Envestis SA ("we", "our", "us", "Envestis", or the "Company") is committed to protecting your privacy and handling your personal data responsibly. This Privacy Policy explains in detail how we collect, use, store, disclose, and safeguard your personal data when you visit or interact with the website envestis.ch (the "Website"). This policy is designed to comply with the Swiss Federal Act on Data Protection (nFADP/DSG), the EU General Data Protection Regulation (GDPR - Regulation (EU) 2016/679), and the California Consumer Privacy Act (CCPA/CPRA).

1. Data Controller

Envestis SA
Via Pretorio 13A
6900 Lugano
Canton Ticino, Switzerland

Email (legal inquiries): legal@envestis.ch
Email (general inquiries): info@envestis.ch
Website: envestis.ch

Envestis SA is the data controller responsible for the processing of your personal data as described in this Privacy Policy. If you have any questions regarding data protection, wish to exercise your rights, or have concerns about how your data is being processed, please contact us at legal@envestis.ch.

2. Data We Collect

2.1 Contact Form Data

When you submit our contact form to request a free security audit or make a general inquiry, we collect the following data:

• Required fields: Full name, email address, message content
• Optional fields: Phone number, company name, website URL

This data is transmitted securely via Brevo (Sendinblue SAS, France) to our email inbox. We use this information solely to respond to your inquiry, evaluate your request, and - where applicable - to prepare and deliver the requested security audit or other services.

2.2 Technical Data (Automatically Collected)

When you visit our Website, certain technical data is automatically collected through our hosting and content delivery infrastructure. This includes:

• IP address (anonymized where technically feasible)
• Browser type and version
• Operating system
• Referring URL (the page that linked you to our site)
• Pages visited and navigation path
• Date, time, and duration of your visit
• Device type and screen resolution
• Language preferences

Our Website is hosted on Cloudflare Pages. Cloudflare processes this data as a data processor acting on our behalf under its Data Processing Addendum (DPA). This processing is necessary for the delivery, optimization, and security of the Website. For full details, see Cloudflare's Privacy Policy.

2.3 Analytics Data

With your consent, we use Cloudflare Web Analytics, a privacy-focused, cookieless analytics service. Cloudflare Web Analytics:

• Does not use cookies or any form of client-side storage for analytics
• Does not collect personally identifiable information
• Does not track individual users across sessions or websites
• Provides only aggregated metrics such as page views, referrers, browser types, and geographic regions (country-level)

No personal data is transmitted to third parties for analytics purposes. You may withdraw your consent for analytics at any time through the cookie consent banner or by contacting us.

2.4 Bot Protection Data

We use Cloudflare Turnstile to protect our contact form and other interactive elements from automated abuse, spam, and bot attacks. Turnstile may process:

• IP address
• Browser characteristics and environment data
• Interaction patterns (mouse movements, keystrokes - used only for bot detection)

This processing is based on our legitimate interest in maintaining the security and integrity of our Website and preventing spam and abuse (GDPR Art. 6(1)(f)). Turnstile is designed to be privacy-preserving and does not use cookies for tracking purposes.

2.5 Web Fonts

Our Website uses Google Fonts served via Google's Content Delivery Network (CDN). When you visit our Website, your browser establishes a connection to Google's servers to retrieve font files. In this process, your IP address is transmitted to Google LLC. Google's use of this data is governed by Google's Privacy Policy.

3. Cookies and Local Storage

We use a minimal number of cookies, strictly limited to those necessary for the functioning and security of our Website. We do not use advertising cookies, tracking pixels, social media plugins, or cross-site tracking technologies of any kind.

Cookieless analytics: Cloudflare Web Analytics operates entirely without cookies. No analytics cookies are placed on your device at any time.

You can manage your cookie preferences at any time by clicking the "Cookie Settings" link in the footer of our Website, or by adjusting your browser settings. Please note that disabling strictly necessary cookies may impair the functionality of the Website.

4. Legal Basis for Processing (GDPR Art. 6)

We process your personal data only when we have a valid legal basis under the GDPR. The specific legal basis depends on the processing activity:

Where we rely on legitimate interest as the legal basis, we have conducted a balancing test to ensure that our interests do not override your fundamental rights and freedoms. You have the right to object to processing based on legitimate interest at any time (see Section 8).

