Privacy Policy

1. Controller and scope

The controller is Peak Pioneers Consulting Group, owner Julian Wolf, Luzernerstrasse 13, 6353 Weggis, Switzerland (“Peak Pioneers”). Privacy contact: datenschutz@peak-pioneers.ch.

This notice covers personal data processed on peak-pioneers.ch and for consulting, digitalisation, individually agreed corporate seminars, in-house training, workshops, software and web development, process automation, and agreed operation and support. Bookings and the KI-Seminare learning platform have their own privacy notice. Visiting this website does not automatically result in processing by providers used for other offerings.

Peak Pioneers processes data under the Swiss Federal Act on Data Protection (FADP) and, where applicable, the EU General Data Protection Regulation (GDPR).

2. Categories and sources of data

Depending on the interaction, data includes names, professional roles, companies, contact and billing details, correspondence, quotations, contracts, bookings, participation details, payment status and support enquiries. Projects may also require supplied documents, technical configurations, logs and agreed access permissions.

Website visits generate IP addresses, timestamps, requested addresses, referring pages, browser and device information, and technical error and security data. Section 6 explains basic statistics without prior consent and additional analytics and advertising data with consent.

Data mainly comes from you. Other sources include your employer or someone authorised to book for you, payment and communication providers, and technical systems. Please provide only necessary data that you are authorised to share.

3. Purposes and legal framework

Peak Pioneers processes data to answer enquiries, prepare and perform contracts, deliver and support training and projects, process payments, keep accounts, maintain security, resolve errors and protect legitimate legal claims. Additional purposes such as newsletters, advertising measurement and published participant recordings are explained separately.

Swiss law requires lawfulness, proportionality, purpose limitation and transparency. Where justification is required, this may include consent, an overriding private or public interest, or a legal provision.

Where the GDPR applies, processing to perform contracts with data subjects relies on Article 6(1)(b), legal obligations on Article 6(1)(c), and consent on Article 6(1)(a). Article 6(1)(f) may apply to business contacts, IT security and the proportionate protection of legal claims. The legitimate interests are reliable business operations, secure services and enforcement of rights; a balancing of interests remains necessary.

4. Website operation and protection against abuse

A cloud hosting and delivery provider operates the website. Production server functions run in Frankfurt am Main, Germany. Content is also delivered through a worldwide network, involving IP addresses, requested addresses, access times, and browser and device data. The server-function location does not restrict all processing to Germany.

A bot and abuse detection service protects forms. Technical browser, connection and interaction signals are sent to the security provider, and a verification response is processed. On Peak Pioneers, this service's script is currently included in the general page layout.

Technical logs may also be used to investigate errors and security incidents. They are not routinely retained indefinitely.

5. Contact and communication

For form enquiries, Peak Pioneers processes entered information and technical information about its origin. Form emails pass through a transactional email provider and include the contact context that triggered them. The general contact form sends the referring page's domain and path without URL parameters or fragments. These details help us handle the enquiry; advertising analysis is a separate purpose.

Email and documents are handled through the office and communication services actually used. Recipients are the people handling your enquiry or order. Meetings may use the conferencing and calendar services specified for that occasion.

Individual corporate seminars and in-house training

Preparation and delivery require details about the ordering contact and registered participants, particularly names, business contact details, participation and agreed organisational requirements. The ordering company may supply these details and receives information necessary for administration and agreed attendance confirmations. Confidential questions or individual performance assessments are not disclosed merely because the company booked the training. Sample data should be used for exercises wherever possible. Audio, video and chat content shared in online sessions is processed through the agreed conferencing service. Section 9 applies to recordings.

6. Analytics, advertising and settings

On peak-pioneers.ch we distinguish between aggregated basic statistics without prior analytics or advertising consent and additional usage analytics and advertising measurement with express consent. These help assess use of our services and campaign effectiveness. Technical connection and security data for website operation is processed separately under section 4.

Basic statistics without prior consent

On selected public pages, page views and certain actions are added to daily totals. Depending on the page, these include opening and submitting a contact form, reaching scroll thresholds and at least 30 seconds of active use. Stored fields are the calendar date in UTC, approved page path, action type and count, and available campaign information described below. These are event counts, not unique visitor counts or complete sequences of individual visits.

Before you make a selection, basic counting starts only after the basic statistics notice has been visible and you subsequently interact with the page, for example by scrolling or clicking in the content. This is not consent to Umami or Google measurement. A saved choice with basic statistics enabled allows basic counting immediately, even when analytics and advertising are rejected. Counting remains disabled if you turn basic statistics off, select “Reject all”, separately opt out of basic statistics, send a browser “Do Not Track” or “Global Privacy Control” signal, or the consent-management status cannot be determined.

Campaign evaluation uses only known, approved campaign and ad group identifiers and the booked advertising keyword from the current page's parameters. That keyword is the term configured in the advertising account, not the actual search text entered into Google. Individual click identifiers such as GCLID, unknown parameters and complete internet addresses are excluded. Missing campaign parameters are not reconstructed through hidden recognition.

