Privacy Policy

Effective Date: February 1. 2026

SCMC Swiss Cybersecurity Management Center GmbH

Last updated: 9 October 2026

The Swiss Cybersecurity Management Center GmbH (SCMC) (“we”, “our”, or “us”) is committed to protecting your privacy and ensuring transparency regarding the collection, use, and protection of personal data. This Privacy Policy explains how we process personal data when you interact with our website, services, platforms, and communications.

This Privacy Policy is issued in accordance with the Swiss Federal Act on Data Protection (revFADP / revDSG) and, where applicable, the EU General Data Protection Regulation (GDPR).

1. Scope & Applicability

This Privacy Policy applies to:

  • Visitors to our website
  • Users registering for accounts
  • Customers and business contacts
  • Individuals communicating with SCMC

It does not replace or override contractual data protection provisions (e.g. Data Processing Agreements) agreed separately with customers.

2. Roles Under Data Protection Law

  • SCMC acts as a data controller for personal data related to website usage, marketing, account management, and administrative purposes.
  • SCMC acts as a data processor when processing personal data on behalf of customers as part of service delivery, subject to a separate Data Processing Agreement (DPA).

3. Information We Collect

a. Personal Data

We may collect the following personal data:

  • Full name
  • Email address
  • Phone number
  • Company or organization name
  • Job title

b. Technical & Usage Data

When you access our website or platform, we may collect technical data such as:

  • IP address
  • Browser type and version
  • Device type and operating system
  • Referring URL and visited pages
  • Session duration and interaction data

This data is used to maintain security, improve functionality, and analyze usage trends.

4. Legal Bases for Processing

Personal data is processed on the following legal bases, where applicable:

  • Consent (e.g. marketing communications to people without a customer relationship)
  • Performance of a contract or pre-contractual measures
  • Legitimate interests, including system security, fraud prevention, and service improvement
  • Compliance with legal obligations under Swiss or international law

5. Purposes of Processing

Purpose Legal Basis
Providing, operating, and improving our services Performance of a contract
Responding to inquiries and communications Legitimate interests / Performance of a contract
Managing user accounts and customer relationships Performance of a contract
Sending service-related updates Performance of a contract
Sending the newsletter to customers Legitimate interests (Art. 3(1)(o) Swiss UCA), unsubscribe at any time
Sending marketing communications to people without a customer relationship Consent
Monitoring system security and detecting threats Legitimate interests
Processing payments via secure payment providers Performance of a contract
Meeting legal, regulatory, and compliance obligations Legal obligation

Notices and newsletters by email

We send two kinds of email, both through our infrastructure in Zurich:

  • Notices about your contract and the operation of the platform, such as a change to the data processing agreement or a maintenance window. They are part of performing the contract and cannot be unsubscribed from.
  • Newsletters with news about SCMC and our own, similar offers. You receive them as a customer and can unsubscribe at any time through the link in every issue. Unsubscribing applies to all later newsletters; you will still receive notices.

We do not measure whether or when you open our emails. They contain no tracking pixels and no tracked links.

6. Disclosure of Personal Data

We do not sell or rent personal data.

Personal data may be disclosed to trusted third parties acting as processors or service providers, under strict contractual and security safeguards, including:

  • IT infrastructure and hosting providers
  • Security monitoring and analytics providers
  • Payment service providers
  • Authorities where legally required

All recipients are carefully selected and required to comply with applicable data protection laws.

Analysis of access logs (Munot)

We analyse how our website is used with Munot, an analytics service of K-I-Soft IT&Holding GmbH, Bernstrasse 27b, 3122 Kehrsatz, Switzerland. Munot sets no cookies and runs no code in your browser. It only reads the access logs that are created anyway when our pages are requested: IP address, time, requested address, referring page, browser identifier and the country derived from the IP address. Cookies are not logged.

Munot runs in Switzerland (AWS region Zurich). K-I-Soft processes the logs as our processor and solely for our analysis. Logs containing IP addresses are deleted after 6 months at the latest; only figures without personal reference remain longer, such as page views per day. The legal basis is our legitimate interest in improving our offering and detecting misuse.

7. Payment Processing

a. Stripe

Payments are processed via Stripe, a payment service provider headquartered in Ireland/USA (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland).

During payment processing, personal data such as name, billing details, and payment information may be transmitted to Stripe. Stripe complies with applicable data protection and security standards, including PCI DSS.

For transfers to Stripe's US infrastructure, SCMC relies on Standard Contractual Clauses (EU Commission Decision 2021/914) and the Swiss-U.S. Data Privacy Framework, supplemented by Stripe's data processing addendum (available at stripe.com/legal/dpa).

More information:
👉 Stripe Privacy Policy

b. Purchase on invoice (Swiss QR-bill)

Modules can also be bought on invoice. We issue the invoice with its Swiss QR payment part ourselves, no payment service provider is involved. For this we process the billing address of the project (company, contact person, address, email address and, if provided, the VAT number), the booked services and amounts, the invoice number and the QR reference.

The invoice is stored as an encrypted PDF in our infrastructure in Switzerland (AWS region Zurich) and sent by email to the billing address, likewise via AWS in Zurich. Payment is made by bank transfer to our bank in Switzerland. To match a payment to its invoice, we record the amount, date, bank reference and the name of the paying person or company from the bank's credit advice.

