Privacy notice

Last updated: 22 October 2026

This notice informs you, in accordance with Article 19 of the Swiss Federal Act on Data Protection (FADP; Datenschutzgesetz, DSG), how Dr. Bach AG processes personal data when you use this website, contact us or instruct us with a mandate.

1. Controller

The controller is:

Dr. Bach AG
Global Compliance Assistance
Oberstrasse 288
CH-9014 St. Gallen
Switzerland

Phone: +41 (0)71 280 09 76
Email: kontakt@dr-bach.ch
UID: CHE-114.928.848

2. Scope

This notice applies to the website dr-bach.ch, to messages by email and telephone, and to personal data that we process in connection with enquiries and consulting mandates.

We process personal data of natural persons. We process information about companies where it relates to identifiable persons, in particular contact persons.

3. Visiting the website

When you open the website, technically necessary connection data are generated. They include the IP address, date and time, the page requested, the volume of data transferred, the status of the request, the previously visited page, and information about the browser and operating system.

The server needs these data to deliver the page, to keep it stable and to detect misuse. The legal basis is our overriding interest in operating a functioning and secure website (Article 31 FADP).

The website does not set cookies. No analytics, advertising or social-media services are embedded. Fonts and scripts are loaded from our own server.

We delete or anonymise log data as a rule within three months at the latest. We keep them longer only where this is necessary to prevent or investigate a specific case of misuse.

4. Contact by email and telephone

If you write to us or call us, we process the information you provide. This usually includes your name, company, telephone number, email address and the content of your message.

We use these data to answer your enquiry and to prepare a possible collaboration. The legal basis is our overriding interest in this correspondence and, once a contract is concerned, the direct connection with its conclusion or performance (Article 31 FADP).

An enquiry is voluntary. Without the contact details needed for a reply, we cannot respond. We store emails on our mail server. Unencrypted emails can be read by third parties in transit. On request, we receive confidential mandate documents by a channel agreed in advance.

We delete enquiries that do not lead to a contract once the correspondence is closed, as a rule within 24 months at the latest, unless a statutory duty requires longer retention.

5. Mandates

In a consulting mandate we process the data needed to carry it out. They include contact details of the persons involved, contract and invoicing data, and content that the client provides to us.

We base this processing on the contract and on our overriding interest in performing the mandate (Article 31 FADP). We process personal data of employees or other persons that a client provides to us for this purpose. Where consent is required, we obtain it, or we rely on the client being entitled to provide the data.

We do not collect sensitive personal data, such as health data, through this website. In a mandate we process such data only where the assignment requires it and a justification under Article 31 FADP exists.

We retain business records and accounting documents for the statutory period of ten years (Article 958f of the Swiss Code of Obligations).

6. Disclosure

We do not sell personal data and we do not disclose them for advertising. Recipients may include:

Contabo GmbH, Munich, as a processor for hosting and email; it processes the data only on our instructions (Article 9 FADP);

authorities and courts where we are legally obliged to disclose data;

fiduciaries, legal advisers and comparable professional advisers, where we involve them in our own business;

cooperation partners only where this is necessary for a mandate and the data subject has been informed or another justification exists.

7. Disclosure abroad

The website and the email address are operated on servers of Contabo GmbH in the European Union. Germany and, where individual network data locate the server address in France, France as well provide an adequate level of data protection (Article 16 paragraph 1 FADP, Annex 1 to the Data Protection Ordinance).

Disclosure to other states is not intended for the operation of this website. If a mandate exceptionally requires disclosure to a state without an adequate level of protection, we inform you beforehand. We base such disclosure on appropriate safeguards under Article 16 paragraph 2 FADP or on an exception under Article 17 FADP.

8. Your rights

You may request access to the personal data processed about you (Article 25 FADP).

You may request that your data be surrendered or transferred where we process them by automated means and you have consented, or where the processing is directly connected with a contract (Article 28 FADP).

You may request that inaccurate data be corrected (Article 32 paragraph 1 FADP). In the case of unlawful processing, you may request that we refrain from the processing, refrain from a disclosure, or delete the data, unless a statutory retention duty applies (Article 32 paragraph 2 FADP in conjunction with Articles 28 et seq. of the Swiss Civil Code). If neither accuracy nor inaccuracy can be established, you may request that a note of the dispute be added (Article 32 paragraph 3 FADP).

You may withdraw consent at any time with effect for the future. Withdrawal does not affect processing already carried out. We do not rely on consent for the operation of the website.

Please send your request to kontakt@dr-bach.ch. We may ask you to confirm that you are the data subject. Access is provided as a rule within 30 days.

You may also contact the Federal Data Protection and Information Commissioner (FDPIC): Feldeggweg 1, 3003 Bern, www.edoeb.admin.ch.

9. No automated individual decisions

We do not take decisions based solely on automated processing that produce a legal effect concerning you or significantly affect you (Article 21 FADP). We do not carry out profiling.

10. Links

On the partners page we link to third-party websites, in particular Pitzek GMP Consulting and Inspection Ready. Your browser connects to the other website only when you open such a link. The respective operators are responsible for their content and for their processing of personal data.

11. Data security

We take appropriate technical and organisational measures to protect personal data against unauthorised processing (Article 8 FADP). These include access restrictions on servers and mailboxes. We cannot guarantee absolute security of transmission over the internet.

12. Persons in the EU and the EEA

Where the General Data Protection Regulation (GDPR) applies to a processing activity, its requirements apply in addition. The legal bases are then in particular Article 6 paragraph 1 point (b) (contract and pre-contractual steps), point (c) (legal obligation) and point (f) (legitimate interests in the secure operation of the website and in answering enquiries).

Data subjects may object to processing based on legitimate interests (Article 21 GDPR). They also have the rights of access, rectification, erasure, restriction, data portability and the right to lodge a complaint with a supervisory authority.

We have not appointed a representative in the Union under Article 27 GDPR for the operation of this website, because this processing is occasional and does not present a high risk. Please send requests to the address in Switzerland stated above.

13. Changes

We update this notice when the processing or the law changes. The version with the date above is the applicable one. Further details about the company are in the imprint. If the German and English versions differ, the German version prevails.