Privacy Policy

Version 1.0 | Effective 18 August 2026 | Last updated 18 August 2026

1.1 About this policy and its scope

This Privacy Policy explains how KITAV Vuong processes personal data when you visit kitav.ch or www.kitav.ch, use the website's contact function, communicate with KITAV by email, choose a website language, or choose optional website analytics.

This policy applies only to the KITAV company website. Separate products, applications and third-party websites linked from the website are outside its scope and are governed by their own privacy information.

The English version is the primary reference version. Mandatory rights under applicable law remain unaffected.

1.2 Controller and privacy contact

For privacy questions or requests, contact info@kitav.ch. KITAV has not appointed a data protection adviser. Under Swiss law, appointment is voluntary for private controllers.

1.3 Personal data we process and where it comes from

Website delivery and security

When you open the website, KITAV's hosting provider may process technical request data such as your IP address, date and time, requested page or file, referrer, response status, browser type, operating system, device and language information. This data comes from your browser and network connection and is needed to deliver the website, maintain stability, prevent abuse and investigate security incidents.

Contact form and email

If you use the contact form, KITAV processes your name, email address and message. A subject is optional. The form endpoint processes your IP address transiently for rate limiting and abuse prevention. The submitted content is transmitted through KITAV's hosting infrastructure and configured email service to the designated KITAV contact recipient. If you contact KITAV directly by email, KITAV processes the email address, message content, metadata and any attachments you provide.

Please do not send sensitive personal data unless it is necessary for your request.

Language preference

The website uses the language in the URL, your saved language choice, your browser or system language and, only as a fallback, a coarse country code supplied by the hosting infrastructure. An explicit language choice is stored in a first-party cookie and local storage. No precise location is requested or stored.

Consent choice

The website stores your Analytics choice, the applicable policy version and the time of the choice in first-party browser local storage. The record does not contain a visitor identifier and is used only to remember and demonstrate your selection.

Google Analytics, only after consent

If you select 'Accept all', Google Analytics 4 processes first-party cookie identifiers, pages viewed, session duration, limited interaction events, traffic source and permitted campaign parameters, browser and device characteristics, operating system, language, and an approximate country or region derived from the network connection.

KITAV records only a limited set of named events, such as a generic successful contact-form submission, a company product-page view, an App Store click, an external-link click using only the destination domain, and a language change using only the language code. Contact-form values, message content, full external URLs, names and email addresses are not sent to Google Analytics.

Google Fonts

The website currently requests font files from Google Fonts to display its typography. When the page loads, your browser connects to Google's servers and transmits technical connection data, including your IP address and browser request information. Google Fonts does not need to set a KITAV cookie for this purpose.

1.4 Purposes, legal grounds and retention

Swiss data protection law applies to KITAV's processing. KITAV processes personal data lawfully, proportionately, transparently and only for stated purposes. Where the EU or UK GDPR applies, the legal grounds below apply in addition.

Website operation and security

Purpose: deliver the website, maintain availability, prevent misuse and investigate faults or security events. Where the GDPR applies, the legal ground is KITAV's legitimate interest in operating a secure and reliable website under Article 6(1)(f). Firebase Hosting may retain IP-related hosting data for a few months under Google's service practices. KITAV-controlled diagnostic or security records are normally retained for no more than 90 days, unless an incident, legal claim or authority request requires longer retention.

Contact requests

Purpose: receive, answer and document enquiries and take requested steps before a possible contract. Where the GDPR applies, the legal grounds are Article 6(1)(b) for pre-contractual requests and Article 6(1)(f) for other correspondence and record keeping. Contact correspondence is generally retained for up to 24 months after the matter is closed, unless it must be kept longer for a contract, legal duty or the establishment, exercise or defence of claims. It may be deleted earlier where no overriding reason requires retention.

Language preference

Purpose: present the website in a suitable language and remember an explicit choice. Where the GDPR applies, the legal ground is KITAV's legitimate interest in an accessible multilingual website under Article 6(1)(f). The saved choice expires after one year and can be changed at any time.

