Understanding Data Security, GDPR, and LPD

This guide covers data protection regulations in Switzerland and Europe, and the measures taken by Infomaniak to secure your customer data and data within Web Hosting and Mail Services.

Understanding the difference between data security and data confidentiality

Data security aims to prevent any unauthorized access to your information. It relies on measures such as encryption, firewalls, or VPNs. A security breach can have disastrous consequences: imagine a hacker stealing your entire customer database and demanding a ransom to recover it. This type of attack – ransomware – can paralyze a company overnight.

Data confidentiality concerns who can access your information and how it is used. Even if your data is secure against hacking, it can be collected, analyzed, and resold… legally.

Example: you carefully store your customers' information, but unbeknownst to you, a service you use shares – anonymously – this data with third parties. Result? Your competitors can obtain valuable analyses of your market and target your own customers without ever needing to hack.

LPD & GDPR

In Switzerland, the LPD (Federal Law on Data Protection) and nLPD (for the "new Law" in effect since September 2023) protect the confidentiality of residents by regulating the collection and processing of personal data by organizations.

On the other hand, the GDPR (General Data Protection Regulation) of the EU, in effect since May 2018, influences global companies processing the data of European residents, including in Switzerland. While the LPD applies to the data of Swiss residents, the GDPR concerns that of EU residents. Swiss companies managing European data must comply with the GDPR requirements, including the designation of a Data Protection Officer and the conduct of Impact Assessments in case of risky processing.

Your role as an Infomaniak Client

Regarding the hosted data that belongs to you — and especially if it contains personal data of your visitors, contacts, or customers — it is your responsibility to ensure its compliance.

When processing this personal data, it is essential to inform users about the purpose and methods of this processing. This is usually done through a privacy policy or a data processing agreement (DPA).

Agreement between data controller and processor

A DPA (Data Processing Agreement), known in German as AVV (Auftragsverarbeitungsvertrag), in Italian as ATD (Accordo di Trattamento dei Dati), and in Spanish as CTA (Contrato de Tratamiento de Datos), translates to Data Processing Agreement or Personal Data Processing Contract.

It is a mandatory contract provided by the GDPR between a data controller and a processor. It defines the purpose, duration, and nature of the processing, as well as the obligations and security measures. Its goal is to protect the personal data entrusted to a service provider.

This GDPR certificate (in PDF format) can be generated and downloaded from the Manager (accessible to organization users who are owners or administrators):

Click here to access DPA management on the Infomaniak Manager (need help?).
Click the Generate button to download the customized PDF document:

Here are some tips on this subject:

Inform about all data processing, not just those related to the website.
Ensure easy access to the privacy statement on the website, for example, in the footer of each page.
Generally, it is not necessary to obtain the user's approval for privacy statements (e.g., for forms); it is sufficient to indicate where to find the statement (example Site Creator).
Keep in mind that new, more in-depth information rules may require adjustments to existing privacy statements.

It is crucial to differentiate between the security of the infrastructures where your data is hosted and the management and implementation of your data on your side. As a host, Infomaniak acts as a subcontractor for your GDPR-related obligations. In this context, its privacy policies and cookie usage, as well as its terms and conditions, provide the necessary guarantees regarding its compliance as a subcontractor.

If necessary, you can find professionals or online guides to help you in the compliance process.

Infomaniak's role

Like companies that work with user data, Infomaniak must comply with the LPD and, because some of these users are European citizens, the GDPR as well:

the data privacy policy details the data that Infomaniak retains to provide and execute its services
the policy related to the protection of your personal data describes Infomaniak's commitments as a subcontractor that hosts all of your data, including personal data

These commitments, as outlined in the general terms and specific conditions, are as follows:

to keep your data within data centers exclusively located in Switzerland and never to transfer your information outside of these infrastructures
to apply rigorous security standards and to continually improve processes to ensure a high level of security across all services
to promptly inform you in case of a data breach
to ensure transparency with you when Infomaniak uses subcontractors who may process your data
to strengthen and develop physical security measures to prevent any unauthorized access to the infrastructures where your data is stored
to implement physical and/or logical isolation systems (depending on the services) to separate the hosting of different clients; additionally, Infomaniak conducts annual penetration tests to ensure data integrity between clients
to demonstrate a high level of reactivity in updating the security of the systems under its responsibility

Manage the cookies on the infomaniak.com site

When you visit the page infomaniak.com a choice must be made for the acceptance of certain cookies. To modify this choice later, access your preferences from the bottom of the site's page:

Link to this FAQ:

Display all FAQs for this product