Within the platform, only the owners and administrators of the project can see the billing address and the invoices. Because of the statutory retention obligation, we keep invoices for 10 years (see section 10), even if the project or the user account is deleted earlier. The legal basis is the performance of the contract and the statutory obligation to keep accounts.

8. Hosting, Storage & Security

a. Data Hosting

Your projects, assessments, answers, user accounts, invoices and all other content you enter in the platform are stored only in Switzerland, in the data centres of Amazon Web Services (AWS) in Zurich, and so are the backups. They are encrypted with SCMC's own key, which is also kept in Zurich (AWS Key Management Service). The access logs of our website and the logs of the firewall that checks every request for attacks are kept there as well. To run the platform we store nothing outside Switzerland, Germany included.

In the following processes, data passes encrypted through locations outside Switzerland. It is only forwarded there and not stored:

  • Access via Amazon CloudFront: when you open the website or the platform, your browser connects to the nearest access point of the worldwide CloudFront network, in Europe usually one in the EU. The access point forwards your request encrypted to our infrastructure in Zurich.
  • Sign-in: the function that checks your sign-in when a page is requested runs at the access point and stores nothing of yours. AWS only keeps technical runtime messages for it, without content and without personal data.
  • Live updates: when several people have the same assessment open, changes are forwarded to the open browsers via AWS in Frankfurt (Germany).

Where data passes an access point in the USA in the process, we rely on the standard contractual clauses in the AWS data processing addendum (EU Commission Decision 2021/914) and the Swiss-U.S. Data Privacy Framework. According to the Swiss Federal Council, Germany and the EU provide an adequate level of data protection. Card payments (section 7) go through a separate provider with its own locations.

Data is subject to the requirements of the Swiss revFADP and, where applicable, the GDPR.

b. Technical & Organizational Measures

We implement industry-standard security measures, including:

  • Encryption of data at rest with SCMC's own key (AWS Key Management Service, in Zurich), of data in transit with TLS
  • Access controls based on the need-to-know principle
  • Authentication and authorization mechanisms
  • Regular backups and monitoring
  • Security reviews and audits

AWS complies with recognized international standards such as ISO 27001, SOC 1/2/3, and PCI DSS. Certifications are available via the 👉 AWS Artifact Portal .

9. International Data Transfers

Where personal data is transferred outside Switzerland or the European Economic Area (EEA), we ensure appropriate safeguards, including:

  • Adequacy decisions issued by Swiss or EU authorities
  • Standard Contractual Clauses (SCCs)
  • Supplementary technical and organizational measures where required

10. Data Retention

Personal data is retained only as long as necessary for the stated purposes or as required by law.

Indicative retention periods include:

  • Contract and billing records: 10 years (CO Art. 958f; VAT Act Art. 70)
  • Marketing and newsletter data: until consent is withdrawn or you unsubscribe
  • Sending records of notices and newsletters (recipient, time of sending, unsubscription): for the duration of the customer relationship, as they show when a notice was delivered
  • Technical logs and security data: 6 months at most (firewall logs 30 days, website access logs 60 days, their analysis by Munot 6 months)

11. Your Rights

Depending on your jurisdiction, you may have the right to:

  • Access your personal data
  • Rectify inaccurate or incomplete data
  • Withdraw consent at any time
  • Request deletion of personal data
  • Object to or restrict processing
  • Request data portability
  • Lodge a complaint with a supervisory authority
    (Switzerland: Federal Data Protection and Information Commissioner – FDPIC)

Data that has to be kept under statutory retention obligations, in particular invoices, is not deleted when a deletion is requested. As long as invoices for your own projects are open, your user account cannot be deleted.

Requests are handled within 30 days, unless extended as permitted by law.

To exercise your rights, contact:
📧 support@scmc.ch

12. Cookies & Tracking Technologies

We use only what operation requires:

  • Session cookies for signing in. The platform does not work without them.
  • Settings in your browser's storage, such as the language you chose.

We set no cookies for analytics or advertising, which is why there is no cookie banner. Our visitor statistics come without cookies from the access logs of our server (section 6, Munot).

Protection of the forms

We protect the contact form and the confirmation of a sign-up without third-party services. A field hidden from people is filled in only by automated programs, and for the contact form the time between opening and sending counts as well. Our firewall also limits how many requests one IP address can send to these forms in a short time. The IP address appears only in the firewall log (section 10).

13. Children’s Data

Our services are not directed at individuals under the age of 16. We do not knowingly collect personal data from minors.

14. Data Security Disclaimer

While we apply appropriate technical and organizational measures to protect personal data, no system can guarantee absolute security. Users are encouraged to apply appropriate safeguards when using online services.

15. Changes to This Privacy Policy

This Privacy Policy may be updated from time to time. The latest version will always be published on this page with the updated revision date.

16. Contact Information

SCMC Swiss Cybersecurity Management Center GmbH
Tiefenhöfe 10
8001 Zürich
Switzerland
📧 Email: info@scmc.ch
🌐 Website: https://www.scmc.ch

Data Controller:
SCMC Swiss Cybersecurity Management Center GmbH, Tiefenhöfe 10, 8001 Zürich, Switzerland

Supervisory Authority (Switzerland):
Federal Data Protection and Information Commissioner (FDPIC)
Feldeggweg 1, 3003 Bern, Switzerland
🌐 www.edoeb.admin.ch

This Privacy Policy is available at all times at https://www.scmc.ch/privacy.

Further legal information:
Legal Notice · Data Processing Agreement (DPA) · Terms & Conditions