Privacy policy

The controller for the processing of data in connection with this website is xappido ag, Kavalleriestrasse 2, 6210 Sursee (info@xappido.com).

Information security

Protecting your data is a high priority for us. xappido is certified to ISO/IEC 27001 – the internationally recognised standard for information security management systems. We therefore follow a systematic approach to ensuring the confidentiality, integrity and availability of information.

View the certificate (PDF) Valid until 17 June 2029

Our principle

This website itself sets no cookies, builds no usage profiles and embeds no third-party tracking. Fonts, images and video thumbnails are served from our own server – they create no connection to third parties. Outbound connections are made only when you trigger them yourself: when you play a video, when you load the map on the contact page, and as soon as you select a field in one of our forms (spam protection). Those services may then set cookies of their own. We describe all three below.

We store two things on your device. First, a setting: whether sound should be on for the home page. It is held in your browser’s local storage and disappears as soon as you clear the browser data for this site. Second, if you reached us through an advertisement or a link from another site, a note of that – the campaign identifier of an ad, say, or the name of the referring website. This note is held in your browser’s session storage, so it disappears when you close the window at the latest, and it reaches us only if you submit the contact form: it is then included in your enquiry so that we know where you found us. We set no cookies for this, and no connection to third parties is made.

Videos (YouTube)

We embed videos only after a click (“click-to-load”). Only when you play a video is a connection made to YouTube (Google Ireland Ltd.) via the more privacy-friendly domain youtube-nocookie.com; data (your IP address, for example) is transmitted to YouTube in the process. The thumbnails are served from our own server.

Map on the contact page

The map on the contact page is a fixed image that we serve from our own server – opening the page therefore creates no connection to a map service. Only when you load the map using the button do we fetch further map tiles from the map service CARTO (CARTO Inc.); your IP address is transmitted there in the process. Without that click – and without JavaScript – the image is all there is.

The “Plan your route” button is an ordinary link: it transmits nothing until you click it, and then opens Google Maps in a new window.

Contact form

If you contact us through the form, we process the data you provide – name, organisation, email address, phone number, your enquiry, the page on which you filled in the form and the origin note described above – solely in order to answer your enquiry. The details reach us as an email; we do not pass them on to third parties and do not use them for advertising.

Job applications

If you apply through our application form, we process your details and the documents you upload (CV, references, work samples) solely in order to assess your application. Transmission is encrypted; the documents are sent as an email through our business mail service at Microsoft 365 (Microsoft Ireland Operations Ltd.) to the people responsible for recruitment, and are not shared in any publicly accessible channel. Once the process is complete, we keep your documents for no longer than six months and then delete them – unless you have expressly agreed to a longer retention period for future positions. You can request erasure at any time at info@xappido.com.

Spam protection on the forms

We check both forms for automated submissions on our own server. In doing so we look at how long the form was open, how many links the text contains, which script it is written in, and how many submissions arrive from the same internet connection in a short space of time. For that last check we hold your IP address in memory for no more than 15 minutes; it is not stored, not logged and not passed on. On the contact form we also check whether the phone number carries a country code from which, in our experience, we receive nothing but advertising, and whether your enquiry contains the typical wording of a sales pitch. No cookies are set for this and no connection to third parties is made.

In addition, reCAPTCHA v3 from Google (Google Ireland Ltd.) may be switched on. When it is active, we load the script it needs only once you select a field in a form – simply opening a page creates no connection to Google. From that point on, reCAPTCHA transmits data to Google, in particular your IP address together with details of your device, browser and behaviour on the page, and Google may set cookies in the process. From this, Google calculates a score for how likely the submission is to be automated; only that score reaches us, not the data it is derived from.

For both, we rely on our overriding interest in keeping a usable channel of contact. If a check rejects your enquiry, you will see so immediately and can write to us at info@xappido.com instead – that route is unaffected by any of the checks.

Audience measurement

To understand which content is read and how people find us, we measure the use of this website ourselves, on our own server and without third-party services. We set no cookies for this and store nothing on your device. When a page is opened, your browser transmits to us the address requested (without query parameters), the name of the website you came from (for example “google.ch”, never the full address), where applicable the campaign identifier of an advertisement, the language setting and time zone of your browser, and a rough device class (phone, tablet or computer). When you leave the page, it transmits how long the page was visible and how far you scrolled, as well as individual steps such as clicking a link to our contact page, e-mail address or phone number, or starting and submitting a form (never its content). For each of these we record the date and time. So that we can tell apart the visitors of a given day, we form a checksum on the server from your IP address, your browser’s identifier and a random value; we do not store the IP address itself. The random value changes daily, and when it changes we delete the previous one. From then on the checksum can no longer be attributed to anyone, not even by us, and visits on different days cannot be linked to one another. The data is held in a Microsoft Azure data store in Switzerland and is evaluated only in aggregated form. If your browser sends the “Global Privacy Control” or “Do Not Track” signal, we measure nothing. We rely for this on our overriding interest in improving our offering.

Hosting and server log data

This website runs on Microsoft Azure. When it is accessed, log data is generated for technical reasons (for example IP address, date and time, page requested). This data is used solely for secure operation and error analysis and is not combined with other data.

Disclosure abroad

The services named above – YouTube, reCAPTCHA, CARTO, Microsoft 365 and Azure – may process data outside Switzerland. In doing so we rely on providers that are subject to adequate data protection or that provide contractual guarantees within the meaning of the Swiss Federal Act on Data Protection.

Your rights

Under the Swiss Federal Act on Data Protection (FADP / DSG) you have, in particular, the right of access to the data processed about you, as well as the right to its rectification, erasure and portability. You may also object to processing. A short message to info@xappido.com is enough – we will get back to you.

Authoritative version

The German version of this privacy policy is authoritative. In the event of any discrepancy, the German wording prevails.

Last updated: 29 September 2026