Data controller
The data controller for this website and drilic CxO Suite is Drazenko Ilic (drilic), Im Bruggen 26, 8906 Bonstetten, Switzerland. Contact: drazenko@drilic.ch.
What data we process
Account and login data, the company and leadership data you enter (business situation, metrics, decisions and implementation), and publicly available company information (commercial register/official gazette and your company website). We also process technical logs, such as IP address, access time and browser type, to operate the service. No private contact data is added.
Purposes
Providing and operating the Suite, establishing the public company information baseline, supporting leadership, security and abuse prevention, billing and support.
Legal bases
Performance of a contract, legitimate interests and, where required, your consent under the Swiss Federal Act on Data Protection (FADP) and, where applicable, the GDPR.
Hosting
The application server is hosted by Infomaniak Network SA in Geneva, Switzerland. Data in transit is encrypted using TLS/HTTPS.
Database and authentication
Database and authentication services are provided through Supabase Inc. (USA). Account, company and leadership data is stored there. Passwords are stored exclusively as hashes, with no plaintext access.
Use of AI
The Suite uses a language-model service (OpenAI-compatible; OpenAI Inc., USA) to prepare assessments, recommendations and evidence of impact. Processing is limited to the purposes of leadership support. Your data is not used to train the models. Results require review; facts and inferences are presented separately.
Public sources
The Suite processes publicly or officially available company information: the Swiss Official Gazette of Commerce (SOGC/SHAB), the commercial register (Zefix, where available) and your company’s own website. This data is designated for publication by law and is publicly accessible.
International data transfers
Certain service providers process data outside Switzerland, in particular Supabase Inc. (USA, database and authentication) and OpenAI Inc. (USA, AI processing). These transfers comply with Articles 16 et seq. FADP, particularly through appropriate safeguards or your consent.
Retention
Data is retained only for as long as necessary for the stated purposes or legal obligations. Invoice and payment data is subject to statutory retention periods (Article 958f of the Swiss Code of Obligations).
Your rights
Under applicable law, you have rights of access, rectification, erasure, restriction and data portability, as well as a right to object. Please send requests to drazenko@drilic.ch. You may also contact the Federal Data Protection and Information Commissioner (FDPIC).
Contact
For questions about privacy, contact drazenko@drilic.ch.