normakte / Privacy
In short: no cookies, no tracking, no third-party fonts. What you type into the tools does not leave your browser.
ITG Suisse Sagl, Corso Elvezia 25, 6900 Lugano, Switzerland. Email: kontakt@normakte.com. Further details in the legal notice.
No cookies, not even technically necessary ones. No tracking or analytics (no Google Analytics, no pixel, no consent banners). No external resources: fonts, styles and scripts are loaded only from our own server; no Google Fonts are embedded, so your IP address is not transmitted to third parties. No registration: the tools work without an account or email address.
All free tools on the website – generators, calculators, CRA classification and the declaration check, including when you upload a PDF or DOCX file – run entirely in the browser. Your entries and files are neither transmitted to a server nor stored; they are lost when you close the page. Copy or print the result if you want to keep it.
The only exception, and only if you use it: the generator's “Make verifiable (QR)” function stores in our database (Supabase, EU) the SHA-256 cryptographic fingerprint of the declaration text, the manufacturer's name and the product designation, in order to display the verification page linked to the QR code. The full text of the declaration is not transmitted. Deletion on request to kontakt@normakte.com.
The site is hosted by Netlify, Inc., 512 2nd Street, Suite 200, San Francisco, CA 94107, USA. On access, for technical reasons, the IP address, timestamp, requested file, data volume, referrer and user agent are processed. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure operation). Logs are kept 90 days online and one year offline, not combined with other data.
A data processing agreement under Art. 28 GDPR is in place with Netlify (version of 9 June 2026; contact: privacy@netlify.com). Netlify is certified under the EU-U.S. Data Privacy Framework; failing that, the European Commission standard contractual clauses apply (Implementing Decision (EU) 2021/914). For transfers under Swiss law the same clauses apply with the Swiss amendments (competent authority: the Federal Data Protection and Information Commissioner). Netlify demonstrates ISO 27001 and SOC 2 Type II certifications; AES-256 encryption at rest and TLS 1.2 or higher in transit. The operator of normakte, ITG Suisse Sagl, is established in Switzerland, for which an adequacy decision of the European Commission exists.
On some pages you can leave your email address to be notified of changes to the two regulations. The form is handled by Netlify Forms, without cookies or third-party scripts. Only the address you provide and the time of submission are processed. Legal basis: Art. 6(1)(a) GDPR; consent may be withdrawn at any time (by email), after which the address is deleted. An invisible field serves only to repel automated submissions; no profile is created.
If you email us, we process the data you provide in order to reply. Legal basis: Art. 6(1)(b) or (f) GDPR. Correspondence is deleted once no longer needed.
You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), portability (Art. 20) and objection (Art. 21 GDPR), and the right to lodge a complaint with a supervisory authority.
For the paid conformity file, personal data is processed beyond the tools above, as soon as you create an account or take out a paid plan.
Account and file data. We process your email address, your organisation name and country, your VAT number and its verification status, and the content you enter. Authentication runs via Supabase Auth; your password is stored only as a cryptographic hash. Legal basis: Art. 6(1)(b) GDPR.
Storage (processor Supabase). Account and file data are stored with Supabase Pte. Ltd, with which a data processing agreement under Art. 28 GDPR is in place (Version 1 of 1 August 2026), in a data centre in the European Union (Frankfurt region). Row Level Security at database level ensures that an account can access only its own data.
Payment (Stripe). Billing is handled by the payment provider Stripe. Name, email address, billing address, VAT number and payment method are transmitted to Stripe. Card data are collected directly by Stripe; normakte neither receives nor stores them. Legal basis: Art. 6(1)(b) GDPR.
Email sending (Resend). Sign-in links and notifications are sent via Resend (Resend, Inc.), which processes the recipient email address. Legal basis: Art. 6(1)(b) GDPR.
Transfers outside the EU. The database is held in the EU (Frankfurt). Supabase Pte. Ltd is based in Singapore and uses a US company as data importer; Stripe and Resend have their seat or parent in the USA. Transfers rely on the EU-U.S. Data Privacy Framework (where the recipient is certified) or on the standard contractual clauses (EU) 2021/914; acceptance of the Supabase terms constitutes conclusion of those clauses. For Swiss law the same clauses apply with the Swiss amendments.
Retention. Account and file data are processed for the duration of the contract. After the contract ends, files remain readable and exportable for 90 days, then are deleted. Billing and payment data are excluded: they are kept for the statutory commercial and tax retention periods (Art. 6(1)(c) GDPR); in place of deletion, processing is then restricted.
If you request one of our documents through an ad form on LinkedIn, LinkedIn passes us the details you release in the form: first name, last name, email address, company, job title, country and, if ticked, your consent to the deadline briefing. The form itself is provided by LinkedIn; LinkedIn's privacy policy applies to the processing on the platform.
Purpose and legal basis. We use the details to provide the requested document (Art. 6(1)(b) GDPR). We only send deadline-briefing emails if you have given your consent and confirmed it in reply to our first message (Art. 6(1)(a) GDPR). You can withdraw your consent at any time – a short reply saying “unsubscribe” or an email to kontakt@normakte.com is enough.
Retention. Details without consent to the briefing are deleted no later than 90 days after receipt. Details with consent are kept until you withdraw it; proof of consent is kept for as long as legally required. The details are not passed on to third parties or used for other purposes.
Version of 12 October 2026.