Privacy policy.
This English version is provided for convenience. Only the German version is legally binding.
This privacy policy explains which personal data we process when operating this website, for what purpose, who other than us gets to see it and what rights you have in this respect.
1. Controller
The controller responsible for the data processing described on this website is eyedentity gmbh, The Circle 60, 8058 Zurich, Switzerland (UID CHE-112.455.916).
‘Creative Nomads’ is a product and brand name of eyedentity gmbh and not a separate legal entity. The controller within the meaning of data protection law is therefore always eyedentity gmbh.
For questions about data protection and to exercise your rights, you can reach us at contact@creativenomads.ch or +41 43 399 05 61.
2. Scope
This policy applies to the website projects.creativenomads.ch and all its subpages — including the project and document pages of our clients that are not publicly linked. Linked third-party websites are subject to their own privacy policies.
3. Applicable law
We comply with the Swiss Federal Act on Data Protection (FADP). Where the EU General Data Protection Regulation (GDPR) applies to a processing activity, we also comply with its requirements. The legal bases cited in this policy refer to the GDPR; under Swiss law, no separate legal basis is required for the processing described here.
4. What data we process
4.1 Server log data
Each time this website is accessed, our hosting provider collects technically necessary data: IP address, date and time of access, requested address, amount of data transferred, status message, previously visited page (referrer) and browser and device identifier (user agent).
The purpose is to deliver the website, ensure operational security, troubleshoot errors and prevent misuse. The legal basis is our legitimate interest in secure and functioning operation (Art. 6(1)(f) GDPR). We do not analyse this data on a personal basis and do not combine it with other data.
4.2 Booking an initial consultation
Via the ‘Initial consultation’ form, we collect the following details, all of which are mandatory:
- First name and surname
- Company
- Email address
- Phone number
- Your brief description of the issue
- The appointment you have chosen
We use these details to reserve the appointment, send you a confirmation with a calendar file, call you at the agreed time and prepare for the conversation. The legal basis is the performance of pre-contractual measures at your request (Art. 6(1)(b) GDPR). Without these details, we cannot reserve the appointment.
The booking is stored in our content management system (section 6); the confirmation and our internal notification are sent via our email service provider. In addition, the appointments appear in an internal calendar subscription that only we can access via a secret address.
4.3 Project pages and package bookings
For ongoing client projects, we operate individual project pages. They can only be accessed via a link that cannot be guessed, are not listed publicly anywhere and are blocked for search engines. They contain the name, email address and phone number of the contact persons on the client side and of our own people, so that they appear on the page and in correspondence.
For each client there is also an overview page listing all of that client's project pages. It can likewise only be accessed via its link or the client login (section 4.4), is not listed publicly and is blocked for search engines.
If a package is booked bindingly on a project page, we record the time of booking and send a confirmation to the stored contact address as well as an internal notification. The legal basis is the initiation and performance of the contract and our legitimate interest in transparent project handling (Art. 6(1)(b) and (f) GDPR).
4.4 Client login
Via ‘Client login’, clients can sign in with their email address and client number to reach the overview of their projects. Both details are transmitted to our server and compared there with the client's contact address stored in the content management system. If they match, we forward you to the overview page; otherwise an error message is shown.
The details entered are used only for this comparison; they are neither stored nor logged and are not passed on. The login sets no cookies and stores nothing in your browser. The legal basis is the performance of our contract with you or our legitimate interest in offering clients easy access to their project pages (Art. 6(1)(b) and (f) GDPR).
4.5 Contacting us
If you contact us by email or phone, we process your details in order to respond to your enquiry (Art. 6(1)(b) or (f) GDPR).
5. Cookies, tracking and audience measurement
This website does not set any cookies of its own. We do not use advertising technologies, do not track you across other websites, do not create usage profiles and do not store anything in your browser's local storage. A cookie banner is therefore not required.
5.1 Audience measurement with Plausible Analytics
To understand how our public pages are used, we measure their reach with Plausible Analytics. Plausible works without cookies and without any other identifiers in the browser. It records the page visited, the previously visited page (referrer), browser, operating system and device type, as well as the country and region the visit comes from. We also count individual actions: tapping a button for the initial consultation, a successful booking, viewing a reference and tapping a phone number. Details from the booking form are not passed on to Plausible.
To recognise repeat visits on the same day, Plausible creates a hash from the IP address and browser identifier together with a random value that changes daily. The random value is deleted every 24 hours; the IP address and full browser identifier are not stored. The data is only analysed in aggregated form; no conclusions can be drawn about individuals.
