Privacy Policy

1. Introduction

Welcome to Pegaso Services. We are committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, store, and protect your personal data when you visit our website, interact with our services, or engage with us in any way.

This policy is drafted in accordance with the Swiss Federal Act on Data Protection (FADP), the EU General Data Protection Regulation (GDPR – Regulation EU 2016/679), and other applicable data protection legislation.

By using our website and submitting information through our contact form, you acknowledge that you have read and understood this Privacy Policy.

2. Data Controller

The data controller responsible for processing your personal data is:

Pegaso Services Sagl
Swiss UID: CHE-323.693.697
Email: contact@pegasoservices.ch
Phone: +39 3939468060

For any questions regarding data protection, please contact us at the email address above.

3. Personal Data We Collect

We only collect personal data that is strictly necessary for the purposes described in this policy. The categories of data we may collect include:

• Contact form data: Name, email address, subject, message content, and GDPR consent confirmation
• Technical data: IP address (hashed for rate limiting purposes only), browser type, device type, timestamp of form submission
• Communication data: Any additional information you voluntarily provide when contacting us by phone or email

We do not collect sensitive personal data (such as health data, biometric data, or financial information) through our website.

4. Purpose of Processing

Your personal data is processed exclusively for the following purposes:

• To respond to your enquiries and requests submitted via the contact form
• To provide the services you have requested (security consulting, luxury car rental, drone surveillance, software development, villa rental)
• To send you quotations, proposals, or follow-up communications related to your enquiry
• To comply with legal obligations under Swiss and EU law
• To prevent spam, fraud, and abuse of our contact form (rate limiting, honeypot, CSRF protection)
• To maintain internal records of communications for quality assurance and GDPR compliance

5. Legal Basis for Processing

We process your personal data based on the following legal grounds:

• Consent (Art. 6(1)(a) GDPR): You have explicitly consented to the processing of your data by ticking the GDPR consent checkbox in the contact form
• Contractual necessity (Art. 6(1)(b) GDPR): Processing is necessary to respond to your request and potentially enter into a contract
• Legitimate interest (Art. 6(1)(f) GDPR): Spam prevention, security of our systems, and maintaining business records
• Legal obligation (Art. 6(1)(c) GDPR): Compliance with applicable Swiss and EU regulations

6. How Your Data Is Processed

Contact Form Submissions

When you submit the contact form on our website, your data is transmitted securely via HTTPS to our server. The data is then sent via authenticated SMTP to our designated email address (contact@pegasoservices.ch). A hashed record of the submission (IP hash, name, subject, consent status, and timestamp) is stored in a local log file solely for GDPR compliance and anti-spam purposes.

Security Measures

We implement the following technical and organisational measures to protect your data:

• HTTPS encryption for all data transmissions
• CSRF token protection on all forms
• Honeypot fields and time-based bot detection
• IP-based rate limiting (maximum 5 submissions per IP every 10 minutes)
• Header injection prevention on all user inputs
• Authenticated SMTP for email delivery
• Server-side input sanitisation and validation

7. Cookies and Tracking

Our website uses only technical cookies that are strictly necessary for the site to function correctly:

• Session cookie (PHPSESSID): Required for CSRF token validation and GDPR consent state management. Automatically deleted when the browser session ends.
• localStorage (pegaso_lang): Stores your preferred language selection locally in your browser. No personal data is stored.

We do not use analytics cookies, advertising cookies, tracking pixels, or any third-party tracking technologies. No data is shared with Google Analytics, Facebook Pixel, or similar services.

8. Third Parties and Data Transfers

We do not sell, rent, or share your personal data with third parties for marketing purposes. Your data may be disclosed only in the following limited circumstances:

• Service partners: Trusted international security firms (including Resurgit Consulting Group) solely when required to deliver the specific service you have requested, and only with your prior knowledge
• Hosting provider: Our web hosting provider processes data on our behalf under strict contractual obligations compliant with Swiss FADP and GDPR
• Legal authorities: When required by law, court order, or government authority

Where data is transferred outside Switzerland or the EU/EEA, appropriate safeguards are implemented in accordance with Art. 46 GDPR and Swiss FADP requirements.

9. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected:

• Contact form submissions: Retained for up to 24 months from the date of submission, unless a longer period is required for ongoing contractual relationships or legal obligations
• Rate limiting logs: IP hashes are automatically purged after 10 minutes
• GDPR consent records: Retained for the duration of the business relationship plus the statutory limitation period

After the retention period expires, data is securely deleted or anonymised.

10. Your Rights

Under the GDPR and Swiss FADP, you have the following rights regarding your personal data:

• Right of access: Request a copy of all personal data we hold about you
• Right to rectification: Request correction of inaccurate or incomplete data
• Right to erasure: Request deletion of your personal data ("right to be forgotten")
• Right to restriction: Request limitation of processing under certain conditions
• Right to data portability: Receive your data in a structured, machine-readable format
• Right to object: Object to processing based on legitimate interests
• Right to withdraw consent: Withdraw your consent at any time without affecting prior lawful processing
• Right to lodge a complaint: File a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC) or your local EU supervisory authority

To exercise any of these rights, please contact us at contact@pegasoservices.ch. We will respond within 30 days.

11. Minors

Our services are intended for business professionals and adults. We do not knowingly collect personal data from individuals under the age of 18. If you believe we have inadvertently collected such data, please contact us immediately and we will delete it without delay.

12. Changes to This Policy

We reserve the right to update this Privacy Policy at any time to reflect changes in our practices, technology, or legal requirements. The "Last updated" date at the top of this page indicates when the most recent revision was made. Continued use of our website after changes constitutes acceptance of the updated policy.

13. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or the processing of your personal data, please contact us:

Pegaso Services Sagl
Swiss UID: CHE-323.693.697
Email: contact@pegasoservices.ch
Phone: +39 3939468060