Privacy policy

As of 25.10.2026 (draft, legal review pending). The German version is authoritative.

1. Controller

Hunkeler Digital Services, Richard Hunkeler, Im Storchen 1, 8212 Neuhausen am Rheinfall, Switzerland, info@igs.ch. Data protection contact point: datenschutz@igs.ch. This privacy policy is based on the Swiss Federal Act on Data Protection (FADP) and, where applicable, the EU General Data Protection Regulation (GDPR). The respective customer is the controller of the personal data in the DMARC aggregate reports of our customers' domains; we process it on the customer's behalf (section 5).

2. Data we process

• Account: name of the organisation, address, billing address, e-mail addresses and names of users, language, role, chosen display (light or dark), plan.
• Login and security: password (hash only), authenticator app key (stored in encrypted form), recovery codes (hash only), trusted devices (browser and operating system, timestamps), login times, IP addresses for abuse protection, log of important actions.
• Invitations: e-mail address and role of the invited person, inviting person, timestamps.
• Domains: the customer's domains, proofs of ownership, report address with token, results of the DNS checks (public DNS records, MTA-STS policy) and their history.
• Transport encryption (MTA-STS and TLS-RPT): for the MTA-STS policy provided by igs.ch, mode, mail servers (MX), id, validity and the times and history of releases with the email address of the person acting; from TLS-RPT reports (RFC 8460), reporting period, reporting organisation with contact address, report id, policy, number of successful and failed encrypted connections, type of failure, name and IP address of the receiving mail server and, where reported, IP address of the sending mail server, and the result of the signature check (DKIM).
• DMARC aggregate reports (section 4): reporting period, reporting organisation and report identifier; per report row, the IP address of the sending mail server, number of mails, disposition, SPF and DKIM results, domains and selectors, alignment and the domain in the From header (header-from); derived from these, host name (reverse DNS), network operator (ASN), assignment to a sender and its classification by the customer; the received report e-mails with headers and attachment until their deletion, as well as the result of the check of their signature (DKIM) with the signing domain.
• Phases: approvals of the next step of the DMARC policy by main users (time, step, e-mail address, justification) and the published records.
• Tasks: sender, error pattern, deadline, status, assigned person, history with replies, internal notes and uploaded files; for persons without an account (externals) to whom a customer assigns a task, additionally e-mail address, name (optional), language and times at which the personal link was accessed; replies of the assigned person by e-mail to order@igs.ch (text without quotation, attachments in permitted formats).
• Billing (paid plans): ordered plan and domains, billing address with optional UID or EU VAT number and the result of its check in the EU VAT Information Exchange System (VIES), invoices, credit notes, reminder levels, payments and payment status; incoming payments from bank statements (amount, date, payer, message, reference); for card payments an identifier and the last four digits of the card. If an account is looked after by a partner, we invoice the plan to the partner.
• E-mails: recipient, subject and time of e-mails sent.
• E-mails to the addresses of igs.ch (e.g. info@igs.ch or datenschutz@igs.ch): sender, recipients, subject, text, attachments and headers as well as our replies; result of the check of the sender's signature (DKIM); assignment to a customer account, a task or a data protection request, automatically based on the sender address, the case number or the task identifier, or manually; blocks of sender addresses or domains (time, by whom).
• Acceptance of the GTC including the data processing agreement: version, time, name and e-mail address of the accepting person, IP address.
• Data protection requests: type, scope, receipt, name, e-mail address, address in case of a contribution to costs, process and result.
• Contact form: name, e-mail address, organisation (optional), topic and message. They are sent by e-mail to the appropriate igs.ch mailbox (info@, datenschutz@ or security@igs.ch) and handled like e-mails to our addresses. To limit abuse we count requests per IP address; only a checksum (hash) is stored and deleted after 24 hours.
• Free DMARC check: the queried domain and the result of checking its public DNS records and its MTA-STS policy, cached for at most 10 minutes (key stored as a checksum). For rate limiting we count queries per IP address (for IPv6 per /64 network) and in total; only a checksum is stored and deleted after 24 hours. We do not link the queried domain to you. If you open the check via a link with the domain in the address (?domain=…), it appears like any page address in the web server’s access logs.

3. Purposes and legal bases

We process the data to provide the platform, perform and invoice contracts, ensure the security of the platform, prevent abuse, fulfil legal obligations and communicate with you. Legal bases are the contract, our legitimate interests and the legitimate interests of our customers (protection of their domains against spoofing, security of e-mail traffic, abuse protection, enforcement of claims) as well as legal obligations. We process e-mails to the addresses of igs.ch to answer enquiries, reports and requests and as evidence of the performance of contracts (contract, legitimate interests, legal obligations). We process reports that we cannot assign to any customer on the basis of our legitimate interest in secure and error-free operation (section 4).

