Privacy Policy

This privacy policy explains how we process personal data in connection with our activities and operations, including our website at the domain soda.today. In particular, it explains why, how and where we process which personal data. It also explains the rights of the people whose data we process.

We may publish further privacy policies or other data protection information for individual or additional activities and operations.

1. Contact details

Responsible for the processing of personal data:

Pierre Berchtold
Soda Studios AG
Hohlstrasse 402
8048 Zurich

hallo@soda.today

In individual cases, third parties may be responsible for the processing of personal data, or we may share responsibility with third parties.

2. Definitions and legal basis

2.1 Definitions

Data subject: A natural person whose personal data we process.

Personal data: Any information relating to an identified or identifiable natural person.

Sensitive personal data: Data on trade union, political, religious or philosophical views and activities; data on health, private life or ethnic or racial origin; genetic data; biometric data that uniquely identifies a natural person; data on criminal and administrative sanctions or proceedings; and data on social assistance measures.

Processing: Any handling of personal data, irrespective of the means and procedures used, for example querying, matching, adapting, archiving, retaining, reading, disclosing, obtaining, recording, collecting, erasing, revealing, sorting, organising, storing, altering, disseminating, linking, destroying and using personal data.

2.2 Legal basis

We process personal data in accordance with Swiss data protection law, in particular the Federal Act on Data Protection (Data Protection Act, FADP) and the Ordinance on Data Protection (Data Protection Ordinance, DPO).

3. Type, scope and purpose of processing personal data

We process the personal data that is necessary to carry out our activities and operations in a lasting, user-friendly, secure and reliable way. The personal data we process may fall in particular into the categories of browser and device data, content data, communication data, metadata, usage data, master data including inventory and contact data, location data, transaction data, contract data and payment data.

We also process personal data that we receive from third parties, obtain from publicly accessible sources or collect while carrying out our activities and operations, insofar as such processing is legally permitted.

Where necessary, we process personal data with the consent of the data subjects. In many cases, we may process personal data without consent, for example to fulfil legal obligations or to protect overriding interests. We may also ask data subjects for their consent even when it is not required.

We process personal data for as long as is necessary for the respective purpose. In particular, we anonymise or delete personal data in line with statutory retention and limitation periods.

4. Disclosure of personal data

We may disclose personal data to third parties, have it processed by third parties or process it jointly with third parties. These third parties are, in particular, specialised providers whose services we use.

For example, we may disclose personal data to banks and other financial service providers, authorities, educational and research institutions, consultants and lawyers, interest groups, IT service providers, cooperation partners, credit and business information agencies, logistics and shipping companies, marketing and advertising agencies, the media, organisations and associations, social institutions, telecommunications companies and insurers.

5. Communication

We process personal data in order to communicate with individuals as well as with authorities, organisations and companies. In particular, we process data that a data subject sends us when getting in touch, for example by post or e-mail. We may store such data in an address book or similar tools.

Third parties who send us data about other people are themselves obliged to ensure the data protection of those data subjects. In particular, they must ensure that such data is accurate and may be passed on.

6. Job applications

We process personal data about applicants insofar as it is necessary to assess their suitability for employment or to later perform an employment contract. The necessary personal data results in particular from the information requested, for example in a job advertisement. We may publish job advertisements with the help of suitable third parties, for example in electronic and print media or on job portals and recruitment platforms.

We also process the personal data that applicants share or publish voluntarily, in particular as part of cover letters, CVs and other application documents, as well as online profiles.

7. Data security

We take appropriate technical and organisational measures to ensure a level of data security that is appropriate to the respective risk. With these measures we ensure in particular the confidentiality, availability, traceability and integrity of the personal data we process, although we cannot guarantee absolute data security.

Access to our website and our other online presence uses transport encryption (SSL / TLS, in particular with Hypertext Transfer Protocol Secure, or HTTPS for short). Most browsers warn against visiting websites without transport encryption.

Like practically all digital communication, our digital communication is subject to mass surveillance without cause or suspicion by security authorities in Switzerland, the rest of Europe, the United States of America (USA) and other countries. We have no direct influence on the corresponding processing of personal data by intelligence services, police authorities and other security authorities. Nor can we rule out that a data subject is being specifically monitored.

