🔐 Introduction

GreenTrust ("we", "us", "our") operates the greentrust.ch website and related services (collectively, the "Service"). This Privacy Policy explains our practices regarding data collection, use, and protection.

We are committed to respecting your privacy and complying with:

• GDPR (General Data Protection Regulation) - for EU/EEA users
• CCPA (California Consumer Privacy Act) - for California residents
• Swiss Data Protection Laws - as we are Switzerland-based

📊 What Data We Collect

1. Data You Provide Directly

Data Type	Where Collected	Required?	Purpose
Name	Feedback Form (/feedback)	Yes	To identify feedback submissions
Email	Feedback Form	Yes	To contact you about your feedback
Message/Feedback	Feedback Form	Yes	To understand your experience

2. Data Collected Automatically

Data Type	Collection Method	Legal Basis (RGPD)
IP Address	Google Analytics, Server Logs	Legitimate Interest
Browser Type & Version	Google Analytics	Legitimate Interest
Device Type	Google Analytics	Legitimate Interest
Pages Visited & Time Spent	Google Analytics, GTM	Legitimate Interest
Referral Source	Google Analytics	Legitimate Interest
Click Events	Google Tag Manager	Legitimate Interest
reCAPTCHA Score	reCAPTCHA v2 (Google)	Legitimate Interest
Consent Preferences	Cookie Storage (localStorage)	Consent

💡 How We Use Your Data

• Feedback Management: To respond to your feedback and improve our service
• Analytics & Insights: To understand how users interact with our site and improve UX
• Security & Fraud Prevention: reCAPTCHA prevents spam and abusive behavior
• Legal Compliance: To comply with legal obligations
• Service Improvement: To test features, fix bugs, and optimize performance

🔗 Who We Share Data With

We share data with the following third parties (all have Data Processing Agreements in place):

Google Services

• Google Analytics (GA4): ID G-XJL31E3FBK - for website analytics
• Google Tag Manager (GTM): ID GTM-PFK55NWN - for event tracking
• reCAPTCHA v2: for spam protection on feedback form
• Data Processing: Google acts as a Data Processor under their DPA
• Location: Data may be transferred to the US (Google EU-US Data Protection Framework)

Third-Party Service

• PHP Feedback Server: timothee.kronegg.ch (for form submission storage)
• Data Stored: Name, Email, Message, Timestamp, IP Address
• Retention: 6-12 months, then deleted

⏱️ How Long We Keep Your Data

Data Type	Retention Period	Reason for Retention
Feedback (Name, Email, Message)	6-12 months	To address follow-ups, then deleted
Google Analytics Data	14 months	Google's default; we don't have direct control
Server Logs (IP addresses)	30 days	Security and troubleshooting
Cookie Consent Preferences	1 year	To remember your preferences

⚖️ Your Rights Under RGPD & CCPA

RGPD Rights (EU/EEA Users)

You have the following rights:

• Right to Access: Request a copy of your personal data
• Right to Rectification: Correct inaccurate information
• Right to Erasure: Request deletion of your data ("right to be forgotten")
• Right to Data Portability: Receive your data in a portable format
• Right to Restrict Processing: Limit how we process your data
• Right to Object: Opt-out of certain processing
• Right to Lodge a Complaint: With your local data protection authority

CCPA Rights (California Residents)

You have the following rights:

• Right to Know: What personal information is collected, used, and shared
• Right to Delete: Request deletion of personal information
• Right to Opt-Out: Of the sale or sharing of personal information (we don't sell data)
• Right to Correct: Inaccurate personal information
• Right to Non-Discrimination: We won't discriminate for exercising your rights

How to Exercise Your Rights

To exercise any of these rights, contact us at:

🔒 Security & Protection

• HTTPS Encryption: All data in transit is encrypted (TLS/SSL)
• Limited Access: Only authorized team members can access personal data
• Data Minimization: We only collect what we need
• Regular Reviews: We audit our security practices regularly
• No Third-Party Ads: We don't sell your data to advertisers

⚠️ Important: While we implement security measures, no method is 100% secure. If you notice a data breach, please contact us immediately.

🍪 Cookies & Tracking Technologies

We use cookies and similar tracking technologies. For detailed information, see our Cookie Policy.

👶 Children's Privacy

Our Service is not directed to children under 13 (or local equivalent). We don't knowingly collect data from children. If we become aware of such collection, we'll delete it immediately.

🌍 International Data Transfers

Your data may be transferred to and stored in the United States (Google's servers). These transfers are conducted under the:

• EU-US Data Protection Framework (for EU users)
• Standard Contractual Clauses (SCCs)

📋 Changes to This Privacy Policy

We may update this policy occasionally. If material changes occur, we'll notify you via email or prominently on our website. Your continued use constitutes acceptance.

📞 Contact Us

EU Data Protection Authority: If you have complaints, you can lodge a complaint with your local Data Protection Authority. Find yours at: EDPB Members