4. DMARC aggregate reports and DNS checks

Origin: under the DMARC standard (RFC 7489), mail providers create aggregate reports on which servers have sent e-mails in the name of a domain to their users and whether these passed the SPF and DKIM checks. They send the reports to the address that the domain holder specifies in its DMARC record. If a customer points this address to igs.ch, the reports go to a report address of the form rua+token@igs.ch in a mailbox on our own server (Strasbourg data centre, France). We fetch them there via an encrypted connection (IMAP over TLS).

Content: the reports contain no e-mail content, no subject lines and no recipient addresses. We only store the information listed in section 2. We do not process forensic reports (ruf), which may contain parts of individual e-mails; if any are received, they are discarded without evaluation.

Personal reference: the IP addresses mostly belong to systems of businesses and mail providers. Occasionally a personal reference may exist, for example where a self-employed person operates their own mail server or e-mails are sent via a private internet connection. Domain names may also contain names of persons.

Assignment of senders: to assign IP addresses to a sender, we compare them with our catalogue of known services, look up the host name via reverse DNS and determine the network operator (ASN) via the public, free DNS service "IP to ASN" of Team Cymru. Only the IP address of the sending mail server is transmitted in these queries, no information about the customer, the domain or e-mails. Reverse DNS queries go to the name servers responsible for the respective IP range, usually its network operator.

Reports that cannot be assigned: we do not evaluate reports without a token, with differing tokens or with a domain that does not match the token; we are the controller for these. We do not evaluate or display reports for domains whose ownership has not yet been proven; we keep them for at most 7 days so that no data is lost after the proof.

DNS checks: daily and on request, we query the public DNS records of the customers' domains (SPF, DKIM, DMARC, MTA-STS, TLS-RPT, DNSSEC) and retrieve the MTA-STS policy at https://mta-sts.<domain>/.well-known/mta-sts.txt. We do not transmit any personal data in the process; the queried systems only see the IP address of our server. Public records may occasionally contain personal data (e.g. a contact address); we only store it as part of the check result.

TLS-RPT reports: under the TLS-RPT standard (RFC 8460), mail providers report whether they were able to deliver email to a domain's mail servers in encrypted form. If a customer sets the _smtp._tls record in DNS with the address tls+id@igs.ch, these reports go to the same mailbox as the aggregate reports and are handled in the same way (retrieval, assignment via the id, signature check, deletion of the emails after 7 days). They contain no email content, subject lines or addresses, only numbers of connections, types of failure and names and IP addresses of mail servers. We process them on behalf of the customer (section 5).

Hosted MTA-STS (Project and Partner plans): at the customer's request, we provide its MTA-STS policy at https://mta-sts.<domain>/.well-known/mta-sts.txt; for this, the customer points the name mta-sts.<domain> to our server via DNS (CNAME). As the standard requires, the policy is publicly retrievable; it contains only the mode, validity and the names of the domain's mail servers. For the mta-sts.<domain> names we obtain a shared certificate from Let's Encrypt (Internet Security Research Group, USA) and transmit only these names. Under the Certificate Transparency procedure, all names in a certificate are published in publicly accessible logs; in addition, anyone retrieving the certificate sees the names of all domains with hosted MTA-STS. The fact that a domain uses igs.ch for MTA-STS is therefore publicly recognisable. We do not evaluate retrievals of the policy; the IP addresses of retrieving mail servers appear only in the web server's access logs.

Data subjects: operators of mail servers who wish to exercise their rights regarding the report data contact the customer whose domain is concerned. If they contact us, we forward the request to the customers concerned.

5. Processing on behalf of customers

We process the personal data in the aggregate reports of a customer's domains on behalf of that customer. The customer is responsible; data subjects contact the customer to exercise their rights. We support the customer in this. Likewise, we process on behalf of the customer the information on externals to whom the customer assigns a task (e.g. employees of its IT partner); externals contact this customer to exercise their rights. This includes replies of the assigned person by e-mail to order@igs.ch that we add to the task history. The details are governed by the data processing agreement. It forms part of the GTC, is accepted together with them during registration and is published on igs.ch.

6. Cookies and web analytics

We only use technically necessary cookies. We use no tracking, no web analytics, no advertising and no third-party content; we also serve the fonts from our own server. All cookies apply only to igs.ch.

• "igs" (session): keeps you logged in. It ends when the browser is closed or after the inactivity period you have chosen (15 minutes to 7 days; from one day onwards, the login persists after the browser is closed). Cannot be read by scripts (HttpOnly); SameSite=Lax; when accessed via HTTPS, transmitted in encrypted form only (Secure).
• "igs_td" (trusted device): only if you choose it; the code then no longer has to be entered on this device. Duration 1 to 90 days (default 30), revocable at any time under "Account → Security". Cannot be read by scripts (HttpOnly); SameSite=Lax; when accessed via HTTPS, transmitted in encrypted form only (Secure).
• "igs_theme" (display): only if you switch between light and dark display without being logged in. It only stores this choice and no identifier; duration 12 months; SameSite=Lax. For logged-in users, we store the choice in the account.

