Privacy Policy

ANOMAL AG, Ueberlandstrasse 1, 8600 Dübendorf, Switzerland (Handelsregister Zürich, UID CHE-213.937.621) is the controller for personal data processed on this website and through our services. Data protection contact · dataprotection@anomal.xyz.

• Contact form and booking submissions (name, email, company, message).
• Technical logs (IP, user agent, referrer) for security and abuse prevention.
• Analytics events (cookie-based, only after consent).
• Customer telemetry processed inside the ANOMAL SOC platform, governed by the Data Processing Agreement (DPA) signed with each customer.

We process personal data based on your consent (analytics, marketing), the performance of a contract (SOC services, booking), our legitimate interest (security, product improvement), or legal obligation (accounting, incident reporting).

Customer telemetry processed by the ANOMAL SOC is kept in Swiss or EU regions of the customer's own tenant. HubSpot (CRM) processes data exclusively in the EU (Frankfurt, Germany). Cloudflare (edge delivery, Turnstile) operates a global network. It may transfer data to the United States as part of this, safeguarded by EU Standard Contractual Clauses and the Swiss FDPIC-approved addendum. A current sub-processor list is maintained on our Trust Center.

The website is delivered through a website hosting provider on Cloudflare infrastructure (global network). The website database and file storage (form submissions, applications) run with a database provider in the AWS region eu-central-2 (Zurich, Switzerland).

To operate the site, we store your language, colour scheme and cookie choice in your browser. Without consent, source details of the current session (referrer, campaign parameters) stay in session storage and are only sent when you submit a form. A visitor ID and the first source are stored persistently only after your consent. Your answers in the application flow stay in the browser's session storage until you submit them. They are deleted as soon as you close the tab.

When you apply, we process your details (name, email, motivation, LinkedIn profile), your CV and your answers from the application flow. The data is kept in our database and in non-public file storage with our database provider in Switzerland (Zurich). Only the people at ANOMAL AG responsible for recruiting have access. Before storing them, we automatically check uploaded CVs for active content such as scripts or macros. We delete application documents no later than 6 months after receipt.

Links to Google Maps and Apple Maps only open the respective service once you click them.

• We delete requests submitted through the website from our website system after 24 months.
• Application documents: no later than 6 months after receipt.
• Accounting-relevant records (invoices, contracts): 10 years, per Swiss OR art. 958f.
• Security logs and audit trails: 12 months rolling.
• Customer SOC telemetry: per DPA, typically 12 months rolling, extendable.

You have the right to access, correct, delete or port your personal data, and to withdraw consent at any time. Data subjects within the scope of the GDPR also have the right to restriction of processing (Art. 18 GDPR). Send requests to dataprotection@anomal.xyz. You may also lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern.

A data-security breach may pose a high risk to the personality or fundamental rights of data subjects. In that case, we notify the FDPIC as soon as possible under Art. 24 revDSG. We inform affected data subjects to the extent required for their protection or as ordered by the FDPIC. Within the scope of the GDPR, notification to the competent supervisory authority is made within 72 hours (Art. 33 GDPR).

We do not actively process sensitive personal data within the meaning of Art. 5 lit. c revDSG (including health, religious, trade-union, social-assistance, judicial or biometric data for unique identification) and we do not process data of children under 16. Our offering is aimed at professionals and decision-makers within companies. If such data reaches us unintentionally, we delete it without undue delay once identified.