Privacy Policy

LEAN FS

Lean Financial Solutions GmbH

Meret Oppenheim-Platz 1

4053 Basel, Switzerland

Commercial Register: CHE-246.886.717 (Canton of Basel-Stadt). VAT-No.: CHE-246.886.717 MWST.

We have appointed an internal contact for all data protection matters. This single channel handles every request from data subjects — including access (Art. 25 revFADP / Art. 15 GDPR), rectification (Art. 32 revFADP / Art. 16 GDPR), erasure (Art. 32 revFADP / Art. 17 GDPR), restriction (Art. 18 GDPR), objection (Art. 30 revFADP / Art. 21 GDPR), data portability (Art. 20 GDPR) and withdrawal of consent.

Contact: dpSPAMoleaREMOVEn-fschCopied. We respond to requests within one month, as required by Art. 12(3) GDPR and Art. 19 revFADP.

The table below lists the cookies and browser-storage entries we set, grouped by purpose. Names containing a wildcard (e.g. `_ga_<id>`) represent a family of entries.

This website uses Google Analytics 4 (provided by Google Ireland Limited, with infrastructure operated by Google LLC in the United States) to analyse the use of our website. Google Analytics uses cookies and similar technologies that enable an evaluation of how you use the website. According to Google, Google Analytics 4 does not permanently store or log IP addresses and IP-anonymisation (`anonymize_ip`) is enabled. We have configured the maximum data-retention period of 14 months for event-level data in our Google Analytics property.

Where consent is required, processing is based on your consent (Art. 6(1)(a) GDPR / Art. 6 revFADP). The identifiers generated by Google Analytics (e.g. `_ga` client_id) are pseudonymous and, on their own, do not allow us to identify you (Art. 11 GDPR). You can withdraw your consent at any time via the cookie settings.

Depending on your location, Google Analytics is loaded through Google Consent Mode v2. For visitors in the EU, the EEA and the United Kingdom we apply the "Basic" configuration: no Google Analytics request is sent before you make a consent choice. For visitors elsewhere, including Switzerland, we apply the "Advanced" configuration: even before you choose, Google Analytics may send minimal, cookieless signals to Google that are used solely for aggregate, statistical modelling. These signals set no cookies, store no Analytics identifier (such as the `_ga` client_id) and are not used to recognise or profile you; full, identified measurement only begins once you consent, and declining or withdrawing consent prevents it. Insofar as these aggregate signals constitute personal data, we rely on our legitimate interest in measuring the use of our website (Art. 6(1)(f) GDPR / Art. 6 revFADP).

Transfers of personal data to the United States are governed by Google's Standard Contractual Clauses (SCC, EU Commission Decision 2021/914) and additional safeguards documented by Google. Switzerland-specific adequacy is covered by the Swiss FDPIC adequacy recognition of the EU-U.S. Data Privacy Framework (Google LLC participating).

This website uses Microsoft Clarity (provided by Microsoft Corporation, Redmond, USA) to better understand how visitors use our website (for example through heatmaps and session recordings). Microsoft Clarity uses cookies and similar technologies to capture user interactions and to help us improve usability and content. Depending on the configuration, information generated in this context may be transmitted to and processed by Microsoft, including in the United States.

Microsoft Clarity is only used if you have given your consent via the cookie banner. You can adjust or withdraw your consent at any time via the cookie settings. Microsoft Clarity masks form inputs and other sensitive content by default; masked content is therefore not transmitted to Clarity. The identifiers generated by Clarity (e.g. `_clck` user_id) are pseudonymous and, on their own, do not allow us to identify you (Art. 11 GDPR).

When you contact us via our forms, we may include a deep-link to your Clarity session recording in our internal notification e-mail so our team can prepare your enquiry with full context. This processing is based on our legitimate interest (Art. 6(1)(f) GDPR / Art. 6 revFADP) in providing relevant, well-prepared responses.

We also calculate an anonymous interest score from your interactions, stored locally in your browser (`lfs_lead_score_v1` in localStorage) for up to 13 months. This score never leaves your browser unless you submit a form, and is cleared automatically when its retention period expires.

