Privacy Policy
Version from October 2, 2026
1. Content
Studio Nicotra GmbH (hereinafter also referred to as "Company", "we", "us") collects and processes personal data concerning you or other individuals (so-called "third parties"). In this privacy policy, we describe what we do with your data when you use www.studio-nicotra.com (hereinafter "Website"), obtain our services, are otherwise connected with us in the context of a contract, or communicate with us in any other way.
This explanation is not exhaustive. Where applicable, general terms and conditions, terms of participation, and similar documents may govern specific matters. Personal data is understood to mean any information relating to an identified or identifiable person.
If you provide us with personal data of third parties (e.g., family members, colleagues), please ensure that these individuals are aware of this privacy policy and only share their personal data with us if you are permitted to do so and if the data is accurate.
This privacy policy is designed to meet the requirements of the EU General Data Protection Regulation ("GDPR"), the Swiss Data Protection Act ("DPA"), and the revised Swiss Data Protection Act ("revDPA"). Whether and to what extent these laws apply depends on the individual case.
2. Data Controller
Studio Nicotra GmbH is responsible for data processing, unless stated otherwise in individual cases. If you have any data protection concerns, you can contact us as follows:
Studio Nicotra GmbH, Gutstrasse 145, CH-8055 Zurich, hello@studio-nicotra.com
3. Types of Personal Data
We primarily process the personal data that we receive from our clients and other business partners, as well as other individuals involved, in the context of our business relationship with them, or that we collect from users when operating our websites, apps, and other applications.
To the extent permitted, we also collect data from publicly accessible sources (e.g. debt enforcement registers, land registers, commercial registers, the press, the internet) or receive such data from authorities and other third parties.
In addition to the data we receive directly from you, the categories of personal data that we receive about you from third parties include, in particular, information from public registers, information learned in connection with administrative and judicial proceedings, information related to your professional functions and activities (so that we can, for example, conclude and process business transactions with your employer with your assistance), information about you in correspondence and meetings with third parties, credit reports (insofar as we conduct business with you personally), information about you provided to us by people close to you (family, advisors, legal representatives, etc.) so that we can conclude or process contracts with you or involving you (e.g., references, your address for deliveries, powers of attorney, information regarding compliance with legal requirements such as anti-money laundering and export restrictions, information from banks, insurance companies, sales and other contractual partners of ours regarding the use or provision of services by you (e.g., payments made, purchases made)), information from the media and internet about you (insofar as appropriate in the specific case, e.g., in the context of an application, press review, marketing/sales, etc.), your addresses and, where applicable, interests and other socio-demographic data (for marketing), and data related to the use of the website (e.g., IP address, MAC address of your smartphone or computer, details about your device and settings, cookies, date and time of the visit, accessed pages and content, features used, referring website, location details).
4. Purpose of Data Processing and Legal Bases
We primarily use the personal data we collect to conclude and process contracts with our clients and business partners, particularly in connection with providing services to our clients in the areas of architecture, interior design, lighting design, and product design, as well as business consulting regarding strategy and organization, and the purchase of products and services from our suppliers and subcontractors, as well as to comply with our legal obligations in Switzerland and abroad. If you work for such a client or business partner, your personal data may, of course, also be affected in this capacity.
In addition, where permitted and deemed appropriate by us, we also process personal data concerning you and other individuals for the following purposes, in which we (and sometimes third parties) have a legitimate interest corresponding to the purpose:
– Offering and further developing our products, services, websites, apps, and other platforms on which we are active;
– Communication with third parties and processing their inquiries (e.g., job applications, media inquiries);
– Reviewing and optimizing needs analysis procedures for the purpose of direct customer contact, as well as collecting personal data from publicly available sources for customer acquisition purposes;
– Advertising and marketing (including the organization of events), provided you have not objected to the use of your data (if we send you advertising as an existing customer, you can object to this at any time, and we will then place you on a blocklist to prevent further promotional mailings);
– Market and opinion research, media monitoring;
– Assertion of legal claims and defence in connection with legal disputes and official proceedings;
– Prevention and investigation of criminal offences and other misconduct (e.g. conducting internal investigations, data analysis for fraud prevention);
– Ensuring our operations, in particular our IT, websites, apps, and other platforms;
– Measures for IT, building, and facility security and the protection of our employees, other individuals, and assets belonging to or entrusted to us (such as access controls, visitor logs, network and email scanners, telephone recordings);
– Purchase and sale of business divisions, companies or parts of companies and other corporate transactions, and the associated transfer of personal data, as well as business management measures and, where applicable, for compliance with legal and regulatory obligations as well as internal regulations.
