Privacy Policy

1. Data controller

Dukiwi SA, a Swiss corporation, is the controller of your personal data in the context of using the Gleeder platform.

2. Data collected

When you register and use the platform, we collect the following data:

Data	Purpose	Retention period
Username	Platform identification	Duration of account
Email address	Account recovery, notifications	Duration of account + 30 days
Password	Authentication (Argon2id hashed)	Duration of account
IP address	Security, intrusion detection	90 days in logs
Agent data	Management of registered machines	Duration of account
Activity logs	Audit, security	90 days

3. Hosting and data location

All data is hosted exclusively in Switzerland by Infomaniak Network SA, an ISO 27001-certified provider with data centres in Geneva and Winterthur. No data is transferred outside Switzerland.

4. Cookies and sessions

The platform uses only session cookies strictly necessary for authentication. These cookies:

• Are marked HttpOnly and SameSite=Strict
• Contain no personal data
• Expire automatically after 1 hour of inactivity
• Are never shared with third parties

No tracking, advertising or analytics cookies are used.

5. Legal basis for processing

Processing of your data is based on your explicit consent given at registration (acceptance of the Terms and this policy), as well as the performance of the service agreement between you and Dukiwi SA.

6. Data sharing

Dukiwi SA never sells, rents or shares your personal data with third parties for commercial purposes. The only sub-processor involved is Infomaniak Network SA for hosting, governed by a data processing agreement compliant with the revFADP.

7. Security

We implement appropriate technical and organisational measures to protect your data:

• Password hashing with Argon2id
• CSRF protection on all forms
• Sessions bound to the IP address
• Login rate limiting
• Access and anomaly logging

8. Your rights (revFADP)

In accordance with the revised Federal Act on Data Protection (revFADP), in force since 1 September 2023, you have the following rights:

• Right of access — obtain a copy of your data
• Right of rectification — correct inaccurate data
• Right to erasure — request deletion of your account and data
• Right to portability — receive your data in a structured format
• Right to object — object to certain processing activities

To exercise these rights, contact Dukiwi SA. We respond within a maximum of 30 days.

9. Changes to this policy

Dukiwi SA may update this policy. In the event of a material change, you will be notified by email at least 30 days before it takes effect. The date of last update always appears in the header of this document.

10. Contact

For any questions regarding the protection of your data, contact the Dukiwi SA data protection officer via our institutional website.