5. Third-Party Services

We engage a limited number of third-party service providers to operate and maintain our Website. Each provider has been selected for its strong privacy practices and compliance with applicable data protection laws.

We have entered into Data Processing Agreements (DPAs) or verified the existence of appropriate safeguards with all processors that handle personal data on our behalf.

6. International Data Transfers

Some of our third-party service providers are based in or process data in countries outside of Switzerland and the European Economic Area (EEA), particularly the United States. We ensure that all international data transfers are conducted in compliance with Chapter V of the GDPR (Articles 44-49) and Chapter 2 of the Swiss nFADP. The following safeguards are in place:

• EU-US Data Privacy Framework (DPF): Cloudflare, Inc. and Google LLC are certified participants in the EU-US Data Privacy Framework, which has been recognized by the European Commission as providing an adequate level of data protection (Adequacy Decision of 10 July 2023). Switzerland has also recognized the Swiss-US Data Privacy Framework.
• Standard Contractual Clauses (SCCs): Where the DPF does not apply or as an additional safeguard, we rely on Standard Contractual Clauses as adopted by the European Commission (Commission Implementing Decision (EU) 2021/914) and recognized by the Swiss Federal Data Protection and Information Commissioner (FDPIC).
• Data Processing Addenda (DPAs): All third-party providers processing personal data on our behalf have executed or published Data Processing Addenda that include appropriate technical and organizational measures.
• EU-based processing: Brevo (Sendinblue SAS) processes data within the European Union (France), which provides an adequate level of data protection under Swiss law.

You may request a copy of the relevant safeguards by contacting legal@envestis.ch.

7. Data Retention

We retain personal data only for as long as is necessary for the purposes for which it was collected, or as required by applicable law. Our specific retention periods are:

When personal data is no longer required, it is securely deleted or irreversibly anonymized. We conduct periodic reviews of retained data to ensure compliance with these retention periods.

8. Your Rights

8.1 Rights Under GDPR (EU/EEA Residents)

If you are located in the European Union or the European Economic Area, you have the following rights under the GDPR:

• Right of access (Art. 15): You have the right to obtain confirmation of whether we process your personal data and to receive a copy of that data, along with information about the processing.
• Right to rectification (Art. 16): You have the right to request the correction of inaccurate personal data and to have incomplete data completed.
• Right to erasure / "right to be forgotten" (Art. 17): You have the right to request the deletion of your personal data where there is no compelling reason for its continued processing.
• Right to restriction of processing (Art. 18): You have the right to request that we restrict the processing of your personal data in certain circumstances, such as when you contest the accuracy of the data.
• Right to data portability (Art. 20): You have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit that data to another controller.
• Right to object (Art. 21): You have the right to object to the processing of your personal data based on legitimate interests (Art. 6(1)(f)). We will cease processing unless we demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.
• Right not to be subject to automated decision-making (Art. 22): You have the right not to be subject to decisions based solely on automated processing, including profiling, that produce legal effects or similarly significant effects on you. We do not engage in such processing.
• Right to withdraw consent (Art. 7(3)): Where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
• Right to lodge a complaint: You have the right to lodge a complaint with a supervisory authority in the EU Member State of your habitual residence, place of work, or place of the alleged infringement.

8.2 Rights Under the Swiss nFADP (DSG)

Swiss residents have equivalent data protection rights under the revised Swiss Federal Act on Data Protection (nFADP/DSG), which entered into force on 1 September 2023. These include:

• Right to information (Art. 25 DSG): You may request information about whether and how we process your personal data.
• Right to data disclosure and portability (Art. 28 DSG): You may request the release of your personal data or its transfer to another controller in a commonly used electronic format.
• Right to rectification (Art. 32 DSG): You may request the correction of inaccurate personal data.
• Right to deletion (Art. 32 DSG): You may request the deletion of your personal data.
• Right to object: You may object to the processing of your data at any time.

The competent supervisory authority for data protection in Switzerland is:
Federal Data Protection and Information Commissioner (FDPIC)
Feldeggweg 1, 3003 Bern, Switzerland
Website: www.edoeb.admin.ch

8.3 Rights Under CCPA/CPRA (California Residents)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):

• Right to know: You have the right to know what personal information we collect, the purposes of collection, the categories of third parties with whom we share personal information, and the specific pieces of personal information we hold about you.
• Right to delete: You have the right to request the deletion of personal information we have collected from you, subject to certain legal exceptions.
• Right to correct: You have the right to request the correction of inaccurate personal information.
• Right to opt out of the sale or sharing of personal information: We do not sell or share your personal information for cross-context behavioral advertising purposes. Therefore, there is no need to opt out.
• Right to non-discrimination: We will not discriminate against you for exercising any of your CCPA/CPRA rights.
• Right to limit use of sensitive personal information: We do not collect sensitive personal information as defined by the CPRA.