8. Personal data abroad

We generally process personal data in Switzerland. However, we may also disclose or export personal data to other countries, in particular to process it there or have it processed there.

We may disclose personal data to all countries on Earth and elsewhere in the universe, provided that the local law ensures adequate data protection in accordance with a decision of the Swiss Federal Council.

We may disclose personal data to countries whose law does not ensure adequate data protection, provided that suitable data protection is ensured for other reasons, in particular on the basis of standard data protection clauses or other appropriate safeguards. In exceptional cases, we may export personal data to countries without adequate or suitable data protection if the special requirements under data protection law are met, for example the explicit consent of the data subjects or a direct connection with the conclusion or performance of a contract. On request, we are happy to inform data subjects about any safeguards or provide a copy of them.

9. Rights of data subjects

9.1 Data protection claims

We grant data subjects all claims under the applicable data protection law. In particular, data subjects have the following rights:

• Access: Data subjects can ask whether we process personal data about them and, if so, which personal data. Data subjects also receive the information necessary to assert their data protection claims and to ensure transparency. This includes the personal data processed as such, but also information on the purpose of processing, the retention period, any disclosure or export of data to other countries and the origin of the personal data, among other things.
• Rectification and restriction: Data subjects can have inaccurate personal data corrected, incomplete data completed and the processing of their data restricted.
• Erasure and objection: Data subjects can have personal data erased (“right to be forgotten”) and object to the processing of their data with effect for the future.
• Data release and data portability: Data subjects can request the release of personal data or the transfer of their data to another controller.

We may postpone, restrict or refuse the exercise of data subjects’ rights within the legally permitted framework. We may inform data subjects of any requirements that must be met to exercise their data protection claims. For example, we may refuse access in whole or in part with reference to confidentiality obligations, overriding interests or the protection of other people. We may also, for example, refuse the erasure of personal data in whole or in part, in particular with reference to statutory retention obligations.

In exceptional cases, we may charge for the exercise of these rights. We will inform data subjects of any costs in advance.

We are obliged to identify data subjects who request access or assert other rights by appropriate means. Data subjects are obliged to cooperate.

9.2 Legal protection

Data subjects have the right to enforce their data protection claims through the courts or to file a report or complaint with a data protection supervisory authority.

The data protection supervisory authority for private controllers and federal bodies in Switzerland is the Federal Data Protection and Information Commissioner (FDPIC).

10. Use of the website

10.1 Cookies

We may use cookies. Cookies – both our own (first-party cookies) and those of third parties whose services we use (third-party cookies) – are data stored in the browser. Such stored data is not necessarily limited to traditional text-based cookies.

Cookies can be stored in the browser temporarily as “session cookies” or for a certain period as so-called permanent cookies. “Session cookies” are deleted automatically when the browser is closed. Permanent cookies have a specific storage period. In particular, cookies make it possible to recognise a browser the next time it visits our website and thus, for example, to measure our website’s reach. However, permanent cookies can also be used for online marketing, for example.

Cookies can be fully or partially disabled and deleted in the browser settings at any time. Without cookies, our website may no longer be fully available. We actively ask for explicit consent to the use of cookies – at least if and to the extent required.

For cookies used for performance and reach measurement or for advertising, a general objection (“opt-out”) is possible for many services via AdChoices (Digital Advertising Alliance of Canada), the Network Advertising Initiative (NAI), YourAdChoices (Digital Advertising Alliance) or Your Online Choices (European Interactive Digital Advertising Alliance, EDAA).

10.2 Logging

For every access to our website and our other online presence, we may log at least the following information, provided it is transmitted to our digital infrastructure during such access: date and time including time zone, IP address, access status (HTTP status code), operating system including user interface and version, browser including language and version, the individual subpage of our website accessed including the amount of data transferred, and the last web page accessed in the same browser window (referer or referrer).

We log such information, which may also constitute personal data, in log files. The information is necessary to provide our online presence in a lasting, user-friendly and reliable way. It is also necessary to ensure data security – including by or with the help of third parties.

10.3 Tracking pixels

We may embed tracking pixels in our online presence. Tracking pixels are also known as web beacons. Tracking pixels – including those of third parties whose services we use – are usually small, invisible images or scripts written in JavaScript that are loaded automatically when our online presence is accessed. Tracking pixels can capture at least the same information as log files.

