Privacy notice

At a glance

• Project enquiries are stored for the ToBeTold team and forwarded through an email delivery service.
• YouTube players stay unloaded until the individual video is explicitly loaded. An external viewing link is also available.
• No advertising pixel, audience analytics or newsletter integration is present in the reviewed website code.
• Privacy requests can be sent to contact@tobetold.ch.

1. Responsible company

ToBeTold GmbH, Goldiwilstrasse 14o, 3600 Thun, Switzerland, is responsible for the processing described here. Contact: contact@tobetold.ch, +41 77 522 04 70.

This notice covers the website and its enquiry form. Production-specific handling of footage, participants and customer materials is addressed in the relevant project agreement and, where applicable, a separate data processing arrangement.

2. Website delivery and security

The reviewed site is configured to use Cloudflare infrastructure for website delivery, a D1 database and R2 storage for portfolio media. Page requests involve technical connection data such as the IP address, requested URL and browser information, which are needed to deliver and protect the website.

The application does not implement audience analytics or advertising tracking. Technical processing by the hosting platform is distinct from marketing analytics. The host’s actual logging settings, contractual providers, storage locations and deletion periods must still be confirmed for the final notice.

Provider information: Cloudflare privacy policy ↗.

3. Project enquiries

The form collects the submitted name or organisation, email address, event information, date and location, requested content, project goal, budget range and message. These details are used to assess and respond to the enquiry and prepare a possible collaboration.

Submissions are stored in the website database with an enquiry identifier, a timestamp and email delivery status. For abuse prevention, the application stores a hashed value derived from the connection’s IP address and a server secret. This is a pseudonymous security identifier, not anonymous audience measurement.

When email delivery is configured, the submitted enquiry is also sent through Resend (Plus Five Five, Inc.) to the company mailbox and an additional ToBeTold team mailbox on Bluewin. Resend handles the message content and delivery data. A failed email delivery does not remove the enquiry from the database.

Resend states that its primary processing and stored customer data are in the United States. Its published data processing addendum contains standard contractual clauses with Swiss adaptations. The applicable account agreement and the complete mailbox-provider chain remain part of the pre-publication review. Provider information: Resend data processing information ↗ and data processing addendum ↗.

The form does not subscribe submissions to a mailing list. Confidential production files, identity documents and sensitive personal information should not be included in an initial enquiry.

4. Optional YouTube videos and external links

Embedded project films use an individual load control. Until that control is activated, the player is absent and this video component makes no request to YouTube. Its placeholder does not load an external thumbnail.

Loading the player establishes a connection to YouTube/Google and transmits technical information such as the IP address, browser information, this website’s origin and viewing interactions. Processing can take place outside Switzerland, including in the United States. The privacy-enhanced YouTube domain does not make playback anonymous or guarantee that no cookies or similar storage are used.

The “Remove YouTube player” control removes the embedded player. It does not undo information already transmitted or delete storage controlled by YouTube. The choice is not saved between page visits.

Opening a YouTube, Instagram or other external link navigates to that provider; its own privacy rules then apply. Provider information: Google privacy policy ↗.

5. Cookies and browser storage

The reviewed public-site application does not set a cookie for audience analytics, advertising or video preferences. A technically necessary session cookie is used for the restricted content administration area; its lifetime is controlled by the administration login and logout flow.

After a form submission, the browser’s per-tab session storage holds only a processing status and timestamp so the confirmation page can show the result. An accepted status means that the delivery provider accepted the request; it does not confirm delivery to a mailbox. The record is removed when the confirmation page reads it and is ignored after 15 minutes. It contains no form fields or enquiry identifier and is not used for advertising or audience analytics.

Cookies set by the hosting platform and by an explicitly loaded external player must be distinguished from the application’s own cookies. The final deployment’s runtime behaviour must be checked before this draft is approved. No blanket acceptance of optional services is required to browse the portfolio.

6. Retention and access

Enquiries are available to the authorised ToBeTold team in the administration area and the receiving mailboxes. Service providers process data to provide hosting, storage or email delivery.

The reviewed enquiry database has no configured automatic deletion period. A documented retention and deletion schedule for enquiries, the security identifier, delivery records, mailboxes and backups must be confirmed before publication. No unverified fixed deletion deadline is promised in this preview.

Any legally required retention of contract or accounting documents must be distinguished from ordinary initial enquiries and technical logs.

7. Privacy requests

Requests for information, correction or deletion, objections to processing and questions about an image or film can be sent to contact@tobetold.ch. Rights and any limitations depend on the applicable law; retention obligations and the rights of other people may affect a request.

The competent Swiss supervisory authority is the Federal Data Protection and Information Commissioner (FDPIC) ↗. The Swiss Federal Act on Data Protection applies; any additional law that applies to a particular case remains unaffected.