Categories of personal information collected in the preceding 12 months: Identifiers (name, email address, IP address), Internet or electronic network activity information (browsing history on our Website, interaction with our Website), and professional or employment-related information (company name, if provided).

We do not sell personal information. We have not sold personal information in the preceding 12 months and have no plans to do so.

To exercise your CCPA/CPRA rights, contact us at legal@envestis.ch. We will verify your identity before processing your request and will respond within 45 days.

8.4 How to Exercise Your Rights

To exercise any of the rights described above, please contact us at:

Email: legal@envestis.ch
Subject line: "Data Protection Request"

We will acknowledge your request within 5 business days and provide a substantive response within 30 days (GDPR/nFADP) or 45 days (CCPA/CPRA). If your request is complex or we receive a large number of requests, we may extend this period by an additional 60 days, in which case we will notify you of the extension and the reasons for it. We may ask you to verify your identity before processing your request to protect your data from unauthorized disclosure.

9. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include, but are not limited to:

• Encryption in transit: All data transmitted between your browser and our Website is encrypted using TLS 1.2 or higher (HTTPS). We enforce HSTS (HTTP Strict Transport Security) headers.
• Web Application Firewall (WAF): Cloudflare WAF provides real-time protection against common web vulnerabilities including SQL injection, cross-site scripting (XSS), and other OWASP Top 10 threats.
• DDoS protection: Cloudflare's global network provides automatic DDoS mitigation for all traffic to our Website.
• Access controls: We implement the principle of least privilege, ensuring that only authorized personnel have access to personal data, and only to the extent necessary for their role.
• Regular security assessments: As a cybersecurity company, we conduct regular internal security reviews and assessments of our own infrastructure and processes.
• Secure email transmission: Contact form data is transmitted to Brevo via encrypted API connections (TLS).
• Vendor security review: We evaluate the security posture and data protection practices of all third-party service providers before engagement.

While we strive to protect your personal data, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security but are committed to maintaining industry-standard protections.

10. Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will:

• Notify the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of the breach (GDPR Art. 33). Under Swiss nFADP (Art. 24), we will notify the FDPIC as soon as possible.
• Notify affected individuals without undue delay if the breach is likely to result in a high risk to their rights and freedoms (GDPR Art. 34), providing clear information about the nature of the breach, its likely consequences, and the measures taken or proposed to mitigate it.
• Document the breach internally, including the facts of the breach, its effects, and the remedial actions taken, in accordance with our breach response procedures.

11. Children's Privacy

Our Website and services are not directed at children under 16 years of age. We do not knowingly collect, solicit, or process personal data from children under 16. If we become aware that we have inadvertently collected personal data from a child under 16, we will take prompt steps to delete such data. If you are a parent or guardian and believe your child has provided personal data to us, please contact us immediately at legal@envestis.ch.

12. Automated Decision-Making and Profiling

We do not use automated decision-making or profiling that produces legal effects or similarly significant effects on individuals (GDPR Art. 22). The bot protection mechanism (Cloudflare Turnstile) performs automated analysis of visitor behavior solely for the purpose of distinguishing human visitors from bots, and does not produce decisions that have legal or similarly significant effects on you.

13. Do Not Track (DNT) Signals

Our Website respects Do Not Track (DNT) browser signals. When we detect a DNT signal, we do not load analytics scripts. Additionally, since Cloudflare Web Analytics is cookieless and does not track individual users, our analytics approach is inherently privacy-respecting regardless of DNT settings.

14. Changes to This Privacy Policy

We reserve the right to update or modify this Privacy Policy at any time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make changes:

• The updated policy will be posted on this page with a revised "Last updated" date.
• For material changes that significantly affect how we process your personal data, we will provide a prominent notice on our Website (such as a banner notification) at least 30 days before the changes take effect.
• If required by law, we will obtain your renewed consent for any new processing activities.

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your data.