11. Notifications and messages

11.1 Performance and reach measurement

Notifications and messages may contain web links or tracking pixels that record whether an individual message was opened and which web links were clicked. Such web links and tracking pixels may also record the use of notifications and messages on a personal basis. We need this statistical recording of usage for performance and reach measurement, so that we can send notifications and messages effectively and in a user-friendly, lasting, secure and reliable way, based on the needs and reading habits of the recipients.

11.2 Consent and objection

You generally have to consent to the use of your e-mail address and other contact details, unless their use is permitted for other legal reasons. To obtain double-confirmed consent where applicable, we may use the “double opt-in” procedure. In this case, you will receive a message with instructions for the double confirmation. We may log the consents obtained, including IP address and timestamp, for evidence and security reasons.

You can generally object to receiving notifications and messages such as newsletters at any time. With such an objection, you can at the same time object to the statistical recording of usage for performance and reach measurement. This does not apply to necessary notifications and messages in connection with our activities and operations.

11.3 Service providers for notifications and messages

We send notifications and messages with the help of specialised service providers.

In particular, we use:

• Brevo: Building and maintaining relationships with customers and users, in particular via e-mail and instant messaging; provider: Sendinblue GmbH (Germany); data protection information: privacy policy, “Data protection and data security”, “Security and data protection”.

12. Social media

We are present on social media platforms and other online platforms so that we can communicate with interested people and share news about our activities and operations. In connection with such platforms, personal data may also be processed outside Switzerland.

The general terms and conditions, terms of use, privacy policies and other provisions of the individual platform operators also apply in each case. In particular, these provisions explain the rights of data subjects directly vis-à-vis the respective platform, such as the right of access.

13. Third-party services

We use services from specialised third parties to carry out our activities and operations in a lasting, user-friendly, secure and reliable way. Among other things, such services allow us to embed functions and content in our website. When content is embedded in this way, the services used capture users’ IP addresses, at least temporarily, for technically compelling reasons.

For necessary security-related, statistical and technical purposes, third parties whose services we use may process data in connection with our activities and operations in aggregated, anonymised or pseudonymised form. This includes, for example, performance or usage data needed to provide the respective service.

In particular, we use:

• Umami: for analysing visitor numbers. Provider: Umami Software, Inc; data protection information: Privacy Policy.

13.1 Digital infrastructure

We use services from specialised third parties to access the digital infrastructure we need in connection with our activities and operations. This includes, for example, hosting and storage services from selected providers.

In particular, we use:

• Cyon: hosting; provider: cyon GmbH (Switzerland); data protection information: “Data protection”, privacy policy.

13.2 Digital content

We use services from specialised third parties to embed digital content in our website. Digital content includes, in particular, images, video, music and podcasts.

In particular, we use:

• Vimeo: video platform; provider: Vimeo Inc. (USA); data protection information: privacy policy, “Private video hosting”.
• YouTube: video platform; provider: Google; YouTube-specific information: “Privacy and Safety Center”, “My data on YouTube”.

14. Performance and reach measurement

We try to measure the success and reach of our activities and operations. In this context, we may also measure the effect of third-party referrals or test how different parts or versions of our online offering are used (“A/B testing”). Based on the results of performance and reach measurement, we can in particular fix errors, strengthen popular content or make improvements.

In most cases, performance and reach measurement captures the IP addresses of individual users. In this case, IP addresses are generally shortened (“IP masking”) in order to follow the principle of data minimisation through the corresponding pseudonymisation.

Performance and reach measurement may involve the use of cookies and the creation of user profiles. Any user profiles created include, for example, the individual pages visited or content viewed on our website, information on the size of the screen or browser window and the – at least approximate – location. Generally, any user profiles are created in pseudonymised form only and are not used to identify individual users. Individual third-party services with which users are logged in may be able to link the use of our online offering to the user account or profile on the respective service.

15. Final notes on this privacy policy

We created this privacy policy with the privacy policy generator by Datenschutzpartner on 31 January 2025.

We may update this privacy policy at any time. We will inform you of updates in an appropriate form, in particular by publishing the current privacy policy on our website.