Insofar as you have given us consent to process your personal data for specific purposes (for example, when registering to receive newsletters or conducting a background check), we process your personal data within the scope of and based on this consent, unless we have another legal basis and require one. Any consent given can be revoked at any time, although this will not affect data processing that has already taken place.
5. Cookies, Tracking, and Other Technologies in Connection with the Use of Our Website
We typically use "cookies" and similar techniques on our websites, which can identify your browser or your device. A cookie is a small file that is sent to your computer or automatically stored on your computer or mobile device by your web browser when you visit our website. If you visit this website again, we can recognize you, even if we do not know who you are. In addition to cookies that are only used during a session and deleted after your website visit ("session cookies"), cookies can also be used to store user preferences and other information for a certain period of time (e.g., two years) ("permanent cookies"). However, you can configure your browser to reject cookies, store them only for one session, or otherwise delete them prematurely. Most browsers are pre-set to accept cookies. We use permanent cookies so that you can save user preferences (e.g., language, autologin), so that we can better understand how you use our services and content, and so that we can show you offers and advertisements tailored to you (which may also happen on websites of other companies; however, they will not learn from us who you are, if we even know that ourselves, because they will only see that the same user who visited a specific page on our site is also on their website). If you block cookies, certain features (such as language selection, contact processes) may no longer work.
In our newsletters and other marketing emails, we sometimes—and to the extent permitted—include visible and invisible image elements. By retrieving these from our servers, we can determine whether and when you opened the email, allowing us to measure and better understand how you use our offers and tailor them to your needs. You can block this in your email program; most are preset to do so.
By using our websites and consenting to receive newsletters and other marketing emails, you agree to the use of these technologies. If you do not want this, you must configure your browser or email program accordingly.
We use Google Analytics and/or comparable services on our websites. This is a service provided by third parties who may be located in any country in the world (in the case of Google Analytics, it is Google Ireland (based in Ireland); Google Ireland relies on Google LLC (based in the USA) as a data processor (both "Google"), www.google.com), with which we can measure and evaluate the use of the website (on a non-personal basis). Permanent cookies set by the service provider are also used for this purpose. Although we can assume that the information we share with Google does not constitute personal data for Google, it is possible that Google may draw conclusions about the identity of visitors from this data for its own purposes, create personal profiles, and link this data to the Google accounts of these individuals. If you have registered with the service provider yourself, the service provider will also know who you are. The processing of your personal data by the service provider is then the responsibility of the service provider in accordance with its data protection provisions. The service provider merely informs us how our respective website is used (no information about you personally).
We also use so-called plug-ins from social networks such as YouTube, LinkedIn or Instagram and programs such as Calendly on our websites. This is indicated to you in each case (typically via corresponding symbols). We have configured these elements so that they are deactivated by default. If you activate them (by clicking on them), the operators of the respective social networks can register that you are on our website and where you are, and can use this information for their purposes. The processing of your personal data is then the responsibility of this operator in accordance with its data protection provisions. We do not receive any information about you from them. We only load embedded YouTube videos when you click on "Play" (two-click solution), and do so in enhanced privacy mode via youtube-nocookie.com. Only with this click is data such as your IP address transmitted to YouTube or Google Ireland Limited and Google LLC (USA); cookies may be set in the process. For more information, please see Google's privacy policy (policies.google.com/privacy).
