Privacy Policy

1. Who is responsible for your data (data controller)

The controller responsible for processing personal data on this website is:

• Mimir Lab di Sechi Gabriele (sole proprietorship / ditta individuale)
• 6936 Cademario (TI), Switzerland
• Swiss business identification number (IDI/UID): CHE-331.120.073
• Email: g.sechi@mimirlab.net

Under the Swiss Federal Act on Data Protection (FADP, Art. 10), appointing a data protection adviser is voluntary for private controllers; we have not appointed one. As a controller established in Switzerland (outside the EU), we have assessed Art. 27 GDPR and rely on the exemption in Art. 27(2)(a) — our processing is occasional, not large-scale and low-risk — so we have not designated an EU representative. For any data-protection request, contact us at the email above.

2. Scope of this policy

This policy covers personal data processed through the public websitemimirlab.net, where we act as the controller. It does not cover personal data we process as a processor when delivering automation or development services to clients — that processing is governed by the separate data-processing agreement (DPA) entered into with each client, as required by Art. 9 FADP and Art. 28 GDPR.

3. What data we collect, and why

mimirlab.net is a static informational website. We do not run web analytics, we do not use tracking or advertising cookies, and the site contains no contact or sign-up forms that collect your data. We process personal data only in the limited ways described below.

3.1 Technical access data (server and CDN logs)

Our website is hosted and delivered through Cloudflare. When you visit the site, Cloudflare automatically processes technical connection data, which may include your IP address, the date and time of the request, the page requested, your browser and operating system type, and referrer information. This data is processed to deliver the website, ensure its security and stability, and prevent abuse.

Legal basis: our legitimate interest in operating and securing the website (GDPR Art. 6(1)(f)); lawful processing of personal data under the Swiss nFADP.

3.2 Communications you send us

If you contact us — for example by email (Google Workspace), or by writing to us on our LinkedIn page or our Telegram bot — we process the personal data you choose to share (such as your name, contact details, and the content of your message) for the sole purpose of handling your request and responding to you.

Legal basis: our legitimate interest in responding to enquiries, and, where your message relates to a possible engagement, the taking of steps at your request prior to entering into a contract (GDPR Art. 6(1)(b) and 6(1)(f)); lawful processing under the Swiss nFADP.

4. Cookies

We do not set analytics or marketing cookies. Our hosting and CDN provider (Cloudflare) may set strictly necessary cookies for security and to keep the site running (for example, bot-mitigation cookies). These cookies do not track you across other websites and are not used for advertising.

Under Swiss law (Art. 45c of the Telecommunications Act, TCA), storing or reading data on your device is allowed where you are informed and given the possibility to refuse (an opt-out model, unlike the EU opt-in requirement). As we use only strictly necessary cookies, no consent banner is required.

5. Service providers and recipients

We rely on the following providers to operate the website and communicate with you:

• Cloudflare, Inc. — website hosting, CDN, and security (processes technical access data).
• Google (Google Workspace) — email, if you write to us by email.
• GitHub, Inc. — source hosting and automated deployment of the website.

If you choose to interact with us on third-party platforms (LinkedIn, Telegram, GitHub), or follow our affiliate links to partner tools (such as n8n or HubSpot), those platforms act as independent controllers under their own privacy policies. We do not control and are not responsible for their processing.

5.1 Data processed through the LinkedIn API

We manage our LinkedIn company page using LinkedIn's Marketing / Community Management APIs. In this context we may process data made available to us by LinkedIn — such as the content of posts and comments, reactions, and aggregated engagement statistics — for the sole purposes of publishing and scheduling our own content, moderating and replying to interactions on our page, and measuring the performance of our posts. We do not sell this data, and we do not use it for advertising profiling or to build profiles of individual members. This processing is carried out in accordance with theLinkedIn Privacy Policyand LinkedIn's API terms, and the data is retained only as long as needed for these purposes.

6. International data transfers

Some of our providers and platforms (including Cloudflare, Google and LinkedIn) are based in, or process data in, the United States. Switzerland recognises theSwiss–U.S. Data Privacy Framework (in force since 15 September 2024): where a U.S. recipient is certified under that framework, the transfer relies on Switzerland's adequacy decision (Annex 1 to the FADP Ordinance). Where a recipient is not certified — or for visitors in the EEA under the GDPR — we rely on appropriate safeguards, in particular theEU Standard Contractual Clauses together with the Swiss addendum, recognised by the FDPIC (Art. 16(2) FADP). You can ask us which mechanism applies to a given provider using the contact details below.

7. How long we keep your data

Technical access and security logs are retained only for as long as necessary to operate and secure the website, after which they are deleted or anonymised by our providers in line with their standard retention periods. Communications are kept for as long as needed to handle your request and to comply with any applicable legal retention obligations.

8. Your rights

Subject to the conditions of the Swiss nFADP and, where applicable, the GDPR, you have the right to:

• access the personal data we hold about you;
• request the rectification of inaccurate data;
• request the erasure of your data;
• request the restriction of, or object to, our processing;
• receive your data in a portable format (data portability, GDPR);
• withdraw any consent you have given, at any time, without affecting prior processing.

To exercise any of these rights, email us atg.sechi@mimirlab.net. You also have the right to lodge a complaint with a supervisory authority: in Switzerland, theFederal Data Protection and Information Commissioner (FDPIC); in the EEA, your local data protection authority.

9. Children

This website is intended for a professional, business audience and is not directed at children. We do not knowingly collect personal data from children.

10. Changes to this policy

We may update this policy to reflect changes in our practices or in the law. The current version is always available on this page, with the "Last updated" date shown above.

11. Contact

For any question about this policy or about how we handle your personal data, contact:
Mimir Lab di Sechi Gabriele
6936 Cademario (TI), Switzerland
g.sechi@mimirlab.net