Privacy notice

1. Controller

The controller is:

Business name

Zentriq Software (sole proprietorship of Guillaume Fernandes)

Address

Rue du Lac 411815 Clarens

UID number

CHE-228.383.878

Commercial register

Commercial register of the Canton of Vaud

Owner and person responsible

Guillaume Fernandes

Email

guillaume@whorunssap.com

Questions and requests about your data: guillaume@whorunssap.com, or the opt-out page.

We have not appointed a representative in the European Union (Art. 27 GDPR).

2. Visiting the website

• No cookies, no analytics, no advertising.
• No third-party content: fonts and scripts are served by the website itself.
• Our hosting provider logs technical data (IP address, date and time, page requested, browser) for the security and operation of the site. It keeps these logs for a short period set by its plan, then deletes them.

Legal basis: our interest in the security and operation of the site (Art. 31(1) FADP; Art. 6(1)(f) GDPR where the GDPR applies).

3. Requests by email

Sample request: you email us. We process that email, i.e. your address, your name, your company and what you write to us (for example the list and region you are interested in), to reply to you and send you the sample.

Data requests (opt-out page): you email us. We process that email (your address, name, company, type of request and message) to handle the request and to be able to demonstrate that it has been handled.

The website has no forms: your email is received and stored in our mailbox, which is hosted in Switzerland.

Legal basis: your request (steps prior to a contract, Art. 6(1)(b) GDPR); for requests about your data, our legal obligations (Art. 25 and 32 FADP; Art. 6(1)(c) GDPR).

Retention: for a sample request, as long as our business relationship requires; 3 years for a request about your data. An opted-out address stays on our suppression list indefinitely, so that the opt-out is honoured.

4. Customers and payments

For an order, we process the buyer’s name, company, email address and, where applicable, billing address, as well as the order itself. Payment is made by bank transfer against a QR-bill.

Legal basis: performance of the contract (Art. 6(1)(b) GDPR) and our accounting obligations (Art. 6(1)(c)).

Retention: 10 years for accounting records (Art. 958f of the Swiss Code of Obligations).

5. The lists we sell

Our lists describe companies, not people: they contain no employee names, job titles or email addresses. We sell them to companies, which may use them only internally: the licence forbids reselling, publishing or sharing them with third parties.

For each company, in particular: its registered name, its locality and canton, its website, the SAP product it uses, where relevant its migration status, and the date of the latest evidence when known.

The public documents we use to verify the lists may name individuals. We keep these documents internally, for verification purposes, and do not pass them on with the lists.

The registered name of a sole proprietorship contains its owner’s name, so it is also personal data. The owner can ask us to remove the business on the opt-out page.

Legal basis: our overriding private interest, and that of our customers, in understanding the business market (Art. 31(1) FADP); this information has been made generally accessible (Art. 30(3) FADP). Where the GDPR applies: the same legitimate interest (Art. 6(1)(f) GDPR). The owner of a sole proprietorship can object to the processing on the opt-out page (Art. 30(2)(b) FADP; Art. 21 GDPR).

6. Our own prospecting

To offer our lists, we approach potential business customers ourselves: SAP integrators and partners, software vendors, consulting firms, recruiters. For this, we process business contact data. It is for our internal use only: we do not sell it or pass it on to our customers.

Data processed

Name, job title, employer, business email address and the result of its verification. No private or sensitive data.

Where the data comes from

• Business information published by the companies themselves or by third parties (websites, professional publications)
• Business contact data providers and email address verification services

Informing the people concerned

If we write to you, our first message says where your contact details come from and links to this notice and to the opt-out page, where you can object to any further contact.

Legal bases

Switzerland (FADP): our overriding private interest in prospecting businesses (Art. 31(1) FADP); the data is mostly business data made generally accessible (Art. 30(3) FADP). You can object to the processing at any time (Art. 30(2)(b) FADP).

European Union, where the GDPR applies: our legitimate interest in business-to-business prospecting (Art. 6(1)(f) GDPR). You can object at any time (Art. 21 GDPR).

Retention

At most 2 years after collection if no exchange has taken place; sooner if we learn that the person has left the company. An opted-out address stays on our suppression list.

7. Providers and transfers abroad

We use providers in the following categories, in the countries shown:

• Website hosting and technical logs (United States).
• Email service (Switzerland).
• Contact data enrichment and verification for our own prospecting (United States, European Union, Canada, New Zealand).
• Automated analysis of public documents, which may contain people’s names (European Union or United States).

Switzerland recognises the European Union, Canada and New Zealand as providing adequate data protection, and the United States only for companies certified under the Swiss-U.S. Data Privacy Framework. For other transfers to the United States, we rely on the standard contractual clauses provided for in our providers’ terms (Art. 16(2)(d) FADP; Art. 46 GDPR).

8. Your rights

You can ask for access to your data and information on its origin, for its rectification or erasure and for a copy of the data you have provided to us (portability), and you can object to its processing. Where the GDPR applies, you can also ask for the restriction of processing. Use the opt-out page or write to guillaume@whorunssap.com. We reply within 30 days and may ask you to confirm your identity.

9. Supervisory authority

You can lodge a complaint with:

• Switzerland: the Federal Data Protection and Information Commissioner (FDPIC), www.edoeb.admin.ch.
• European Union: the data protection authority of the country where you live or work (list at edpb.europa.eu).

10. Changes

We update this notice when our processing changes. The version published on this website applies.