Privacy policy
Last updated: 13.10.2026
1. Who is responsible
abc multilingual collective AG, with its registered office at Gotthardstrasse 14, 6300 Zug, Switzerland
Email: contact@oravitavr.com
Our representative in the European Union pursuant to Art. 27 GDPR is
STÄMMLER Rechtsanwaltsgesellschaft mbH, Markt 22, 07743 Jena, Germany, andre@staemmler.legal
This policy explains how we process personal data when you visit this website. It applies to this website only. It does not cover our product, which is described separately.
We process personal data in accordance with the Swiss Federal Act on Data Protection (FADP). Where the General Data Protection Regulation (GDPR) applies, we process personal data in accordance with the GDPR as well. Where the GDPR applies, the legal basis for each processing activity is stated in the relevant section below.
2. Our approach in short
This website sets no cookies of its own. It only stores two technical entries in your browser (see section 11). We do not use advertising or tracking scripts. Before you give your consent, every page of this website loads only from our own domain. Two third party services load only after you have agreed to them: the booking calendar and, where used, embedded videos.
3. Server log files and hosting
Our website is hosted by Netlify, Inc., United States. When you visit the site, our hosting provider automatically records technical information in server log files, including:
- your IP address
- date and time of the request
- the page requested
- the referring page, where transmitted by your browser
- browser type, version and operating system
This data is required to deliver the website, to ensure its stability and to detect and defend against attacks.
Legal basis: our legitimate interest in delivering the website and operating it securely (Art. 6(1)(f) GDPR).
Retention: log data is deleted automatically after a short period, unless it is needed to investigate a specific security incident.
4. Visit measurement
We measure visits using Netlify Web Analytics. This service evaluates the server log files described above. No script runs in your browser, no cookies are set and you are not tracked across websites. IP addresses are processed as part of the log data.
Legal basis: our legitimate interest in understanding how our website is used, based on aggregated statistics and without creating user profiles (Art. 6(1)(f) GDPR).
5. Contact form and "reach out" form
You can contact us using the contact form or the "reach out" form. We collect:
- name
- email address
- organisation (optional)
- phone number (optional, in the reach out form)
- topic of your enquiry
- your message
These submissions are processed by Netlify Forms (Netlify, Inc., United States) and forwarded to our mailboxes, which are operated by Google Ireland Limited, Ireland, as part of Google Workspace; data may also be processed by Google LLC, United States. To protect our forms against spam, Netlify has submissions checked by the spam filtering service Akismet (Automattic Inc., United States). Fields not marked as optional are required so that we can answer your enquiry.
Purpose: to answer your enquiry and, where applicable, to take steps prior to entering into a contract.
Legal basis: steps prior to entering into a contract at your request (Art. 6(1)(b) GDPR) and otherwise our legitimate interest in responding to enquiries (Art. 6(1)(f) GDPR).
Retention: we delete your enquiry, including the copy stored with Netlify, once it has been dealt with, unless statutory retention obligations apply, for example where an enquiry forms part of our business records (up to ten years under Swiss law).
6. Record of your cookie choice
When you make a choice in our consent banner, we store a record of that choice. The record contains the categories you allowed or refused, the version of the banner, the date and time, and the page on which you decided. It does not contain your name. The record is transmitted through Netlify Forms (including the spam check described in section 5), and our hosting provider processes your IP address as it does for any request.
Purpose: to demonstrate that a valid choice was made and to apply it correctly.
Legal basis: our legitimate interest in being able to demonstrate valid consent and to apply your choice correctly (Art. 6(1)(f) GDPR in conjunction with Art. 7(1) GDPR).
Retention: we keep the record for as long as your choice applies and for up to three years afterwards.
7. Booking a call
On our booking page we embed a scheduling calendar provided by Calendly LLC, United States. The calendar is blocked until you allow functional services. Before that, the page shows only a placeholder and sends no request to Calendly.
If you allow functional services and book an appointment, Calendly processes the data you enter, such as your name, email address, the appointment time and any answers you give. Calendly also processes technical data such as your IP address, and sets its own cookies. Calendly processes the booking data on our behalf as our processor. For its own cookies, Calendly is itself responsible. We delete booking data once the appointment and any follow-up have been completed, unless retention obligations apply.
