Privacy

Controller

The controller is Nuca Trading GmbH, which operates ClearSource (see the imprint). For data-protection requests, write to us through the contact form and choose the topic “Privacy request”.

What is processed when you visit

Our hosting and security provider delivers the site. Its logs for that delivery can include your IP address, browser (user agent), referrer and the page requested.

ClearSource sets no analytics cookies. From the requests it delivers, our hosting provider compiles aggregate statistics for us, such as the number of visits, the pages requested, countries and device types. They are not linked to a person and are not used to build a profile. ClearSource’s own statistics of page views and clicks are described in the next section. Fonts, logos and images are served from this site.

Aggregate statistics and partner links

ClearSource records on its own server how the site is used: which pages are viewed; which marked buttons and links are clicked (for example an IT partner’s website, phone or email link, a comparison, the change-log feed, the licence modeller’s buttons) and, for a link to another website, only that website’s host name (such as example.ch); what is searched for with the site search; and a small fixed set of events (opening and exporting the licence modeller, viewing a comparison or an IT-partner profile, switching language). For the first page you open, the website you came from is recorded by its host name only (such as google.com or chatgpt.com), never the address of the page you were on. Search queries are stored normalised (lower case, at most 60 characters); a query that contains an @ sign or more than six digits is not recorded at all. Text you enter in forms and seat counts are never recorded.

Each record holds only the page, the day, the language and the item above. No IP address, no browser details (user agent), no cookie and no identifier are stored with it, and nothing is stored on your device, so records cannot be linked to each other or to a person: they are statistics that do not relate to any person (Art. 31 para. 2 let. e FADP). The request that reports an event is delivered like any page request (see “What is processed when you visit”); its IP address is used only briefly, in memory, to limit the number of requests per minute. If your browser sends Global Privacy Control or Do Not Track, page views, clicks and searches are not recorded.

The single records are stored with our hosting provider (see “Service providers and other countries”) and deleted after three months; daily totals of the fixed events are kept in ClearSource’s database in Zurich. They show which parts of the site are used, what people look for and how many visits IT partners receive from it. Reports to IT partners contain only totals, and figures below 5 are not shown.

If the address of the page you arrive on contains campaign tags (utm_source, utm_medium, utm_campaign, utm_content, utm_term), for example from a newsletter or an advertisement, source, medium and campaign are recorded too. These tags name a campaign, not a person.

Links to IT partners’ websites go through ClearSource’s own address clearsource.ch/go/…, which counts the click in the same aggregate way and then forwards you to the partner’s website. The partner receives only the address of this site (https://clearsource.ch/, not the page you were on) as the referring page, plus the tags utm_source=clearsource, utm_medium=referral and a utm_campaign that names where the link was placed. No other information about you is passed to the partner.

Licence modeller

The licences you pick are calculated in your browser and kept in the page address (the “?m=…” part), so a link can be shared or reopened. Your current model and any scenarios you save are also kept in your browser’s local storage on your device. ClearSource doesn’t receive or store your selection.

Contact form

The contact form asks for your name, company, business email, a topic and your message, and optionally a phone number. ClearSource uses these details only to answer you; they are never passed to IT partners. Legal basis: your request and your consent, which you give with the checkbox.

Double opt-in: after you send the form, we email you a link, and your message reaches us only after you confirm it. Until then it is stored in our database in Switzerland. The confirmation email is sent by our email service in the European Union; the confirmed message is delivered to our mailbox, hosted in Switzerland.

Protection against spam: the form runs automatic checks against spam and bots, such as a limit on how often one IP address can send and a check that your email domain can receive email (only the domain is looked up, never your full address). If a security check is shown, our hosting and security provider processes technical data of your browser (such as IP address and browser type) to detect bots, on our behalf and, to improve its bot detection, as an independent controller; it never reads what you enter.

Retention: the confirmation link is valid for 24 hours, and a message that is not confirmed is deleted after 7 days at the latest. A confirmed message is removed from the database once delivered and kept in our mailbox as long as needed to deal with your request. Our email log keeps only a one-way hash of your address, never the address.

Cookies and local storage

There is no cookie banner because there are no analytics or advertising cookies. When you choose another language in the “Language” menu, a technical session cookie remembers that language until you close your browser. Your light or dark theme, your licence model and the IT-partner directory’s view settings and comparison list are kept in your browser’s local storage on your device. None of this is used to build a profile.

