Data protection declaration

The controller for personal data processed through this site is:

• EMA DIGITAL LTD, company number 15221041
• 128 City Road, London EC1V 2NX, United Kingdom
• gestion@emagency.ch

No data protection officer has been appointed. Requests about your data are handled at the address above.

The following is not a statement of intent but a description of the current implementation:

• no cookie is set without your consent; if you accept Google Analytics measurement, it sets its own cookies (see “Google Analytics, with your consent”);
• the analytics and performance measurement in place (Vercel Web Analytics and Speed Insights, see “Analytics and performance measurement”) does not identify you individually and cannot reconstruct your path across sites;
• no advertising tracker and no pixel; the only third-party tag is Google Analytics, loaded only if you accept it;
• no script, font or image is loaded from a third-party domain, except the Google Analytics script after your consent;
• no profiling, no automated decision-making, no sale of data;
• no form data is received other than the details of an appointment you confirm (see “Booking a call”), and none is stored on a server of this site.

On your first visit you are asked one question: accept or decline Google Analytics measurement. Declining is as easy as accepting, nothing is loaded before you answer, and the “Measurement preferences” link at the foot of every page lets you change your mind at any time. The cookieless Vercel measurement does not depend on it (see “Analytics and performance measurement”).

The Swiss Federal Act on Data Protection (FADP, revised, in force since 1 September 2023) and the EU General Data Protection Regulation are not the same and do not apply in the same situations. Which framework applies depends on your circumstances and on the processing concerned.

• FADP — the primary framework for this site, which addresses the Geneva and French-speaking Swiss market. Processing by a private person must be lawful, carried out in good faith, proportionate, recognisable, and consistent with the purpose stated.
• GDPR — may apply where processing relates to offering goods or services to people in the EU or EEA. Where it does, the legal bases are Article 6(1)(b) for contact and booking, and Article 6(1)(f) for operating and securing the site.
• UK law — as EMA DIGITAL LTD is registered in the United Kingdom, the UK GDPR and the Data Protection Act 2018 also apply to its processing.

The site is hosted by Vercel Inc., Delaware, United States. Vercel provides the technical infrastructure needed to serve the site and may process technical data as far as necessary to provide its services. The purposes of the processing are determined by EMA DIGITAL LTD as controller.

In practice only the web requests described below pass through that infrastructure, together with the details of an appointment you confirm, for as long as it takes to enter them in our calendar (see “Booking a call”); they are not kept there. The analytics and performance measurement described in the next section is also active on this same infrastructure.

Vercel states that its primary processing facilities are in the United States and that data may be processed in or transferred to other countries; no exclusive Swiss or EEA storage is guaranteed. Vercel states that it applies appropriate safeguards under applicable law when making such transfers. The list of its subprocessors, with their functions and locations, is published at security.vercel.com.

As with any web server, the infrastructure records the requests it receives: IP address, date and time, requested address, response code, referrer and browser used. These logs serve to deliver the pages and to keep the service available and secure. They are not used to analyse your behaviour and are not combined with other sources. Their retention period is determined by the host's configuration.

Since 18 September 2026, this site uses Vercel Web Analytics and Vercel Speed Insights to measure traffic and technical performance (load time, visual stability, responsiveness). These tools are provided by Vercel Inc., the host already named above: no new third party is involved.

The script loads from this site's own domain, not from a third-party domain. It sets no cookie and writes nothing to your browser's storage. Vercel identifies a visit through a hash computed from the request, not kept beyond 24 hours, and states that it does not retain information that would let it reconstruct your browsing path across sites or identify you individually.

The data recorded is limited to: the page visited (address and route, without query string or fragment), the event's timestamp, country, device type, operating system and browser, the referring page, and performance metrics (LCP, INP, CLS, and similar). This site is configured never to pass these tools your name, email address, company name, phone number, appointment reference or message content: those fields are stripped before anything is sent, for every event measured.

This measurement does not rely on your consent: the data collected is limited, cookieless measurement data without advertising identifiers or cross-site tracking, used only for aggregate statistics; its legal basis is the legitimate interest in operating and improving the site (GDPR Art. 6(1)(f)) and, under the FADP, the proportionality of processing carried out for that same purpose. No consent banner is therefore used for this measurement.

Vercel retains this data under its own policy, which depends on the subscription tier in use — see vercel.com/docs/analytics/limits-and-pricing and vercel.com/docs/speed-insights/limits-and-pricing; this site sets no separate retention period of its own. What Vercel collects is documented in full at vercel.com/docs/analytics/privacy-policy and vercel.com/docs/speed-insights/privacy-policy.

If you accept it, this site uses Google Analytics 4 to learn which pages and articles are read, how far, and which pages they lead to. The service is provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland); data may be processed by Google LLC in the United States under the EU–US Data Privacy Framework and its Swiss extension, under which Google LLC is certified.

Nothing is loaded before you answer. Your answer is kept in your browser's local storage under ema-consent (accepted or declined, and the date) for thirteen months at most; it is never transmitted. After that, you are asked again.

The data sent is limited to: the page visited (address without query string or fragment) and its title, the time, the language, the device type, browser and operating system, the referring page, and reading and navigation events (how far an article was scrolled, a click to another article or to an expertise page, the start and confirmation of a booking). Google uses your IP address to derive the country and states that Google Analytics 4 does not log or store it. This site is configured never to send your name, email address, company name, a telephone number, a booking reference or the content of a message. Advertising features, Google Signals and granular location and device collection are switched off.

