Privacy policy

Last updated: 26.10.2026

1. In brief

We process as little data as possible. No advertising, no sale or rental of data, no third-party tracker. What you write to us is used to reply to you and to follow your request. You can at any time find out what we hold about you, have it corrected or erased: write to mgmt@summitsuite.ch.

This page covers the summitsuite.ch site (visit, chat, contact form, appointment booking) and all the applications that SummitSuite creates (section 11, with one part per application).

2. Who is responsible

The controller (the one who decides why and how data is processed, Art. 5(j) FADP) is:

Benjamin Hagenbuch, for Summit & Co. Sàrl (in formation), Chemin de la Veyre-d'en-Haut B6, 1806 Saint-Légier-La Chiésaz
email mgmt@summitsuite.ch

SummitSuite is the name under which Benjamin Hagenbuch, for Summit & Co. Sàrl (in formation) carries out its Odoo integration business.

3. The laws we apply

We apply the Federal Act on Data Protection (FADP), in force since 1 September 2023. The European Union's General Data Protection Regulation (GDPR) also applies when we offer our services to people who are in the European Union or when we monitor their behaviour on the site (Art. 3(2) GDPR). This page meets the duty to inform (Art. 19 FADP; Art. 13 GDPR).

4. Where your data is: hosting

The site and our Odoo database run on Odoo.sh, the platform of Odoo SA (Belgium). Odoo SA is our processor: it processes the data on our behalf and according to our instructions (Art. 9 FADP).

Our database is hosted in the Europe region of Odoo.sh. According to Odoo SA's privacy policy, this region uses data centres in France and Belgium for operation, and in France, the Netherlands and Sweden for backups; they are operated by Google Cloud and OVH, processors of Odoo SA. Your data therefore does not stay in Switzerland. The Federal Council recognises that these countries offer an adequate level of protection (Art. 16(1) FADP; Annex 1 FADP Ordinance (OPDo)).

5. When you visit the site

• Server logs: the host records technical data at each visit, in particular the IP address, the date and the page requested. They are used to run and protect the site.
• Odoo visitor tracking: Odoo records a visitor identifier, the pages viewed and the country, deduced from the IP address by geolocation (GeoIP: a table that links an IP address to a country). We use it to know which pages are useful and to give context to the person who answers the chat.
• Cookies (small files that the site places in your browser): only three, all technical. frontend_lang keeps the language you chose, tz the time zone, session_id the session (needed for the chat and for login). No cookie for audience measurement, advertising or social networks. You can block cookies in your browser; the chat and login may then stop working (Art. 45c TCA).
• No third-party service: the site loads no resource from another provider (no external font, no measurement script, no advertising pixel, no social network button). A link to another site only passes on data if you click it; that site then applies its own rules.

6. The live chat

The chat starts with a bot that follows a fixed script: it asks questions planned in advance, without artificial intelligence, and decides nothing. A person from SummitSuite then takes over. We keep the conversation, as well as the name, email and phone number you type, and the country deduced from your IP address. When nobody is online, the bot asks you for your email so that we can reply to you by email. Please do not write sensitive data (health, banking data, passwords) in the chat.

7. The contact form

You give us your name, your email, your phone number, your company and your message. Your request becomes a "lead" (a request to follow up) in our Odoo CRM (the software where we track our contacts and our offers) and also reaches us by email. We use it to reply to you and, if you wish, to make you an offer.

8. Appointment booking

You give us your name, your email, your phone number and the answer to the question asked when you book. The appointment becomes an event in the Odoo calendar, synchronised with the Google calendar of the person who receives you. Google LLC (United States) therefore receives this data as a processor. The United States appears in Annex 1 OPDo for companies certified under the Swiss-U.S. Data Privacy Framework; Google states that it is certified (verifiable on dataprivacyframework.gov). For people in the European Union, the transfer relies on the European Commission's adequacy decision for certified companies (Art. 45 GDPR).

9. Emails

Our emails go through SummitSuite's mail service at Infomaniak, in Switzerland.

10. Clients, portal accounts and payments

The "Client area" link (at the bottom of the page) is reserved for clients who have a portal account. Our clients' data is processed according to the contract concluded with them. The site has no shop and takes no payments.

11. Our applications

SummitSuite creates Odoo applications and modules for its clients. This section applies to each of them. Each application has its own part further down, with its own address: the address of this page, followed by #app- and the name of the application (for example https://www.summitsuite.ch/privacy#app-odoo-modules). This is the address we give in Apple's App Store and in Google Play.