Consent record

Purpose: remember your choice and demonstrate privacy compliance. Where the GDPR applies, the legal grounds are Article 6(1)(c) where a legal record is required and Article 6(1)(f) for privacy administration. The local-storage record is valid for 180 days, after which the website asks again.

Analytics

Purpose: understand aggregated website use and improve content, navigation and technical performance. Analytics is based on your consent; where the GDPR applies, the legal ground is Article 6(1)(a). GA4 user-level and event-level data is configured for retention for up to 14 months. Aggregated reports that no longer identify a browser instance may be retained longer. Analytics cookies expire after no more than 180 days.

Google Fonts

Purpose: provide consistent website typography. Where permitted and where the GDPR applies, KITAV relies on its legitimate interest in a consistent, efficient presentation under Article 6(1)(f). KITAV does not retain the technical request data generated by the font request; Google determines retention within its own systems under its terms and privacy policy.

Legal duties and claims

KITAV may retain and use relevant records where necessary to comply with law or establish, exercise or defend legal claims. Where the GDPR applies, the legal grounds are Article 6(1)(c) and Article 6(1)(f). Retention follows the applicable statutory retention or limitation period.

1.5 Service providers and other recipients

Google services

Google LLC and, depending on the service and contracting arrangement, Google Ireland Limited provide Firebase Hosting, Cloud Functions, Firebase/Google Analytics and Google Fonts. Their role may be that of a processor acting for KITAV or an independent controller for their own service data. Google may process data in Switzerland, the EEA, the United Kingdom, the United States and other locations used by approved subprocessors. See Google's Privacy Policy, Firebase privacy information and Google Analytics safeguards.

Email service provider

KITAV's configured SMTP and mailbox provider processes contact messages so they can be delivered, stored and answered. It acts as a contractual service provider to the extent it processes data on KITAV's instructions. The current provider identity and relevant processing location can be requested from KITAV at info@kitav.ch.

Other disclosures

Personal data is available only to the owner and authorised service providers who need it for the purposes above. KITAV may disclose data to professional advisers, courts, regulators, law-enforcement bodies or other authorities where required by law or reasonably necessary to protect rights, safety or the website. KITAV does not sell personal data and does not disclose it for targeted advertising.

1.6 International data transfers

Some providers and subprocessors may process personal data outside Switzerland. If data is disclosed to a country that does not provide an adequate level of protection under Swiss law, KITAV relies on a permitted safeguard, such as recognised Standard Contractual Clauses adapted for Switzerland, or another lawful exception. Where the GDPR applies, an adequacy decision, Standard Contractual Clauses or another lawful transfer mechanism is used as required. Additional measures such as encryption in transit, access controls, data minimisation and contractual purpose limits are applied where appropriate.

You may request information about relevant destination countries and safeguards by contacting info@kitav.ch.

1.7 Cookies and similar technologies

The website uses necessary local storage and a language cookie to remember your choices. Optional Google Analytics cookies are created only after you consent. The full inventory, durations and controls are set out below under Cookie Settings.

You can select 'Necessary only' when first asked, or reopen the permanent 'Cookie settings' control in the website footer or on this page at any time. Revoking consent stops future Analytics collection and removes accessible first-party Google Analytics cookies from the KITAV domain where technically possible. Essential website functions, including the contact form, remain available either way.

1.8 Additional information about Google Analytics

The Analytics SDK is not downloaded and Analytics data is not sent until you accept. Only analytics storage is granted; advertising storage, advertising user data and advertising personalisation remain denied. KITAV does not implement Google User-ID, Google Signals, advertising personalisation or a Google Ads connection for this website.

Google states that Google Analytics uses IP addresses at collection time to determine coarse location and route the connection but does not log or store individual IP addresses for users in Switzerland, the EEA or the United Kingdom. Analytics data is transmitted over HTTPS.

1.9 Your rights

Depending on the law that applies, you may request access to personal data about you, correction of inaccurate data, deletion, restriction or cessation of processing, objection to processing based on legitimate interests, and release or portability of data in a common electronic format. You may withdraw consent at any time with effect for future processing. Withdrawal does not affect processing that was lawful before withdrawal.

