Privacy policy

Controller

The controller is Edouard Nordmann.

Postal address: Chemin du Musée 4, 1700 Fribourg, Suisse

For any question about your data or to exercise your rights: support@carbonlab.ch.

Two distinct roles

For visit, account and login data, CarbonLab is the controller: it alone decides why and how the data is processed.

For the data a client enters in the platform (inventories, factors, actions, settings), CarbonLab acts as a processor within the meaning of Article 9 FADP: it processes the data on the client’s behalf and according to its instructions, and the client remains responsible for it.

Data processed and purposes

Visiting the website and the platform

For every request, the server records the IP address, the date and time, the address of the page requested, the response code, the processing time and the browser identification (user agent). If you are logged in, your username is added. Purposes: running the service, protecting it against abuse and diagnosing faults.

To prevent the emission factor database from being scraped, the number of requests per second is limited on certain programming interface addresses, counted per IP address. This count is kept in memory only: it is never written to disk and disappears when the server restarts.

Accounts and logins

Access to the platform is provided by CarbonLab; there is no open sign-up. For each successful login, the server records the username and access code used, the IP address, the browser identification and the time. Purposes: securing access and knowing which accesses are in use.

Clients’ inventory data

Consumption, purchasing, travel, emission factors, actions and settings entered by the client, including any names of people they contain. Purpose: providing the service to the client, on its behalf.

Messages

If you write to support@carbonlab.ch, we use your address and the content of your message to reply to you.

No profiling, no automated individual decisions, no advertising, and no selling or renting of data.

Cookies

The website uses no advertising or audience measurement cookies. It sets at most two cookies, both needed for what you ask it to do:

• session: set only when you log in. It holds your username and login status, signed by the server to prevent tampering. Page scripts cannot read it (HttpOnly) and it is not sent with requests coming from other websites (SameSite=Lax). It expires 14 days after your last visit, or as soon as you log out. It is only sent over a secure connection (Secure).
• cl_langue: set only if you choose a language with the language selector. It remembers that choice (fr, de, it or en) for one year and contains nothing else.

The light or dark display preference chosen with the button in the header is not a cookie: it is stored only in your browser (local storage, entry cl_theme) and is never sent to the server. It holds nothing but that choice and disappears when you clear the site’s data in your browser.

The pages load nothing from third parties: fonts, icons, styles and scripts are served by CarbonLab’s server in Switzerland. Your browser therefore contacts no other service when you use the website or the platform, unless you follow a link to another website.

Recipients and processors

Hosting: Infomaniak Network SA, Geneva, on servers located in Switzerland. Infomaniak acts as CarbonLab’s processor.

No other provider has access to the platform’s data.

Searching the medical device database queries the public MedZero database from our server: only the search term and the selected product are sent to it, never your IP address or any data from your account.

Data is disclosed to an authority only where the law requires it.

Disclosure abroad

The personal data processed by the website and the platform stays in Switzerland: it is not disclosed to any other country.

Retention

• Request and login logs: deleted automatically after 365 days.
• Session cookie: at most 14 days after the last visit. Language cookie: one year.
• Inventory data: for the term of the contract, then returned to the client or deleted, at its request.
• Messages: for as long as needed to handle the request and any resulting relationship.

Security

The measures in place today:

• access to the platform restricted to accounts provided by CarbonLab; without logging in, the application and its programming interface return no data;
• a signed session cookie, unreadable by scripts and restricted to the site;
• a per-IP limit on the number of requests to the emission factor database;
• help videos and images, which show demonstration data, available only to logged-in users;
• a server located in Switzerland, and no third-party resources loaded by the pages.

Your rights

You can request access to your data (Art. 25 FADP), its correction or deletion (Art. 32 FADP) or its delivery in a common electronic format (Art. 28 FADP), and you can object to processing. Write to support@carbonlab.ch: we reply within 30 days, as a rule free of charge, and may ask for proof of identity if in doubt.

If your request concerns data entered by a CarbonLab client, for example in its inventory, we forward it to that client, which is responsible for it, and help it respond.

You can also contact the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, www.edoeb.admin.ch.

Changes

This policy follows how the service actually works: it is updated whenever that changes, and the date of the last update appears at the top of the page.