Personal data runs through more systems than anyone ever documented: a CRM, a newsletter tool, an analytics service, a form that has been writing into a mailbox for years. Part of it sits on servers outside Switzerland and the EU, and whether there is a contract covering that, nobody knows for certain. As long as nothing happens, none of it shows. It shows the moment someone requests access, a major client asks before awarding a contract – or something leaks.
What to do about it
Compliance is not a question of documents but of knowledge: which data you collect, where they flow, on what basis, and how long they stay. As long as those four answers are missing, every privacy policy is a guess – and in an incident, precisely the guess that gets examined.
We follow the path of your data through your real systems rather than through a questionnaire, then close the gaps that matter: contracts, retention periods, access. Where it makes sense we move data onto Swiss servers we run ourselves, which makes the answer to the location question very short. You do not need a second supplier for it.
A first conversation is usually enough to name the two or three places that would be noticed first if it ever came to that.