Trust & Security

Privacy Policy

Version: 1.2. Last updated: 20 October 2026. Owner: Cytria Sàrl.

1. Data Controller and Contact Details

The data controller responsible for the processing of your personal data on this website is:

Cytria Sàrl
Chemin de la Florence 10
1208 Genève
Switzerland

For any questions regarding data protection, you can contact us at: contact@cytria.com.

2. Data Categories and Collection Methods

We process personal data that you provide to us directly through our interactive forms, assessment tools, or contact requests:

  • Contact and Booking Forms: Name, work email address, company name, job role, phone number, and the specific details of your request or desired timing.
  • Where to Start Diagnostic: Your responses regarding your business situation, processes, and tool usage, combined with your name and work email.
  • AI Readiness Assessment: Your evaluation answers across strategy, people, processes, data, governance, and technology dimensions, alongside your email, company name, and consent state.
  • Public domain check: The domain name you enter. We only read public information about that site (DNS, certificate, home page). Your IP address is used in memory for anti-abuse limits and is not stored in a database.
  • Technical Logs: IP address, date and time of request, browser version, operating system, and referral page details.

3. Purposes of Processing

We use the collected personal data for the following purposes:

  • To qualify and respond to your consulting, training, or solutions inquiries.
  • To generate and deliver your AI Readiness maturity score and custom recommended path.
  • To contact you regarding booked advisory calls with Enrico Bartolotti.
  • To deliver practical editorial updates and newsletters, subject to your explicit consent.
  • To secure our website infrastructure and diagnose technical issues.

4. Legal Bases under the Swiss FADP (nLPD)

We process your data in conformity with the Swiss Federal Act on Data Protection (FADP). The processing is based on the following grounds:

  • Consent: When you subscribe to our newsletter or request your assessment report, you give us explicit permission to contact you.
  • Pre-contractual measures: Form submissions asking for quotes or audit bookings represent steps toward establishing a business agreement.
  • Legitimate interest: Securing our website and analyzing general visitor habits to improve services.

5. Systems that process your data (CRM, e-mail, analytics, content)

As of 19 October 2026:

  • • CRM (Odoo): Contact and booking requests are stored in our own Odoo CRM, self-hosted on Cytria servers. It is the system of record for your request. Monitoring and test submissions are marked as such and archived automatically, so they are never handled as real requests.
  • • Consent record: With each request we store what you agreed to, when, and the exact version of the consent text you saw (privacy notice and, where offered, marketing communications). This record is kept with the request in the CRM so we can show which consent applied.
  • • E-mail and marketing (Mautic): Your form answers are also recorded in our self-hosted Mautic. We use it to follow up on your request and, only if you ticked the marketing box, to send editorial updates. Every marketing e-mail has an unsubscribe link. E-mail is sent from contact@cytria.com through Infomaniak (Switzerland).
  • • Analytics (Umami): We measure visits with Umami, self-hosted, without cookies and without a cross-site identifier. We count page views, the referring site, the country derived from the IP address (the address itself is not stored), and form submissions as an anonymous event. Test and monitoring traffic is kept in a separate, excluded dataset.
  • • Content (Payload CMS): Our articles can be managed in a self-hosted Payload CMS. It holds editorial content only and receives no visitor data.
  • • Abuse protection: Our forms and the domain check use ALTCHA, an open-source proof-of-work check hosted on our own servers: your browser solves a small computation, with no cookie, no tracker and no third-party service. To limit abuse, your IP address and the domain you enter are processed in memory only to enforce rate limits (for at most 24 hours), and a domain check result is kept in memory for about one hour so the checked site is not queried repeatedly.

6. Data Retention Periods

We retain your personal data only as long as necessary to fulfill the purposes for which it was collected:

  • Contact inquiries & Diagnostics: Retained for 12 months after the last communication.
  • AI Readiness Reports: Retained for 24 months to allow comparison with future evaluations.
  • Newsletter Subscriptions: Retained until you withdraw your consent or unsubscribe.
  • Technical server logs: Automatically deleted after 30 days.

7. Data Recipients and Processors

All data is hosted in Switzerland, in Geneva: in the Infomaniak data centre and on our own servers. We do not sell or lease your personal data. We only share information with third-party service providers (processors) that help operate our infrastructure, under strict confidentiality agreements. No international data transfer occurs during the standard use of this website.

8. Your Rights

Under the Swiss FADP, you have the following rights regarding your personal information:

  • Right of Access: You can request a copy of all personal data we hold about you.
  • Right to Rectification: You can ask us to correct incorrect or incomplete information.
  • Right to Erasure (Deletion): You can request the deletion of your personal data.
  • Right to Object: You can object to data processing based on legitimate interests or withdraw consent at any time.
  • Right to Data Portability: You can receive the data you gave us in a common, machine-readable format, or ask us to send it to another controller.
  • Right to Restriction: You can ask us to limit processing while a request about accuracy or lawfulness is being examined.

Visitors in the EU/EEA (GDPR): where the EU General Data Protection Regulation applies, the bases above correspond to Art. 6(1)(a) GDPR (consent), Art. 6(1)(b) (pre-contractual steps) and Art. 6(1)(f) (legitimate interests: securing the website and measuring visits without cookies). You have the rights listed above under Art. 15 to 21 GDPR. Withdrawing consent does not affect processing carried out before the withdrawal.

Automated scoring: the AI Readiness Assessment and the Where to Start diagnostic calculate a score or a suggested starting point automatically from your answers. No decision with legal or similarly significant effects is taken on that basis; a person reviews every request.

To exercise any of these rights, please email us at contact@cytria.com.

9. Complaint Authority

If you believe your data has been processed unlawfully, you have the right to file a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC / PFPDT) in Bern. If you live in the EU/EEA, you may also complain to the data protection authority of your country of residence or work.

10. Policy Updates

We may update this policy periodically to reflect changes in our services, integrations, or legal obligations. We recommend reviewing this page regularly for the latest details.