Privacy Policy

Skopa GmbH (in formation)
Keltenweg 4, 2540 Grenchen, Switzerland
Data protection: privacy@skopa.ai

When this website is accessed, our hosting provider automatically collects information in so-called server log files transmitted by your browser: IP address, date and time of access, page accessed, browser and operating system used, and the previously visited page (referrer). This processing serves the secure and stable operation of the website as well as error analysis and is based on our legitimate interest in secure operation.

This website is operated via Google Firebase Hosting (Google Ireland Limited or Google LLC), which processes the aforementioned server log files on our behalf. A corresponding data-processing agreement is in place. Application data of the client portal is processed in the region europe-west6 (Zurich, Switzerland).

We use no analytics, tracking or advertising services. No profiling and no automated tracking of your behaviour takes place, and we set no cookies of our own. For basic functions your browser stores a few details locally (local storage): the chosen language, the chosen appearance (light or dark), your acceptance of this statement together with its timestamp, and around sign-in the email address last entered and whether two-factor authentication has already been offered to you. These details stay on your device, are not transmitted to us, and can be deleted at any time via your browser. On the contact form and the sign-in page, Google reCAPTCHA is loaded to protect against misuse; it may set cookies of its own (see section 6).

The fonts used (Archivo, IBM Plex Mono) are served locally from our own server. No connections to third-party servers are established and no IP addresses are transmitted to Google.

For access to the client portal we use Firebase Authentication (Google) with two-factor authentication as well as Google reCAPTCHA Enterprise (App Check) to protect against misuse. In this context, technical information (including the IP address) may be transmitted to Google. Project and client data is processed in Switzerland (europe-west6). Contact and company details you edit yourself in the portal are synchronised with our CRM system, HubSpot (HubSpot, Inc., USA; data processing agreement with standard contractual clauses, EU instance); support requests are also tracked there as a ticket. As a second factor you may register an authenticator app (TOTP) or your mobile number; for clients this is optional. If you choose delivery by SMS, we process your phone number for that purpose and transmit it to Google, which sends the code; Google reCAPTCHA is also loaded in that case.

If you contact us by email, we process the information you provide for the purpose of handling your request. If you use our contact form, the details you enter (name, email address, phone number, job title, company and your message) are additionally recorded in our CRM system, HubSpot. With the enquiry we also transmit, once, the page it came from, any campaign parameters in that page's address (utm parameters) and the address of the referring website if your browser provides it – only at the moment of sending, with no cookie and no script, so that we know by which route enquiries reach us. It is operated by HubSpot, Inc., based in the USA; a data processing agreement with standard contractual clauses is in place and processing takes place on an EU instance. Apart from HubSpot, we do not pass this data on to third parties. We delete it as soon as it is no longer required and no statutory retention obligations prevent deletion.

For enquiries sent through our contact form as well as for support requests in the client portal, we prepare a draft reply with the help of a language model (Google Vertex AI). For an enquiry sent through the contact form, what is transmitted is your name, your company, your role, the chosen language, the page the enquiry came from and your message; your email address and phone number are not transmitted. For a support request in the client portal, what is transmitted is the text of your request together with an extract of your portal data limited to your organisation (company profile, project and milestone names, titles of delivered results, earlier requests and answers). The contents of stored documents are not transmitted. In both cases processing takes place in the europe-west4 data centre (Netherlands) and therefore within the EU; processing in Switzerland is not available for this service. The basis is our data processing agreement with Google and standard contractual clauses. The draft is purely internal preparation: it is always reviewed and approved by a person before you receive a reply. No automated individual decision-making in the legal sense takes place.

When you apply through our careers page, we process your name, email address, optionally your phone number and LinkedIn profile, your message, the CV (PDF) if uploaded, optionally the link to your LinkedIn profile and, if you are asked for it during the process, a short video introduction, solely to conduct the application process. The basis is the consent you give in the form. During the process you receive an email at each step and access to the application portal, where you sign in with your email address and a mailed code, see the status, answer questions and add to your details; if we remain silent for more than two weeks, you automatically receive an interim update. The data is stored in Switzerland (Google Cloud europe-west6, Zurich); CV and video can only be opened by Skopa staff through short-lived links issued server-side. Application data is not transferred to our CRM. It is deleted automatically four months after receipt. If you agreed to join the talent pool, we keep the application for twelve months in order to contact you about later roles; you can withdraw this consent at any time by email to careers@skopa.ai, after which the data is deleted. You can withdraw an application at any time in the portal. You can also ask there at any time for your application to be deleted – including after a rejection or a withdrawal; the deletion happens during the following night, and you receive a confirmation by email.

The careers page may embed a video delivered via Cloudflare Stream (Cloudflare, Inc., USA). The video is loaded only when you press play; before that no connection to Cloudflare is made. During playback, technical data such as your IP address, browser details and the requested address are transmitted to Cloudflare. The basis is our legitimate interest in presenting the company to applicants. The transfer to the USA rests on the data processing agreement with Cloudflare and standard contractual clauses; details are in Cloudflare's privacy policy.

Si vous recevez une offre de notre part, le lien contenu dans le courriel mène à une page accessible uniquement par ce lien. Si vous y signez, nous traitons le nom que vous saisissez, le lieu, votre signature dessinée ainsi que le moment et la version de la phrase confirmée. Pour attester la session, nous conservons en outre des valeurs à sens unique (hachages) de votre adresse IP et de votre identifiant de navigateur, de même que cet identifiant ; ces indications figurent dans le protocole de signature de l'offre signée, que vous recevez avec le fichier. La base est la conclusion et l'exécution du contrat. Les données restent en Suisse (Google Cloud europe-west6, Zurich) et sont conservées avec le contrat aussi longtemps que les obligations légales l'exigent. Nous ne les transmettons pas à des tiers.

This website is delivered exclusively in encrypted form via TLS (https). We take appropriate technical and organizational measures to protect your data against loss and unauthorised access.

Within the scope of the applicable data protection law, you have in particular the following rights:

• access to the data processed about you
• correction of inaccurate data
• deletion or restriction of processing
• objection to a processing
• release or transfer of your data

To exercise your rights, an informal message to privacy@skopa.ai is sufficient.