Privacy notice

Special Projects is the controller. Contact for all data protection matters: privacy@s-projects.com.

Swiss data protection law, the Federal Act on Data Protection (FADP), governs our processing. Section 12 applies where the EU General Data Protection Regulation (GDPR) or the UK GDPR also applies to a given processing.

Contractors we engage for an engagement process personal data on our instructions.

From you: what you give us when you write to us, subscribe, meet us or work with us, in particular name, organisation, role, contact details, correspondence, meeting notes and the content of our work together.

From our site and tools: technical data generated when you use the site or open our emails, such as IP address, device and browser data, pages viewed, time of visit, referring page, and whether an email was opened or a link clicked, to the extent described in sections 4 and 5.

From other sources: public sources such as commercial registers, company websites, professional networks, media and publications; our clients and their advisers; and data providers that supply or complete business contact and company information. Section 3.4 describes the research use.

You are not obliged to provide personal data. Without contact details we cannot answer you or deliver an engagement.

Communication: answering enquiries and corresponding with you and with third parties in the course of our work.

Engagements: assessing, agreeing, delivering, documenting and invoicing engagements, including contacting counterparties, journalists, investors, advisers and other stakeholders on a client’s behalf.

Relationship management and marketing: maintaining records of the people and organisations we deal with, inviting you to events, sending our newsletter and other information about our work, and understanding how our site and communications are used. You may object to marketing at any time (section 11).

Research and analysis: collecting and analysing publicly available information about organisations, markets, stakeholders and the public roles of the people who lead them, for strategic intelligence, positioning and stakeholder work for our clients and for our own publications. We do not build personality profiles. We assess case by case whether informing each person individually is proportionate; where it is not, this notice serves as the information.

Site operation and improvement: delivering the site, measuring its use, identifying the organisations that visit it, and improving content and performance.

Security, compliance and legal: protecting our systems and data, preventing abuse, meeting legal and accounting obligations, managing conflicts of interest, and establishing, exercising or defending legal claims.

AI-assisted work: we use AI tools to transcribe, summarise, draft, translate and analyse. Providers process data on our instructions, and we do not permit them to use our data to train their models.

We do not make automated decisions with legal or similar effect on you.

The site stores and reads information on your device only as described here. Swiss law requires us to inform you and to give you the right to refuse; EU and UK law require your consent for anything that is not strictly necessary. The site’s cookie settings let you see the technologies in use, give and withdraw consent, and refuse non-necessary technologies at any time. The current list of technologies and providers is in the cookie settings; this notice describes them by category.

Necessary: security, bot protection and content delivery (for example a short-lived security cookie and a bot check on forms), and the storage of your cookie choices. These run without consent. Our infrastructure provider processes your IP address and connection data to deliver the page and block attacks.

Statistics: analytics services that measure visits and use of the site. Depending on the service, this uses cookies or a daily, salted one-way code derived from your IP address and browser that cannot identify you after 24 hours. Where consent is required, statistics run only after you give it.

Business visitor identification: services that match the IP address and network of a visit to the organisation it belongs to, so that we can see which companies visit the site. They are designed to identify organisations; where a visit could point to an individual, for example at a sole trader, we treat the data as personal data. In Switzerland you can refuse this in the cookie settings at any time; elsewhere it runs only after your consent.

Services that identify individual visitors by name run only with your prior consent given in the cookie settings, never by default.

Embedded content and social media: pages may embed content from third-party platforms (for example video or a professional network). The platform receives your IP address and may set its own cookies, under its own privacy notice, once you load the content.

You can block or delete cookies in your browser. Necessary technologies cannot be refused without refusing the site itself.

You receive our newsletter only after confirming your subscription (double opt-in). The sign-up form tells you that our newsletter service records your email address, the time of confirmation, deliveries, opens and clicks, so that we can send the newsletter, maintain the list and understand what is read. If you do not wish opens and clicks to be measured, ask us and we will send you the newsletter without measurement.

Every edition contains an unsubscribe link. Unsubscribing withdraws your consent; we then keep a suppression record so that we do not write to you again.

We may also send clients and persons with whom we have a business relationship information about our work that is relevant to that relationship. Where the law requires your consent for electronic marketing, we ask for it first. You may object at any time (section 11).

We maintain pages on professional and social networks, currently LinkedIn. When you interact with these pages, the platform processes your data under its own notice and provides us with aggregated statistics. For such statistics the platform and we may be joint controllers; the platform’s notice describes the arrangement. We may use the platform’s interfaces to publish content and read engagement data about our pages.