Basic statistics use no visitor or session identifier, recognition cookies or fingerprinting. Their database stores no IP addresses, browser identifiers, exact event times, referring pages, form entries or payment identifiers. Events are added to daily counters, not stored as a history. Counters are not linked to customer accounts, enquiries, orders, Umami or Google data. No person is linked across pages, visits or devices. Reports contain only completed days and groups with at least five counted events.

Requests go to our website's endpoint at Vercel; daily counters are held in a separate Neon database. These server functions and the database are in Frankfurt am Main, Germany. Transmission still involves connection data such as the IP address. Restricting statistics fields does not make all hosting and security operations completely anonymous. Section 10 explains recipients and processing abroad.

Basic statistics help improve the website and campaigns using aggregated counts without individual visitor profiles. You can disable them at any time in the privacy settings. “Reject all” also stops them. Analytics and advertising can be rejected independently. The separate opt-out is saved in the browser as a fixed preference without an individual identifier. You may need to set it again after clearing storage or on another device. Removing this separate opt-out does not change your saved basic-statistics choice. If it is disabled there, you can enable it in the selection window.

Umami: usage analytics with consent

Self-hosted Umami analytics loads on the public website only with your consent to the analytics category. It records sanitised page and referral information, page views, scroll depth, interactions, event times, and browser and device information. Pseudonymous session identifiers can link views within a session. Umami derives the identifier from technical connection data, including the IP address and browser identifier; the IP address is not stored as a separate field in ordinary session records. This does not mean complete anonymity. Access keys, activation links, advertising click identifiers, complete payment identifiers, names, email addresses and form entries are not transmitted as Umami event content.

The analytics application and database operate in Germany; section 10 describes hosting and database providers. The separate KI-Seminare website and learning platform have their own privacy notice.

Google Ads and Google Analytics 4 with consent

With advertising consent, Google Ads, advertising click identifiers and available campaign details are used to attribute enquiries and configured success signals to advertising. Sanitised page and referral details, the time and type of enquiry event, and the click identifier may be sent to Google. Names, email addresses and free-text enquiry contents are not transmitted through this analytics channel. Handling an enquiry remains a separate process under section 5. Analytics consent alone does not permit advertising attribution.

Google Analytics 4 starts only with analytics consent, independently of advertising consent. Advertising consent alone permits Google Ads but keeps Google Analytics 4 and Umami disabled. Analytics consent alone permits Umami and Google Analytics 4 without enabling Google Ads tags. With the relevant consent, Google Analytics 4 can process and link page and usage events, campaign details, and technical browser, device and connection data using identifiers.

Further information: How Google uses data from sites and apps that use Google services.

“Enhanced measurement” is enabled in the GA4 stream shared by the two public websites. Configured features include page views, reaching 90 percent scroll depth, external-link clicks, downloads, form starts and submissions, and, where technically present, site searches and supported embedded YouTube videos. Depending on the event, data may include page details, link and file names, destination addresses, form IDs and names, form destinations, submit-button labels, and video titles, addresses and playback progress. A detected site search may include the term entered on that site; this is not a previous Google search text. Automatic form measurement concerns interactions and form attributes, not input-field contents. These features follow the same consent controls above. An automatically detected submission does not confirm a successfully processed enquiry or booking.

Consent management, choices and withdrawal

The self-hosted consent manager saves your choice in the necessary pp_consent_v1 cookie for 180 days. It contains the selected purposes, the text version, timestamps and a random receipt reference. A minimal server-side receipt contains the choice, version, language, website and timestamp; it does not contain your IP address, account, browsing history or advertising identifiers. The reference is used only to document the choice, never for analytics or advertising. Receipts expire after 365 days and are removed in the daily cleanup; backup copies may remain within the database recovery window of 24 hours. A later consent requires successful receipt storage. Refusal and withdrawal take effect immediately even if that storage service is unavailable.

The consent interface is provided directly by this website. Google Tag Manager deploys and controls configured tags. Consent and tag management may load before a selection, and their providers may receive technical connection data. This does not activate measurement tags requiring consent. No selection or simply continuing to use the website is not consent to Umami, Google Ads or Google Analytics 4. Where the GDPR applies, these consent-dependent measurements rely on Article 6(1)(a).

You can change or withdraw your choices and separately disable basic statistics in the privacy settings. Withdrawal ends the relevant future measurement; the page may reload. Actions before a later consent are not retrospectively transmitted as individual analytics or advertising events. Withdrawal does not affect the lawfulness of previous processing. “What happens on withdrawal and deletion” explains existing data and identification needs. Contact, booking and use of our services do not depend on analytics or advertising consent.

7. Newsletters and email advertising

Newsletters and other email advertising are sent only on a permitted legal basis. Where consent is obtained, it is voluntary, separate from booking and withdrawable at any time through the unsubscribe link or contact address. Records of the choice and necessary suppression records may be retained to respect your decision. Necessary contractual and course communications remain separate.

