Privacy Policy

Last updated: February 2026

This Privacy Policy explains how we process personal data when you use this website. We process personal data in accordance with the Swiss Federal Act on Data Protection (FADP, revised FADP). Where applicable (in particular for users and activities within the EU/EEA), processing is also carried out in accordance with the EU General Data Protection Regulation (GDPR).

1. Privacy at a glance

General information

Personal data means any information that can be used to identify you personally. When you visit this website, personal data may be processed—partly automatically (e.g., technical data) and partly based on information you provide (e.g., enquiries).

Data collection on this website

Who is responsible?
The controller responsible for data processing on this website is:

CC Cinnamon Circle GmbH
In Gassen 9, 8001 Zurich, Switzerland
Phone: +41 43 540 6149
Email: joern@cinnamoncircle.com

How do we collect data?

• Data you provide: e.g., via contact forms or emails.

• Automatically (technical data): e.g., IP address, browser type, operating system, time of page access (server log files).

• With your consent: e.g., analytics (Google Analytics 4) and certain third-party media.

Why do we use your data?

• to operate the website securely and reliably

• to respond to enquiries

• with consent: to analyse and improve the website (analytics)

• with consent/activation: to display third-party content (maps, videos, social feeds)

Your rights

Depending on applicable law, you may have rights to access, rectification, erasure, restriction of processing, objection, withdrawal of consent and data portability. Details are set out in Section 10.

2. Hosting

Hosting by IONOS

This website is hosted with IONOS. When you access the website, IONOS processes technical data on our behalf that is required to deliver and secure the website. This includes server log files (see Section 4).

Where legally required, we have concluded a data processing agreement / contractual safeguards with our hosting provider.

3. Legal bases for processing

Where the GDPR applies, we process personal data on the following bases in particular:

• Consent (Art. 6(1)(a) GDPR), e.g., analytics and external media

• Contract / pre-contractual measures (Art. 6(1)(b) GDPR), e.g., service enquiries

• Legitimate interests (Art. 6(1)(f) GDPR), e.g., secure operation, troubleshooting, and preventing abuse

Under Swiss law (revised FADP), we rely on the applicable statutory bases and principles (lawfulness, purpose limitation, proportionality, transparency, data security).

4. Data collected when you visit the website

Server log files

When you visit our website, the hosting provider automatically collects and stores information in server log files, such as:

• IP address (possibly truncated depending on system settings)

• date and time of the request

• requested page/file

• referrer URL

• browser type/version and operating system

• hostname of the accessing device

Purpose: technical delivery, security, stability, error analysis, and defence against attacks.
Retention: log data is stored only as long as necessary for these purposes and is then deleted or anonymised where possible.

5. Cookies and consent management

Our website may use cookies and similar technologies. Some are technically necessary, while others are used for statistics/analytics or for loading external media.

Consent for analytics and external media

Google Analytics 4 as well as certain embedded third-party content (e.g., Google Maps, YouTube, Instagram feed) are activated only with your consent (e.g., via a consent tool / cookie settings).

You can change or withdraw your consent at any time via the Cookie Settings link/button on the website.

If you do not provide consent, analytics will not run and certain external content may not be displayed (or will only load after manual activation via a two-click solution).

6. Contacting us

Contact form

If you send us enquiries via a contact form, we process the information you provide (e.g., name, email address, message) to handle your enquiry and follow-up questions.

Legal basis: contract/pre-contractual measures (where relevant) or legitimate interests (efficient handling of enquiries).
Retention: until your enquiry has been fully processed, unless statutory retention obligations apply.

Email or phone enquiries

If you contact us by email or phone, we process your data to handle the request. Retention and legal bases correspond to the contact form section.

7. Web analytics: Google Analytics 4 (GA4)

We use Google Analytics 4 to analyse website usage and improve our content. GA4 is activated only after you have given consent (see Section 5).

Provider

Google services are generally provided by Google Ireland Limited (Ireland). Depending on configuration, processing by affiliated Google entities (including in the United States) cannot be ruled out.

Data processed (examples)

• usage and interaction data (e.g., page views, events)

• technical data (browser, device, operating system)

• approximate location region (derived from IP, depending on settings)

• identifiers/cookies, where enabled

Google Tag Manager (if used)

If we use Google Tag Manager, it serves to manage website tags. Tag Manager itself does not (to our knowledge) create user profiles, but it may process technical data and trigger tags. Where required, tags are triggered only after consent via the cookie settings.