7. Storage location and disclosure

The platform, the database, the mailbox for the aggregate reports and e-mail delivery run on a dedicated server of Hunkeler Digital Services provided by Server4You GmbH (Hanau, Germany) in a data centre in Strasbourg (France); we handle system administration ourselves. We transfer invoices and credit notes (with billing address, e-mail address, amounts and payment status) to our own accounting program cash.simples.ch; it is operated by Hunkeler Digital Services, likewise on a server of Server4You GmbH in Strasbourg. Under the Data Protection Act, France and Germany are states with adequate data protection. There is currently no separate data processing agreement under Art. 9 FADP with Server4You. We have assessed the associated risks and accepted them internally. We aim to conclude such an agreement by 31.03.2027. Encrypted backup copies are additionally kept on a separate computer of our own in Switzerland.

Recipients or categories of recipients:

• Processors: Server4You GmbH, Hanau (Germany), Strasbourg data centre (France): provision of the servers for igs.ch (platform, database, files, mailbox and e-mail delivery) and for cash.simples.ch (accounting data).
• Customers of igs.ch and the users of their account: the evaluations of the aggregate reports and the results of the DNS checks of their domains.
• Externals to whom a customer assigns a task: only this task with domain, sender, instructions, servers according to the reports and history (without internal notes).
• Customers of igs.ch, in the history of their tasks: replies of the assigned person by e-mail to order@igs.ch (text and permitted attachments) if the sender is confirmed (valid signature matching the sender's domain). Customers do not see other e-mails to igs.ch.
• Team Cymru, Inc. (USA): the IP address of sending mail servers as a DNS query to determine the network operator (ASN), without further information.
• Let's Encrypt (Internet Security Research Group, USA): the mta-sts.<domain> names of domains with hosted MTA-STS, to issue the certificate; these names are published in public Certificate Transparency logs. The USA is not considered a country with adequate data protection; only domain names are transmitted, without further information about the customer.
• Network operators: the IP address of sending mail servers as a reverse DNS query to the name servers responsible for the IP range.
• Recipients' mail providers: e-mails are delivered via their own mail providers.
• European Commission (VIES): country code and EU VAT number, if a company based in the EU provides one, to check its validity for the VAT treatment of the invoice.
• Partners of igs.ch: if a partner looks after a client account, it sees and processes its content on behalf of the organisation.
• Banks: payments with the QR payment slip reach us through your bank and ours with amount, reference and payer.
• Authorities, if required by law.

Beyond that, we do not disclose data to third parties. We maintain the catalogue of known services ourselves.

8. Retention

• We keep account data and all content of an account (domains, senders and their classification, results of the DNS checks, evaluations of the aggregate reports) for the duration of the contract, unless a shorter period applies below. We delete them 90 days after the end of a paid subscription or after suspension for non-payment, unless the customer switches to the Free plan (section 6 of the GTC); beforehand, we send a reminder by e-mail every 10 days. Until then, you can download your data.
• We delete report e-mails in the mailbox after 7 days, including those that cannot be assigned and faulty ones. We delete reports for domains without proof of ownership after at most 7 days.
• We keep individual report rows (with IP addresses) for 30 days on the Free plan and for 13 months on the Project and Partner plans. After that, we only keep daily aggregates per sender (number of mails and results per day) as long as the domain is recorded in the account. If a sender cannot be assigned to a known service, it may be designated there by host name or IP address. If the customer removes a domain, we delete the associated report data.
• We retain TLS-RPT data for as long as individual report rows (Free 30 days, Project and Partner 13 months) and then delete it completely. We retain the MTA-STS history as long as the domain is registered in the account. If hosted MTA-STS is switched off (by the customer or on a change to the Free plan), we set the policy to "none" and remove it once its previous validity has expired (at most 15 days); in Certificate Transparency logs the names remain recorded permanently.
• We keep invoices, payments and other accounting records for ten years.
• We delete e-mail delivery logs after 180 days and expired login and invitation links after 30 days.
• We delete tasks with their history, replies, files and the information on the externals 24 months after their completion, at the latest together with the domain or the account. Links for externals are valid for at most 30 days, can be revoked at any time and are deleted 90 days after expiry. We keep the history of the phases as long as the domain is recorded in the account.
• We keep e-mails to the addresses of igs.ch and our replies for 24 months from the last message in a thread. If they relate to a customer's order (assignment to the customer account), we keep them for 5 years from the last message, even after the account has been closed and in the event of an erasure request. We keep e-mails relating to a data protection request for as long as the case. We may delete unwanted e-mails, such as advertising, earlier. We place e-mails from blocked senders in quarantine and delete them there after 20 days; the block remains until it is lifted, even in the event of an erasure request. The copy on our mail server is deleted as well.
• We keep evidence of the acceptance of the GTC and the data processing agreement for the duration of the contract and thereafter for as long as claims may arise from it.
• Backups are kept for at most 6 months; deleted data may still be contained in backups until then.
• We record deletions on request and account closures in a deletion record. If a backup has to be restored after an outage, we repeat these deletions using the deletion record; the platform repeats automatic deletions after the expiry of the time limits by itself. We do not record individual deletions of content by customers (e.g. a domain) (no deletion log); they may be present again after a restore, as a rule at most those of the last 12 hours. In that case, we inform the customers concerned.
• We keep the action log of an account (time, action, e-mail address of the acting person) for as long as the account exists and for 2 years after the account is closed as evidence in case of claims. The e-mail address remains there even after a login has been deleted.
• We keep data protection request cases and the deletion record for 6 years after completion; we check copies of identity documents and do not store them.
• We log access to the platform's interfaces (fetching of reports via IMAP, exports to accounting, payment service) with time, result and, where applicable, IP address in a separate database secured against subsequent modification for 6 months. We also record there when a protective limit is triggered (e.g. too many login attempts, free checks or messages via the contact form): type of limit, time, count, IP address, browser identification and, if signed in, the login – to prevent abuse, likewise for 6 months; queried domains and content are not recorded.
• We keep messages from the contact form like e-mails to our addresses (see above). We delete cached results of the free DMARC check after at most 10 minutes and the rate-limiting counters (checksums) after 24 hours.

