This page covers data about visitors to hallebardier.com and about the companies I contact or whose website I study. Data belonging to our clients is covered separately: data processing.
Maxime Perriard, Hallebardier, Avenue du Général-Guisan 28, 1700 Fribourg, Switzerland. maxime.perriard@hallebardier.com
+41 26 420 00 86
Data protection questions and requests go straight to Maxime Perriard, maxime.perriard@hallebardier.com. There is no intermediary desk: a one-person firm cannot afford one, and you should not have to deal with one.
Hallebardier is established in Switzerland and subject to the Swiss Federal Act on Data Protection. The site also addresses visitors in the European Union and the United Kingdom, so the GDPR and the UK GDPR apply on top, and this page serves as the information notice under all three regimes. One regime, the strictest, is applied to everyone: guessing your jurisdiction from your IP address would be wrong the moment you travel.
Contact form and visibility test: performance of a contract or steps prior to it, Art. 6(1)(b) GDPR. Technical logs and security: legitimate interest in running the service without being attacked, Art. 6(1)(f). Analytics: your consent, Art. 6(1)(a), withdrawable at any time and with no consequence. Under Swiss law these operations rest on the lawfulness, proportionality and transparency principles of Art. 6 and 19 FADP, which require no separate legal basis for a private person.
Diagnostic form. Name, email address, and if you give them, phone and company, with your answers to the five questions and the calculated figures. The answers stay in your browser until you send the form: the calculation runs on your side. Name and email are enough, and nothing obliges you to use the form rather than the phone. This data is never sold and never added to a mailing list.
The free sentence on the homepage. If you describe your situation in one sentence instead of picking a box, that sentence, and only that sentence, is sent to TypeSafe (United States) to pick the right diagnostic. Neither your name, nor your email, nor your IP address goes with it. I do not keep the sentence. Do not write anything personal in it.
What the form records besides your answers. The date, the language of the page you wrote from, and the approximate city and country the host derives from your IP address. Those three travel with your message into my sales tracking software, hosted in Switzerland. It is written here because you did not type it yourself.
Analytics, only with your consent. Google Analytics 4 is enabled only after your explicit consent: until you answer the banner, Google’s script is not even downloaded and nothing leaves your browser. If you accept: pages viewed, referrer, device type. Google Analytics 4 does not store your IP address; it is used to derive an approximate origin, then discarded. This data is transferred to Google LLC in the United States under the European Commission’s standard contractual clauses with the Swiss addendum. Ad storage and personalisation stay denied in all circumstances, even after you accept.
Technical logs. IP address, date and time, kept thirty days by the host for service security. They serve nothing else and are not mined for statistics.
Booking. The scheduler is provided by Google. It loads only after you click “Show the calendar”: before that click, Google receives nothing, not even your IP address. After the click, and for whatever you enter in the scheduler, Google acts under its own policy. You can also open the scheduler in a separate tab, or simply call.
Visibility test. If you leave an email address it is stored with the domain tested so I can get back to you, and kept for two years. Without an email, only an anonymous result is kept.
Hallebardier also writes to companies that have not contacted it, and publishes a study of Swiss SME websites. This section is the information required by Art. 19 FADP for both. Information about a limited company (AG/SA or GmbH/Sàrl) is not personal data under Swiss law, which protects natural persons; it becomes personal data for a sole proprietorship, a general partnership, or when an email address contains a name.
Where this information comes from. The commercial register, which the Confederation publishes as open data: company name, legal form, registered address, UID number, purpose. The company’s website, as any visitor sees it. The Swiss directory, queried under licence from Swisscom Directories AG (multisource.ch), for the phone number and the “no advertising” flag, which is always respected. The email address is the one the website publishes, or a generic address on the domain (info@, contact@, kontakt@) that MillionVerifier confirms exists. Nothing is bought from a data broker.
What the study reads on a website. The home page, in its desktop and mobile versions, the contact page, the privacy page, robots.txt, sitemap.xml and llms.txt. The crawler identifies itself as HallebardierEtude. It reads robots.txt before any other page and follows it, including the delay between requests, opens one page at a time and about twenty at most per site. It opens nothing behind a login, submits no form and does not test security. The crawler that prepares a first message follows the same access rules (robots.txt, nothing behind a login, no forms) under the name Hallebardier. To exclude your site from both: the lines User-agent: Hallebardier and Disallow: / in your robots.txt; HallebardierEtude alone excludes only the study. Or an email.