Google Analytics sets two cookies, _ga and _ga_…, which tell visits from the same browser apart; they expire at the latest thirteen months after your consent. Event data is kept for fourteen months. If you withdraw your consent, measurement stops and these cookies are deleted from your browser.

Under the GDPR, the legal basis is your consent (Art. 6(1)(a)). Under the FADP, the processing is justified by your consent (Art. 31(1)). What Google collects is detailed at policies.google.com/privacy.

If you switch the site between its night and day appearance, that choice is kept in your browser's local storage as a single entry named ema-theme, whose value is dark or light.

This is not a cookie: the value is never sent to the server, identifies nobody, and does not leave your device. You can remove it at any time by clearing your browser's site data.

To book a call you choose a format — a Google Meet video call or a WhatsApp call — and a time, then give your name, your email address, your company name, your main need (chosen from a fixed list) and, for a WhatsApp call, your WhatsApp number. Nothing is sent while you type: these details reach the server of this site when you confirm the appointment. To know which pages bring requests, the form also sends, when you confirm, the address of the page you book from and, if you read an article on this site during the same visit, the address of the last article you read (path only, without query parameters or fragment, for example “/en/insights/…”). That address is kept only in the memory of the open page — no cookie, no storage in your browser — and forgotten as soon as the tab is closed or the page is reloaded; failing that, the browser reports the previous page of this same site. These addresses appear in the event, on the “Booked on…” line.

The server checks that the time is still free, then enters the appointment in a Google calendar reserved for EMA DIGITAL LTD’s appointments. The event holds your details, the format and the time; for a video call, Google creates a Google Meet link specific to that appointment. Google sends the invitation to your email address and a copy to our inbox, followed by any change or cancellation. This site keeps no other database: the calendar is the only record of the appointment.

To offer only free times, the server reads the busy periods of our own calendars (Google and Outlook), without their content. These reads involve no data about you.

For a WhatsApp call, we call you from our WhatsApp Business account, on the number you gave and only about this appointment. This site sends no data to WhatsApp or Meta; the call itself runs over WhatsApp.

The “reschedule or cancel” link in the invitation contains a signed reference that can manage this appointment only. The “add to your calendar” buttons take you to Google Calendar or Outlook, or download a calendar file: what you do there is governed by those services and by your own device.

If you write to us, we process your email address and the content of your message in order to reply and, where relevant, to arrange the call you asked for. How the message travels depends on your email provider and ours.

This site discloses no data to third parties for commercial purposes and sells none. The only third parties involved are the technical providers needed to run it: the host named above; Google, which hosts the appointment calendar, creates the Google Meet links and sends the invitations; Microsoft, which hosts our email and our Outlook calendar; and email providers when an exchange of email takes place.

Your browser loads no resource from a foreign domain, except, if you accept it, the Google Analytics script and the measurements it sends to Google (see “Google Analytics, with your consent”). When you confirm an appointment, the server of this site passes its details to Google, which may process them outside Switzerland and the EEA, in particular in the United States.

Data is kept only for as long as the purpose it was processed for requires:

• server logs — for the period set by the host's configuration;
• correspondence — for as long as it takes to deal with your request, then for the duration of the business relationship and any retention obligations that follow from it;
• appointments — a cancelled appointment is deleted from the calendar; an appointment that took place stays there for the duration of the business relationship and any retention obligations that follow from it;
• display preference — until you clear your browser storage;
• answer to the measurement question — thirteen months at most;
• Google Analytics — fourteen months for event data; _ga cookies thirteen months at most.

The site is served over HTTPS only, with an HSTS policy. A restrictive Content Security Policy forbids the execution of any third-party script other than Google Analytics — and that one only after your consent —, the framing of the site by another, and the submission of forms to an external domain. The details of an appointment are not kept on the server of this site: they pass through it to be entered in the calendar. Access to the calendar is reserved to the server and is never sent to your browser.

Depending on the applicable framework, you have the right to obtain information about the data concerning you, to have it corrected or deleted, and to object to processing. Where the GDPR applies, the rights to restriction of processing and to data portability are added to these.

Google Analytics measurement relies on your consent. You can withdraw it at any time, without disadvantage, with the “Measurement preferences” link at the foot of every page: measurement stops and its cookies are deleted from your browser. The other processing described here does not rely on your consent.

To exercise these rights, write to gestion@emagency.ch. We may ask for reasonable evidence of your identity before acting.

If you believe processing is not lawful, you may contact the competent authority:

• Switzerland — Federal Data Protection and Information Commissioner (FDPIC), edoeb.admin.ch;
• EU / EEA — the supervisory authority of your habitual residence or of the alleged infringement;
• United Kingdom — Information Commissioner's Office (ICO), ico.org.uk.

This site addresses businesses and people acting in a professional capacity. It is not directed at children and we do not knowingly collect data about them.

This declaration is revised whenever the way the site works changes. It was updated on 15 October 2026 to describe Google Analytics measurement, subject to your consent (“Google Analytics, with your consent”); the previous update, on 18 September 2026, described the activation of Vercel Web Analytics and Speed Insights. Only the version published on this page applies; its update date appears at the top.