Legal basis: your consent to loading the calendar (Art. 6(1)(a) GDPR); for the booking itself, steps prior to entering into a contract at your request (Art. 6(1)(b) GDPR). You can withdraw your consent at any time via "Cookie settings" at the bottom of every page, with effect for the future. Further information: Calendly's privacy policy (https://calendly.com/privacy).
8. Embedded videos
Where we embed videos, we use the extended data protection mode of YouTube (youtube-nocookie.com), operated by Google Ireland Limited, Ireland; data may also be processed by Google LLC, United States. Videos are blocked until you allow functional services. Once loaded, Google processes technical data including your IP address.
Legal basis: your consent (Art. 6(1)(a) GDPR). At the time of this version, no videos are embedded on this website.
9. Newsletter
Our newsletter is published and sent by Substack Inc., United States. This website does not collect email addresses for the newsletter. The newsletter section contains a link that takes you to the sign up page operated by Substack. No data is transmitted to Substack until you follow that link.
If you subscribe there, Substack processes your email address and technical data such as the time of registration and your IP address, and it records whether emails are opened and links are clicked. Subscription is confirmed by clicking a link in a first email (double opt in), and you can unsubscribe at any time using the link in every issue. The privacy policy of Substack applies to that processing.
10. Links to social networks
Our website contains links to our profiles on LinkedIn and Instagram. These are plain links. No data is transmitted to those providers until you click a link. Once you do, the privacy policy of the respective provider applies.
11. Cookies and local storage
This website sets no cookies of its own. We store two entries in your browser:
| Name | Where | Purpose | Lifetime |
|---|---|---|---|
| oravita_consent | Local storage | records your cookie choice and the date | until you delete it or change your choice |
| oravita-popup-shown | Session storage | ensures the reach out message appears at most once per visit | deleted when you close the tab |
Third party services set their own cookies only after you have allowed functional services, as described above.
12. Recipients and international transfers
| Recipient | Purpose | Location |
|---|---|---|
| Netlify, Inc. | hosting, forms, visit measurement | United States |
| Automattic Inc. (Akismet) | spam check of form submissions on behalf of Netlify | United States |
| Calendly LLC | appointment booking, after consent | United States |
| Google Ireland Limited / Google LLC | our mailboxes, calendars and file storage (Google Workspace); embedded videos (YouTube), after consent | Ireland / United States |
Substack is named in section 9. Because the newsletter sign up takes place on Substack's own website, we do not transmit data to Substack ourselves.
Personal data may therefore be transferred to the United States. The US recipients listed above are certified under the EU-U.S. Data Privacy Framework and the Swiss-U.S. Data Privacy Framework. For certified companies, the European Commission (Art. 45 GDPR) and the Swiss Federal Council have recognised an adequate level of data protection. In addition, the providers' data processing terms include the standard contractual clauses approved by the European Commission (Art. 46(2)(c) GDPR), which are also recognised by the Federal Data Protection and Information Commissioner (FDPIC). Switzerland itself is recognised by the European Commission as providing an adequate level of data protection.
13. Your rights
Subject to the applicable law, you have the right to request information about the personal data we process about you, to have inaccurate data corrected, to have data deleted, to restrict processing, to object to processing and to receive certain data in a portable format. Where processing is based on consent, you may withdraw your consent at any time with effect for the future.
Right to object: Where we process your data on the basis of our legitimate interests (Art. 6(1)(f) GDPR), you may object to this processing at any time on grounds relating to your particular situation (Art. 21 GDPR).
We do not use automated individual decision-making or profiling.
To exercise these rights, write to contact@oravitavr.com.
You also have the right to lodge a complaint with a supervisory authority. In Switzerland this is the Federal Data Protection and Information Commissioner (FDPIC). In the European Union it is the supervisory authority of your country of residence.
14. Security
We use appropriate technical and organisational measures to protect personal data. This website is delivered exclusively over an encrypted connection (HTTPS).
15. Changes
We may update this policy to reflect changes to our website or to the law. The current version is always available on this page.