We disclose personal data to the following categories of recipients, and only to the extent needed for the purposes in section 3:

• Service providers that process data on our instructions, bound by data processing agreements: infrastructure, hosting and security (United States, EU); analytics and visitor identification (EU, United States); newsletter, relationship and marketing tools (United States, United Kingdom, EU); document, collaboration, transcription and AI tools (United States, EU, Switzerland); content and automation tools (United States, EU); data providers that complete business contact and company records (United States, EU); accounting and professional advisers (Switzerland).
• Clients and their advisers, where an engagement requires it.
• Counterparties, journalists, investors and other persons involved in a matter, to the extent the engagement requires.
• Platforms we publish on, which process your data as independent controllers under their own notices.
• Authorities, courts and other bodies, where the law requires or permits it, or where necessary to protect our rights.

We never sell personal data. The cookie settings name the technologies used on the site. A current list of our other service providers, with each provider’s location and transfer safeguard, is available on request.

We process data mainly in Switzerland and the EU. Our providers may process data in other countries, in particular the United States and the United Kingdom.

Switzerland, the EU and the United Kingdom recognise each other as providing adequate protection. Switzerland and the EU recognise the United States for recipients certified under the Swiss-US and EU-US Data Privacy Frameworks. For other recipients in countries without adequate protection, we use the European Commission’s standard contractual clauses with the Swiss and UK amendments, or rely on an exception the law provides, such as your consent, the performance of a contract with you, or the establishment, exercise or defence of legal claims.

You may request a copy of the safeguards in place.

We keep personal data for as long as the purpose requires, then delete or anonymise it. In particular:

• Enquiries that do not lead to an engagement: 12 months after our last exchange.
• Engagement files: 10 years after the end of the engagement. Accounting records: 10 years from the end of the financial year (art. 958f CO).
• Relationship, research and stakeholder records: reviewed every two years; deleted three years after our last contact or use, unless an engagement, a legal claim or a legal obligation requires longer.
• Newsletter data: until you unsubscribe, then a suppression record.
• Site statistics: aggregated data without time limit; identifiable visit data between 24 hours and 14 months depending on the analytics service in use, as stated in the cookie settings.
• Backups: overwritten within 90 days.

We protect data with measures including multi-factor authentication, encryption in transit and at rest, and access limited to the people who need it for the work.

Email is not a secure channel. For sensitive matters we can agree a more secure route.

In the event of a data breach we notify the Federal Data Protection and Information Commissioner where the law requires and inform you where this is necessary for your protection.

To the extent provided by the applicable law, you may ask what personal data we hold about you and receive a copy; have it corrected or deleted; restrict its use; object to any use based on our legitimate interests; receive the data you gave us in a portable format; and withdraw consent with effect for the future.

You may object to direct marketing at any time. We will stop and keep a record so that we do not write to you again.

Write to privacy@s-projects.com. We may ask you to verify your identity. We normally answer within 30 days and without charge. Conditions and exceptions may apply, in particular to protect third parties, confidentiality and our clients’ matters; we may redact copies accordingly.

You may complain at any time to the Federal Data Protection and Information Commissioner (edoeb.admin.ch).

Where the GDPR or the UK GDPR applies to a given processing, this section applies to that processing in addition to the rest of this notice.

Legal bases: performance of a contract with you, or steps at your request before one (art. 6(1)(b)); our legitimate interests as described in section 3, in particular communicating with you, delivering engagements for our clients, maintaining professional relationships, marketing our work, research and analysis, operating and securing the site, and protecting our rights (art. 6(1)(f)); legal obligations (art. 6(1)(c)); and your consent where we ask for it, in particular for the newsletter and for non-necessary site technologies (art. 6(1)(a)).

Where we obtain your personal data from a source other than you, we inform you within one month of obtaining it, at our first contact with you if earlier, or, where informing each person individually would involve disproportionate effort, through this notice.

In addition to section 11, you may complain to the supervisory authority of your country of residence. [Representative under art. 27 GDPR / UK GDPR: none designated | name, address, email.]

We do not sell or share personal information for cross-context behavioural advertising. You can refuse non-necessary technologies in the cookie settings or by enabling the Global Privacy Control signal in your browser, which we honour. We do not knowingly collect data from children.

We update this notice when our tools or the law change and date each version. Material changes to the treatment of subscribers’ or clients’ data are announced to them by email. This notice is not part of any contract with you. Previous versions are available on request.