Send requests to info@kitav.ch. KITAV may ask for information needed to verify your identity and protect your data. Requests are generally answered within 30 days or one month, as applicable, and are normally free of charge. A deadline may be extended only where and as permitted by law.

If you believe your data has been processed unlawfully, you may contact the Swiss Federal Data Protection and Information Commissioner (FDPIC), www.edoeb.admin.ch. Where the GDPR applies, you may also complain to the competent supervisory authority in the relevant country.

1.10 Security

KITAV uses proportionate technical and organisational measures designed to protect personal data against accidental or unlawful loss, alteration, disclosure, access or misuse. Measures include HTTPS encryption, restricted access, secret management, input validation, rate limiting and data-minimised Analytics events. No internet transmission or storage system can be guaranteed completely secure.

1.11 Automated decisions and children

KITAV does not use website data to make decisions based solely on automated processing that produce legal or similarly significant effects. The company website is not directed to children and KITAV does not knowingly request personal data from children under 16 through it. A parent or guardian who believes a child has submitted data may contact KITAV for review and deletion, subject to legal retention duties.

1.12 Changes and contact

KITAV may update this policy when the website, service providers, processing or law changes. The current version and effective date will be published on kitav.ch. If a material change affects processing based on consent, KITAV will request consent again where required.

Privacy contact: info@kitav.ch.

Cookie Settings

Version 1.0 | Effective 18 August 2026 | Last updated 18 August 2026

4.1 Your choices

KITAV uses necessary browser storage to remember your privacy and language choices. With your permission, KITAV also uses Google Analytics to understand aggregated website use and improve content, navigation and technical performance. Analytics remains completely off until you choose 'Accept all'.

Necessary only

This is the default privacy-preserving choice. It stores only your consent decision, policy version and timestamp in first-party local storage. Essential functions, including the contact form and language selection, remain available. No Google Analytics SDK is downloaded and no Analytics data is sent.

Accept all

This enables optional Google Analytics. Google may create first-party Analytics cookies and receive the limited website usage data described below. Advertising storage, advertising user data and advertising personalisation remain denied.

4.2 Cookie and storage inventory

The exact GA4 container suffix is generated from the configured measurement container. Browser or Google implementation changes may alter a technical cookie name without changing the purpose or category described here.

4.3 Analytics data and limits

After consent, Analytics may process a random first-party browser identifier, page views, session duration, limited interaction events, traffic source and safe campaign parameters, browser and device characteristics, operating system, language, and approximate country or region.

KITAV does not send contact-form fields or message content to Analytics. KITAV does not use Google User-ID, Google Signals, advertising personalisation, targeted advertising or a Google Ads connection on this website. A successful contact request is recorded only as a generic completion event. External-link events include only the destination domain, not the full destination URL.

GA4 user-level and event-level data is configured for retention for up to 14 months. Aggregated statistics that no longer identify a browser instance may be retained longer.

4.4 Change or withdraw your choice

You can reopen the permanent 'Cookie settings' control in the website footer or use the button below at any time. Selecting 'Necessary only' after previously accepting stops future Analytics collection, updates the saved choice and removes accessible first-party Google Analytics cookies for kitav.ch where technically possible. Withdrawal does not affect processing that occurred lawfully before it.

You can also delete cookies and local storage in your browser settings or block cookies. Browser-level blocking may affect how your choices are remembered, but the website's essential content and contact form do not require Analytics.

Open cookie settings

4.5 Consent interface text

Initial notice

Your privacy choices. With your permission, KITAV uses Google Analytics to understand how the website is used. Analytics stays completely off until you accept. Actions: 'Accept all', 'Necessary only', 'Privacy Policy'.

Settings panel

Cookie settings. Choose whether KITAV may use privacy-conscious website analytics. Essential website functions work with either choice. The current state is shown as 'Analytics accepted', 'Necessary only', or 'No choice saved yet'. Actions: 'Accept all', 'Necessary only', 'Close cookie settings'.

4.6 Updates and contact

KITAV will update this inventory if the website adds, removes or materially changes storage or tracking technologies. A material change to consent-based processing will trigger a new choice where required.

For questions about cookies or privacy, contact info@kitav.ch.