Data Protection Statement of Francesco Loschiavo (SwissLOF)

With this Data Protection Statement we, Francesco Loschiavo (SwissLOF) (hereinafter Francesco Loschiavo (SwissLOF), we or us), describe how we collect and further process personal data. This Data Protection Statement is not necessarily a comprehensive description of our data processing. It is possible that other data protection statements or contractual terms are applicable to specific circumstances. The term "personal data" in this Data Protection Statement shall mean any information that identifies, or could reasonably be used to identify, any person.

If you provide us with personal data of other persons (such as work colleagues or invited participants), please make sure the respective persons are aware of this Data Protection Statement and only provide us with their data if you are allowed to do so and such personal data is correct.

This Privacy Notice is aligned with the EU General Data Protection Regulation («GDPR»), the Swiss Data Protection Act («DPA») and the revised Swiss Data Protection Act («revDPA»). However, the application of these laws depends on each individual case.

1. Controller / Data Protection Officer / Representative

The "controller" of data processing as described in this data protection statement is the following natural person (operator of SYNCnode, also acting under the developer alias SwissLOF):

You can notify us of any data protection related concerns using the following contact details: Francesco Loschiavo (SwissLOF), Datenschutzkoordination, Schickenstrasse 10, 8157 Dielsdorf, Schweiz, E-Mail: privacy@loschgi.info.

Our representative in the EEA according to art. 27 GDPR (if legally required) is: EU-Vertretung (auf Anfrage erhältlich via privacy@loschgi.info).

2. Collection and Processing of Personal Data

We primarily process personal data that we obtain from our clients and other business partners as well as other individuals in the context of our business relationships with them or that we collect from users when operating our websites, web applications (such as SYNCnode), and other digital services.

Insofar as it is permitted to us, we obtain certain personal data from publicly accessible sources (e.g. commercial registers, press, internet) or we may receive such information from authorities or other third parties. Apart from data you provide to us directly, the categories of data we receive about you include, but are not limited to:

• Information in connection with your professional role and activities;
• Information about you in correspondence and communications with third parties;
• Information regarding compliance with legal and security requirements;
• Data in connection with your use of our websites and application (e.g. IP address, date and time of visit, technical device and browser information, room identifiers for peer signaling).

3. Purpose of Data Processing and Legal Grounds

We primarily use collected data in order to conclude and process contracts with our clients and business partners, in particular in connection with Provision and technical operation of the decentralized peer-to-peer video conferencing and collaboration platform SYNCnode, as well as in order to comply with our domestic and foreign legal obligations.

In addition, in line with applicable law and where appropriate, we may process your personal data for the following purposes, which are in our (or any third parties') legitimate interests:

• Providing, operating, maintaining, and improving our products, services, and platforms;
• Communication with third parties and processing of technical support requests;
• Ensuring our operations, including IT security, platform integrity, and network reliability;
• Prevention, detection, and investigation of system abuse, security incidents, or unlawful conduct;
• Asserting legal claims and defense in legal disputes and official proceedings.

If you have given us your consent to process your personal data for specific purposes, we will process your personal data within the scope of and based on this consent, unless we have another legal basis. Consent given can be withdrawn at any time, without affecting data processed prior to withdrawal.

4. Cookies / Tracking and Other Techniques Regarding Website Use

We use certain browser technologies on our websites and within the SYNCnode application to ensure flawless operation.

4.1 Strictly Necessary Cookies & Browser LocalStorage

We use session cookies and standardized browser LocalStorage strictly for technically necessary functions (such as remembering your chosen interface language, camera/microphone permission states, and temporary room codes for peer connection). These records remain on your local device and are not shared with advertising or tracking networks.

4.2 No Third-Party Analytics or Marketing Pixels

SYNCnode does not utilize third-party tracking scripts (such as Google Analytics, Meta Pixel, or commercial ad trackers) or social media plugins that record or monitor your browsing behavior across the web.

4.3 Server Logs

When you access our application, our web servers automatically record technical parameters (e.g. IP address, browser type and version, operating system, referrer URL, and timestamp). These logs are processed purely to guarantee stability, connectivity, and defensive cybersecurity.

5. Datatransfer and Transfer of Data Abroad

In the context of our business activities and in line with the purposes set out in Section 3, we may transfer data to third parties, specifically to the following categories of recipients:

• IT & Infrastructure Providers: Our web and signaling relay infrastructure is hosted with Kreativ Media GmbH, Zollstrasse 24, 8005 Zürich, Schweiz;
• Authorities or Courts, domestically or abroad, where we are legally required to do so;
• Legal Counsel & Auditors to safeguard our legitimate legal interests.

These recipients are located primarily in Switzerland and the European Economic Area (EEA). If data is transferred to a country without an adequate statutory level of data protection, we ensure compliance using the revised European Commission’s Standard Contractual Clauses (SCC) or equivalent recognized safeguards.

6. Retention Periods for your Personal Data

We process and retain your personal data as long as required for the performance of our contractual and legal obligations or other purposes pursued with the processing.

Transient operational data (such as temporary signaling logs to facilitate the WebRTC peer handshake) are deleted promptly, and general operational logs are retained for periods of twelve months or less unless an incident requires extended preservation.

7. Data Security

We implement appropriate technical and organizational security measures (TOMs) to protect your personal data from unauthorized access, loss, or misuse:

• Transport Layer Security (TLS): All HTTP/WebSocket traffic between your client and our web servers is encrypted via modern TLS/HTTPS.
• Client-Side End-to-End Encryption (Web Crypto): Media and data channels between connected peers are protected end-to-end using hardware-accelerated 256-bit AES-GCM cryptography.
• Infrastructure Protection: Strict physical and logical access controls and scheduled system maintenance.

8. Obligation to Provide Personal Data To Us

In using our services, you must provide the personal and technical data necessary for the initiation and execution of the online session. Without certain technical transmission data (such as your IP address), the platform cannot establish real-time network traffic.

9. Profiling and Automated Individual Decision-Making

We do not process your personal data automatically to evaluate personal aspects (no profiling). Furthermore, we do not employ fully automated individual decision-making procedures within the meaning of Art. 22 GDPR.

10. Your Rights

In accordance with and to the extent provided by applicable data protection laws (such as GDPR and the Swiss revDPA), you are entitled to the following rights:

• Right of Access: The right to obtain confirmation and information regarding personal data processed about you;
• Right to Rectification: The right to have inaccurate or incomplete data corrected;
• Right to Erasure: The right to request the deletion of your personal data;
• Right to Restriction of processing;
• Right to Object to our data processing;
• Right to Data Portability: The right to receive your data in a structured, commonly used format.

To exercise your rights, you can reach out to us at any time using the contact details in Section 1 (privacy@loschgi.info). Please note that we may require proof of identity to prevent unauthorized disclosure.

Every data subject also has the right to lodge a complaint with the competent supervisory authority. The competent authority in Switzerland is the Federal Data Protection and Information Commissioner (FDPIC / EDÖB) (www.edoeb.admin.ch).

11. Amendments of this Data Protection Statement

We reserve the right to amend this Data Protection Statement at any time without prior notice. The version currently published on our website shall apply.