Privacy Policy

Effective date: 2 November 2026

Last updated: 2 November 2026

1. Who we are

Oten Switzerland GmbH ("Oten", "we", "us" or "our") is responsible for the processing of personal data described in this Privacy Policy.

We are a limited liability company incorporated under the laws of Switzerland and registered in the Commercial Register of the Canton of Zug.

Company identification number (UID): CHE-392.530.193

Registered seat: Baar, Canton of Zug, Switzerland

Registered address: Blegistrasse 15, 6340 Baar, Switzerland

Email: [email protected]

Telephone: +41 77 291 61 22

Please include "Privacy request" in the subject line when contacting us about your personal data.

2. Scope of this policy

This Privacy Policy explains how Oten Switzerland GmbH collects and uses personal data when you:

Visit our corporate website, oten.com.
Visit the Oten Trust Center at compliance.oten.com, including its resources, controls, subprocessor information, FAQ and updates.
Submit a consultation request or communicate with us about our company and services, security reviews, access to restricted documents, update requests or vulnerability reports.

In this policy, the "websites" means these two named websites. The Trust Center's descriptions of data processed by the OXU Platform concern product use; they do not mean that merely visiting the Trust Center collects those product data categories.

It does not govern personal data processed through OXU product accounts or on behalf of customers using OXU services. That processing is addressed in the applicable product privacy notices, customer agreements and data processing agreements.

OXU is a product brand of Oten Switzerland GmbH, not a separate contracting entity. The OXU marketing website, product applications and documentation, including oxu.com, account.oxu.com and docs.oxu.com, are not brought within this website policy merely because they use the OXU brand or link to this page. Their visitor and service processing requires the applicable notices for those services. Other websites and subdomains are covered only where expressly identified in this policy.

This policy provides information about our processing activities. It does not, by itself, constitute your consent to processing.

3. Personal data we collect

Information you provide

When you contact us, we collect the information you submit, which may include:

Your name, work email address and company.
Your role and business contact details, if provided.
Your security requirements, questions and consultation requests.
Information contained in subsequent correspondence.
Preferences or permissions you communicate to us.

Contact form submissions on oten.com are stored in our website's content management system so that authorised personnel can review and respond to them.

Trust Center interactions and correspondence

The Trust Center currently serves public information without visitor accounts or a document-request database. Its request-access and subscription dialogs validate entries only in your browser: submitting those dialogs does not transmit their field values to Oten, grant document access or register an email subscription. We do not receive or store those entries through the dialogs.

To contact us, use the email link to [email protected] and send a message through your email service. Opening an email link alone does not send the message. If you send it, we receive your email address, sender details, subject, message, any attachments and associated email metadata. A document request may include your organisation, role, requested material, reason for access and subsequent confidentiality-agreement correspondence. A vulnerability report may include technical information you choose to provide.

We use this correspondence to respond, assess requests for restricted material, manage confidentiality arrangements and investigate reported issues. An email asking about updates does not activate an automated subscription. Any future subscription service will explain its processing and provide the required choice before enrolment.

Please do not submit passwords, encryption keys, identity documents, customer datasets or other sensitive information through the general contact form. If such information is necessary for a particular engagement, contact us first to arrange an appropriate channel.

Technical information

The systems used to deliver and protect the website process technical request information, such as your IP address, request time, requested URL, browser information, referring page where supplied by your browser, response status and security events.

For oten.com, Cloudflare provides website delivery and protection and also processes connection and security information to identify malicious or automated traffic. Security checks may use browser signals and identifiers associated with a request or challenge. The Trust Center is currently served directly from our web server; its HTTP access and error logging processes technical request information, but it does not use the corporate website's Cloudflare proxy security checks.

Website analytics, only with your consent

If you accept analytics cookies on oten.com, we use Google Analytics to understand how the website is used: which pages are viewed, how visitors arrive, how long visits last, and general device, browser and approximate location information. Google Analytics assigns your browser a random identifier stored in a cookie, which lets us recognise returning visits without knowing who you are. Google states that Google Analytics 4 does not log or store IP addresses; it uses them to derive approximate location. We have switched off Google signals and advertising features for this website.

If you decline, or do not answer, Google Analytics is not loaded and its cookies are not set.

Information received from others

We may receive your business contact details from a colleague or representative of your organisation in connection with an enquiry involving you. Where applicable, we will provide information about the source and use of that data.

4. Why we use personal data

We use personal data to:

Deliver the websites and their content.
Review and respond to enquiries, security questions, document-access requests and vulnerability reports.
Assess requests for restricted security material and manage related confidentiality arrangements.
Arrange consultations and discuss potential business relationships.
Maintain relevant business correspondence.
Detect and investigate spam, misuse and security incidents.
Understand how visitors use oten.com and improve its content, where you have accepted analytics cookies.
Meet applicable legal obligations.
Establish, exercise or defend legal claims.

