend against attacks. We do not combine it with other data sources.

2.2 Cookies

This website sets no cookies for advertising or analytics purposes. The customer portal at cp.xerio.ch sets strictly necessary cookies for sign-in, session management and cross-site request forgery protection. The portal cannot be used without them.

2.3 Fonts

We embed fonts in a way that establishes no connection to third-party servers when the page loads. No data is transmitted to third parties in the process.

2.4 Spam protection on the contact form

To protect our contact form against automated submissions we use Cloudflare Turnstile, a service of Cloudflare, Inc. When the form loads, a connection to Cloudflare is established and technical details about your device and connection — in particular IP address, browser details and interaction patterns — are processed in order to distinguish a human submission from an automated one. Turnstile sets no cookies for advertising or analytics purposes and builds no cross-site usage profile.

This processing is necessary for us to offer the form at all; without it the form would become unusable through abuse within a short time. It is based on our legitimate interest in a functioning contact channel that is protected against misuse. Cloudflare may process data outside Switzerland; the conditions in clause 9 apply. If you prefer to avoid this, write to us directly at hello@xerio.ch instead.

We use the same protection in the customer portal at cp.xerio.ch.

2.5 Embedded content

Where we embed third-party content — such as maps or videos — this happens only after your express consent. Until then, no connection to the respective provider is established. This does not apply to the spam protection under clause 2.4, which is necessary for the form to operate.

3. Contact and Support

3.1 If you contact us via the contact form, by email, by telephone or through our ticket system, we process the details you provide — as a rule name, company, email address, telephone number and the content of your enquiry — in order to handle your request.

3.2 Support requests are documented in the ticket system of the customer portal. The history remains visible to you and to us so that later requests can be assessed in context.

3.3 Under clause 3.1.2 of the GTC we may request evidence to verify your details, for instance a commercial register extract or a copy of an identity document. We process such evidence solely to verify identity and to prevent misuse.

4. Customer Relationship and Contract

4.1 To establish and perform a contract we process account and contract data: name, company, address, contact details of the billing, administrative and technical contacts, services obtained, contract terms and the history of communications.

4.2 For invoicing we process payment data. Card payments are handled by specialised payment service providers; we neither collect nor store full card numbers.

4.3 In the event of late payment we may pass the data required for legal enforcement to debt collection providers, legal representatives and the competent authorities.

4.4 We may inform you about our own services and developments. You can unsubscribe at any time via the unsubscribe link or in the customer portal; system and billing notices necessary for operations are excluded.

5. Domain Names and WHOIS

5.1 Where we register a domain name for you, we are obliged to pass the registrant data — name, address, email address and telephone number — to the competent registry and to the registrar we use.

5.2 Depending on the extension, this data is published in whole or in part and is publicly accessible (WHOIS/RDAP). We have no influence over the scope or duration of that publication; the rules of the respective registry and of ICANN are authoritative.

5.3 This disclosure is a precondition for registration. Without it, a domain name can neither be registered nor held.

6. Operational and Security Data

6.1 To operate our infrastructure securely we log security-relevant events: administrative access, failed sign-in attempts, connection and network data, and anomalies in mail traffic.

6.2 We use this data to defend against unauthorised access, to investigate security incidents and to handle abuse reports.

6.3 Data centre entries are logged and the perimeter is under video surveillance. This processing is carried out in part by the respective data centre operators under their own house rules.

6.4 We do not evaluate this data to monitor the conduct of individuals.

7. Purposes and Legal Bases

We process personal data for the following purposes:

• providing the contractually agreed services and performing the contractual relationship;
• answering enquiries and providing support;
• invoicing, payment processing and debt recovery;
• ensuring operational, network and information security and preventing misuse;
• meeting statutory retention, disclosure and notification obligations;
• safeguarding and enforcing legal claims;
• informing customers about our own services within an existing customer relationship.

Where the GDPR applies, we base this processing on the performance of a contract (Art. 6(1)(b)), compliance with legal obligations (lit. c), our legitimate interests in secure and economical operations (lit. f), or your consent (lit. a) where we obtain it.