You can block or delete cookies and local storage in your browser settings. The site still works without them, but your language and theme choice, your licence model, your saved scenarios and your comparison list are then not remembered, and signing in is not possible.

IT partner directory

The directory shows public information about companies, with the public sources they come from. It contains no records about you as a visitor.

If you tick IT partners to compare them, the list (at most four) and your view settings stay in your browser’s local storage and are not sent to ClearSource. The comparison page lists the chosen IT partners in its address, so you can share it.

Data about IT partners and their contact persons

The IT-partner directory is about companies, but some of its data can relate to people: the name of a sole proprietorship, the names of owners or managers in the commercial register, and the names, roles, business email addresses and phone numbers of contact persons that a company publishes or adds to its own page. ClearSource takes this data from public sources: the Swiss commercial register (Zefix), Microsoft’s partner directory and the company’s own website; a partner that claims its listing can add to it in the partner portal. Each entry shows its sources.

The purpose is to show visitors which IT partners sell Microsoft licences in Switzerland and how to reach them. The directory pages are public: search engines and AI services can read them, show them in their answers and use them to train AI models (see the terms of use).

If you are named in the directory, you can object to the processing of your data or ask for it to be corrected or deleted at any time: write to us through the contact form with the topic “Data correction” or “Privacy request”. We then check the entry and correct or remove your data; only data that comes from the company’s entry in the commercial register and is needed to identify the company stays, as long as the register shows it.

Requests for offers

If you ask for offers through the “Get quotes” form, ClearSource processes the details you enter: your company’s name, canton, size and industry (optional), your name, role (optional), business email, phone (optional) and preferred language, the licences and seats you chose, your situation and when you need the licences, the contract duration, payment frequency and whether some licences are on a monthly term, any comment you add, and whether you picked the IT partners yourself or let ClearSource match you. The purpose is to pass your request to the IT partners shown in the form (those you chose, or the participating IT partners that fit it) and to follow up on it.

Legal basis: your consent, which you give with the checkbox and confirm with the link in our email (double opt-in), and the steps you request before a contract with an IT partner. Until you confirm, nothing is passed on. You can withdraw your consent at any time with effect for the future.

Recipients: the IT partners you chose, or the participating IT partners that ClearSource matched by canton, language and products (all of them, or up to 3, as the form shows before you send); your confirmation email names them. Participating IT partners are those whose claim to their listing ClearSource approved and that accepted ClearSource’s partner terms and lead data-sharing terms. The matching is automatic and follows these fixed rules; it is not an automated individual decision about you (Art. 21 FADP). They first see only your canton, company size, situation and timing, contract terms, licences and seats; your company name, contact details and comment only once they accept. They process your details as independent controllers under their own privacy notices. IT partners pay ClearSource a fee when they accept a request; payment never affects which partners are selected.

While no IT partner takes part for your preferred language yet, your request goes to ClearSource only, and the form says so before you send it. ClearSource then contacts you and passes your details to an IT partner only with your agreement in each case; that partner then processes them as an independent controller.

Processors: our hosting, database (Switzerland) and email providers (see “Service providers and other countries”). If a security check is shown on the form, our hosting and security provider processes technical data of your browser (such as IP address and browser type) to detect bots, on our behalf and, to improve its bot detection, as an independent controller; it never reads what you enter. Our email log keeps only a one-way hash of the recipient address, never the address.

Retention: requests that are not confirmed within 7 days expire and are never passed on. Your details are anonymised 12 months after the request; what the IT partners keep is governed by their own privacy notices.

Your rights: you can ask which data ClearSource holds about you, have it corrected or deleted, withdraw your consent, and report a suspected breach of data protection to the Federal Data Protection and Information Commissioner (FDPIC). After 7 days we ask you once by email whether you received offers; your answer is used only to check the quality of the service.

Accounts for IT partners and administrators

Anyone can create an account with an email address and a password; ClearSource’s administrators and the staff of IT partners that use the partner portal sign in with one. For each account ClearSource processes the email address, the password (stored only as a salted hash), the second sign-in step if one is set up, the partner and role the account belongs to, and when it signed in. The purpose is to give access to the admin area and the partner portal and to keep that access secure. Legal basis: the contract with the IT partner, the steps you ask for before one, and ClearSource’s legitimate interest in secure access.

