Privacy Statement
for Btwentyfour Website
01Controller & Contact
The controller responsible for the processing of personal data in connection with this website and our services is:
Btwentyfour AG
Grafenauweg 8
6300 Zug, Switzerland
UID: CHE-172.454.429
E-mail: privacy@btwentyfour.com
Website: btwentyfour.com
For all questions relating to the processing of your personal data or to exercise your rights, please contact us at the address above, marking your communication "Privacy".
02Scope & Applicable Law
Btwentyfour AG is incorporated in Switzerland and is primarily subject to the Swiss Federal Act on Data Protection (revFADP / nDSG), which has applied since 1 September 2023.
Where we process personal data of individuals located in the European Economic Area (EEA) or the United Kingdom, the EU General Data Protection Regulation (GDPR) and, where applicable, the UK GDPR apply in addition.
This Privacy Statement explains which personal data we process when you visit our website (btwentyfour.com and our country domains, such as btwentyfour.se or btwentyfour.de, which lead to it), when you send us a request or contact us, and in our sales and customer relationships. It also explains with whom we share data and what rights you have.
03In Short
- Our website sets no cookies and stores nothing in your browser.
- It uses no web analytics, no advertising or retargeting tags and no social media plug-ins, and it loads no content from third parties.
- You can therefore use the website without making any cookie or tracking choices: there is nothing to accept or decline.
- We receive personal data from the website only when you send us a network check request through its form, or when you contact us by e-mail or phone.
04Visiting Our Website
The website is hosted on Microsoft Azure in data centres in the European Union (the Netherlands and Ireland). Our country domains are forwarded to it through Microsoft Azure Front Door.
When you open a page, your browser necessarily sends technical data to the servers, such as your IP address, the page requested, the time and your browser type. This data is used only to deliver the page and to keep the service secure and working. Our technical operating logs do not store full IP addresses (IP addresses are masked) and are kept for no longer than 90 days.
Legal basis: our legitimate interest in providing a secure and working website (Art. 6(1)(f) GDPR; legitimate interest under nDSG).
05Cookies & Similar Technologies
Our website does not use cookies, local storage or similar technologies, neither our own nor those of third parties. For this reason it does not show a cookie banner and there are no cookie settings to change.
Should we ever introduce technologies that require your consent, we will update this Privacy Statement first and ask for your consent before using them.
06The Network Check Request
With the form on our website you can ask us to map your suppliers or buyers against the marketplace.
Data we receive
- Your company name and your work e-mail address
- Whether you are a buyer or a seller
- The names of the suppliers or buyers you list
- The language version of the website you used
Purpose & legal basis
We use this data to carry out the network check and to reply to you. Processing takes place at your request with a view to a possible business relationship (Art. 6(1)(b) GDPR) and on the basis of our legitimate interest in answering business enquiries (Art. 6(1)(f) GDPR; legitimate interest under nDSG).
How it is processed
Your request is checked by a service of ours on Microsoft Azure and sent as an e-mail from our mailbox hello@btwentyfour.com to our sales team at sales@btwentyfour.com, through Microsoft 365. Our sales team may record the request and our correspondence in our customer relationship management (CRM) system.
Protection against misuse
To protect the form against automated misuse, we limit how many requests can be sent. For this purpose your IP address is stored only as a one-way coded value (a keyed hash with a random key that changes every day), from which the IP address cannot be recovered. These values are deleted automatically within two days. The form also contains an invisible field and a small calculation in your browser that tell people and automated programs apart. No CAPTCHA service or other third party is involved.
07Contacting Us by E-mail or Phone
When you contact us, for example at sales@btwentyfour.com, support@btwentyfour.com, privacy@btwentyfour.com or by phone, we process the details you give us (such as your name, company, contact details and the content of your message) to handle your enquiry. E-mail is processed in Microsoft 365. We may record enquiries and correspondence in our CRM systems.
Legal basis: pre-contractual measures or the performance of a contract (Art. 6(1)(b) GDPR) and our legitimate interest in handling enquiries (Art. 6(1)(f) GDPR; contract performance / legitimate interest under nDSG).
08CRM & Business Communication
We manage our customer and prospect relationships in Microsoft Dynamics 365 (Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland) and HubSpot (HubSpot, Inc., 25 First Street, Cambridge, MA 02141, USA). HubSpot stores our data in its data centre in the European Union.