15. Contact Us

If you have any questions, concerns, or complaints regarding this Privacy Policy or our data protection practices, please contact us:

Envestis SA
Via Pretorio 13A
6900 Lugano, Switzerland
Email (legal/privacy): legal@envestis.ch
Email (general): info@envestis.ch

We aim to resolve all complaints and disputes regarding data protection in a timely and fair manner. If you are not satisfied with our response, you have the right to lodge a complaint with the competent supervisory authority (see Section 8).

These Terms of Service ("Terms", "Agreement") constitute a legally binding agreement between you ("you", "your", "User", "Client") and Envestis SA ("Envestis", "we", "us", "our", the "Company"), a company registered in Lugano, Canton Ticino, Switzerland. These Terms govern your access to and use of the envestis.ch website (the "Website") and any professional services provided by Envestis.

By accessing, browsing, or using the Website or engaging our services, you acknowledge that you have read, understood, and agree to be bound by these Terms. If you do not agree with any part of these Terms, you must discontinue use of the Website immediately.

1. Definitions

For the purposes of these Terms, the following definitions apply:

• "Services" means all professional services offered by Envestis, including but not limited to cyber security consulting, website security audits (manual and automated), secure web development, security awareness training, and any related advisory or technical services.
• "Website" means the website accessible at envestis.ch, including all pages, content, features, and functionality.
• "Client" means any individual or entity that engages Envestis for professional Services pursuant to a separate engagement agreement or statement of work.
• "User" means any individual who accesses or uses the Website.
• "Report" or "Security Audit Report" means any written deliverable produced by Envestis as a result of a security audit or assessment engagement, including findings, recommendations, and supporting documentation.
• "Confidential Information" means any non-public information disclosed by one party to the other in connection with the Services, including but not limited to technical data, business information, security findings, audit reports, methodologies, trade secrets, and any information marked as confidential or that a reasonable person would consider confidential given its nature and the circumstances of disclosure.
• "Intellectual Property" means all patents, copyrights, trademarks, trade secrets, methodologies, tools, frameworks, techniques, know-how, and any other intellectual property rights.
• "Force Majeure Event" means any event beyond the reasonable control of a party, including but not limited to natural disasters, war, terrorism, cyber attacks by third parties, pandemics, government actions, power failures, internet outages, or failures of third-party services.

2. Service Description

Envestis SA provides professional cyber security services, including:

• Cyber security consulting: Strategic advisory services to help organizations assess, improve, and maintain their security posture.
• Website security audits: Comprehensive manual and automated security assessments of web applications, including vulnerability scanning, penetration testing, code review, and configuration analysis.
• Secure web development: Design and development of websites and web applications with security built in from the ground up, following secure development lifecycle (SDLC) best practices.
• Security awareness training: Educational programs designed to equip teams and employees with the knowledge to recognize and respond to security threats.

The Website provides general information about our Services and allows visitors to contact us via a contact form to request information, schedule consultations, or request a free security audit. The provision of specific Services is subject to a separate engagement agreement or statement of work agreed upon by both parties.

3. Website Usage Rules

You may access and browse the Website for informational purposes. By using the Website, you agree to the following rules of conduct. You shall not:

• Use the Website for any purpose that is unlawful or prohibited by these Terms
• Attempt to gain unauthorized access to any part of the Website, its servers, databases, or any connected networks or systems
• Conduct any form of security testing, vulnerability scanning, penetration testing, or reconnaissance against the Website without prior written authorization from Envestis
• Interfere with, disrupt, or create an undue burden on the Website or its infrastructure
• Use automated tools, bots, scrapers, crawlers, or similar technologies to access, extract, index, or reproduce any content from the Website without prior written consent
• Transmit any viruses, malware, ransomware, worms, Trojan horses, or other malicious or harmful code
• Impersonate any person or entity, or falsely state or misrepresent your affiliation with any person or entity
• Collect or harvest personal information of other users of the Website
• Use the Website to send unsolicited communications (spam)
• Attempt to reverse-engineer, decompile, or disassemble any software or technology used on the Website

Envestis reserves the right to restrict or terminate access to the Website for any User who violates these rules, without prior notice and without liability.

4. Contact Form Terms

By submitting the contact form on our Website, you:

• Consent to the collection and processing of the personal data you provide (name, email, phone number, company name, website URL, and message) in accordance with our Privacy Policy
• Confirm that the information you provide is accurate and complete to the best of your knowledge
• Understand that submission of the form does not constitute a binding contract for services or guarantee a response within any specific timeframe
• Acknowledge that we will make reasonable efforts to respond to your inquiry within 5 business days, but response times may vary depending on volume and complexity
• Consent to the use of Brevo (Sendinblue SAS) as our email service provider for the transmission and delivery of your message
• Understand that your submission will be protected by Cloudflare Turnstile bot protection

5. Security Audit Report Terms

The following terms apply to all security audit reports, assessments, and deliverables produced by Envestis:

• Confidentiality: All Reports are strictly confidential and are prepared exclusively for the use of the specific Client who commissioned the engagement. Reports contain sensitive security information and must be treated with the highest level of confidentiality.
• Point-in-time assessment: Reports reflect the security posture of the analyzed systems at the time of the audit only. Security threats and vulnerabilities evolve continuously. A Report does not and cannot guarantee the complete absence of all vulnerabilities or the ongoing security of the assessed systems.
• No guarantee of completeness: While Envestis employs industry-standard methodologies and best practices, no security audit can guarantee the identification of every vulnerability. Certain vulnerabilities may exist that were not discoverable within the scope, time, and methodology of the engagement.
• Client responsibility: The Client is solely responsible for reviewing, prioritizing, and implementing the recommendations contained in the Report. Envestis is not responsible for any security incidents that result from the Client's failure to implement recommendations.
• No sharing without consent: Reports may not be disclosed, distributed, reproduced, or shared with any third party - whether in whole or in part - without the prior written consent of Envestis. This includes sharing with affiliates, partners, regulators, or the public, unless otherwise agreed in the engagement agreement.
• No warranty of results: Envestis does not warrant or guarantee that implementing the Report's recommendations will result in the elimination of all security risks or prevent future security incidents.
• Scope limitations: The Report addresses only the systems, applications, and components explicitly defined in the scope of the engagement. Any systems outside the agreed scope are not covered.

6. Intellectual Property

All content on the Website, including but not limited to text, articles, graphics, logos, icons, images, audio clips, video clips, data compilations, page layouts, underlying code, and software, is the exclusive property of Envestis SA or its licensors and is protected by Swiss and international copyright, trademark, patent, and other intellectual property laws.

Additionally, all methodologies, tools, frameworks, techniques, processes, and proprietary know-how developed or used by Envestis in the delivery of its Services remain the exclusive Intellectual Property of Envestis, unless explicitly stated otherwise in a written engagement agreement.

No part of the Website or its content may be reproduced, distributed, modified, displayed, published, transmitted, or used in any form or by any means without the prior written consent of Envestis SA. You are granted a limited, non-exclusive, non-transferable, revocable license to access and view the Website content for personal, non-commercial informational purposes only.

7. Professional Services Disclaimer

Envestis provides its professional Services based on industry-recognized best practices, established methodologies (including OWASP, NIST, and ISO 27001 frameworks), and the professional expertise of its team. However, you acknowledge and agree that:

• No guarantee of finding all vulnerabilities: Cyber security is an inherently complex and evolving field. Despite our best efforts and use of both manual and automated techniques, it is not possible to guarantee that every vulnerability will be identified in a security assessment.
• Security is ongoing: Security is an ongoing, continuous process - not a one-time fix. A security audit provides a snapshot of the current state and recommendations for improvement, but maintaining security requires continuous monitoring, patching, and adaptation to new threats.
• No liability for post-audit breaches: Envestis shall not be liable for security breaches, data loss, or other incidents that occur after the completion of an audit or engagement, including but not limited to breaches resulting from new vulnerabilities, zero-day exploits, social engineering, insider threats, or the Client's failure to maintain security practices.
• Client cooperation required: The effectiveness of our Services depends on the Client's full cooperation, including providing accurate and complete information, timely access to systems, and implementing recommended security measures.
• Third-party dependencies: Envestis is not responsible for vulnerabilities, failures, or security incidents caused by third-party software, services, hosting providers, or infrastructure that are outside of Envestis's direct control.
• Regulatory compliance advisory: While Envestis may provide guidance on regulatory compliance (such as GDPR, nFADP, PCI DSS), this guidance does not constitute legal advice. Clients should consult qualified legal professionals for compliance matters.

8. Confidentiality Obligations

Both parties agree to maintain the confidentiality of all Confidential Information received from the other party in connection with the use of the Website or the provision of Services. Specifically:

• Non-disclosure: Neither party shall disclose, publish, or disseminate Confidential Information to any third party without the prior written consent of the disclosing party.
• Use limitation: Confidential Information shall be used solely for the purpose for which it was disclosed - namely, the evaluation, provision, or receipt of Services.
• Standard of care: Each party shall protect the other party's Confidential Information with at least the same degree of care it uses to protect its own confidential information, and in no event less than a reasonable standard of care.
• Exceptions: Confidentiality obligations do not apply to information that: (a) is or becomes publicly available through no fault of the receiving party; (b) was already known to the receiving party prior to disclosure; (c) is independently developed by the receiving party without reference to the Confidential Information; or (d) is required to be disclosed by law, regulation, or court order, provided the receiving party gives the disclosing party prompt notice (where legally permitted) and cooperates in seeking a protective order.
• Survival: Confidentiality obligations under these Terms shall survive the termination of these Terms and any engagement for a period of 3 years from the date of disclosure.

9. Disclaimer of Warranties

Website: The Website, including all content, features, and functionality, is provided on an "AS IS" and "AS AVAILABLE" basis, without warranties of any kind, whether express, implied, or statutory. To the fullest extent permitted by applicable law, Envestis expressly disclaims all warranties, including but not limited to implied warranties of merchantability, fitness for a particular purpose, non-infringement, accuracy, and completeness. We do not warrant that the Website will be uninterrupted, error-free, secure, or free from harmful components (including viruses or malware).

Professional Services: Professional Services are provided with reasonable skill, care, and diligence consistent with generally accepted industry standards and practices in the field of cyber security. This constitutes the sole and exclusive warranty with respect to our Services. Except for this professional standard, all other warranties - whether express, implied, or statutory - are expressly disclaimed to the maximum extent permitted by law.

Information on Website: The information published on the Website (including blog posts, articles, and general security advice) is provided for general informational and educational purposes only. It does not constitute professional security advice, legal advice, or a recommendation for any specific security measure. You should not rely on Website content as a substitute for professional consultation.

10. Limitation of Liability

To the maximum extent permitted by Swiss law and applicable international law, the following limitations apply:

• No indirect damages: Envestis SA, its directors, officers, employees, agents, contractors, and affiliates shall not be liable for any indirect, incidental, special, consequential, exemplary, or punitive damages of any kind, including but not limited to: loss of profits, loss of revenue, loss of business opportunities, loss of data, loss of goodwill, business interruption, reputational damage, or cost of procurement of substitute services, arising out of or in connection with these Terms, the Website, or any Services - regardless of the legal theory (contract, tort, negligence, strict liability, or otherwise) and even if Envestis has been advised of the possibility of such damages.
• Total liability cap: Envestis's total aggregate liability for all claims arising out of or related to a specific engagement or these Terms shall not exceed the greater of: (a) the total fees actually paid by the Client to Envestis for the specific engagement giving rise to the claim, or (b) CHF 100 (one hundred Swiss Francs).
• No liability for failure to implement: Envestis shall not be liable for any loss, damage, or security incident that results - in whole or in part - from the Client's failure to implement, or delay in implementing, the recommendations, remediation steps, or security measures set forth in a Report or otherwise communicated by Envestis.
• No liability for third-party actions: Envestis shall not be liable for any damages caused by the actions or omissions of third parties, including but not limited to hackers, cybercriminals, malicious insiders, third-party service providers, or other external actors.
• No liability for post-audit incidents: Envestis shall not be liable for security incidents, data breaches, or vulnerabilities that arise, are discovered, or are exploited after the completion of an audit engagement, including but not limited to zero-day vulnerabilities, newly discovered attack vectors, or changes to the Client's systems or environment made after the audit.
• Time limitation on claims: Any claim arising out of or related to these Terms or the Services must be commenced within one (1) year after the cause of action arises. Failure to bring a claim within this period shall constitute a permanent and irrevocable waiver of such claim.

Some jurisdictions do not allow the exclusion or limitation of certain types of damages. In such jurisdictions, our liability shall be limited to the maximum extent permitted by applicable law. Nothing in these Terms shall exclude or limit liability for death or personal injury caused by negligence, fraud, or any other liability that cannot be excluded or limited under applicable law.

11. Indemnification

You agree to defend, indemnify, and hold harmless Envestis SA, its directors, officers, employees, agents, contractors, and affiliates from and against any and all claims, demands, actions, liabilities, damages, losses, costs, and expenses (including reasonable legal fees and court costs) arising out of or related to:

• Your violation of these Terms or any applicable law or regulation
• Your use or misuse of the Website
• Your unauthorized disclosure of Reports or Confidential Information
• Your failure to implement security recommendations provided by Envestis
• Any claim by a third party arising from your actions or omissions in connection with the Website or Services
• Your infringement of any third party's intellectual property or other rights

This indemnification obligation shall survive the termination of these Terms.

12. Termination

These Terms are effective as long as you use the Website. We may, at our sole discretion and without prior notice:

• Suspend or terminate your access to all or any part of the Website for any reason, including but not limited to a breach of these Terms
• Remove or disable any content that violates these Terms or applicable law
• Take any other action we deem necessary to protect the integrity of the Website or the rights of Envestis or third parties

Termination of specific Service engagements is governed by the applicable engagement agreement or statement of work. In the absence of a separate agreement, either party may terminate a Service engagement by providing 30 days' written notice to the other party.

The following sections shall survive termination of these Terms: Intellectual Property, Confidentiality Obligations, Disclaimer of Warranties, Limitation of Liability, Indemnification, Governing Law and Jurisdiction, and any other provisions that by their nature should survive termination.

13. Force Majeure

Neither party shall be liable for any failure or delay in the performance of its obligations under these Terms (other than payment obligations) to the extent that such failure or delay is caused by a Force Majeure Event. The affected party shall promptly notify the other party of the Force Majeure Event and use reasonable efforts to mitigate its effects. If a Force Majeure Event continues for more than 60 consecutive days, either party may terminate the affected engagement by written notice.

14. Governing Law and Jurisdiction

These Terms are governed by and shall be construed in accordance with the substantive laws of Switzerland, without regard to its conflict of law principles and excluding the United Nations Convention on Contracts for the International Sale of Goods (CISG).

Any dispute, controversy, or claim arising out of or relating to these Terms, or the breach, termination, or invalidity thereof, shall be subject to the exclusive jurisdiction of the competent courts of Lugano, Canton Ticino, Switzerland. Notwithstanding the foregoing, Envestis reserves the right to seek injunctive or equitable relief in any court of competent jurisdiction to protect its intellectual property rights or Confidential Information.

15. Severability

If any provision of these Terms is found by a competent court to be invalid, illegal, or unenforceable, such provision shall be modified to the minimum extent necessary to make it valid and enforceable. If modification is not possible, the provision shall be deemed severed from these Terms. The invalidity or unenforceability of any provision shall not affect the validity or enforceability of the remaining provisions, which shall continue in full force and effect.

16. Entire Agreement

These Terms, together with our Privacy Policy, constitute the entire agreement between you and Envestis with respect to your use of the Website. These Terms supersede all prior or contemporaneous communications, proposals, and representations - whether oral or written - with respect to the Website.

For professional Services, these Terms are supplemented by the applicable engagement agreement, statement of work, or service contract. In the event of a conflict between these Terms and a specific engagement agreement, the engagement agreement shall prevail with respect to the specific Services covered therein.

17. Waiver

The failure of Envestis to exercise or enforce any right or provision of these Terms shall not constitute a waiver of such right or provision. Any waiver must be in writing and signed by an authorized representative of Envestis. A waiver of any right or provision on one occasion shall not be deemed a waiver of such right or provision on any subsequent occasion.

18. Assignment

You may not assign or transfer these Terms, or any rights or obligations hereunder, without the prior written consent of Envestis. Envestis may assign these Terms in connection with a merger, acquisition, corporate reorganization, or sale of all or substantially all of its assets, without your consent. Subject to the foregoing, these Terms shall bind and inure to the benefit of the parties and their respective successors and permitted assigns.

19. Changes to These Terms

We reserve the right to modify, amend, or replace these Terms at any time at our sole discretion. Changes take effect upon publication on this page with a revised "Last updated" date. For material changes, we will provide reasonable notice via a prominent notice on the Website at least 30 days before the changes take effect. Your continued use of the Website after any modification constitutes your acceptance of the revised Terms. If you do not agree with the modified Terms, you must discontinue use of the Website.