8. AI use and processing on behalf of clients

Suitable AI tools support agreed services and internal work. Not every enquiry or customer record is automatically sent to every provider. Necessary data, providers and safeguards depend on the use case. Confidential client and personal data should be processed only through applications reviewed and approved for that purpose. Excluding general model training does not, by itself, establish rules for logging, security reviews, retention or support access.

When Peak Pioneers processes personal data on a client's behalf, for example in automations, retrieval-augmented generation systems, migrations or technical support, the client generally determines the purposes. Instructions, approved systems, subprocessors, security measures, incident reporting, and return and deletion of data are agreed for each project. Data subject requests are coordinated with the responsible client.

9. Recordings and transcription

Booking a course is not general consent to image or sound recordings. Recordings and automatic transcription take place only on request and with prior permission. Those affected are separately informed beforehand about the purpose, provider, recipients and retention; necessary consents are documented before recording starts. Identifiable people in marketing recordings are asked for separate voluntary permission. Declining does not exclude participation.

10. Recipients and processing abroad

Recipients include people handling your enquiry or service and the providers below. Only data needed for the purpose is transmitted. Visiting the website does not automatically send data to every category. Necessary disclosures may also involve authorities, legal advisers or specialist partners engaged under contract.

Processors handle data within agreed purposes and instructions. A provider acting for its own purposes, such as legal obligations or fraud prevention, is responsible for that processing. Roles depend on the service and actual data flow.

A German server or database location does not rule out processing abroad for delivery, support, security or subprocessors. The recipients and data flows actually used are decisive.

Transfers to countries without adequate protection require legally recognised safeguards, particularly standard contractual clauses with necessary Swiss adaptations, unless a statutory exception applies. A relevant Swiss-U.S. Data Privacy Framework certification may be considered for US recipients; where the GDPR applies, its transfer basis must also be assessed. A provider's registered office or standard data processing agreement alone does not establish certification or safeguards for every data flow. Information about actual recipients and transfer safeguards, and a copy of applicable safeguards, is available from the privacy contact, subject to protecting confidential information.

11. Retention and security

Daily cleanup deletes basic-statistics counters whose counting date is more than 90 calendar days in the past. The database recovery window is six hours; deleted counters may still exist in recovery copies during that window. These periods apply only to basic statistics, not generally to Umami, Google measurement, operational logs, contractual documents or Academy data.

Personal data is retained as long as necessary for the stated purpose, legal obligations or proportionate protection of legal claims. Accounting records and certain business documents are generally subject to ten-year retention; this does not imply ten-year storage of all usage data.

Enquiries without orders, logs, training and attendance records, recordings and project copies may be kept only as long as required for their purposes and necessary evidence. Agreed client-data return and deletion obligations take precedence unless mandatory obligations prevent this. Data temporarily remaining in technically isolated backups is not used for ongoing processing and is removed with the backup cycle. Previous deletions must be reapplied after a restoration.

Peak Pioneers takes appropriate technical and organisational measures for secure transmission, restricted access and recoverability. Absolute protection against every risk cannot be guaranteed.

What happens on withdrawal and deletion

Withdrawal ends further processing based on that consent. Where we can attribute it to a person or learning account, we also arrange deletion without undue delay of attributable data based solely on that consent, unless another lawful retention ground applies. A second deletion request is not required. A responsible person may review and perform deletion; immediate automatic deletion in every system is not promised.

Changing cookie preferences initially controls future measurement in that browser. Pseudonymous data already sent to analytics providers cannot reliably be located using only your name or email. Targeted deletion may require details about the relevant usage or an analytics identifier still available. Contact us to clarify what is needed. We do not collect extra identification data solely to re-identify statistics no longer attributable to a person.

We delete relevant data in systems we manage and arrange necessary deletion by processors. Where recipients process data for their own lawful purposes, we account for their separate responsibility and help you exercise your rights. Business documents subject to statutory retention and data still needed for your contract or specific legal claims are restricted to those purposes. We explain necessary exceptions on request. Withdrawing analytics consent does not end your contract or course access.

Aggregated statistics from which your use can no longer be determined cannot be attributed to you and deleted as your individual contribution, particularly the daily counters described above. Unneeded personal data must be deleted or effectively anonymised regardless of a deletion request.

12. Rights and contact

Subject to applicable law, you may request access, rectification, deletion or cessation of unlawful processing and, where provided for, delivery or transfer of your data. Where the GDPR applies, its rights of restriction and objection may also apply. Consent may be withdrawn for the future.

Please send requests to the privacy contact above. Proportionate identity verification may be needed to prevent unauthorised disclosure. Restrictions may arise from statutory retention or overriding interests deserving protection. Access requests are generally answered within the legal deadline, normally within 30 days in Switzerland.

You may contact the Swiss Federal Data Protection and Information Commissioner (FDPIC) and, where applicable, a competent European authority. A prior complaint to Peak Pioneers is not required.

13. Changes

This notice is updated when processing or legal requirements change. The current version and effective date are published on the relevant website. New consent is obtained where required for new purposes that depend on consent.