11.1 Rules common to all our applications

• Your data stays with you: in your company's Odoo or on your device, unless the application's part says otherwise.
• Applications used in a company's Odoo: the company (often your employer) is responsible for the processing. SummitSuite does not see this data. If the company asks us to intervene, we access it only for the company, as a processor and under a contract (Art. 9 FADP).
• Never any advertising, sale or rental of data, tracker or third-party software kit that follows your use.
• Device permissions (camera, location, notifications…): requested only when a function needs them, explained in the application's part, and removable at any time in the device settings.
• What you can ask for: to know what data the application processes, to have it corrected, erased, or to receive it in a common format (section 17). If the application lets you create an account, it also lets you delete it. Uninstalling the application erases the data kept only on the device.
• Contact: mgmt@summitsuite.ch. For an application used in your company, first contact the company; we help it to answer you.

11.2 List of our applications

Custom Odoo modules and applications

• What they do: modules that are added to a client's Odoo (fields, workflows, portal for its clients, links with other tools), made at the client's request.
• Data processed: what the client records in its Odoo (for example contacts, equipment, contracts, service requests). The module does not add any on its own initiative.
• Where it is stored: in the client's Odoo, with the host the client has chosen.
• Who receives it: the client, and its users according to their rights. SummitSuite accesses it only at the client's request and under the contract concluded with it.
• How long: until the client deletes it.
• Device permissions: none.
• Your rights: section 17. If you are a user or a client of a company that uses the module, first contact that company.
• Contact: mgmt@summitsuite.ch.

12. Who receives your data

Only our processors, for what is described above: Odoo SA (hosting, with Google Cloud and OVH), Google LLC (appointment calendar) and Infomaniak (email). An authority may receive some if the law obliges us to. We never sell or rent data.

13. Transfers abroad

Your data goes to France, Belgium, the Netherlands and Sweden (hosting) and to the United States (Google calendar), as described in sections 4 and 8. If we ever had to use a provider in a country without recognised adequate protection, we would use standard data protection clauses (Art. 16(2) FADP; Art. 46 GDPR) and we would update this page beforehand.

14. How long we keep your data

We erase or anonymise data as soon as it is no longer needed (Art. 6(4) FADP).

If a request leads to a contract, its data joins the client's file.

We check these periods once a year and delete whatever exceeds them.

15. Why we are entitled to process your data

In Switzerland, processing that respects the principles of the law (lawfulness, good faith, proportionality, purpose, accuracy, Art. 6 FADP) does not need authorisation; if a justification is needed, it is your consent, an overriding interest or the law (Art. 31 FADP), for example preparing or performing a contract (Art. 31(2)(a) FADP). For the GDPR, we rely on:

• pre-contractual measures requested by you and the performance of a contract (Art. 6(1)(b) GDPR): chat, form, appointments;
• our legitimate interest in running, protecting and improving the site and in answering requests (Art. 6(1)(f) GDPR): logs, visitor tracking, replies;
• a legal obligation (Art. 6(1)(c) GDPR): keeping accounting records;
• your consent when we ask for it (Art. 6(1)(a) GDPR), which you can withdraw at any time (Art. 7(3) GDPR).

We make no automated individual decisions (Art. 21 FADP) and do no profiling.

16. Security

We protect your data with technical and organisational measures suited to the risk (Art. 8 FADP): access limited to the people who need it, personal accounts, encrypted connection, backups with the host.

17. Your rights

You can at any time:

• find out whether we process data about you and which (Art. 25 FADP; Art. 15 GDPR);
• have it corrected (Art. 32(1) FADP; Art. 16 GDPR);
• have it erased, or have a processing or a disclosure prohibited (Art. 32(2) FADP; Art. 17 GDPR);
• object to a processing (Art. 30(2)(b) FADP; Art. 21 GDPR) or ask for it to be restricted (Art. 18 GDPR);
• receive the data you gave us, in a common electronic format, or have it transmitted to another controller (Art. 28 FADP; Art. 20 GDPR).

Write to mgmt@summitsuite.ch. It is free of charge (Art. 25(6) FADP). We reply as a rule within 30 days (Art. 25(7) FADP), and at the latest within one month under the GDPR (Art. 12(3) GDPR). We may ask you to prove your identity, so as not to give your data to someone else.

18. Complaint

Write to us first: we quickly correct what is wrong. You can also contact the Federal Data Protection and Information Commissioner (FDPIC, www.edoeb.admin.ch), who can open an investigation on report (Art. 49 FADP). If you live in the European Union, you can lodge a complaint with the data protection authority of your country (Art. 77 GDPR).

19. Changes

We update this page when our processing changes; the date at the top shows the latest version. This page exists in French, English, German and Italian; in case of difference, the French version prevails.