Timber Carbon

Privacy Policy

Last updated: August 28, 2026

Protecting your personal data matters to us. This privacy policy explains what data we process, for which purposes — and what rights you have. It applies to our website timbercarbon.ch, our newsletters and our other offline and online activities (e.g. events and webinars).

1. Controller and contact

The controller responsible for the data processing described in this policy is:

Timber Carbon Solutions AG Ausstellungsstrasse 36 8005 Zürich, Switzerland info@timbercarbon.ch · +41 (0)58 255 42 60

For privacy matters, you can reach us by email or by post at the address above.

2. Applicable law

We process personal data in accordance with the Swiss Federal Act on Data Protection (FADP) and the Data Protection Ordinance (DPO). Where the EU General Data Protection Regulation (GDPR) applies — for instance because we direct our services to people in the EU/EEA — we additionally comply with its requirements.

3. What data we process

Data you provide to us directly:

  • Contact and form data: first name, last name, email, company, phone number and your message — when you use one of our forms (contact, project submission, document request), write to us or call us, attend one of our events or hand us your business card.
  • Project-related data: information about your building project that you share with us as part of a project submission or certification.
  • Newsletter data: email address and subscription status. Sign-up uses a confirmation step (double opt-in); you can unsubscribe at any time via the link in every mailing.
  • Application data: documents you send us when applying for a position.

Data generated automatically when you use the website:

  • Log data: IP address, date and time of access, pages visited, referrer, browser and operating system — technically required to operate and secure the website.
  • Usage data: pages visited, time spent, approximate location (country/region), device type — provided you have consented to analytics cookies (see sections 5 and 6).

Data from other sources: Publicly available information (e.g. commercial registers, company websites, LinkedIn) and data from business partners — to the extent required for the business relationship.

4. Purposes of processing

We process your data to:

  • provide, secure and further develop our website and services;
  • respond to your enquiries and communicate with you;
  • review project submissions and handle the certification process (contract initiation and performance);
  • send you newsletters and updates — with your consent;
  • analyse how our website is used and improve what we offer (with your consent, where cookies are involved);
  • tailor our communication and marketing activities;
  • review job applications;
  • comply with legal obligations and establish, exercise or defend legal claims.

Where the GDPR applies, we rely on: your consent (Art. 6 (1) (a)), the performance or initiation of a contract ((b)), legal obligations ((c)) or our legitimate interest in operating our services securely and efficiently ((f)). You can withdraw any consent at any time with effect for the future.

No automated individual decision-making with legal effect on you takes place.

5. Cookies and consent

Our website uses only technically necessary cookies, which are required for the operation and security of the site. We do not currently use analytics or marketing cookies. You can block or delete cookies in your browser; instructions are available in your browser's help pages. Without certain cookies, not all functions of the website may be available.

6. Services we use

Hosting — Vercel: Our website is hosted by Vercel Inc. (San Francisco, USA). Technical log data (including IP addresses) is processed in this context. Vercel is certified under the Swiss-U.S. Data Privacy Framework. Details: https://vercel.com/legal/privacy-notice

Content management — Sanity: The website's content is delivered via the headless CMS Sanity (Sanity Inc., San Francisco, USA / Oslo, Norway). No visitor data beyond the log data is processed in this context. Details: https://www.sanity.io/legal/privacy

Web analytics — Google Analytics 4: With your consent, we use Google Analytics 4 (Google Ireland Ltd., Dublin, Ireland) to analyse how our website is used and to improve what we offer. Google Analytics 4 does not store IP addresses permanently by default; the IP is used for coarse location detection and then discarded. The data remains pseudonymous but may still allow individuals to be identified. Retention period for usage data: 14 months. Google Signals is enabled; this may combine data across devices where you are logged into your Google account and have consented to personalised advertising. Where data is transferred to the USA, Google relies on the EU-U.S. and Swiss-U.S. Data Privacy Framework. Details and objection options: https://policies.google.com/privacy

CRM, forms & newsletter — HubSpot: We use HubSpot (HubSpot Inc., Cambridge, USA / HubSpot Ireland Ltd., Dublin) to manage contacts, form enquiries and newsletter delivery. HubSpot processes the data you enter in our forms on our behalf and is certified under the Swiss-U.S. Data Privacy Framework. For our newsletter, we use HubSpot to measure opens and clicks in order to improve our content. This is done with your consent, which you give when subscribing and may withdraw at any time with effect for the future. Details: https://legal.hubspot.com/privacy-policy

LinkedIn: We embed posts from our LinkedIn profile and — with your consent — use the LinkedIn Insight Tag for reach measurement and conversion tracking (LinkedIn Ireland Unlimited Company, Dublin, Ireland). Links and share buttons to LinkedIn only transmit data once you click them. For the Insight Tag, we and LinkedIn Ireland Unlimited Company are joint controllers within the meaning of Art. 26 GDPR. The essential content of our arrangement follows from LinkedIn's Pages Joint Controller Addendum. LinkedIn is solely responsible for its subsequent processing of the data for its own purposes. Details: https://www.linkedin.com/legal/privacy-policy

Videos — YouTube: We embed videos in privacy-enhanced mode (youtube-nocookie.com). A connection to Google servers is established and your IP address transmitted as soon as the player loads, which is why the player is only loaded after you consent. If you are logged into your YouTube account, Google may associate the request with your account. Details: https://policies.google.com/privacy

7. Disclosure and international transfers

We only disclose personal data where this is necessary for the purposes stated — in particular to the service providers named in section 6, who act partly as processors (Vercel, Sanity, HubSpot, Google Analytics), partly as joint controllers (LinkedIn Insight Tag) and partly as independent controllers (YouTube/Google); to authorities and courts where legally required; or to parties in legal proceedings.

Some recipients are located abroad, in particular in the EU/EEA and the USA. US providers certified under the Swiss-U.S. Data Privacy Framework ensure a level of data protection recognised as adequate by the Swiss Federal Council. In all other cases, we base transfers on the European Commission's Standard Contractual Clauses or on statutory exceptions (e.g. contract performance, consent).

8. Retention

We keep personal data only for as long as needed for the respective purpose or as required by statutory retention obligations (e.g. up to 10 years under accounting and tax law). After that, the data is deleted or anonymised.

9. Data security

We protect your data with appropriate, state-of-the-art technical and organisational measures — including encryption (TLS), access restrictions and multi-factor authentication — and adapt them continuously to the threat landscape. Please note that data transmission over the internet can never be fully protected against access by third parties.

10. Your rights

You have the right to:

  • access the data we process about you;
  • rectification of inaccurate data;
  • deletion of your data, unless retention obligations require otherwise;
  • restriction of processing and objection to processing, in particular for direct marketing;
  • receive and transfer your data in a common electronic format;
  • withdraw any consent — at any time, with effect for the future.

To exercise your rights, an email to info@timbercarbon.ch is sufficient; for security, we may ask for proof of identity. You can also lodge a complaint with a supervisory authority: in Switzerland, the Federal Data Protection and Information Commissioner (FDPIC, www.edoeb.admin.ch); in the EU/EEA, the data protection authority responsible for you.

11. Changes to this policy

We may update this privacy policy from time to time — the version published on this page applies.

12. Representative

We value your privacy and your rights as a data subject and have therefore appointed Prighter Group with its local partners as our privacy representative and your point of contact for the following regions:

  • United Kingdom (UK)
  • European Union (EU)

Prighter gives you an easy way to exercise your privacy-related rights (e.g. requests to access or erase personal data). If you want to contact us via our representative, Prighter or make use of your data subject rights, please visit the following website:https://app.prighter.com/portal/17443578875