9. Data security

We protect the data with technical and organisational measures, in particular encrypted transmission (HTTPS, IMAP over TLS), a strict Content Security Policy, storage of files outside the web directory, logging and a permission concept. For login we require a mandatory second factor (code from an authenticator app) in addition to the password. Exception: on a device that you have marked as trusted, the code is not required during the period you have chosen (at most 90 days). We store passwords and recovery codes as hashes only and the keys of the second factor in encrypted form. Each domain receives its own report address that cannot be guessed; reports are only evaluated if the domain in the report matches the report address. When reading in the reports, we protect ourselves against manipulated files with size and decompression limits and a parser without external entities. Links for externals are random, time-limited and revocable, are stored only as hashes or in encrypted form and show only the one task; we only accept uploaded files in permitted formats and deliver them only as downloads. We check report e-mails for a valid signature (DKIM) of the reporting organisation; only reports authenticated in this way count towards recommendations. Database and files are backed up in encrypted form at least every 12 hours. The details are set out in annex 2 of the data processing agreement.

10. Your rights

You have the right to access, rectification, erasure, restriction, handover or transfer of your data as well as to object and to withdraw consent.

You can request information about the personal data we process about you. The information comprises the information provided for by law, in particular the purposes of processing, the personal data processed, the recipients or categories of recipients, the retention period and, where provided for, the origin of the data.

You can request part of the information automatically via the platform. If the automatic extract does not contain all the information subject to the right of access, you can request supplementary information from our data protection contact point. We examine the request and provide the information to the extent required by law and within the statutory time limits. Restrictions permitted by law remain reserved.

• With a login, you submit access and erasure requests directly under "Account → My data". You receive the automatic extract by e-mail; it includes, among other things, your login, your account, your classifications and contributions to tasks, the action log, the e-mails sent to you, your e-mails to igs.ch with our replies and your requests. A further access request within 12 months is handled personally by our data protection contact point. You delete your login with your password and a code from the authenticator app. If there are other users in the account, the sole main user first hands over the role; if they are the only user, they close the account with their login. Content and logins are then deleted immediately; amounts already paid are not refunded.
• Without a login or for other requests, contact our data protection contact point at datenschutz@igs.ch. Where necessary to prevent unauthorised disclosure of data, we may request additional information to verify your identity. We only request a copy of an identity document if the identity cannot be sufficiently verified by less intrusive means. We check the copy of the identity document and do not store it.
• Access is free of charge. In exceptional cases (disproportionate effort, manifestly unfounded or excessive requests) we ask for a contribution to costs of at most CHF 300 in advance.
• A request via igs.ch only concerns the data of this platform. On request, we carry it out for all services of Hunkeler Digital Services.
• Data we process on behalf of customers (sections 4 and 5) concerns the respective customer; we forward your request to them.

You can lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC); in the EU with the competent supervisory authority.

11. Changes

We update this privacy policy when the platform or the law changes. The version published on igs.ch applies.