6. Data Disclosure and Transfer of Data Abroad
In the context of our business activities and for the purposes set out in Section 4, we also disclose personal data to third parties, where permitted and deemed appropriate, whether for processing on our behalf or for their own purposes. This specifically involves the following entities:
– Our service providers (e.g. banks, insurance companies), including data processors (such as IT providers, legal advisors);
– Dealers, suppliers, subcontractors, and other business partners;
– Clients;
– domestic and foreign authorities, official agencies, or courts;
– Media;
– General public, including website visitors and social media users;
– Competitors, industry associations, federations, organizations, and other bodies;
– Buyers or parties interested in acquiring business divisions, companies, or other parts;
– other parties in potential or actual legal proceedings; collectively referred to as “recipients”.
These recipients may be located both domestically and abroad. The data may be transferred to other countries where our service providers are located (such as Google, Apple).
If a recipient is located in a country without adequate statutory data protection, we contractually oblige the recipient to comply with applicable data protection requirements (for this purpose, we use the European Commission's revised standard contractual clauses, which are available here: eur-lex.europa.eu/eli/dec_impl/2021/914/oj), unless the recipient is already subject to a legally recognized framework ensuring data protection and we cannot rely on an exemption clause. An exemption may apply, in particular, in the case of legal proceedings abroad, but also in cases of overriding public interests, if contract performance requires such disclosure, if you have consented, or if the data in question has been made generally accessible by you and you have not objected to its processing.
7. Retention Period for Personal Data
We process and store your personal data for as long as it is necessary for the fulfillment of our contractual and legal obligations or otherwise for the purposes pursued with the processing, i.e., for example, for the duration of the entire business relationship (from the initiation and execution to the termination of a contract) as well as beyond that in accordance with statutory retention and documentation obligations. It is possible that personal data will be retained for the time in which claims can be asserted against our company and to the extent that we are otherwise legally obliged to do so or legitimate business interests require it (e.g., for evidence and documentation purposes). As soon as your personal data is no longer required for the purposes mentioned above, it will generally and as far as possible be deleted or anonymized. For operational data (e.g., system logs), fundamentally shorter retention periods of twelve months or less apply.
8. Data Security
We take appropriate technical and organizational security measures to protect your personal data from unauthorized access and misuse.
9. Obligation to provide personal data
As part of our business relationship, you must provide the personal data necessary to initiate and carry out a business relationship and to fulfill the associated contractual obligations (you generally have no statutory obligation to provide us with data). Without this data, we will usually not be in a position to conclude or execute a contract with you (or the entity or person you represent). Furthermore, the website cannot be used if certain information required to ensure data traffic (such as your IP address) is not disclosed.
10. Rights of the Data Subject
Within the framework of the data protection law applicable to you and to the extent provided therein (such as under the GDPR), you have the right to information, rectification, erasure, the right to restrict data processing, and otherwise to object to our data processing, particularly for direct marketing purposes, profiling carried out for direct advertising, and other legitimate interests in the processing, as well as the right to receive certain personal data for transfer to another entity (so-called data portability). Please note, however, that we reserve the right to assert the statutory restrictions on our part, for example if we are obligated to retain or process certain data, have an overriding interest in doing so (insofar as we are entitled to rely on this), or require it for the assertion of claims.
If any costs arise for you, we will inform you in advance. We have already informed you about the possibility of withdrawing your consent in Section 4. Please note that exercising these rights may conflict with contractual agreements and may have consequences such as the premature termination of the contract or cost implications. In this case, we will inform you in advance where this is not already contractually regulated.
The exercise of such rights generally requires that you clearly prove your identity (e.g. by providing a copy of your ID, where your identity is otherwise not clear or cannot be verified). To assert your rights, you can contact us at the address provided in Section 2.
In addition, every data subject has the right to enforce their claims in court or to lodge a complaint with the competent data protection authority. The competent data protection authority in Switzerland is the Federal Data Protection and Information Commissioner (www.edoeb.admin.ch).
11. Changes
We may update this privacy policy at any time without prior notice. The current version published on our website shall apply. If the privacy policy is part of an agreement with you, we will notify you of any changes by email or other appropriate means in the event of an update.