Privacy Policy

1. Introduction

Colistor ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and protect information when you use our online productivity platform hosted at colistor.com ("the Service").

2. Data Controller

2.1 Who We Are

Colistor acts as the data controller for all personal data processed through the Service. We are responsible for determining how and why your personal data is processed and for ensuring compliance with applicable data protection laws.

2.2 Our Responsibilities

As the data controller, we are responsible for:

• Ensuring compliance with applicable data protection laws (GDPR, Swiss FADP, etc.)
• Implementing appropriate security measures to protect your data
• Managing user consent and facilitating data subject rights
• Maintaining data processing records
• Conducting data protection impact assessments where required

3. Information We Collect

We collect and process the following types of information:

3.1 User Account Information

• Names, email addresses, usernames
• Authentication credentials (securely hashed)
• User preferences and settings

3.2 Content Data

• Tasks, notes, bookmarks, and other user-generated content
• Files and attachments uploaded to the system
• Metadata associated with user content

3.3 Technical Information

• IP addresses and access logs
• Browser type and device information
• Usage patterns and analytics for service improvement

4. Legal Basis for Processing (GDPR)

We process personal data of individuals in the EU/EEA based on the following legal grounds under GDPR Article 6:

4.1 Consent (Article 6(1)(a))

• We obtain clear, informed consent from users where required
• Users can withdraw consent at any time

4.2 Contract (Article 6(1)(b))

• Processing necessary for providing the Service to users

4.3 Legal Obligation (Article 6(1)(c))

• Compliance with legal requirements

4.4 Legitimate Interests (Article 6(1)(f))

• Security and fraud prevention
• Service improvement and optimization

5. Data Subject Rights (GDPR)

We ensure users can exercise their rights under GDPR:

5.1 Right of Access (Article 15)

You have the right to obtain confirmation whether your personal data is being processed and access to such data.

5.2 Right to Rectification (Article 16)

You have the right to have inaccurate personal data corrected.

5.3 Right to Erasure (Article 17)

You have the right to request deletion of your personal data ("right to be forgotten").

5.4 Right to Data Portability (Article 20)

You have the right to receive your personal data in a structured, commonly used format.

5.5 Right to Object (Article 21)

You have the right to object to processing of your personal data.

5.6 Right to Restriction (Article 18)

You have the right to request restriction of processing under certain circumstances.

6. Swiss Data Protection (FADP)

We comply with the Swiss Federal Act on Data Protection when processing personal data of individuals in Switzerland:

6.1 Data Processing Principles

• We process personal data lawfully
• We collect data for specified, explicit, and legitimate purposes
• We process only adequate, relevant, and necessary data
• We ensure data accuracy
• We limit data retention periods

6.2 Information Obligations

• We inform data subjects about data processing
• We provide information about data retention periods
• We inform about rights to access and correction

6.3 Data Security

• We implement appropriate technical and organizational measures
• We protect data against unauthorized access
• We ensure confidentiality and integrity

6.4 Cross-Border Data Transfers

When transferring data outside Switzerland:

• We ensure adequate level of protection
• We use appropriate safeguards (Standard Contractual Clauses, etc.)
• We comply with Swiss data transfer requirements

7. Data Security

We implement robust security measures including:

• Encryption of data at rest and in transit
• Access controls and authentication
• Regular security updates and patches
• Backup and disaster recovery procedures
• Monitoring and logging (with appropriate privacy measures)

8. Data Retention

We have established data retention policies:

• We retain personal data only as long as necessary for the purposes outlined in this policy
• We have defined retention periods for different data categories
• We implement automated deletion where appropriate
• We document retention periods and legal justifications

9. Third-Party Services

We may use third-party services to help operate our platform:

• We ensure their compliance with data protection requirements
• We review their privacy policies and data processing terms
• We implement appropriate data processing agreements
• We inform users about third-party data sharing where applicable

10. Cookies and Tracking

The Service uses:

10.1 Essential Cookies

• Session management and authentication
• Security and fraud prevention
• These are necessary for the Service to function

10.2 Optional Cookies

• Analytics and performance monitoring
• User preferences and settings
• We obtain consent where required by law

See our Cookie Policy for more details.

11. Children's Privacy

The Service is not intended for children under 16 years of age. If we become aware that a child has provided personal data:

• We take immediate steps to delete such information
• We implement age verification measures
• We obtain parental consent where required by law

12. Data Breaches

In the event of a personal data breach:

12.1 GDPR Requirements (Article 33-34)

• We notify the supervisory authority within 72 hours (if there is a risk to rights)
• We notify affected data subjects without undue delay (if there is a high risk)
• We document all data breaches

12.2 Swiss FADP Requirements

• We notify the Federal Data Protection and Information Commissioner (FDPIC) if there is high risk
• We implement measures to mitigate risks
• We document incidents

13. International Data Transfers

When we process data across borders:

• We ensure adequate protection mechanisms
• We implement Standard Contractual Clauses where required
• We conduct Transfer Impact Assessments
• We comply with data localization requirements

14. Records of Processing Activities

Under GDPR Article 30, we maintain records including:

• Purposes of processing
• Categories of data subjects and personal data
• Categories of recipients
• Data retention periods
• Security measures

15. Data Protection Officer (DPO)

We have considered the need for a Data Protection Officer and have implemented appropriate oversight of data protection practices in accordance with GDPR Article 37 requirements.

16. Updates to This Policy

We may update this Privacy Policy from time to time:

• We review and update this policy regularly
• We inform users of material changes
• We maintain version history
• We obtain renewed consent where required by law

17. Our Compliance Commitment

To ensure compliance:

• We conduct regular privacy audits
• We implement privacy by design and default
• We provide privacy training for our team
• We maintain documentation of compliance measures
• We have established procedures for handling data subject requests

18. Contact for Privacy Matters

For privacy-related questions or to exercise your data protection rights, please contact us through the support channels provided on colistor.com.

19. Governing Law

This Privacy Policy is governed by Swiss law. We ensure compliance with applicable data protection laws including GDPR and Swiss FADP.