What is processed
- Business contact details (name, company, job title, business e-mail, phone)
- Our correspondence and the history of our business relationship
- Engagement with e-mails we send (opens, clicks, unsubscribes)
Purpose & legal basis
We use these systems to manage enquiries, customer relationships and business communication (Art. 6(1)(b) and (f) GDPR; contract performance / legitimate interest under nDSG). Marketing e-mails are sent only where permitted, and every marketing e-mail contains an unsubscribe link. Both providers act as our data processors under data processing agreements.
09Cognism – B2B Contact Data Provider
We use Cognism Limited (7 Bishopsgate, London EC2N 3AR, United Kingdom) as a data provider for outbound B2B sales activities. Cognism compiles publicly available and legitimately sourced professional contact data.
Data categories received
- Business name, job title, and seniority level
- Business e-mail address and direct-dial telephone number
- Company name, size, and industry
- LinkedIn profile URL
Legal basis
We process this data on the basis of our legitimate interest in communicating with decision-makers at companies that may benefit from Btwentyfour's marketplace and B2B trade services (Art. 6(1)(f) GDPR; legitimate interest under nDSG).
Right to object
You may object to our use of your contact details for prospecting at any time by e-mailing privacy@btwentyfour.com. We will cease processing without delay.
10Service Providers
We use the following service providers. They process personal data only on our behalf and according to our instructions.
| Provider | Purpose | Location of processing |
|---|---|---|
| Microsoft (Azure) | Hosting of the website, the request form and its technical operation | European Union (the Netherlands, Ireland) |
| Microsoft (Microsoft 365, Dynamics 365) | E-mail, office applications and CRM | European Union |
| HubSpot | CRM and business e-mail communication | European Union; support access from the USA possible |
| Cognism | B2B contact data for sales prospecting | United Kingdom |
Our reporting channel for the whistleblower system, linked in our Imprint, is operated by Visslan under its own privacy notice.
11International Data Transfers
Some of our service providers are based outside Switzerland and the EEA, or may access data from there, in particular in the USA and the United Kingdom. We ensure an adequate level of protection through:
- Adequacy decisions (for example for the United Kingdom)
- The EU-US Data Privacy Framework and its Swiss extension (where the recipient is certified)
- Standard Contractual Clauses (SCCs) adopted by the European Commission
- Swiss standard data protection clauses as approved by the FDPIC
A copy of the applicable safeguards can be requested at privacy@btwentyfour.com.
12Data Retention
| Data category | Retention period |
|---|---|
| Coded values used to limit form requests | Deleted automatically within 2 days |
| Technical operating logs of the website | Up to 90 days |
| Network check requests and e-mail correspondence | 10 years (Swiss commercial record-keeping obligation) |
| CRM data (active contacts) | Duration of business relationship + 3 years |
| CRM data (no engagement) | 24 months from last interaction; then deleted or anonymised |
| Cognism prospect data | Until opt-out or 12 months from acquisition if no engagement |
13Your Rights
Depending on your location and applicable law, you have the following rights:
| Right | Description |
|---|---|
| Access (Art. 25 nDSG / Art. 15 GDPR) | Request a copy of the personal data we hold about you |
| Rectification (Art. 32 nDSG / Art. 16 GDPR) | Have inaccurate or incomplete data corrected |
| Erasure (Art. 32 nDSG / Art. 17 GDPR) | Request deletion of data no longer necessary |
| Restriction (Art. 18 GDPR) | Ask us to restrict processing in certain circumstances |
| Data portability (Art. 20 GDPR) | Receive your data in a structured, machine-readable format |
| Object (Art. 21 GDPR / nDSG) | Object to processing based on legitimate interest, incl. direct marketing |
| Withdraw consent | Withdraw consent at any time without affecting past processing |
Submit requests to: privacy@btwentyfour.com. We will respond within 30 days (extendable to 90 days for complex requests under Swiss law; one month extendable to three months under GDPR).
You may also lodge a complaint with the relevant supervisory authority:
- Switzerland: Federal Data Protection and Information Commissioner (FDPIC) – www.edoeb.admin.ch
- EU/EEA: Data protection authority of your country of residence
14Security
We implement appropriate technical and organisational measures (TOMs) to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. Measures include encryption of all connections (TLS), a strict content security policy on the website, access controls without shared passwords for our cloud services, and regular security reviews of the website and our service providers.
15Changes to This Statement
We may update this Privacy Statement from time to time. The date of the latest version is always shown at the beginning of this document. For material changes, we will provide a more prominent notice on our website.
This Privacy Statement is available in several languages. If the language versions differ, the English version prevails.