1. Controller
greg.design by Gregory Anthony Zagkos
Murtenstrasse 254
3027 Bern, Switzerland
Email: studio@greg.design
2. General Information
This policy explains what data we collect, how we use it, and your rights under the Swiss Data Protection Act (FADP) and the GDPR.
3. Hosting & Infrastructure
This website is hosted by Webflow Inc., USA, using SCC under GDPR.
See: Webflow Privacy Policy
4. Data We Collect
- Access Logs: IP address, browser type, OS, time. Purpose: security, analytics. Retained for max. 3 months.
- Contact Forms: Name, email, message. Purpose: response to your inquiry.
- Newsletter: Email or phone via double opt-in (Mailchimp/WhatsApp).
- YouTube (embedded): Activated only after click; user data then sent to Google LLC (USA).
- Social Plugins: LinkedIn, Pinterest, Tumblr, SoundCloud – only loaded after user interaction.
5. Cookies & Consent
We use a cookie banner (e.g., CookieYes). Only essential cookies are set by default. Analytics and marketing cookies require your consent. Cookies last up to 2 years.
6. Third Parties & Transfers Outside the EU/CH
These third parties may transfer data to third countries (e.g., the US):
Provider: Webflow Inc.
Purpose: Hosting
Safeguards: Standard Contractual Clauses (SCC), Privacy Shield (US)
Provider: Google LLC
Purpose: YouTube embed
Safeguards: SCC, EU-US Data Privacy Framework (DPF)
Provider: Meta, Pinterest, Tumblr, SoundCloud
Purpose: Social Plugins
Safeguards: Triggered by user only, SCC
Provider: Mailchimp / WhatsApp
Purpose: Newsletter
Safeguards: Double opt-in, SCC
7. Your Rights
You may: request access, correction, deletion, restriction, data portability, withdraw consent, or object to processing.
Email: studio@greg.design
8. Security
We use SSL/TLS encryption. Third-party scripts (e.g., YouTube) are only activated after consent.
9. Changes
We may update this policy as needed. The current version is always available on this page.
10. Data processing on behalf of clients and AI tools
In the context of client commissions, we process personal data provided to us by clients in our capacity as a data processor (Art. 9 revDSG / Art. 28 GDPR). To this end, we use cloud-based and AI-supported tools (see point 6) in accordance with the principle of data minimisation.
Where particularly sensitive personal data may be involved in the course of an order (e.g. health data, data relating to children or data subject to professional secrecy), we clarify in advance with the clients which tools are permissible.
A public list of the sub-processors used can be found at greg.design/sub-processors.
11. Chat assistant
We offer a chat assistant on our website. Use is voluntary; you can always reach us via the contact form or by email instead.
Data processed. The content of your messages, the assistant's replies, the page visited, time and language, and — if you provide them — your name and email address. Your IP address is not stored; for abuse prevention we only use a daily-rotating, non-reversible check value.
Purpose. To answer your questions, receive enquiries, and protect the service from abuse.
Legal basis. Your explicit consent, given before your first message. You may withdraw it at any time by writing to greg@greg.design, with effect for the future.
Recipients. Cloudflare, Inc. (USA) for operation and caching, OpenRouter, Inc. or Google LLC (USA) for generating replies, Webflow, Inc. (USA) for the website, and Telegram FZ-LLC (United Arab Emirates) so we can follow conversations and take over personally.
Transfers abroad. Processing takes place in the USA and the United Arab Emirates. For the USA we rely on the Swiss-U.S. Data Privacy Framework. The United Arab Emirates do not provide adequate protection within the meaning of Art. 16 of the Swiss Data Protection Act; the transfer is based on your explicit consent under Art. 17 para. 1 lit. a. Authorities there may be able to access the data and legal enforcement may be more difficult for you.
Retention. Conversation histories are deleted automatically after 30 days. Enquiries you deliberately submit are kept as long as the business relationship and statutory retention periods require. Messages in our Telegram account are deleted quarterly.
No automated individual decisions. The assistant makes no decisions with legal effect. Replies are machine-generated and may contain errors; only information we confirm to you personally in writing is binding.
Please do not enter sensitive personal data or information about third parties.