Transfers of personal data to the United States are governed by Microsoft's Standard Contractual Clauses (SCC) and the EU-U.S. Data Privacy Framework (Microsoft Corporation participating). Microsoft's Clarity API does not currently offer per-visitor deletion; because the data we hold via Clarity is pseudonymous within the meaning of Art. 11 GDPR, this is communicated transparently here.

If you arrive at our website via a personalised link from our outreach, the URL may contain a short identifier called `rid` that lets us attribute your visit to the specific outreach through which you reached us. We use this identifier purely for measurement and customer-relationship purposes — to understand which outreach is effective and to connect your visit, and (once you contact us) your enquiry, into a single record so we can prepare a relevant response and avoid double-counting. We do not use it to show you personalised advertising, and we never share it with advertising networks or data brokers.

The identifier is a short hash. On this website we store only the hash, the page URL, and a timestamp. We do not store any directly identifying data (such as your name or e-mail address) in connection with the identifier on this website. The mapping of the hash to a specific outreach context is held separately from this website, as part of our outreach operations.

Legal basis — two layers. (i) The client-side identifier is kept in your browser's session storage (only while the tab is open) on the basis of your consent, under the Analytics/Statistics category of our cookie banner; where you grant that consent it may be forwarded to our analytics provider (Google Analytics), and where you additionally grant marketing consent it may also be associated with your Microsoft Clarity session. (ii) Separately, we keep a server-side record of the click (the page URL, the rid value, and a timestamp) for as long as needed for our attribution window — currently up to 25 months — on the basis of our legitimate / overriding interest in measuring our outreach (Art. 6(1)(f) GDPR / Art. 31 revFADP). We do not capture your IP address for this purpose.

You can withdraw the analytics consent at any time via the "Cookie Settings" link in the footer, and you have the right to object to the legitimate-interest processing at any time, free of charge, by contacting us at dpSPAMoleaREMOVEn-fschCopied. A documented Legitimate Interest Assessment is available on request via the same channel.

You can request a copy of the personal data we process about you, together with information on the purpose, the categories of data, the recipients (or categories of recipients), the retention period, and the source of the data if it was not collected directly from you.

If the data we hold about you is inaccurate or incomplete, you may request correction or completion.

You may request the deletion of your personal data when it is no longer necessary, when you withdraw consent, or when our processing has no other valid legal basis. Statutory retention obligations (e.g., commercial-law book-keeping duties) may prevent immediate erasure; in such cases we will restrict processing instead.

You may request that processing of your personal data be restricted, e.g. while the accuracy of the data is being verified or while an objection (see below) is pending.

You may object at any time, for reasons relating to your particular situation, to processing based on our legitimate interests (including any profiling). Where your data is processed for direct-marketing purposes, you have an unconditional right to object, after which we will stop the corresponding processing.

For data you have provided to us and that we process on the basis of consent or a contract, you have the right to receive it in a structured, commonly used, machine-readable format, and to transmit it to another controller.

Where processing is based on consent, you may withdraw that consent at any time, without affecting the lawfulness of processing carried out before the withdrawal. Withdrawal of consent for cookies / tracking is possible at any time via the "Cookie Settings" link in the footer of every page.

You can lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC, edoeb.admin.ch) or, where applicable, with an EU supervisory authority in the member state of your habitual residence or place of work.

In close cooperation with our hosting providers, LEAN FS makes every effort to ensure the secure operation of the website and to protect the databases from unauthorized access, losses, misuse, or falsification as much as possible. Access to the website is therefore at your own risk and responsibility.

LEAN FS rejects any liability for damages or consequential damages resulting from access to its website or parts thereof (e.g., downloaded documents), their use, or links to other websites.

LEAN FS uses all its care to ensure that the information on the website is correct and up-to-date at the time of publication and does not violate the rights of third parties (especially personal rights). Nevertheless, LEAN FS cannot guarantee the accuracy, reliability, or completeness of the information.