Privacy Policy & Imprint

1. Data Controller

Trinity Montessori GmbH, Bergstrasse 66, 8810 Horgen, Switzerland.

For all data protection inquiries: admin@trinity-edu.ch · +41 43 883 94 32. We have not designated a representative in the EU; please contact us at the addresses above.

2. Personal Data We Process

Server logs. When you visit the site, our hosting provider automatically records technical data: IP address, browser type, referrer URL, timestamp and the page requested. This data is used only to operate the site, detect attacks and troubleshoot. Server logs are retained for up to 30 days.

Contact form. If you write to us through the contact form, we process the data you provide — typically your name, email address, optional phone number, subject and message content. We use this information solely to respond to your inquiry.

Cookies and similar technologies. Functional cookies (e.g. the cookie-consent state, and a password-gate session on preview deployments) are set without consent because they are strictly necessary to operate the site. Analytics cookies (Google Analytics 4) are only set after you give explicit consent via our cookie banner. You can withdraw consent at any time through the same banner.

Booking iframe. The tour-booking page embeds a third-party iframe operated by Zehub. Booking data is processed directly between you and Zehub on Zehub's infrastructure; we do not store it ourselves.

3. Purposes of Processing

• Responding to inquiries and requests
• Providing, securing and maintaining our website
• Analysing site usage to improve content (only with your consent)
• Fulfilling legal obligations (e.g. retention of contractual documents)

4. Recipients and Third-Party Processors

We rely on the following service providers, who process data on our behalf under written data processing agreements:

• Vercel Inc. — web hosting and CDN (Frankfurt, EU primary; USA failover)
• Google LLC — Google Analytics 4 (with consent), Google Maps embed, and the Google Places API for school reviews (USA)
• Resend, Inc. — transactional email delivery for contact-form submissions (USA)
• Zehub — tour-booking iframe embedded on /tour (EU)

We do not sell or rent personal data. Beyond these processors, we share data only where legally required (e.g. court order).

5. International Data Transfers

Several of the processors above are located in the United States. We rely on the Swiss–U.S. Data Privacy Framework (where the recipient is certified) and the European Commission's Standard Contractual Clauses (SCC) as the legal basis for such transfers. The U.S. Department of Commerce maintains a list of certified entities at www.dataprivacyframework.gov.

You may request a copy of the safeguards in place by writing to admin@trinity-edu.ch.

6. Retention Periods

• Server logs: up to 30 days
• Contact-form messages: up to 12 months after the inquiry is closed, longer where legally required
• Analytics data (Google Analytics 4): 14 months (Google default, configured by us)
• Cookies: see the cookie banner — maximum lifetime is disclosed per cookie

7. Your Rights

Under the revFADP and, where applicable, the GDPR, you have the right to:

• Know what personal data we process about you (right of access)
• Have inaccurate data corrected
• Have your data deleted, subject to legal retention obligations
• Object to specific processing activities (in particular profiling or marketing)
• Receive your data in a structured, machine-readable format and have it transmitted to another controller, where technically feasible
• Withdraw any consent at any time (e.g. analytics consent via the cookie banner)
• Lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC, www.edoeb.admin.ch) or — if you are in the EU — your local supervisory authority

To exercise any of these rights, please contact admin@trinity-edu.ch. We will respond within 30 days. We may ask for proof of identity to prevent abuse.

8. Data Security

All data is transmitted over TLS/HTTPS. Our hosting and email providers maintain industry-standard security certifications. Access to personal data within our organisation is limited to staff members who need it to perform their duties.

9. Children's Data

We are a school, but our website itself does not knowingly collect personal data from children. Where children's data is processed in the context of enrolment, this is handled offline under a separate written agreement with parents or guardians.

10. Changes to This Policy

We update this policy when our processing activities or applicable law change. The current version is always available at this URL with the date of last update at the bottom.