A consultation request is not a subscription to unrelated marketing communications. Where we offer marketing subscriptions, we explain the relevant processing and obtain consent where required. You may object to direct marketing at any time.

Legal bases where the GDPR applies

Business enquiries made on behalf of an organisation: our legitimate interest in communicating with prospective customers and business partners.
Steps you request before entering into a contract with you personally: steps necessary before entering into that contract.
Website operation and protection: our legitimate interest in providing a reliable website and preventing misuse, subject to applicable consent requirements.
Optional processing for which we request consent, including website analytics: your consent, which you may withdraw.
An obligation imposed by applicable EU or Member State law: compliance with that legal obligation.
Disputes and legal claims: our legitimate interest in protecting legal rights, where applicable.

Where we rely on legitimate interests, we consider the necessity of the processing and its effect on your rights and interests.

Processing subject to Swiss law is governed by the applicable requirements of the Swiss Federal Act on Data Protection.

5. Whether you must provide information

You can browse both public websites without submitting a consultation request, opening an account or requesting restricted documents.

Fields marked as required on a form are needed to handle that request. If you do not provide the requested information, we may be unable to respond meaningfully. Optional information is voluntary.

Information required by a separate contract or by law will be identified in the relevant context.

6. Cookies and similar technologies

The corporate website oten.com uses Cloudflare for delivery and security. Depending on the security checks applied to a visit, Cloudflare may use cookies or similar browser technologies to distinguish legitimate requests from automated traffic and remember the outcome of a security challenge. These technologies support website protection rather than advertising.

Relevant security cookies may include cf_clearance, which records a successful security check, and __cf_bm, where Cloudflare's bot protection requires it. The latter expires after 30 minutes of inactivity; challenge-cookie duration depends on the applicable security configuration. Cloudflare explains these technologies and their lifetimes in its cookie documentation.

The public corporate website does not include advertising pixels. With your consent, it uses Google Analytics to measure how the website is used (Section 3). On your first visit to oten.com, a banner asks whether you accept analytics cookies, and Google Analytics loads only if you choose Accept. It then sets _ga, which distinguishes browsers, and ga followed by our property identifier, which keeps the state of a visit. Both expire 13 months after your last visit and are set for oten.com only, so they are not sent to the Trust Center or other subdomains. Your answer is kept in your browser's local storage under oten-consent, not in a cookie, and you are asked again after 12 months.

You can change your answer at any time through Cookie settings at the bottom of every page on oten.com. Withdrawing consent stops Google Analytics on that page and deletes its cookies from oten.com.

The current Trust Center does not set application cookies, persist its dialog entries in browser storage, or include third-party analytics, advertising pixels or embedded chat services. Its search and filters operate in the browser; ordinary page navigation and resource requests still reach the web server. Administrative sign-in uses session cookies for authorised website administrators; browsing public pages does not require an administrator account.

You can inspect, delete or block cookies through your browser settings. Blocking security or session technologies may prevent a requested function from working or cause security checks to be repeated.

If we introduce further optional technologies requiring consent, we will provide the relevant information and obtain consent before activating them. Consent, where requested, can be withdrawn through the method provided with that choice.

7. Who receives personal data

Access is limited to people and organisations that need the information for the purposes described in this policy.

Recipients may include:

Authorised Oten personnel handling website operations, enquiries and business relationships.
Providers of hosting, storage, website delivery, security and business communications.
Professional advisers where necessary for advice or legal claims.
Authorities or other recipients where disclosure is required by law or otherwise lawfully necessary to protect rights.

The corporate website and Trust Center use hosting infrastructure in Singapore, provided by Amazon Web Services (AWS). Cloudflare provides network delivery and protection for oten.com. The Trust Center is currently served directly and does not use that proxy service for visitor traffic.

Google provides website analytics through Google Analytics for visitors who accept analytics cookies on oten.com, processing that information on our behalf under its Google Ads Data Processing Terms, which cover Google Analytics.

Google Workspace provides business email for oten.com, including correspondence sent to [email protected] and [email protected]. Email sent from the Trust Center is processed through this communications service, rather than through an online Trust Center submission database.

Providers acting as our processors process information under the applicable data processing terms and instructions. Some recipients, such as professional advisers or authorities, may act as independent controllers.

The subprocessor information published for OXU products concerns the services identified there and should not be read as an exhaustive list of providers for the website and correspondence processing described here.

8. International processing

The hosting location for the corporate website and Trust Center is Singapore. Our Swiss corporate address does not mean that all personal data is hosted in Switzerland.

