Privacy Policy

1. Controller

The controller responsible for the processing of personal data on this website is:

TULIP Sàrl

Quai du Mont-Blanc 29

1201 Geneva, Switzerland

Email: info@tulipconsulting.ch

If you have any questions about this policy or how your personal data is handled, please contact us at the address above.

2. Scope

This privacy policy explains how TULIP Sàrl (“we”, “us”, “our”), a consultancy based in Geneva, collects and processes personal data through our website www.tulipconsulting.ch and in connection with our services. It applies to visitors of our website and to people who contact us, subscribe to our newsletter, or otherwise interact with us.

We comply with the Swiss Federal Act on Data Protection (FADP) of 25 September 2020 (in force since 1 September 2023). Where the EU General Data Protection Regulation (GDPR) applies, we also comply with the GDPR.

3. What data we collect and why

3.1 Server log data

When you visit our website, our hosting provider automatically collects technical information that your browser transmits, including:

• IP address (typically truncated/anonymised)
• Date and time of the request
• Page accessed and HTTP status
• Browser type, version, and operating system
• Referring URL

We use this data to operate the website securely, prevent abuse, and diagnose technical issues. Legal basis: our legitimate interest in a secure and functional website (GDPR Art. 6(1)(f); FADP Art. 31(1)).

Retention: our hosting provider Infomaniak keeps access and error logs for at least 7 days, after which entries are deleted and cannot be restored.

3.2 Contact / direct enquiries

If you contact us by email or phone, we process the personal data you provide — typically your name, email address, company, and the content of your message — to respond to your enquiry and, where applicable, to provide our consulting services.

Legal basis: performance of a contract or pre-contractual measures (GDPR Art. 6(1)(b); FADP Art. 31(2)(a)) and our legitimate interest in handling enquiries (Art. 6(1)(f)).

Retention: we keep enquiry data as long as needed to handle your request and afterwards in accordance with statutory retention periods. Under Swiss law, business correspondence is generally retained for up to 10 years (Art. 958f Swiss Code of Obligations).

3.3 Newsletter

If you subscribe to our newsletter, we collect your email address and, optionally, your name. Subscription works on a double opt-in basis: after you sign up, you receive a confirmation email and your subscription becomes active only once you click the confirmation link.

We use this data to send you our newsletter and to measure basic engagement (e.g. whether emails were opened or links clicked) so we can improve content.

We use Brevo (Sendinblue SAS, 106 Boulevard Haussmann, 75008 Paris, France) as our newsletter provider. Brevo processes data on our behalf under a data processing agreement and stores data within the EU.

Legal basis: your consent (GDPR Art. 6(1)(a); FADP Art. 31(1)). You can withdraw consent at any time by clicking the unsubscribe link in any newsletter, or by emailing info@tulipconsulting.ch. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Retention: until you unsubscribe; records of your consent are kept as proof for as long as legally necessary.

3.4 Web analytics

We use Google Analytics 4, a service provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), to understand how visitors use our website and to improve it. For visitors based in the United States and certain other countries, the service is provided by Google LLC.

Google Analytics uses cookies and similar identifiers to collect information, including a pseudonymous identifier, your (truncated) IP address, pages viewed, time spent, device and browser information, and approximate location. IP anonymisation is enabled, so your IP address is truncated within the EU/EEA before being transmitted to Google.

Data may be transferred to Google LLC in the United States. Google is certified under the EU-US Data Privacy Framework and the Swiss-US Data Privacy Framework, which the European Commission and the Swiss Federal Council recognise as providing an adequate level of data protection. For any other transfers, Google uses EU Standard Contractual Clauses.

Legal basis: your consent, given via our cookie banner (GDPR Art. 6(1)(a); FADP Art. 31(1)). You can withdraw consent at any time via the cookie settings link in the footer of our website.

Retention: Google Analytics event data is retained for at least 2 months and up to 14 months, after which it is automatically deleted.

More information on Google’s privacy practices: https://policies.google.com/privacy.

4. Cookies and similar technologies

Our website uses:

• Strictly necessary cookies required for the site to function (e.g. session, security, cookie-preference storage). These do not require consent.
• Analytics cookies (Google Analytics — see section 3.4), set only after you give consent through our cookie banner.

We manage cookie consent using CookieYes, a service provided by CookieYes Limited (3 Warren Yard, Warren Park, Wolverton Mill, Milton Keynes MK12 5NW, United Kingdom). The United Kingdom is recognised by both the Swiss Federal Council and the European Commission as providing an adequate level of data protection.

You can manage your preferences at any time via the cookie settings link in our footer or by adjusting your browser settings. Blocking cookies may affect some features of the site.

5. Sharing with third parties

We do not sell your personal data. We share it only with:

• Service providers (processors) acting on our instructions and bound by data processing agreements (see the list below).
• Authorities or courts, where we are legally required to do so.
• Professional advisors (lawyers, accountants) where necessary to defend or assert legal claims.

Our key processors:

6. International data transfers

Some of our processors are located outside Switzerland or the EU/EEA, in particular Google LLC in the United States.

Where we transfer personal data abroad, we ensure an adequate level of protection through one or more of the following:

• transfer to a country recognised by the Swiss Federal Council and/or the EU Commission as offering adequate protection (this currently covers the EU/EEA, the United Kingdom, and US recipients certified under the EU–US / Swiss–US Data Privacy Frameworks);
• EU Standard Contractual Clauses (together with the Swiss FDPIC’s amendments where required);
• additional technical and organisational measures (e.g. encryption, pseudonymisation) where appropriate.

You can request more information on the safeguards we rely on by contacting us at info@tulipconsulting.ch.

7. Data security

We take appropriate technical and organisational measures to protect personal data against unauthorised access, loss, or alteration — including TLS encryption of our website, access controls, and regular software updates. However, no system can be guaranteed 100% secure.

8. Your rights

Subject to legal conditions and exceptions, you have the following rights regarding your personal data:

• Right of access — to know what data we hold about you.
• Right to rectification — to have inaccurate data corrected.
• Right to erasure / deletion — to have your data deleted in certain circumstances.
• Right to restriction of processing.
• Right to object to processing based on legitimate interests, and to object at any time to direct marketing.
• Right to data portability — to receive your data in a structured, machine-readable format (under the GDPR; a comparable right exists under the FADP for data you have provided).
• Right to withdraw consent at any time, without affecting the lawfulness of prior processing.

To exercise these rights, contact us at info@tulipconsulting.ch. We may need to verify your identity before responding and aim to reply within 30 days.

You also have the right to lodge a complaint:

• in Switzerland, with the Federal Data Protection and Information Commissioner (FDPIC) — edoeb.admin.ch;
• in the EU/EEA, with your local supervisory authority.

9. Children

Our website and services are directed at businesses and adults. We do not knowingly collect personal data from children under 16. If you believe we may hold such data, please contact us and we will delete it.

10. Automated decision-making

We do not use fully automated decision-making, including profiling, that produces legal or similarly significant effects on you.

11. Changes to this policy

We may update this privacy policy from time to time to reflect changes in our practices or the law. The current version is always available on this page, with the date of the latest update at the top.

12. Contact

If you have any questions about this privacy policy or wish to exercise your rights, please contact:

TULIP Sàrl

Quai du Mont-Blanc 29, 1201 Geneva, Switzerland

info@tulipconsulting.ch