Privacy Policy

1. Controller

Stefan Nikolic, Kirchweg 43B, 5415 Nussbaumen AG, Switzerland. Email: stefan@bppartner.ch.

2. What data we collect

We process personal data through the following channels:

• Contact form: name, company name, email address, and your free-text message.
• Business Health Assessment form: name, company name, email address, industry, company size, and your answers to 10 multiple-choice questions.
• Server logs: your IP address, browser type, operating system, and timestamp are automatically logged by our hosting provider (see Section 6).
• Cookies: see Section 6 for a full list of cookies used on this website.
• Business contacts from publicly accessible sources: name, function, business e-mail address, business telephone number, and information about the company or municipality. Details in Section 5.
• Information business contacts provide at our request — for our collective fuel orders, for example the capacity of a property’s tank and the month in which it is usually refilled.

3. Purpose of processing

• Contact form data: to respond to your enquiry and, where applicable, to take pre-contractual measures.
• Assessment form data: to calculate and deliver your personalised Business Health Score and to enable us to prepare for a potential follow-up conversation.
• Server logs: to ensure the security and stability of the website.
• Cookies: to provide the website in your preferred language, store your consent preferences, and — with your consent — to analyse site usage and measure advertising effectiveness.
• Business contact data: to initiate a business relationship, and to combine the fuel requirement of several properties into a single joint enquiry to suppliers.

4. Legal basis

Contact and assessment forms: Art. 6(1)(b) GDPR — processing is necessary for the performance of pre-contractual measures taken at your request. Under Swiss law (Art. 31 nFADP), processing is lawful as it serves the purpose of contract initiation.

Server logs and essential cookies: Art. 6(1)(f) GDPR — processing is based on our legitimate interest in ensuring the technical functionality and security of the website. Under Swiss law, no separate legal basis is required for this processing.

Analytics and marketing cookies: Art. 6(1)(a) GDPR — processing is based on your explicit consent, provided via the cookie consent banner. You may withdraw consent at any time via the "Cookie Settings" link in the footer.

Business contact data from publicly accessible sources: legitimate interest in initiating business relationships (Art. 31 para. 2 lit. a nFADP; where the GDPR applies, Art. 6 para. 1 lit. f GDPR). Details and your right to object in Section 5.

5. Business contacts from publicly accessible sources

We write to companies, municipal administrations, and property managers in Switzerland without any prior contact. The information used for this comes exclusively from publicly accessible sources:

• Official websites of municipalities, cities, administrations, and companies
• The Federal Register of Buildings and Dwellings (GWR) of the Federal Statistical Office
• Public directories such as search.ch and local.ch
• The commercial register and Zefix

We process business information only: name, function, business e-mail address, business telephone number, and information about the company or municipality. We do not process private addresses or private telephone numbers, and we do not approach private individuals.

The purpose is to initiate a business relationship. For our collective fuel orders we additionally collect a property’s requirement — for example the capacity of its tank and the month in which it is usually refilled — in order to form a joint enquiry to several suppliers in the region. Information given to us in response to our enquiry is used only for that purpose and passed on only to the extent the enquiry requires.

The legal basis is our legitimate interest in initiating business relationships (Art. 31 para. 2 lit. a nFADP; where the GDPR applies, Art. 6 para. 1 lit. f GDPR). We have weighed your interest in the protection of your data: we use business contact details only, state the sender, postal address, and telephone number in every message, do not conceal where the information came from, and end the contact on first notice.

Objection

An informal e-mail to stefan@bppartner.ch is enough — one sentence will do. We end the contact immediately and add the address permanently to our suppression list so that it is not written to in future campaigns either. For this purpose the suppression list contains the e-mail address only; it persists even when all other data is deleted, because that is the only way an objection can be honoured permanently.

6. Cookies and tracking technologies

This website uses cookies. A cookie is a small text file stored on your device by your web browser.

Essential cookies (no consent required)

Analytics cookies (require consent)

Marketing cookies (require consent)

Marketing cookies will be activated when the corresponding tools are configured. Currently only analytics cookies are in use.

Google Tag Manager

This website uses Google Tag Manager (GTM) to manage analytics and marketing scripts. GTM itself does not collect personal data — it manages the scripts that do. GTM respects Google Consent Mode v2: no data is collected until you provide consent through the cookie banner.

How to manage cookies

You can change your cookie preferences at any time by clicking the "Cookie Settings" link in the website footer. You can also control cookies through your browser settings. Please note that disabling cookies may affect the functionality of this website.

7. Data processors

We use the following third-party service providers who process personal data on our behalf:

• Vercel Inc., San Francisco, USA — website hosting and delivery. Vercel processes server logs (IP address, browser, timestamp) under a Data Processing Agreement (DPA).
• Resend Inc., USA — email delivery service. When active, Resend processes email addresses to deliver form responses and assessment results on our behalf.
• Google Ireland Limited — Google Analytics and Google Tag Manager. When analytics consent is granted, Google processes anonymised usage data under its Data Processing Agreement.
• Meta Platforms Ireland Limited — when the Meta Pixel is activated (future), Meta will process browsing data for advertising purposes under its Data Processing Agreement. This processor is not currently active.
• Instantly.ai, United States — sending and management of our business e-mail campaigns. Name, function, business e-mail address, and company information are processed.
• Google Ireland Limited — Google Workspace (Gmail) for our business correspondence, including messages to and from business contacts.
• Data quality services: Hunter.io (France) to check whether a business e-mail address is valid, and Clay (United States) to research publicly accessible company information.

8. International data transfers

Our processors are based in the United States and the EU/EEA. Data transfers to the US are safeguarded by the EU-US Data Privacy Framework where applicable, and EU Standard Contractual Clauses (SCCs) as a fallback. We ensure that all processors maintain an adequate level of data protection.

9. Retention

• Form data (contact and assessment): retained for the duration of any potential business relationship. Deleted promptly upon your request.
• Server logs: retained in accordance with Vercel's standard retention policy.
• Essential cookies: persistent until you clear your browser data.
• Analytics and marketing cookies: duration as listed in the cookie tables above. Deleted when you withdraw consent.
• Business contact data from public sources: deleted once it is clear that no business relationship will arise, and in any case no later than 24 months after the last contact. The suppression list under Section 5 is excepted and is kept permanently.

10. Your rights

Under the GDPR and nFADP, you have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate or incomplete data.
• Request deletion of your data.
• Request restriction of processing.
• Data portability — receive your data in a structured, commonly used format.
• Object to processing based on legitimate interests.
• Withdraw consent at any time for consent-based processing (analytics and marketing cookies).

To exercise any of these rights, contact us at stefan@bppartner.ch.

You also have the right to lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC) or, if you are an EU resident, with your competent supervisory authority.

11. Automated decision-making

We do not engage in automated decision-making or profiling as defined by Art. 22 GDPR or Art. 21 nFADP.