Skip to content
Espresso Data Privacy
EN
Request a demo

Legal

Privacy policy

This website does not set cookies, does not track you and does not load content from third-party servers. Here you can read which personal data is nevertheless processed and what we do with it.

Controller

The controller responsible for processing your personal data in connection with this website is:

Yoosana GmbH Gotthardstrasse 30 6300 Zug Switzerland

This privacy policy applies to the website espressodataprivacy.com and the partner portal partner.espressodataprivacy.com. It is based on the Swiss Federal Act on Data Protection (FADP) and, where applicable, the EU General Data Protection Regulation (GDPR).

Key points at a glance

  • No cookies on the website.
  • No tracking, no analytics and no advertising tools.
  • No third-party content: fonts, images and styling are served from our web server.
  • No contact form: if you wish, you can write to us by email.
  • Newsletter only with your consent: we store only what is needed to send it and to prove your consent, with no tracking pixels.
  • Partner portal for invited partners only: one technically necessary cookie after sign-in, no tracking.
  • Server logs only for operation and security.

When you visit the website

When you open a page, your browser transmits technically necessary information to the web server: IP address, date and time, requested address, previously visited page, browser and operating system, and the server's response.

This information is recorded in server logs and used only to provide the website, detect errors and fend off attacks. We do not analyse it for advertising or analytics purposes and do not combine it with other data. The logs are deleted after 30 days at the latest, unless they are needed to investigate a security incident.

If you open the home page without specifying a language, we redirect you to the appropriate language version based on your browser's language setting. Nothing is stored for this.

This information is technically necessary to deliver the website. We do not make any automated individual decisions.

The legal basis under the GDPR is our legitimate interest in the secure and stable operation of the website (Art. 6 para. 1 let. f GDPR).

Cookies and tracking

This website does not set cookies and does not use any analytics, tracking or advertising tools. That is why there is no cookie banner. Fonts, images and stylesheets are served from our web server; no data is transmitted to third parties when you visit.

The partner portal (see «Partner portal») sets a single, technically necessary session cookie only after sign-in; it is not used for any analysis.

When you write to us

If you contact us by email – for example for a demo, a partnership or a media enquiry – we process the information you provide, such as your name, email address, company, position and the content of your message, in order to answer your enquiry and to initiate or maintain a business relationship.

The legal basis under the GDPR is pre-contractual measures and our legitimate interest in answering enquiries (Art. 6 para. 1 let. b and f GDPR).

We retain your message for as long as necessary to handle it and for any business relationship, and beyond that only insofar as statutory retention obligations apply.

Newsletter

If you subscribe to the newsletter, we will send you news from Yoosana GmbH about Espresso Data Privacy and Yoosana's Workflow Services about four times a year, in German or English. When there is big news, such as a new release, an additional issue may be published. It is the same newsletter you can also subscribe to on yoosana.com.

After signing up, you will receive an email with a confirmation link. You are only subscribed once you confirm. We delete unconfirmed sign-ups after 7 days. If you have agreed in person, for example in a conversation, we may also add you without a confirmation email; in that case we record when and how you agreed.

To prevent anyone from flooding someone else's address with confirmation emails, we limit the number of confirmation emails per address. For this we store an irreversible check value of the address for at most 90 days, not the address itself.

We store only what is needed to send the newsletter and to prove your consent: your email address, the language, the website on which you signed up, and the date and time of sign-up and confirmation. We do not store your IP address for this purpose.

The newsletter contains no tracking pixels and no redirected links. We do not analyse whether you open it or which links you click, and we do not create profiles.

The newsletter is sent from our own server through our email account. The data remains with our service providers in Switzerland and Germany (see “Service providers and disclosure abroad”). We do not pass on your address.

You can unsubscribe at any time: via the link in every issue or by email to info@espressodataprivacy.com. When you unsubscribe, we delete your email address and the details of your subscription; only a counter with no link to you remains. Your address remains in our backup copies for at most 14 days and is then automatically deleted.

The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time with effect for the future.

Partner portal

The partner portal partner.espressodataprivacy.com is open only to people we invite as representatives of our partners. There they find documents and the training and register prospects for customer protection under the partner agreement.

For invited people, we process their name, business email address, language and company, the time of the invitation and of the last sign-in, learning progress, exam results, answers to the practical exam and the training records and certificates issued. Sign-in works without a password via a link sent by email that is valid for 15 minutes (the link in the invitation for 7 days). After that, the portal sets a technically necessary session cookie; the session ends after 2 hours without activity, at the latest after 12 hours. The portal does not store your IP address; to prevent misuse, it only counts requests briefly in memory.

When a partner registers a prospect, we receive from the partner details of the company (name, registered office, company number, website), of the contact person at the prospect (name, position, business email address and phone), of the requirements and of the steps taken and planned. We process these details to check and grant customer protection and to work with the partner and the prospect. If the company is not available, we do not store any details of the contact person or the requirements.

We delete the details of the contact person and the free texts of a registration 6 months after protection ends or after rejection; we keep the other details of the registration for 10 years as evidence for commissions and accounting. When a person's access or the partnership ends, we delete their details including learning progress as soon as we no longer need them to perform the partner agreement or to protect our rights; training records and certificates are kept until 2 years after they expire so that they can still be verified.

Every training record and certificate has a number that can be checked on a public verification page. It shows the course, company, date and validity – and the person's name only if they have consented in the portal. Consent can be withdrawn there at any time.

We send the portal's emails from our own server via our mailbox partner@espressodataprivacy.com, without tracking pixels. The data stays with our service providers in Switzerland and Germany (see «Service providers and disclosure abroad»); we keep backups for at most 14 days.

The legal basis under the GDPR is, for people at our partners, the preparation and performance of the partner agreement (Art. 6(1)(b) GDPR), for contact persons at prospects our legitimate interest in working with partners and prospects (Art. 6(1)(f) GDPR) and, for the name on the verification page, your consent (Art. 6(1)(a) GDPR).

Service providers and disclosure abroad

To operate the website and for our email, we use service providers that process personal data on our behalf (hosting and email). They may process the data only in accordance with our instructions and are bound to confidentiality and data security.

Our service providers process the data in Switzerland and in Germany. According to the Federal Council, Germany ensures an adequate level of data protection.

We do not sell personal data and do not pass it on for advertising purposes. Authorities receive data only if we are legally obliged to provide it.

Data security

The website is delivered exclusively in encrypted form (HTTPS). We take appropriate technical and organisational measures to protect personal data against loss and unauthorised access.

Your rights

You have the right to request access to the personal data we process about you, to have it rectified or erased, to object to its processing and to request the release of your data. Under the GDPR, you can also request restriction of processing.

An email to info@espressodataprivacy.com is all it takes. To ensure that we provide information only to you, we may ask for proof of your identity.

You can lodge a complaint with a data protection supervisory authority – in Switzerland with the Federal Data Protection and Information Commissioner (FDPIC), in the EU with a supervisory authority, in particular in the state of your habitual residence, your place of work or the place of the alleged infringement.

Right to object

You can object at any time to the processing of your personal data based on our legitimate interest (Art. 21 GDPR). An email to info@espressodataprivacy.com is sufficient.

Changes

We update this privacy policy when the website or our processing activities change. The version published here applies.