Privacy notice

1. Controller

The controller is:

Business name

Zentriq Software (sole proprietorship of Guillaume Fernandes)

Address

Rue du Lac 411815 Clarens

UID number

CHE-228.383.878

Commercial register

Commercial register of the Canton of Vaud

Owner and person responsible

Guillaume Fernandes

Email

hello@whoruns365.com

Questions and requests about your data: privacy@whoruns365.com, or the opt-out page.

We have not appointed a representative in the European Union (Art. 27 GDPR).

2. Visiting the website

• No cookies, no analytics, no advertising.
• No third-party content: fonts and scripts are served by the website itself.
• Our hosting provider logs technical data (IP address, date and time, page requested, browser) for the security and operation of the site. It keeps these logs for a short period set by its plan, then deletes them.

Legal basis: our interest in the security and operation of the site (Art. 31(1) FADP; Art. 6(1)(f) GDPR where the GDPR applies).

3. Requests by email

Sample request: you write to us by email. We process that email, that is your address, your name, your company and what you write (for example the lists and region you are interested in), to reply and to send you the sample.

Data requests (opt-out page): you write to us by email. We process that email (your address, name, company, type of request and message) to handle the request and to be able to show that it was handled.

The website has no form and collects no data itself: your email is received and kept in our mailbox, hosted in Switzerland.

Legal basis: your request (steps prior to a contract, Art. 6(1)(b) GDPR); for requests about your data, our legal obligations (Art. 25 and 32 FADP; Art. 6(1)(c) GDPR).

Retention: for a sample request, as long as needed for our business relationship; 3 years for a request about your data. A removed address stays on our suppression list indefinitely, so that the opt-out is honoured.

4. Customers and payments

For an order, we process the buyer’s name, company, email address and, where given, billing address, as well as the order itself. Payment is made by bank transfer on a QR invoice.

Legal basis: performance of the contract (Art. 6(1)(b) GDPR) and our accounting obligations (Art. 6(1)(c)).

Retention: 10 years for accounting records (Art. 958f of the Swiss Code of Obligations).

5. The lists we sell

Our lists describe companies and give their decision makers when we know them: name, job title and business email address. This is business data; it includes nothing private or sensitive. We pass it on to the companies that buy our lists, for their own business-to-business prospecting: the licence forbids them to resell, publish or share it with third parties, and requires them to stop contacting anyone who asks them to.

For each company, in particular: its registered name, its locality and canton, its website, the Dynamics product it uses, its confidence tier, the date of the latest evidence when known, where relevant its migration status, and its known decision makers. Names and job titles come from public business information (the commercial register, company websites) and from providers of business contact data. Email addresses come from these providers or are derived from the company’s email address pattern; we have them checked by a specialist service, and the list shows the result of that check for each address.

The public documents we use to verify the lists may mention other people. We keep these documents internally, for verification.

The registered name of a sole proprietorship contains its owner’s name, so it is also personal data. The owner can ask us to remove the business on the opt-out page.

Legal basis: our overriding private interest, and that of our customers, in business-to-business prospecting (Art. 31(1) FADP); part of this data, such as names and job titles in the commercial register or on company websites, has been made generally accessible (Art. 30(3) FADP). Where the GDPR applies: the same legitimate interest (Art. 6(1)(f) GDPR). You can object to the processing at any time on the opt-out page (Art. 30(2)(b) FADP; Art. 21 GDPR): your email address then goes on our suppression list and is left out of every list delivered afterwards.

6. Our own prospecting

To offer our lists, we approach potential business customers ourselves: Microsoft Dynamics partners, ISVs, recruiters. For this we process business contact data. It stays for our internal use: we do not sell it or pass it on to our customers.

Data processed

Name, job title, employer, business email address and the result of its verification. No private data and no sensitive data.

Where the data comes from

• Business information published by the companies themselves or by third parties (websites, professional publications)
• Business contact data providers and email address verification services

Informing the people concerned

If we write to you, our first message says where your contact details come from and links to this notice and to the opt-out page, where you can object to any further contact.

Legal bases

Switzerland (FADP): our overriding private interest in prospecting businesses (Art. 31(1) FADP); the data is mostly business data made generally accessible (Art. 30(3) FADP). You can object to the processing at any time (Art. 30(2)(b) FADP).

European Union, where the GDPR applies: our legitimate interest in business-to-business prospecting (Art. 6(1)(f) GDPR). You can object at any time (Art. 21 GDPR).

Retention

At most 2 years after collection when no exchange has taken place; earlier if the person has left the company. A removed address stays on our suppression list.

7. Providers and transfers abroad

We use providers in the following categories, in the countries shown:

• Website hosting and technical logs (United States).
• Email (Switzerland).
• Contact data enrichment and verification for our lists and our own prospecting (United States, European Union, Canada, New Zealand).
• Automated analysis of public documents, which may contain people’s names (European Union or United States).

Switzerland recognises the European Union, Canada and New Zealand as providing adequate data protection. The United States does so only for companies certified under the Swiss-U.S. Data Privacy Framework; for other transfers to the United States, we rely on the standard contractual clauses in our providers’ terms (Art. 16(2)(d) FADP; Art. 46 GDPR).

8. Your rights

You can ask for access to your data and its origin, its correction or deletion, and you can object to its processing. Where the GDPR applies, you can also ask for the restriction of processing and the portability of the data you gave us. Use the opt-out page or write to privacy@whoruns365.com. We reply within 30 days and may ask you to confirm your identity.

9. Supervisory authority

You can lodge a complaint with:

• Switzerland: the Federal Data Protection and Information Commissioner (FDPIC), www.edoeb.admin.ch.
• European Union: the data protection authority of the country where you live or work (list at edpb.europa.eu).

10. Changes

We update this notice when our processing changes. The version published on this website applies.