Requests to oten.com also pass through Cloudflare's distributed network; requests to the Trust Center are currently served directly. Cloudflare's processing can involve the United States and other countries in which its service network and authorised providers operate. Delivery and security processing is therefore not confined to the website's hosting country. Further information is available in Cloudflare's Privacy Policy and Data Processing Addendum.

Business email handled through Google Workspace can involve processing in the United States and other locations used for the applicable service and support. Sending an email does not mean that the message is stored solely in Singapore or Switzerland. Google identifies its processing arrangements in its Cloud Data Processing Addendum and its Workspace subprocessor and processing-location list. The applicable destinations depend on the service, configuration and support involved.

Google Analytics information, collected only with your consent, can likewise be processed in the United States and other countries where Google and its subprocessors operate. Google describes the safeguards for these transfers in its Google Ads Data Processing Terms.

For transfers subject to Swiss or European data protection requirements, the applicable safeguards depend on the recipient and transfer. These include recognised adequacy decisions where applicable and standard contractual clauses with the necessary Swiss adaptations for transfers that require them.

AWS provides data processing terms, including a Swiss addendum and standard contractual clauses where applicable, as part of its service terms. Cloudflare's data processing terms likewise address international transfers and the safeguards applicable to its processing. These contractual safeguards operate alongside technical and organisational protections; encryption alone is not the legal basis for a transfer.

You may contact us for further information about the destinations and safeguards relevant to your data, or to request a copy of applicable safeguards, subject to necessary redactions protecting confidential information and the rights of others.

9. How long we retain information

We retain personal data only for as long as reasonably necessary for the purposes described in this policy, taking account of applicable legal requirements.

Enquiries, Trust Center requests and security correspondence: for the time needed to handle the matter and relevant follow-up, considering whether a business relationship develops and whether records are needed for a dispute.
Restricted-document access and confidentiality records: for the period needed to evaluate the request, administer any disclosure and confidentiality obligations, and address relevant claims.
Website analytics: Google Analytics keeps information linked to a browser identifier for no more than 14 months; its cookies expire 13 months after your last visit, or when you withdraw consent.
Technical and security records: for the period needed to operate the website and detect or investigate incidents, taking account of the event, the investigation and any related claim.
Consent and objection records: for the period needed to demonstrate or honour your choices.
Records subject to legal retention requirements: for the applicable statutory period.
Backups: until expiry under the relevant backup retention arrangements, with access restricted.

Information may be retained longer where necessary for a specific legal obligation or claim. Once no longer needed, it is deleted or irreversibly anonymised.

The Trust Center dialog fields have no server-side retention period because their values are not submitted to Oten. Email correspondence and web-server records are subject to the criteria above.

There is no single retention period for all the information covered by this policy. You may contact us for the period or criteria applicable to a particular record, or to request deletion where the applicable conditions are met.

10. Security

We apply technical and organisational measures appropriate to the nature of the information and the risks involved. These include HTTPS protection for website communications and restricting access to enquiry records to authorised personnel.

The general contact form and email correspondence, including Trust Center requests and vulnerability reports, allow authorised Oten personnel to read and respond to your message. They are not end-to-end encrypted messaging services. Product-specific descriptions of end-to-end encryption do not automatically apply to this website or to business correspondence.

No website, transmission method or storage system can guarantee absolute security. Please report suspected security issues to [email protected] and avoid including unnecessary personal data or confidential material in an initial report.

Information about our wider security programme is available at Oten Trust Center.

11. Your rights

Depending on the law applicable to your information, you may request access, correction, deletion, restriction of processing or delivery of eligible data in a portable format.

Where processing relies on consent, you may withdraw it without affecting the lawfulness of earlier processing.

Where the GDPR applies, you may object to processing based on legitimate interests for reasons relating to your circumstances. You may object to direct marketing at any time, including associated profiling.

Contact us using the details in Section 1. We may request proportionate identity verification. We respond within applicable statutory deadlines and explain any lawful restriction or extension. Requests are normally free of charge, subject to exceptions permitted by law.

You may contact the Swiss Federal Data Protection and Information Commissioner. Where the GDPR applies, you may also complain to a competent supervisory authority, including in the country of your habitual residence, workplace or the alleged infringement. You do not need to contact us first.

12. Automated processing

Website security systems may automatically challenge or block requests that appear malicious or automated. If you believe a security check has prevented a legitimate enquiry, you may contact us by email.

We do not use the website enquiry information covered by this policy to make decisions based solely on automated processing that produce legal or similarly significant effects on you.

13. Changes and contact

We may update this policy to reflect changes in our operations or applicable requirements. The revised policy will display its effective date. Where required, we will provide additional notice or obtain consent before introducing the relevant change.

For questions or requests, contact [email protected] or write to Oten Switzerland GmbH, Blegistrasse 15, 6340 Baar, Switzerland.