Legal
Privacy notice
Last updated: 12 November 2026
This notice explains how Apiax AG processes personal data when you visit www.apiax.com or contact us through it. It follows the Swiss Federal Act on Data Protection (FADP) and, where it applies, the EU General Data Protection Regulation (GDPR). It covers the website only, not our customer and partner applications.
1. Who is responsible
Apiax AG, Hohlstrasse 216, 8004 Zurich, Switzerland. Apiax AG is part of the Behavox group.
For any question about your data, write to info@apiax.com.
2. When you visit the website
To deliver the pages, our hosting provider AWS receives the technical data every browser sends: your IP address, the page requested, the time, the referring page and your browser's user agent. AWS processes these data to deliver the pages and to protect the service against attacks.
Fonts and images are served from our own domains. No third-party content is loaded before you choose in the cookie banner. The blog loads its posts from our database at Supabase, which also sees your IP address for that request.
While you browse, the website keeps the pages you visit, the site you came from and any campaign tags in your browser's session storage. If you submit a form, the pages and the site you came from are sent with it, so we know how you found us. If you accept statistics, the site you came from and the campaign tags are also sent with our visit statistics (section 3). Closing the tab deletes it.
Legal basis: our legitimate interest in running a secure website and in knowing how enquirers found us (Art. 6(1)(f) GDPR).
3. With your consent: visit statistics
Only if you click “Accept all” in the cookie banner do we measure how the website is used:
- Google Analytics 4 (Google Ireland Ltd. and Google LLC, USA) sets cookies and records the pages you view, your device and approximate location. Google does not store your full IP address.
- Our own visit statistics record the page, the site you came from, campaign tags, your device category, browser family and a random visitor id. They do not record your IP address.
We record your choice itself, so we can show that you consented: a random id, the choice, the banner version and the time. No IP address and no browser details. We keep this record, also of a rejection, on the basis of our legitimate interest in being able to show what you chose (Art. 6(1)(f) GDPR).
You can change your choice at any time under in the footer. Withdrawing deletes the analytics cookies and the visitor id in your browser. We ask again after 12 months, or sooner if what you are asked to accept changes.
Legal basis: your consent (Art. 6(1)(a) GDPR).
4. When you contact us or subscribe
Our contact, tour request and newsletter forms ask for your name, email address, company, job title, message, topics of interest and markets, depending on the form. With the submission we receive the pages you visited in that session and the site you came from (section 2).
We store the submission in our database at Supabase, notify our team by email and in our Slack workspace, and create or update your contact in our CRM at HubSpot. You only receive the newsletter if you ticked the box for it, and every newsletter has an unsubscribe link.
To stop automated spam, we keep the IP address of each submission for at most 20 minutes and then delete it.
Some reports, such as our Black Books, are offered for download through forms on cp.apiax.co, our pages hosted by HubSpot. Those forms ask for your name, email address and company. HubSpot stores your details in our CRM, and we use them as described in this section. If you tick the box on those forms, we also send you emails about our products, services and events until you unsubscribe. These pages ask for their own cookie consent. With it, HubSpot and Google Analytics set cookies there. Without it, Google Analytics still receives your visit, without cookies.
Legal basis: steps you asked for before a possible contract and our legitimate interest in answering enquiries (Art. 6(1)(b) and (f) GDPR). For the newsletter and these emails: your consent (Art. 6(1)(a) GDPR). On cp.apiax.co, the cookies rest on your consent (Art. 6(1)(a) GDPR), and Google Analytics without cookies on our legitimate interest in knowing how often those pages are visited (Art. 6(1)(f) GDPR).
5. Links to other sites
We link to LinkedIn, press articles and PDFs stored at HubSpot. When you open such a link, the other site receives your IP address and processes it under its own privacy notice.
6. Who receives your data
We use the following service providers. They process data on our behalf and under contract.
| Provider | Purpose | Where |
|---|---|---|
| Amazon Web Services (AWS) | Hosting of the website and its images (Amazon S3 and CloudFront) | Data stored in Frankfurt, Germany. Delivered through edge locations worldwide, mostly in Switzerland for Swiss visitors |
| Supabase | Database for form submissions, blog, consent records and visit statistics | Data stored in Ireland (EU). Supabase Inc. is a US company |
| HubSpot | Customer relationship management: contacts from our forms, including the report download forms on cp.apiax.co. Also hosts some PDFs we link to | USA |
| Google Analytics 4: on www.apiax.com only with your consent; on cp.apiax.co see section 4 | USA | |
| Google Workspace | Our email, including the notifications about your form submission and the messages you send us | USA |
| Amazon Simple Email Service (AWS) | Notifies our team of new form submissions | Frankfurt, Germany |
| Slack | Notifies our team of new enquiries and newsletter sign-ups | USA |
7. Data outside Switzerland and the EU
Some providers are in the USA or can access data from there. Where a country does not have an adequate level of data protection, we rely on the Swiss-US and EU-US Data Privacy Framework where the provider is certified, and otherwise on the standard contractual clauses of the European Commission, as recognised by the Swiss Federal Data Protection and Information Commissioner.
8. What we store in your browser
| Name | Purpose | Kept for |
|---|---|---|
| apiax_analytics_consent | Your cookie choice (accepted or declined) | Browser storage, until you change it |
| apiax_consent_id | A random id that links your consent records | Browser storage, until you clear it |
| apiax:visitPath, apiax:entryReferrer, apiax:entryUtm | The pages you visited, the site you came from and campaign tags. Sent with a form you submit, and with our visit statistics if you accepted them (section 2) | Browser session, deleted when you close the tab |
| apiax_consent_meta | When you made your cookie choice. We ask again after 12 months | Browser storage, until you change your choice |
| apiax:visitorId | A random visitor id for our visit statistics, only with consent | Browser storage, deleted when you withdraw consent |
| apiax:pageViewSession | Session id for our visit statistics, only with consent | Browser session, deleted when you withdraw consent |
| _ga, _ga_E3GEHQF2PJ | Google Analytics cookies, only with consent | Up to 2 years, deleted when you withdraw consent |
9. How long we keep data
- IP addresses for spam protection: at most 20 minutes.
- Form submissions in our database: three years.
- Contacts in our CRM at HubSpot: as long as our business relationship or your interest in our services needs them. You can ask us to delete your contact at any time (section 10).
- Notifications to our team in Slack: as long as your contact in our CRM, and deleted together with it.
- Emails to our team about your submission, and the messages you send us: as long as your contact in our CRM, and deleted together with it.
- Visit statistics: 14 months.
- Consent records: three years after your last choice, so we can show that you consented.
- Newsletter: until you unsubscribe. HubSpot keeps the record of your subscription and of your unsubscribing.
10. Your rights
You can ask us what data we hold about you and ask us to correct or delete it. Under the GDPR you can also restrict processing, object to it and receive your data in a portable format. You can withdraw a consent at any time, with effect for the future. Write to us at the address in section 1.
You can complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC) or to the data protection authority in your EU country of residence.
11. Changes
We update this notice when the website changes. The date at the top shows the latest version.