Creating an account: the address is confirmed with a link sent to it; the account can be used only after that. To link an account to a company, its holder claims the company’s listing or requests a new one, with their name, role (optional), phone number, an optional message and, for a new listing, the company’s name, website, canton and company number (optional). ClearSource uses these details only to check and decide on the request, may call the number given, and does not publish them.

Processors: our hosting provider, our sign-in and database provider (data stored in Switzerland) and our email service (European Union); see “Service providers and other countries”. Confirmation links, invitations, sign-in links and password-reset emails are sent through our email service.

Sign-in with Microsoft: if you choose it, Microsoft learns that you are signing in to ClearSource and passes us your email address and, where it has it, your name; ClearSource never receives your Microsoft password. Microsoft acts as an independent controller under its own privacy notice and processes data in the USA, among other countries.

Signing in sets technical cookies that are strictly necessary for the sign-in you asked for and are not used for tracking: session cookies keep you signed in until you sign out, for at most 400 days, and, only while a sign-in with Microsoft is under way, a cookie remembers the chosen service for at most 10 minutes. Visitors who do not sign in receive none of them.

Feedback: signed-in users can send feedback from the portal, with one picture if they wish. We store the topic, the message, the page it is about, the account it came from and the picture, with its metadata (such as a location) removed, with our sign-in and database provider in Switzerland. Only ClearSource’s administrators read it, to fix mistakes and improve the site. Feedback and pictures are deleted after 24 months, or when the account is deleted.

Deleting the account: you can delete your account yourself at any time under “Account and security”, after confirming with your password (and your second sign-in step if one is set up). The account, its company memberships and its open requests are deleted at once. If you were the last owner of a company, its entry goes back to an unclaimed public listing, and a running subscription ends with the period already paid.

Retention: account data are kept while the account exists and deleted when it is removed. The audit log, which records who changed what in the admin area and the portal, keeps the administrator’s email address or, for portal users, only the account’s internal number. Audit-log entries are deleted after 24 months.

Service providers and other countries

ClearSource uses service providers as processors: for hosting, security and the aggregate statistics (provider in the USA, with data centres worldwide; each request is usually served from the one nearest you, which can be in Switzerland, the European Union or another country), for its database (data stored in Switzerland; provider based in the USA), for sending email (European Union) and for its mailbox (Switzerland). As processors they act on our behalf and under a data-processing contract; where a provider also acts as an independent controller, this page says so.

Switzerland recognises the states of the European Union as providing adequate data protection. Where data can be accessed from or transferred to the USA or another country without such recognition, it is protected by the provider’s certification under the Swiss-U.S. Data Privacy Framework or by the standard contractual clauses recognised by Switzerland. When our hosting and security provider shows a browser or security check, it also uses technical data of your browser as an independent controller to improve its bot detection.

On request, we tell you which providers process your data and where.

Protection against overload and copying

To keep the site available and protect its content from automated copying, our security provider checks requests to the site on our behalf (IP address, browser and page requested), limits very frequent requests and filters attacks. Verified search-engine and AI crawlers are not counted towards this limit. If a browser check is shown, a technical cookie records that it was passed.

This serves the security of the site, an overriding interest under the FADP. It is not combined with the aggregate statistics and is not used to build a profile. Request counts expire after a few seconds; the site’s own security logs (IP address, browser and request) are kept for at most seven days.

Retention

Our hosting provider keeps its logs for a short period as part of operating its network; the site’s own logs are deleted after at most seven days, and request counts expire on their own. Contact-form messages are kept as described under “Contact form”.

Requests by automated visitors, such as search-engine and AI crawlers, are recorded by the name their software gives (for example Googlebot or GPTBot), with the address requested, the response status and the day, without an IP address, and kept for three months.

Sale of data

Personal data is not sold.

Your rights

Under the Swiss Federal Act on Data Protection (FADP) you can ask for information about your data (Art. 25), have it corrected or deleted, receive data you gave us in a common electronic format or have it passed to another controller (Art. 28), and object to its processing (Art. 30 para. 2 let. b). Write to us through the contact form with the topic “Privacy request”; we answer within 30 days. You can also report a suspected breach of data protection to the Federal Data Protection and Information Commissioner (FDPIC) and bring a claim before the courts (Art. 32).