20. Contact

If you have any questions about these Terms, please contact us:

Envestis SA
Via Pretorio 13A
6900 Lugano, Switzerland
Email: legal@envestis.ch
Website: envestis.ch

Company Information

Envestis SA
Via Pretorio 13A
6900 Lugano
Canton Ticino, Switzerland

Commercial Register

Legal form: Societa Anonima (SA)
Registered office: Lugano, Canton Ticino
UID/IDI: CHE-339.253.743
CH-ID: CH-501-3019175-3
Commercial Register of the Canton of Ticino

Contact Details

Email (legal inquiries): legal@envestis.ch
Email (general inquiries): info@envestis.ch
Website: envestis.ch

Responsible for Content

Managing Director
Envestis SA
Via Pretorio 13A
6900 Lugano, Switzerland

Responsible for the content of this website pursuant to applicable Swiss media and telecommunications law.

Regulatory Information

Envestis SA is a corporation (Aktiengesellschaft / Societe Anonyme) registered in the Commercial Register of the Canton of Ticino under UID CHE-339.253.743, operating under Swiss commercial law - specifically the Swiss Code of Obligations (CO/OR, Obligationenrecht). The company provides professional cyber security consulting, security auditing, secure web development, and security awareness training services.

Envestis SA is not a regulated financial institution and does not require a license from the Swiss Financial Market Supervisory Authority (FINMA). The company operates in full compliance with applicable Swiss federal and cantonal laws, including but not limited to the Swiss Federal Act on Data Protection (nFADP/DSG), the Swiss Code of Obligations (CO/OR), and the Swiss Federal Act on Unfair Competition (UWG).

VAT Information

UID/IDI: CHE-339.253.743
VAT registration information is available upon request. Please contact legal@envestis.ch for details.

Professional Liability

Envestis SA maintains professional liability insurance appropriate to the nature and scope of its services. As a provider of professional cyber security services, Envestis adheres to industry-recognized standards and best practices, including but not limited to OWASP, NIST Cybersecurity Framework, and ISO/IEC 27001 guidelines. All services are delivered with reasonable skill, care, and diligence consistent with the standards expected of qualified cyber security professionals.

The engagement of Envestis for professional services does not create an implied guarantee of absolute security. Cyber security assessments and audits are point-in-time evaluations, and the security landscape evolves continuously. Clients remain responsible for the ongoing maintenance of their security posture.

Dispute Resolution

Envestis SA is committed to resolving disputes in a fair, efficient, and amicable manner. If you have a complaint or concern regarding our Website or Services, we encourage you to contact us first at legal@envestis.ch so that we may attempt to resolve the matter directly.

While Envestis SA is not obligated to participate in dispute resolution proceedings before a consumer arbitration board, we are willing to engage in good-faith negotiations to seek an amicable resolution.

If a dispute cannot be resolved amicably, it shall be subject to the exclusive jurisdiction of the competent courts of Lugano, Canton Ticino, Switzerland, in accordance with Swiss law.

Disclaimer for External Links

This Website may contain hyperlinks to external third-party websites. These links are provided solely for your convenience and reference. Envestis SA has no control over the content, availability, privacy practices, or security of external websites and assumes no responsibility or liability for:

• The accuracy, completeness, or reliability of any information on linked external websites
• Any damages or losses - direct or indirect - arising from your use of or reliance on external websites
• The privacy practices or data collection policies of external websites
• The security of external websites or any transactions you conduct thereon

The inclusion of any link does not imply endorsement, affiliation, sponsorship, or approval by Envestis SA of the linked website or its operator. We recommend that you review the terms of service and privacy policy of any external website before providing personal data or engaging with its content.

Copyright Notice

All content on this Website - including text, images, graphics, logos, icons, layout, and underlying source code - is the intellectual property of Envestis SA or its licensors and is protected by Swiss and international copyright laws. Unauthorized reproduction, distribution, modification, or use of any content from this Website is strictly prohibited without prior written consent from Envestis SA.

© 2024 - 2026 Envestis SA. All rights reserved.

Information Disclaimer

The information provided on this Website is for general informational and educational purposes only. It does not constitute and should not be construed as legal, financial, technical, or professional advice. While we strive to ensure the accuracy and timeliness of the information presented, Envestis SA makes no representations or warranties - express or implied - regarding the completeness, accuracy, reliability, or suitability of the information for any particular purpose. Any reliance you place on the information on this Website is strictly at your own risk.