Last updated 27 October 2026

Privacy policy

This page explains which personal data I process when you visit this website, book a call, write to me or order something — and what rights you have. In short: no advertising cookies, no tracking, no selling of data.

Who is responsible

The controller is Vingrad GmbH, Bachstrasse 11, 8280 Kreuzlingen, UID CHE-334.348.307, represented by Vladimir Vinogradov.

Send questions about data protection and requests concerning your data to vv@vingrad.com or call +41 76 531 32 64. The company has not appointed a data protection advisor; I answer such requests myself.

Legal basis

I process personal data under the Swiss Federal Act on Data Protection (FADP). Where the EU General Data Protection Regulation (GDPR) applies — for example because you live in the EU and I offer you my services — I rely on these grounds:

• Contract and pre-contractual steps (Art. 6(1)(b) GDPR): booking a call, enquiries about projects or positions, orders.
• Legal obligations (Art. 6(1)(c) GDPR): keeping accounting and business records.
• Legitimate interest (Art. 6(1)(f) GDPR): running the website securely and reliably, answering messages that do not concern a contract.

Visiting the website

The website runs on Cloudflare, Inc. (101 Townsend St., San Francisco, CA 94107, USA). Cloudflare delivers the pages through its global network, protects them against attacks and to do so processes technical data on every request: IP address, time, requested address, browser and system details, and the page you came from. Cloudflare processes this data on my behalf under a data processing agreement.

I keep no access logs myself. Cloudflare keeps error logs of the website functions for at most seven days; I use them only to find errors.

Fonts and images are served from this website itself; no content is loaded from Google or other third parties.

Cookies and local storage

vingrad.ch sets no cookies and uses no tools that follow you across websites.

Only the Managed Apps cart keeps the applications you selected in your browser's local storage so they survive moving between pages. This information leaves your browser only when you start the order, and you can delete it at any time in your browser settings.

The booking page cal.vingrad.ch uses at most technically necessary cookies and local storage, for example for time zone, language and session protection; the booking system sends no usage data to third parties.

Email and phone

When you write or call, I process your details (name, contact data, content of the message) to answer your request and, where relevant, to prepare an offer, a contract or a job interview.

Email to vingrad.com and vingrad.ch addresses goes through a mail server I run myself; it is located in Switzerland. Messages that lead to no engagement are usually deleted within twelve months; business correspondence and records are kept for ten years (Art. 958f Swiss Code of Obligations).

Booking a call

First calls are booked at cal.vingrad.ch. I run the booking system (Cal.diy, open source) on my own server in Switzerland; as with the website, Cloudflare sits in front of it.

For a booking I process your name, email address, the chosen time, what you enter as your topic and, if given, your company's meeting link. I use this to confirm the appointment, send a reminder and prepare the call. Confirmations and reminders are sent through Amazon Simple Email Service by Amazon Web Services EMEA SARL (Luxembourg) from a data centre in the EU.

Booking data is deleted automatically six months after the appointment.

Calendar and video calls

So that no slot is given out twice, the booking system checks free times against my Google Calendar and enters booked appointments there. If the call takes place by video, it creates a Google Meet link. The provider is Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland); data may reach Google LLC in the USA. If you provide your own meeting link instead (for example Teams, Zoom or Webex), the call takes place on your company's service, and its privacy terms apply.

Orders and payments

If you order Managed Apps, Stripe handles the payment: Stripe Payments Europe, Limited (1 Grand Canal Street Lower, Dublin 2, Ireland). You enter your payment details directly on Stripe's page; I do not see them. Stripe also processes the data as a controller in its own right, for instance to prevent fraud, and may transfer it to Stripe, Inc. in the USA.

From Stripe I receive what I need for the contract and the invoice: name, email address, billing address, the services chosen and the payment status. Invoices and accounting records are kept for ten years, as the Swiss Code of Obligations requires.

For VAT I have to show which country you live in. Stripe therefore stores your billing address and the country you order from (derived from your IP address); for businesses also the UID or VAT number. I keep this evidence for ten years.

Order confirmations and cancellation confirmations are sent through the same email service as the booking emails. What you enter in the cancellation form (name, email address, contract, type of cancellation, date and any reason given) is used only to carry out and document the cancellation and is kept with the contract records.

Data that customers process in their Managed Apps instances is processed only on their behalf under the data processing agreement; this policy does not cover it.

Transfers abroad

Some service providers are located outside Switzerland and process data on my behalf under data processing agreements. Data reaches the EU through the emails for bookings, order confirmations and cancellation receipts (Luxembourg) and payment processing (Ireland); both states are listed in Annex 1 of the Data Protection Ordinance (DPO) as providing adequate protection. Cloudflare, Stripe and Google are certified under the Swiss-U.S. and EU-U.S. Data Privacy Frameworks, which Switzerland and the EU recognise as adequate; the European Commission's standard contractual clauses apply in addition.

I do not pass on personal data to earn money from it, and I do not use it for automated individual decisions or profiling.

Security

All connections to vingrad.ch and cal.vingrad.ch are encrypted (HTTPS). Only I have access to the servers and accounts. Backups of the booking system are made daily, encrypted, kept on my server in Switzerland and deleted after 30 days; until then they may still contain bookings that have already been deleted.

Your rights

You can ask at any time which data I process about you, and have it corrected, deleted or handed over in a common format. You can object to processing and withdraw consent. This does not cover what I have to keep for legal reasons.

Write to vv@vingrad.com. I reply within 30 days and may ask you to confirm your identity so that your data does not go to the wrong person.

You can complain to the Federal Data Protection and Information Commissioner (FDPIC, edoeb.admin.ch); if you live in the EU, also to the data protection authority of your country.

Changes

When I start using new services or processes change, I update this policy. The version published here applies. The German version is authoritative.