Last updated: 9 July 2026

Alpine Carbon Group GmbH (“we”, “us”, “our”) respects your privacy. This Privacy Policy explains how we collect, process, and protect personal data when you visit our website and when you contact us through our contact form. It is written to comply with the revised Swiss Federal Act on Data Protection (revFADP/FADP, in force since 1 September 2023) and its Ordinance (DPO), and—where applicable—with the EU General Data Protection Regulation (GDPR).

1. Data Controller

The controller responsible for data processing on this website is:

Alpine Carbon Group GmbH

Zugerstrasse 32 6340 Baar

Canton of Zug, Switzerland

Email: contact@alpinecarbongroup.ch

For any questions about this Privacy Policy or to exercise your rights, contact us at the email address above.

2. Personal Data We Collect

a) Contact form. Our website provides a single contact form. The fields are:

• Name (optional)
• Company (optional)
• Email (required)
• Message (free text)

You decide what information to provide. Only the email address is required so that we can reply. Please do not submit sensitive personal data through the form.

b) Server log data. When you visit our website, our Swiss hosting provider automatically processes standard technical data in server log files on our behalf, including the IP address, browser type and version, operating system, date and time of access, and the pages requested. This data is necessary to deliver the website, ensure stability, and maintain IT security. These server logs are retained for a maximum of 10 days and are then deleted.

c) No tracking. We do not use tracking cookies, advertising cookies, web analytics, profiling, or similar technologies. Only technically essential elements required for the basic operation of the website are used.

3. Purposes and Legal Basis

We process the data described above to:

• respond to and handle your inquiry submitted via the contact form;
• operate, secure, and maintain our website.

Under Swiss law (revFADP). As a private controller, we may process personal data without a specific “legal basis” provided we comply with the data protection principles—lawfulness, good faith, proportionality, purpose limitation, transparency (recognizability), and data accuracy (Art. 6 FADP). We process your data only for the purposes for which you provide it, and only to the extent necessary.

Under the GDPR (where applicable to visitors in the EU/EEA). Where the GDPR applies, our legal bases are:

• Art. 6(1)(b) GDPR – processing necessary to take steps at your request prior to entering into a contract, where your inquiry concerns our services;
• Art. 6(1)(f) GDPR – our legitimate interest in responding effectively to inquiries and in operating a secure, stable website;
• Art. 6(1)(a) GDPR – your consent, where you voluntarily provide optional information (Name, Company) or where consent is otherwise requested. You may withdraw consent at any time with effect for the future.

4. Recipients and Processors

We do not sell your personal data. We share it only with service providers who process data on our behalf (processors) and who are required to process personal data only on our instructions and to protect it:

a) Contact form delivery – Web3Forms. Our contact form is operated through Web3Forms, a contact-form API service. When you submit the form, your data is transmitted to Web3Forms’ servers, processed, and forwarded to our email inbox. Web3Forms acts as our processor for this transmission. Web3Forms processes data on Amazon Web Services (AWS) infrastructure located in the United States. See Section 5 on international transfers.

b) Website hosting – Infomaniak Network SA. Our website is hosted by Infomaniak Network SA, Rue Eugène-Marziano 25, 1227 Les Acacias (Geneva), Switzerland (UID CHE-103.167.648). Infomaniak acts as our processor and stores all website data exclusively on servers located in Switzerland. The processing is governed by a data processing agreement based on Art. 9 revFADP and Art. 28 GDPR, which forms an integral part of Infomaniak’s general terms and conditions. Infomaniak processes the server log data described in Section 2(b) on our behalf and retains it for a maximum of 10 days. Infomaniak has not disclosed any subprocessor located outside Switzerland for its web hosting service.

5. International Data Transfers

Most of our processing takes place in Switzerland. However, when you use our contact form, your submission is transferred to and processed in the United States via Web3Forms (on AWS servers).

On 14 August 2024, the Swiss Federal Council added the United States to the list of countries with an adequate level of data protection, with effect from 15 September 2024—but only for organizations that are certified under the Swiss–U.S. Data Privacy Framework (DPF). Web3Forms is not certified under the Swiss–U.S. DPF, and it does not offer Standard Contractual Clauses or a data processing agreement.

Accordingly, we rely on the statutory exceptions for cross-border disclosure under Art. 17 revFADP: the transfer is necessary for the performance of, or for steps taken at your request prior to, a (pre-)contractual relationship (Art. 17(1)(b) revFADP), and/or it takes place with your consent (Art. 17(1)(a) revFADP), which you give by voluntarily submitting the form. Where the GDPR applies, the corresponding derogations under Art. 49(1)(a) and (b) GDPR apply.

You should be aware that data transferred to the United States may be subject to access by US authorities and that the level of protection may not correspond to that in Switzerland or the EU/EEA. If you prefer not to transfer your data to the United States, you may contact us directly by email at contact@alpinecarbongroup.ch instead of using the form.

6. Data Retention

We retain the personal data from your inquiry only as long as necessary to handle your request and any subsequent related correspondence, and thereafter for up to 12 months, unless a longer retention period is required by law (e.g., statutory record-keeping obligations under the Swiss Code of Obligations). We then securely delete the data.

On the Web3Forms platform, form submissions are stored for a limited period and then automatically deleted. Server logs held by our Swiss hosting provider, Infomaniak, are retained for a maximum of 10 days and are then deleted.

7. Your Rights

Under the revFADP and, where applicable, the GDPR, you have the right to:

• access your personal data and obtain information about its processing;
• rectification of inaccurate or incomplete data;
• erasure (“right to be forgotten”);
• restriction of processing;
• object to processing;
• data portability (to receive your data in a common electronic format or have it transferred);
• withdraw consent at any time, where processing is based on consent, without affecting the lawfulness of processing before withdrawal.

To exercise any of these rights, contact us at contact@alpinecarbongroup.ch. We may need to verify your identity. We will respond within the timeframes required by law.

8. Right to Lodge a Complaint

If you believe your data protection rights have been violated, you may report the matter to the Swiss supervisory authority:

Federal Data Protection and Information Commissioner (FDPIC / EDÖB) Feldeggweg 1, 3003 Bern, Switzerland www.edoeb.admin.ch

We ask that you contact us first so we can try to resolve your concern directly.

9. Data Security

We take appropriate technical and organizational measures to protect your personal data against loss, misuse, unauthorized access, and disclosure. All data submitted through our website is transmitted over an encrypted HTTPS (TLS) connection. Our hosting provider, Infomaniak, operates ISO/IEC 27001-certified information security management and maintains its data centres in Switzerland, with strict physical access controls, redundancy, and regular security testing. Our processors apply their own security measures, including encrypted transmission and storage.

10. Cookies

We use only technically essential elements necessary for the basic operation of the website. We do not use tracking, profiling, analytics, or advertising cookies, and therefore no cookie consent banner for non-essential cookies is required.

11. Minors

Our website and services are directed at businesses and adults, not at children. Switzerland does not set a fixed “digital consent age”; the capacity to consent depends on the individual’s capacity of judgement under the Swiss Civil Code. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

12. Automated Decision-Making

We do not carry out automated individual decision-making or profiling within the meaning of the revFADP or the GDPR.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The current version published on our website applies. The “Last updated” date indicates the most recent revision.

14. Contact

Alpine Carbon Group GmbH

Zugerstrasse 32, 6340 Baar, Switzerland

Email: contact@alpinecarbongroup.ch