1. Data controller
The controller of your personal data is Sphaira Group, Inh. Alejandro Espinosa Lopez, located at Rue Pierre-Ardieu 30, 1630 Bulle, Switzerland. UID CHE-268.913.191. Contact email: hello@sophex.studio.
Applicable legal framework
We apply the Swiss Federal Act on Data Protection (FADP/nLPD) given our seat in Switzerland, and the General Data Protection Regulation (GDPR, EU 2016/679) when we process data of individuals residing in the European Economic Area.
2. What data we collect
We only process data you voluntarily provide.
Contact form
- Full name
- Email address
- Company (optional)
- Free-text message
Minimum technical data
Our hosting provider (Vercel Inc., USA) processes the IP address and user agent in server logs for up to 30 days for security and abuse prevention purposes. We do not perform profiling or cross-reference that information with your identity.
3. Why we use it
Reply to your inquiry
We use your form data to contact you and evaluate your project.
Comply with legal obligations
We retain billing and communications when a tax or commercial law requires it.
Service security
Technical logs are used to detect abuse and protect the site.
4. Legal basis
Processing is based on your consent when submitting the form (Art. 6(1)(a) GDPR; Art. 6 FADP), the performance of pre-contractual measures at your request (Art. 6(1)(b) GDPR), our legitimate interest in keeping the site secure (Art. 6(1)(f) GDPR), and the fulfilment of legal obligations (Art. 6(1)(c) GDPR).
5. How long we keep it
- Form data without an engaged project: up to 24 months from last contact.
- Data from engaged projects: throughout the relationship + 10 years required by Swiss accounting legislation (Art. 958f CO).
- Technical server logs: maximum 30 days.
6. Who we share with
We do not sell or transfer your data. It is only processed by the following data processors, bound by contractual agreements that guarantee confidentiality:
Vercel Inc. (USA)
Website hosting. International transfer covered by Standard Contractual Clauses and the EU-U.S. Data Privacy Framework.
Resend / email provider
Sending and receiving emails generated by the contact form.
7. International transfers
As our company is based in Switzerland and some technology providers are based in the United States, your data may be processed outside the EEA. Such transfers are carried out with adequate safeguards: Standard Contractual Clauses approved by the European Commission and, where applicable, adherence to the EU-U.S. Data Privacy Framework.
8. Your rights
You have the right to access your data, rectify it, erase it, object to the processing, request restriction or portability, and withdraw your consent at any time. To exercise these rights, write to us at hello@sophex.studio stating the right you wish to exercise. We will reply within a maximum of 30 days.
Complaints to supervisory authorities
If you consider that we have not processed your data correctly, you can file a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC, edoeb.admin.ch) or, if you reside in the EU, with the Spanish Data Protection Agency (aepd.es) or the supervisory authority in your country.
9. Security
We apply reasonable technical and organizational measures to protect your data: encryption in transit (HTTPS/TLS), role-based access, encrypted backups and periodic reviews. No system is 100% foolproof, but we do what is necessary to minimize risks.
10. Minors
Our services are aimed at businesses and professionals. We do not knowingly collect data from minors under 16 years of age.
11. Changes to this policy
We may update this policy to reflect legal changes or changes to our services. We will publish the current version on this page indicating the last updated date.