1. Controller
greg.design by Gregory Anthony Zagkos
Murtenstrasse 254
3027 Bern, Switzerland
Email: studio@greg.design
2. General Information
This policy explains what data we collect, how we use it, and your rights under the Swiss Data Protection Act (FADP) and the GDPR.
3. Hosting & Infrastructure
This website is hosted by Webflow Inc., USA, using SCC under GDPR.
See: Webflow Privacy Policy
4. Data We Collect
- Access Logs: IP address, browser type, OS, time. Purpose: security, analytics. Retained for max. 3 months.
- Contact Forms: Name, email, message. Purpose: response to your inquiry.
- Newsletter: Email or phone via double opt-in (Mailchimp/WhatsApp).
- YouTube (embedded): Activated only after click; user data then sent to Google LLC (USA).
- Social Plugins: LinkedIn, Pinterest, Tumblr, SoundCloud – only loaded after user interaction.
5. Cookies & Consent
We use a cookie banner (e.g., CookieYes). Only essential cookies are set by default. Analytics and marketing cookies require your consent. Cookies last up to 2 years.
6. Third Parties & Transfers Outside the EU/CH
These third parties may transfer data to third countries (e.g., the US):
Provider: Webflow Inc.
Purpose: Hosting
Safeguards: Standard Contractual Clauses (SCC), Privacy Shield (US)
Provider: Google LLC
Purpose: YouTube embed
Safeguards: SCC, EU-US Data Privacy Framework (DPF)
Provider: Meta, Pinterest, Tumblr, SoundCloud
Purpose: Social Plugins
Safeguards: Triggered by user only, SCC
Provider: Mailchimp / WhatsApp
Purpose: Newsletter
Safeguards: Double opt-in, SCC
7. Your Rights
You may: request access, correction, deletion, restriction, data portability, withdraw consent, or object to processing.
Email: studio@greg.design
8. Security
We use SSL/TLS encryption. Third-party scripts (e.g., YouTube) are only activated after consent.
9. Changes
We may update this policy as needed. The current version is always available on this page.
10. Data processing on behalf of clients and AI tools
In the context of client commissions, we process personal data provided to us by clients in our capacity as a data processor (Art. 9 revDSG / Art. 28 GDPR). To this end, we use cloud-based and AI-supported tools (see point 6) in accordance with the principle of data minimisation.
Where particularly sensitive personal data may be involved in the course of an order (e.g. health data, data relating to children or data subject to professional secrecy), we clarify in advance with the clients which tools are permissible.
A public list of the sub-processors used can be found at greg.design/sub-processors.