What is kept, and why. Technical measurements: load time, mobile version, platform, structured data, the year shown in the footer, whether a privacy page exists, footer links that no longer answer. Never the content of the pages. Three uses. The study, published as proportions only: no company name, no website address, no figure for a group of fewer than thirty sites. For a company limited by shares or a limited liability company (SA, Sàrl) whose site meets the ten criteria of the “Readable website” label, an offer of the label: the business only appears in the public list if it accepts. And, when the site looks out of date, a record in my sales tracking software ahead of a first message, which I prepare and review myself: no decision is automated. That message may include a mockup of your home page, rebuilt from the text, logo and one photo on your website: the only case where any site content is reused, and it is sent to you alone, never published. Basis: the legitimate interest in studying a market and offering a service to businesses (Art. 6(1)(f) GDPR; under Swiss law, the principles of Art. 6 and 19 FADP).
Who receives it. Infomaniak Network SA, in Switzerland, which hosts the sales tracking software and the study server. Google, for messages sent from Gmail, under the transfer terms described below. GBD Software as a Service Kft., in Hungary (MillionVerifier), which receives the generic address to verify and deletes its files within thirty days. Swisscom Directories AG, in Switzerland, which receives the company name searched in the directory. No one else, and nothing is sold.
How long, and how to say no. The study’s raw data (names, addresses, domains) is deleted at the latest six months after publication; only the proportions remain. A tracking record with no exchange at all is deleted two years after it was created. To receive nothing more, reply “no” to my message or write to maxime.perriard@hallebardier.com: you will not hear from me again, and on request the record is deleted, with only the company name and domain kept on an exclusion list so that the request holds. The rights described below apply here too.
| Recipient | Role | Location | Transfer |
|---|---|---|---|
| Cloudflare, Inc. | Hosting, CDN, security, logs | EU and global network | SCC |
| Google Ireland Ltd and Google LLC | Analytics after consent, booking calendar after your click | EU and United States | SCC |
| Resend, Inc. | Relaying form messages | United States | SCC |
| Infomaniak Network SA | Sales tracking server where your enquiry lands | Switzerland | — |
| TypeSafe AI, Inc. | Routing the free sentence on the homepage, if you write one | United States | SCC |
Nobody else. This data is not sold, not traded, not used for advertising, not passed to a data broker. It is not used to train an artificial intelligence model either. The typefaces are served by this site, not by Google: opening a page sends nothing to anyone but the host.
Cloudflare, Inc., Resend, Inc. and Google LLC are established in the United States. Those transfers rest on the European Commission’s standard contractual clauses, in the version recognised by the Swiss Federal Commissioner, with the Swiss addendum, or on the provider’s certification under the Swiss–US Data Privacy Framework where it is listed. The servers answering for this site sit in Cloudflare’s European network; the sales tracking software and its backups are in Switzerland.
Form and tracking record: two years after the last exchange. Emails received: three years. Server logs: thirty days. Analytics: fourteen months at most. Email address left with the visibility test: two years. Your answer to the consent banner: in your browser, until you clear it. Accounting records tied to a signed engagement: ten years, an obligation under Art. 958f CO that an erasure request cannot override.
No advertising cookie is ever set. The only non-essential cookie is Google Analytics — _ga and _ga_G-E1N8PGWNFP, twenty-four months — and it exists only if you accepted. Your answer to the banner is kept in your browser’s local storage, under the key hb-consentement, not in a cookie: it therefore reaches no server. As of today the host sets no cookie on this site.
You can change your mind at any time using the Cookies link at the bottom of every page. Withdrawing takes the same number of clicks as granting, and both buttons on the banner carry the same visual weight.
No automated individual decision, no profiling, no targeted advertising. The visibility test scores a website, not a person.
HTTPS enforced, TLS 1.3 and HSTS across the site. The site is made of static files: there is no public database and no admin panel to break into. The sales tracking software is in Switzerland, behind two-factor authentication, with encrypted backups. One person has access to the data.
The site addresses businesses. No data is knowingly collected from anyone under sixteen. If that happened, write to me and I delete it.
You may request access, rectification, erasure, restriction or portability of your data, object to its processing, and withdraw your consent to analytics. A request sent to maxime.perriard@hallebardier.com is answered within thirty days, free of charge. Proof of identity is asked only in case of real doubt, and never more than necessary.
If the answer does not satisfy you, you may contact the Swiss Federal Data Protection and Information Commissioner, Feldeggweg 1, 3003 Bern. If you live in the European Union, the supervisory authority of your country is competent as well; in the United Kingdom, the Information Commissioner’s Office.
This page changes when the processing changes, not to put a fresh date on a revision. The previous version can be requested at the same address.
Last updated: September 2026.