Website privacy

Controller and contact

CFS Engineering SA, EPFL Innovation Park, Building A, 1015 Lausanne, Switzerland. Privacy questions, objections, and rights requests can be sent by email: Send a mail.

Optional Umami analytics

Umami remains completely unloaded until you accept optional analytics through Privacy settings. The legal basis is your consent under GDPR Article 6(1)(a) and, where applicable, the corresponding consent rule for access to information on your device. Refusing analytics does not limit the website. You may withdraw at any time through the footer or cookie icon as easily as you accepted.

After consent, Umami measures page paths, anonymous sessions, the referring site's origin, approximate country, region, and city, browser, operating system, device, language, screen size, Core Web Vitals, scroll depth, consented visible-page time, and contact, download, and outbound-link events. Query strings, URL fragments, full referrer paths, link or button text, form values, copied text, media activity, and error details are not sent. CFS Engineering does not assign a persistent visitor ID, so it does not deliberately link a person across separate visits.

Umami uses the request IP address to derive the approximate location and an anonymous session hash based on the IP address, user-agent, and website ID; the processor states that it does not store the IP address. The processor therefore receives network data even though the analytics dashboard does not identify visitors by name. Analytics is not used for advertising, cross-site tracking, lead scoring, session replay, heatmaps, or decisions about individuals.

Umami Software, Inc., San Francisco, United States, processes analytics for CFS Engineering under its data-processing terms. CFS Engineering's operating policy requires Umami's EU data region, private and least-privilege access, disabled public sharing/session replay/heatmaps, and deletion of visitor and event detail within 90 days. Any processor access or onward transfer outside the EEA must remain covered by the applicable contractual and transfer safeguards. Information about those safeguards is available from CFS Engineering on request.

Necessary browser storage and your choice

The Privacy settings panel stores only its version, your analytics choice, and the choice time under cfse-cookie-consent in local browser storage. The language selector stores only the supported language code you explicitly select under cfse-language-preference. These records are necessary to remember your choices on your device, are never sent to CFS Engineering or another party, and remain until you clear site storage or a relevant update invalidates them.

The site also uses session storage to restore scroll position and recover safely after a software update. It contains navigation state rather than analytics and expires with the browser session. Reject analytics and Accept analytics are presented on the first layer; the optional checkbox is off by default. You can reopen Privacy settings at any time from the footer or cookie icon.

Hosting and operational logs

Infomaniak Network SA, Rue Eugène-Marziano 25, 1227 Les Acacias, Switzerland, hosts this website as a processor in Swiss data centres. Its servers receive request data needed to deliver and secure the site. Standard access logs may contain a timestamp, requested address, response status, referrer, IP address, and user-agent string.

Infomaniak states that Web Hosting access logs are available for at least seven days and removes them under the account's rotation schedule. CFS Engineering does not export or retain its own raw-log copy beyond 30 days. The accountable owner periodically verifies the provider schedule, access restrictions, processor terms, and deletion controls.

The purposes are delivery, availability, abuse and incident investigation, and—only after approval—coarse content-demand and capacity statistics. Processing follows the Swiss principles of transparency, proportionality, purpose limitation, privacy by design, and security. Where the GDPR applies, CFSE relies on its legitimate interests under Article 6(1)(f), subject to a documented necessity and balancing assessment. You may object on grounds relating to your situation by contacting us; CFSE will stop the affected legitimate-interest processing unless compelling grounds or legal-claims needs permit it to continue.

No secondary access-log analytics

CFS Engineering does not currently turn hosting logs into a separate analytics dataset. The repository contains a disabled aggregate-report tool, but it cannot be used in production until an accountable owner completes and approves the documented legitimate-interests, necessity, retention, access, and security assessment.

Enquiries

The website has no enquiry form. Contact links open your email application; CFS Engineering receives only the message and details you choose to send. Email content and contact details are never included in traffic statistics.

Depending on the enquiry, processing is necessary to take requested pre-contractual steps under GDPR Article 6(1)(b), to answer general correspondence under CFS Engineering's legitimate interest in communicating under Article 6(1)(f), or to comply with a legal obligation under Article 6(1)(c). Email records are retained only as long as needed to respond and meet applicable contractual, legal, and security obligations. Do not include sensitive personal data or confidential technical material in the initial message.

Your rights and complaints

Depending on the applicable law and circumstances, you may withdraw consent and request access, correction, deletion, restriction, or portability of personal data, and may object to legitimate-interest processing. Because Umami does not receive your name or contact details, CFS Engineering may be unable to associate an analytics session with you without collecting additional identifying information.

You may complain to the Swiss Federal Data Protection and Information Commissioner or the competent authority where you live. Contact us first if you want help exercising a right across operational logs, email, service providers, exports, and backups.

Changes

Introducing browser analytics, identifiers, referrer or user-agent analysis, additional dimensions, longer retention, profiling, enrichment, new recipients, a different host location, or a new purpose requires another privacy review and an updated notice before collection begins.