Privacy policy

This policy explains how WALVIS processes your personal data when you use this website and its forms (AI diagnostic, contact, expert network application). It is written to comply with the Swiss Federal Act on Data Protection (nFADP, "nLPD" in French) and the EU General Data Protection Regulation (GDPR).

1. Data controller

Legal entity name: WALVIS SA
Legal form: Swiss public limited company (SA)
Registered address: Rue des Remparts 10, 1950 Sion, Switzerland
UID / IDE number: CHE-437.379.397 (Commercial Register of the Canton of Valais)
Data protection contact: dpo@walvis.ch

WALVIS is a strategy-to-execution consulting firm based in French-speaking Switzerland, serving Switzerland, France, Europe and the US. For any question or request about your data, write to the contact address above.

2. Data we collect

Depending on the form you use, we collect:

Identity and contact details: first name, last name, email address, phone number (optional).
Professional information: company, job title, country.
Content of your request: free-text message and answers about your company (for example in the AI diagnostic).
Consent records: your choices and their timestamps.
Technical data: connection and security data (logs, rate limiting, audit log) and, with your consent, audience measurement data.

Please do not enter sensitive data (health, political or religious opinions, criminal proceedings, etc.) in free-text fields. We do not need this information to provide our services.

3. Purposes and legal bases

Purpose	Legal basis (GDPR)	Basis (nFADP)
Process your request (diagnostic, contact, application) and reply	Consent (Art. 6(1)(a)) and pre-contractual steps (Art. 6(1)(b))	Consent, good faith and proportionate processing (Art. 6 and 31)
Produce an AI-assisted first reading and an internal pre-triage	Consent and legitimate interest in organising request handling (Art. 6(1)(a) and (f))	Consent, overriding private interest
Share your request with an external sector expert (optional)	Consent (Art. 6(1)(a))	Consent
Send news (optional)	Consent (Art. 6(1)(a))	Consent
Secure the site, prevent abuse, keep an audit log	Legitimate interest (Art. 6(1)(f))	Overriding private interest, security measures (Art. 8)
Measure audience with Google Analytics 4	Consent (Art. 6(1)(a), and ePrivacy rules)	Consent
Measure audience without cookies, at country level	Legitimate interest (Art. 6(1)(f))	Overriding private interest
Comply with our legal obligations	Legal obligation (Art. 6(1)(c))	Legal obligation

4. Consents

Our forms provide separate consents, never pre-checked:

Processing of your request (mandatory for us to handle it).
Sharing with an external sector expert (optional).
Receiving news (optional).

Each consent is recorded with a timestamp. You may withdraw any consent at any time, without affecting processing already carried out, by writing to the contact address. You can also unsubscribe from news at any time. Declining the optional consents has no effect on how your request is handled.

5. Email double opt-in

After you submit a form, we send you an email with a confirmation link. The link is valid for 7 days and single use. Without confirmation, your request is not processed and is deleted after 30 days.

6. Artificial intelligence and no automated decision-making

Artificial intelligence models, accessed through the providers of our hosting platform, produce a first reading of your request and an internal pre-triage. These providers may be located outside Switzerland and the European Union (see section 10).

No automated individual decision with legal effects or similarly significant effects on you is made: a human reviews every request and decides what follows. You may at any time ask for a member of our team to review your file again or express your point of view.

7. Recipients and processors

Your data is accessible to authorised WALVIS staff and to the following providers, acting as processors:

Hosting platform (MindStudio / Remy): hosting and operation of the application.
Email delivery provider: sending confirmation and follow-up emails.
AI model providers (via the platform): first reading and pre-triage.
Google Ireland Limited / Google LLC: Google Analytics 4, only if you have given consent.

We do not sell your data. We share it with other third parties only if the law requires it or if you have consented.

External sector experts

Your data is passed to an external sector expert only with your specific, optional consent. The expert is bound by a non-disclosure agreement (NDA) and uses the data only to review your request.

8. Cookies and similar technologies

walvis_consent (localStorage): stores your cookie choice for 6 months. Strictly necessary for the consent banner to work.
Google Analytics cookies _ga and _ga_<id>: set only if you accept them, for a maximum of 13 months.
Admin session cookie: used only on the /crm path by our team. Strictly necessary, and not relevant to visitors.

You can change or withdraw your choice at any time by clearing the site data in your browser, which makes the consent banner appear again.

9. Audience measurement

Google Analytics 4: runs with Google Consent Mode v2, with default setting denied. Without your consent, no analytics cookie is set. The IP address is not used to identify you, and no personal data (for example form content) is sent to Google Analytics.
The platform's own audience measurement: it is cookieless and limited to country level. It does not allow us to identify you.

10. Transfers outside Switzerland and the European Union

Some processors (platform, AI providers, Google) may process data outside Switzerland and the EU, notably in the United States. These transfers rely on an adequacy decision (for example the Swiss-US or EU-US Data Privacy Framework, where the recipient is certified) or otherwise on standard contractual clauses and, where necessary, supplementary measures. You can request information about these safeguards through the contact address.

11. Retention periods

Unconfirmed requests: deleted after 30 days.
Confirmation link: valid 7 days, single use.
Inactive contacts: deleted or anonymised after 24 months of inactivity.
Cookie consent choice: 6 months.
Google Analytics cookies (if accepted): up to 13 months.
Security and audit logs: kept for a limited period, as needed for security and accountability.

A longer retention period may apply where the law requires it or for the defence of legal claims.

12. Security

We apply appropriate technical and organisational measures, including:

encrypted connection via HTTPS;
passwordless admin login;
server-side access control;
single-use tokens;
rate limiting;
an audit log.

No measure guarantees absolute security. In case of a data breach presenting a risk, we notify the authorities and the individuals concerned as required by law.

13. Your rights

You have the following rights:

access to your data;
rectification of inaccurate data;
erasure of your data;
portability of your data;
objection to processing based on legitimate interest;
withdrawal of consent at any time;
restriction of processing, in the cases provided by the GDPR.

To exercise these rights, write to the contact address in section 1. We may ask you to prove your identity. We normally reply within 30 days.

14. Complaints

You may lodge a complaint with the competent supervisory authority:

in Switzerland: the Federal Data Protection and Information Commissioner (FDPIC / PFPDT);
in the European Union: the supervisory authority of your place of residence, work or of the alleged infringement, for example the CNIL in France.

We encourage you to contact us first so that we can try to resolve the matter.

15. Obligation to provide data

The mandatory form fields are necessary to process your request. Without them, we cannot act on it. Optional fields (for example phone number) and optional consents have no effect on this processing.

16. Changes

We may update this policy, for example when the law or our services change. The version published on this website is the version in force. In case of a significant change, we will inform you appropriately.