8. Disclosure to Third Parties

8.1 We disclose personal data to third parties where this is necessary to deliver our services or where we are legally required to do so. The categories of recipients are:

• data centre operators and network operators at our locations;
• registries and registrars for domain names (clause 5);
• certificate authorities for TLS certificates;
• payment service providers, banks and debt collection providers;
• providers of software and services we use for operations, billing, ticketing, communication and abuse protection, namely Cloudflare, Inc. for the spam protection under clause 2.4;
• legal representatives, auditors and insurers;
• authorities and courts, where we are legally obliged or where this appears necessary to avert a significant danger.

8.2 Service providers that process data for us are contractually bound to an appropriate level of protection and to using the data solely for the agreed purpose.

8.3 We make a current list of the sub-processors engaged available to customers on written request within an existing contractual relationship.

9. Disclosure Abroad

9.1 Our standard infrastructure is located in Switzerland. If you select a location outside Switzerland when ordering a service, your data will be processed and stored there and may be subject to foreign law.

9.2 We disclose data abroad only to recipients in countries with an adequate level of data protection, or on the basis of appropriate safeguards — in particular the standard contractual clauses of the European Commission or the model contracts recognised by the Swiss Federal Data Protection and Information Commissioner.

9.3 For domain registrations, disclosure to foreign registries may be mandatory (clause 5).

10. Retention and Deletion

10.1 We retain personal data for as long as it is required for the relevant purpose or as statutory retention obligations require.

10.2 Business and accounting records are retained for ten years (Art. 958f of the Swiss Code of Obligations).

10.3 Server logs and security-relevant logs are deleted or anonymised as a rule within 90 days, unless they are still needed to investigate a specific incident or to enforce claims.

10.4 After the end of the contract we are entitled under clause 7.5 of the GTC to delete all data from the services obtained. Please back up your data yourself in good time before the contract ends.

11. Data Security

We take appropriate technical and organisational measures to protect against unauthorised access, loss and misuse. These measures are set out in Addendum A to Annex 2 of our GTC. No one, however, can guarantee absolute security of data transmission over the internet.

12. Your Rights

12.1 Within the limits of applicable law you have the right to obtain information about the personal data we process and to have it rectified, erased or its processing restricted. You may object to processing and withdraw any consent given at any time with effect for the future. Where the GDPR applies, you additionally have a right to data portability.

12.2 Please address your request to legal@xerio.ch. We may request suitable evidence to verify your identity. We generally respond within 30 days.

12.3 These rights may be restricted where statutory obligations, the overriding interests of third parties or our own overriding interests conflict with them — for instance during an ongoing security investigation.

12.4 You have the right to lodge a complaint with a supervisory authority. In Switzerland this is the Federal Data Protection and Information Commissioner (FDPIC); within the scope of the GDPR, it is the data protection authority competent for you.

13. Data of Our Customers

13.1 If you operate a website, an application or mailboxes on our infrastructure, you are the controller for the personal data processed there. In that respect we act as processor.

13.2 The Data Processing Agreement in Annex 2 of our GTC is authoritative. It governs rights of instruction, sub-processors, notification obligations in the event of data security breaches, and audit and information rights.

13.3 If a data subject approaches us directly, we refer that person to you and inform you, provided attribution is possible.

13.4 As the operator of your own website, you are obliged to inform your visitors about your data processing yourself and to provide your own provider identification under Art. 3 para. 1 lit. s of the Swiss Unfair Competition Act.

14. Automated Decisions

We do not take automated individual decisions producing legal effects or similarly significant effects for you. Automated measures in security operations — such as filtering route announcements, blocking anomalous access or rate-limiting outbound mail — serve solely to protect the infrastructure and are reviewed by a person on request.

15. Changes to This Policy

15.1 We may amend this privacy policy. The version published on this page at any given time is authoritative.

15.2 We notify existing customers of material changes by email to the contact address held in the customer portal.

Zurich, 1 August 2026