Privacy Policy
Last updated: June 2026 · Governed by Swiss law (DSG / nDSG)
1. Who we are
The Audit Room is operated by BUERGY GmbH, Recheraulaz 10, 3280 Meyriez, Switzerland. When you use this website or submit materials for review, BUERGY GmbH acts as the data controller responsible for your personal data.
2. What data we collect
We collect only the data necessary to provide our service:
- Contact details — name, email address, company name, and optionally phone number, provided when placing an order.
- Submitted materials — files, documents, briefs or other assets you upload for review.
- Payment data — processed exclusively by Stripe. We do not store card numbers or payment credentials. We receive a payment confirmation and transaction reference only.
- Usage data — anonymised analytics collected via Google Analytics 4, including page views, session duration, and device type. No personal identifiers are stored.
- Order metadata — audit type, language preference, delivery format, turnaround, and any context you provide in the order form.
3. How we use your data
- To deliver the requested audit or second opinion.
- To send order confirmations and deliver the completed review.
- To respond to questions or follow-up requests related to your order.
- To improve our service based on aggregated, anonymised usage patterns.
4. Confidentiality of submitted materials
All materials submitted to The Audit Room are treated as strictly confidential. By default, every engagement is covered by a mutual confidentiality agreement. Submitted files are stored in a secure, access-controlled environment and are accessible only to the reviewer performing the audit. Materials are not shared, published, or used for any purpose beyond conducting the requested review.
5. Legal basis for processing
We process your data on the following legal grounds under the Swiss Data Protection Act (nDSG) and, where applicable, the GDPR:
- Contract performance — processing is necessary to deliver the audit you ordered.
- Legitimate interest — anonymised analytics to improve our service.
- Legitimate interest — anonymised analytics to improve our service.
- Legal obligation — retaining transaction records as required by Swiss law.
6. Third-party services
- Stripe — payment processing. Data is subject to Stripe's Privacy Policy.
- Google Analytics 4 — anonymised usage analytics. Data is subject to Google's Privacy Policy. IP addresses are anonymised.
- Supabase — secure data storage, hosted in the EU (Zurich region).
- Resend — transactional email delivery.
- Webflow — website hosting and content delivery.
7. Data retention
We retain order data and submitted materials for as long as necessary to deliver and follow up on the service, and for up to 10 years thereafter as required by Swiss commercial and tax law. Submitted files are permanently deleted upon request. Analytics data is anonymised and retained in aggregate form.
8. Your rights
Under Swiss law (nDSG) and, where applicable, the GDPR, you have the right to:Access the personal data we hold about you.
- Request correction of inaccurate data.
- Request deletion of your data, subject to legal retention obligations.
- Withdraw consent where processing is based on consent.
- Lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC).