Privacy Policy
This policy explains what personal data we process when you visit this website and when you order or take part in a Space Lens assessment, why we process it, and what rights you have. We process personal data in accordance with the Swiss Federal Act on Data Protection (FADP) and, where it applies to our services, the EU General Data Protection Regulation (GDPR).
1. Controller
Leon van Gerwen GmbHRainstrasse 16
6390 Engelberg
Switzerland
Email: leon@stateofculture.com
Telephone: +41 79 917 16 79
2. Visiting this website
Server log files
The website is hosted by STRATO AG, Pascalstraße 10, 10587 Berlin, Germany, on servers located in Germany. When you open a page, your browser automatically transmits data that our hosting provider records in log files: your IP address, the date and time of the request, the page requested, the referring page, your browser and operating system.
This processing is necessary to deliver the website and to keep it secure and stable. It rests on our legitimate interest in the secure and reliable operation of the site (Art. 31 (1) FADP; Art. 6 (1) (f) GDPR). Log data is deleted or anonymised after a short period.
Cookies and local storage
This website sets no tracking cookies, uses no analytics service and embeds no advertising networks. Fonts are hosted on our own server, so no data is transmitted to third parties when fonts are loaded.
If you start filling in the order form, your entries are saved temporarily in your own browser (local storage) so that nothing is lost if you close the window by accident. This data stays on your device, is not transmitted to us at that stage, and is removed once the order is submitted. You can delete it at any time by clearing your browser's site data. This storage is strictly necessary to provide the function you requested.
3. Contacting us
If you contact us by email or telephone, we process the data you provide in order to answer your enquiry. We keep this correspondence for as long as needed to handle the matter and to comply with statutory retention periods.
4. Ordering Space Lens
What we collect
When you place an order we process:
- the ordering organisation, the organisation to be assessed, and the contact person's name
- the contact email address and the email addresses for report delivery
- the project name, survey period and reminder dates
- the billing address and the VAT identification number
- the participant list you upload (see section 5)
- payment status, invoice number and amounts
We process this data to conclude and perform the contract with you (Art. 31 (2) (a) FADP; Art. 6 (1) (b) GDPR). Billing data is additionally processed to meet our obligations under accounting and tax law (Art. 6 (1) (c) GDPR).
Where the data is stored
Order data is stored on our server at STRATO AG in Germany, in an area that is not publicly accessible. Uploaded participant lists are stored separately from the web root and are accessible only to the people described in section 8.
Retention
Invoices and the associated accounting records are kept for ten years, as required by Art. 958f of the Swiss Code of Obligations.
Participant email addresses are deleted 90 days after the report has been delivered, and earlier if the ordering organisation asks us to. Survey responses are retained only in aggregated, non-attributable form after that point.
5. Participant data
To run an assessment, the ordering organisation uploads a list of participant email addresses together with the group each participant belongs to. These are the personal data of third parties.
In this respect we act as a processor on behalf of the ordering organisation, which remains the controller for its employees' data. Before an assessment starts, a data processing agreement (Art. 9 FADP; Art. 28 GDPR) is concluded between the ordering organisation and Leon van Gerwen GmbH.
The ordering organisation is responsible for having a lawful basis for sharing these addresses with us and for informing its employees. We use the addresses solely to send the survey invitation and the agreed reminders, and for no other purpose.
Survey responses are evaluated at group level. Results are reported per group, and groups below the minimum number of completed responses are not reported separately, so that individual answers cannot be attributed to a single person.
6. Payment processing
Payments are processed by Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. When you proceed to payment you are taken to a page hosted by Stripe. Your card details are entered there and transmitted directly to Stripe — we never see or store them.
Stripe processes your name, email address, billing address, VAT identification number, payment method and transaction data in order to carry out the payment, determine the applicable VAT and issue the invoice. We receive back from Stripe the payment status, the billing address, the VAT identification number, the amounts and the invoice link.
Stripe may transfer data to its parent company in the United States; this is safeguarded by the EU standard contractual clauses with the recognised amendments for Switzerland. Stripe's privacy policy: stripe.com/privacy.
7. Email delivery
Order confirmations, survey invitations and reminders are sent via Mailgun, operated by Sinch Email (EU), using servers in the European Union. Mailgun processes the recipient address, the message content and delivery metadata on our behalf as a processor.
8. Recipients of your data
| STRATO AG | Hosting of the website, the ordering system and the database (Germany) |
|---|---|
| Stripe Payments Europe, Ltd. | Payment processing, VAT determination, invoicing (Ireland / USA) |
| Mailgun (Sinch Email) | Sending of emails (European Union) |
| Tax advisor | Processing of invoices for accounting purposes |
Internally, order data is accessible only to the members of the State of Culture team who are involved in handling orders and running assessments. We do not sell personal data and do not pass it on for advertising purposes.
9. Transfers abroad
Our controller is established in Switzerland, while parts of the processing take place in the European Union, which offers an adequate level of data protection. Where data reaches the United States through Stripe, the transfer is safeguarded by standard contractual clauses as described in section 6.
10. Your rights
You have the right to:
- obtain information about the data we hold about you
- have inaccurate data corrected
- have data erased, unless we are required to retain it
- have processing restricted
- receive your data in a portable format
- object to processing based on legitimate interests
- withdraw consent at any time with effect for the future
To exercise any of these rights, write to leon@stateofculture.com. If you are a survey participant, please contact your own organisation in the first instance, as it is the controller for your data; we will of course forward your request.
You may also lodge a complaint with a supervisory authority — in Switzerland the Federal Data Protection and Information Commissioner (FDPIC), and within the EU the authority of your place of residence or work.
11. Obligation to provide data
The data marked as required in the order form is necessary to conclude and perform the contract and to issue a correct invoice. Without it we cannot accept an order.
12. Automated decision-making
We do not use automated individual decision-making or profiling.
13. Data security
This website and the ordering system are delivered exclusively over an encrypted connection (TLS). Order data and uploaded participant lists are stored outside the publicly accessible area of the server, and access to the internal order overview is protected by a password.
14. Changes to this policy
We update this policy when our services or the legal requirements change. The version published here is the one that applies.
← Back to State of Culture