Retention / settings

Analytics retention depends on the retention settings configured in GA4 (e.g., “data retention”). We configure these in line with data minimisation and purpose limitation principles.

8. Third-party content (Google Maps, YouTube, Instagram feed)

Our website may embed third-party content. Once activated, this typically requires your IP address to be transmitted to the third-party provider to deliver the content.

Google Maps

We use Google Maps to display map material and help users find locations. Maps are loaded only after your consent/activation (cookie settings / two-click solution).

YouTube

We embed YouTube videos. When you play a video, a connection to YouTube/Google servers is established. Depending on integration, cookies or similar technologies may be used. YouTube content loads only after consent/activation.

Instagram feed

If we embed an Instagram feed, a connection to Meta/Instagram may be established when the feed loads. The feed is loaded only after consent/activation. Depending on implementation, we may also provide simple links without automatically loading external content.

9. International transfers (in particular to the United States)

When using certain providers (e.g., Google/Meta), transfers of personal data to third countries (such as the United States) cannot be ruled out.

Where transfers occur, they are carried out—depending on the provider and configuration—on the basis of:

• an adequacy decision (e.g., EU-US Data Privacy Framework, where the provider is certified), or

• appropriate safeguards (e.g., Standard Contractual Clauses), or

• your consent, where no other legal basis applies.

Please note that third countries may have a different level of data protection.

10. Your rights

Depending on applicable law (revised FADP / GDPR), you may have the following rights:

• access to your personal data

• rectification of inaccurate data

• erasure (where no statutory obligations or overriding interests apply)

• restriction of processing

• objection to certain processing (especially where based on legitimate interests)

• withdrawal of consent at any time with effect for the future

• data portability (where applicable under the GDPR)

To exercise your rights, please contact us using the details in Section 1.

Right to lodge a complaint

Where the GDPR applies, you have the right to lodge a complaint with a competent supervisory authority. In Switzerland, the competent authority is generally the Federal Data Protection and Information Commissioner (FDPIC).

11. Retention period

We store personal data only as long as necessary for the respective purposes or as required by statutory retention obligations. Data is then deleted or anonymised where possible.

12. Changes to this Privacy Policy

We may update this Privacy Policy if legal requirements, services or processing activities change. The version published on this website at the time is the applicable version.

1. Data protection at a glance

General information

The following information provides a simple overview of what happens to your personal data when you visit this website. Personal data are all data with which you can be personally identified. The data processing on this website is carried out by the website operator. You can find their contact details in the section “Note on the responsible body” in this data protection declaration.

On the one hand, your data is collected when you communicate it to us. This can be, for. E.g. data that you enter in a contact form.

Other data are recorded automatically or with your consent when you visit the website by our IT systems. This is mainly technical data (e.g. internet browser, operating system or time of the page view). This data is collected automatically as soon as you enter this website.

What do we use your data for?

Some of the data is collected in order to ensure that the website is error-free. Other data can be used to analyze your user behavior.

What rights do you have with regard to your data?

You have the right to receive information about the origin, recipient and purpose of your stored personal data free of charge at any time. You also have the right to request the correction or deletion of this data.

Analysis tools and third party tools

When you visit this website, your surfing behavior can be statistically evaluated. This is done primarily with so-called analysis programs.

Note on the responsible body

The responsible body for data processing on this website is: CC Cinnamon Circle GmbH

In Gassen 9

8001 Zurich Switzerland

Phone: +41 435 406 149

Email: joern@cinnamoncircle.com

Storage period

Unless a specific storage period is specified in this data protection declaration, your personal data will remain with us until the purpose for the data processing no longer applies.

Note on data transfer to the USA

Tools from companies based in the USA are integrated on our website. When these tools are active, your personal data can be passed on to the US servers of the respective companies. Revocation of your consent to data processing

Many data processing operations are only possible with your express consent. You can revoke your consent at any time. The legality of the data processing carried out before the revocation remains unaffected by the revocation.

In some cases, cookies from third-party companies can also be stored on your device when you enter our website (third-party cookies).