The measurement script and measurement requests run via our own domain and are forwarded from there to Plausible. We do not measure our clients' confidential project pages and client overviews, nor are any details from the client login passed on to Plausible.
The legal basis is our legitimate interest in a data-minimising analysis of how our website is used (Art. 6(1)(f) GDPR). If you do not want to be counted, you can block the measurement script with a content blocker in your browser; the website will continue to work as usual.
5.2 Fonts and embedded content
We serve the website's fonts ourselves; no data is transmitted to third parties for this when a page is loaded.
One exception concerns embedded films: the background film on the home page and the films in individual references. The provider may set its own cookies or similar identifiers within the embedded player. We embed the player in its privacy-friendly mode (‘Do Not Track’), which does without tracking cookies.
6. Service providers and recipients
We use carefully selected service providers who process personal data on our behalf and according to our instructions. Corresponding data processing agreements are in place with them.
- Vercel Inc., USA — hosting and delivery of the website. Delivery takes place via data centres in the European Union (Frankfurt); this is where the server log data under section 4.1 arises and where the login under section 4.4 is checked.
- Sanity AS, Norway (with a group company in the USA) — content management system and delivery of images. The content is stored in the European Union and made available via a worldwide delivery network. This is also where the bookings under sections 4.2 and 4.3 are stored, as well as the contact addresses against which the client login (section 4.4) checks.
- Twilio Inc. / SendGrid, USA — sending our confirmation and notification emails. The recipient address and the content of the respective message are transmitted.
- Plausible Insights OÜ, Estonia — audience measurement under section 5.1. The data is processed and stored in the European Union on servers in Germany; the measurement requests reach it via our own domain.
- Vimeo Inc., USA — delivery of the background film on the home page and of the films in the references. When the player loads, your IP address is transmitted to Vimeo.
- Google Ireland Limited / Google LLC — only on individual project pages with a design guide: if a Google Fonts typeface is used there for preview purposes, it is loaded when the page is opened and your IP address is transmitted to Google. The public website makes no requests to Google.
Beyond this, we only disclose personal data if we are legally obliged to do so or if it is necessary to protect our rights. We do not sell personal data or pass it on for advertising purposes.
7. Disclosure abroad
As listed under section 6, personal data is also processed outside Switzerland — in particular in countries of the European Economic Area and in the United States. Where a country does not offer an adequate level of data protection, we base the disclosure on recognised safeguards: the European Commission's standard contractual clauses in the version recognised by the FDPIC, or the recipient's certification under the Swiss-U.S. Data Privacy Framework. You can request a copy of these safeguards from us.
8. How long we keep data
We keep personal data for as long as is necessary for the respective purpose:
- Server log data: briefly with the hosting provider, usually a few days to weeks.
- Audience measurement: the daily random value used for counting is deleted after 24 hours; the statistics themselves only contain aggregated values without any personal reference.
- Details entered in the client login: are not stored; they are only used for the comparison at the moment of signing in.
- Enquiries and consultation bookings not followed by a collaboration: 12 months from the appointment, after which we delete them.
- Data from client relationships: for the duration of the collaboration and thereafter for as long as statutory retention obligations apply — for business records, in particular ten years under Art. 958f of the Swiss Code of Obligations.
9. Data security
The website is delivered exclusively in encrypted form (TLS/HTTPS, with HSTS). Project pages can only be accessed via addresses that cannot be guessed and are blocked for search engines. Access to the content management system is personal and password-protected. However, no one can guarantee absolute security of transmission over the internet.
10. Your rights
Within the scope of applicable law, you have the right to:
- request information about the personal data we process
- have inaccurate data corrected
- request the deletion of your data
- request the release or transfer of your data in a common format
- object to processing or request its restriction
- withdraw any consent given at any time with effect for the future
To do so, please contact contact@creativenomads.ch. To process your request, we need to verify your identity. Exercising these rights is generally free of charge.
You also have the right to lodge a complaint with a supervisory authority: in Switzerland with the Federal Data Protection and Information Commissioner (edoeb.admin.ch), and in the European Economic Area with the data protection authority responsible for you.
11. No automated decision-making
We do not make any decisions based solely on automated processing that have legal effects on you or significantly affect you. We do not carry out profiling.
12. Changes
We adapt this privacy policy when our website or the legal situation changes. The version published on this page at any given time applies.
Last updated: 16 September 2026