Privacy Policy.

§ 1Privacy at a Glance

The following notes provide a simple overview of what happens to your personal data when you visit this website. Personal data is any data by which you can be personally identified. Detailed information can be found in the sections below.

Data processing on this website is carried out by the website operator (see § 2). Some data is collected when you actively provide it to us (e.g., via the reservation form or by email). Other data is collected automatically by our IT systems when you visit the website (in particular technical log data).

§ 2Controller

The party responsible for data processing on this website is:

The controller is the natural or legal person who, alone or jointly with others, determines the purposes and means of processing personal data (e.g., names, email addresses, etc.).

§ 3General Information and Legal Bases

We treat your personal data confidentially and in accordance with statutory data protection regulations and this Privacy Policy.

Where you have consented to data processing, we process your personal data on the basis of Art. 6(1)(a) GDPR. Where your data is required for the performance of a contract or for pre-contractual measures, we process it on the basis of Art. 6(1)(b) GDPR. Where processing is necessary to comply with a legal obligation, it is carried out on the basis of Art. 6(1)(c) GDPR. Processing may further be based on our legitimate interest pursuant to Art. 6(1)(f) GDPR.

We point out that data transmission over the internet (e.g., communication by email) may have security gaps. Complete protection of data against access by third parties is not possible.

§ 4Your Rights

You have the right at any time to obtain information free of charge about the origin, recipients, and purpose of your stored personal data. You also have the right to request the correction or deletion of this data. If you have given consent to data processing, you can revoke this consent at any time with effect for the future.

In particular, you have the following rights:

• Access, correction, and deletion of your stored personal data.
• Restriction of processing, where legally permissible.
• Data portability: transmission of your data in a common, machine-readable format.
• Withdrawal of consent given, with effect for the future.
• Objection to processing carried out on the basis of Art. 6(1)(f) GDPR.
• Right to lodge a complaint with the competent supervisory authority (in Switzerland: the Federal Data Protection and Information Commissioner FDPIC; in the EU: the respective competent national data protection authority).

To exercise these rights, an informal message by email to energy@ry3t.com is sufficient.

§ 5SSL/TLS Encryption

For security reasons and to protect the transmission of confidential content — such as orders or inquiries that you send to us as the site operator — this site uses SSL or TLS encryption. You can recognize an encrypted connection by the fact that the browser's address bar changes from "http://" to "https://" and by the lock symbol in your browser bar.

When SSL or TLS encryption is activated, the data you transmit to us cannot be read by third parties.

§ 6Hosting (Vercel)

This website is hosted on the infrastructure of Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. When the website is accessed, technical information (see § 7) is automatically processed by Vercel.

We have concluded a Data Processing Agreement with Vercel. The transfer of data to the USA is based on the Standard Contractual Clauses of the EU Commission.

Details can be found in Vercel's privacy policy: vercel.com/legal/privacy-policy.

The legal basis is Art. 6(1)(f) GDPR. We have a legitimate interest in the reliable and fast provision of our website.

§ 7Server Log Data

When our website is accessed, our hosting provider (Vercel) automatically collects technical data in so-called server log files, which your browser transmits automatically:

• Browser type and version
• Operating system used
• Referrer URL (previously visited page)
• IP address (shortened / anonymized)
• Date and time of access

This data is not merged with other data sources. Its collection serves to ensure the smooth operation of the website and to prevent abuse (legitimate interest, Art. 6(1)(f) GDPR).

§ 8Cookies and Local Storage

Our website uses the following cookies and local storage mechanisms:

Strictly Necessary (localStorage / sessionStorage)

• Currency and language preference: storage of your CHF/EUR/USD and language selection. No personal data.
• Marketing parameters (approx. 90 minutes): temporary storage of campaign parameters from the URL (utm_*, fbclid) in order to attribute your reservation or eBook request to the correct advertising campaign.

Analytics and Marketing (Cookies)

• _fbp, _fbc (Meta) — cookies of the Meta Pixel to measure advertising effectiveness. Retention: up to 90 days. See § 9 for details.
• _ga, _ga_* (Google) — cookies of Google Analytics 4 for statistical reach measurement. Retention: up to 2 years. See § 11 for details.

You can set your browser to block localStorage and cookies in general or on a case-by-case basis. If they are completely deactivated, individual functions of our website may be limited.

Legal basis for strictly necessary storage: Art. 6(1)(f) GDPR (legitimate interest in a functional website). Legal basis for analytics and marketing cookies: Art. 6(1)(f) GDPR (legitimate interest in reach measurement and advertising optimization). Options for objection and opt-out are described in § 12.

§ 9Meta Pixel and Conversions API

The Meta Pixel of Meta Platforms Ireland Limited (4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland) is integrated on our website. In addition, we transmit certain events server-side to Meta directly via the Meta Conversions API.

What is Processed

• Pixel in the browser: when you visit the website, the Pixel records your IP address, browser/device information, pages visited, and interactions (e.g., clicks on reservation buttons, form submissions). This data is stored in the _fbp and _fbc cookies (see § 8).
• Conversions API (server-side): for reservation and eBook requests, we additionally send data directly from our server to Meta: hashed email address, hashed first and last name (if provided), IP address, user agent, and the value and currency of the reservation. Personal data is hashed via SHA-256 before transmission (pseudonymization).
• Automatic Advanced Matching: when you fill in form fields, the Pixel may transmit these to Meta in hashed form for effectiveness measurement.

Purpose

Measuring the effectiveness of our advertisements on Facebook and Instagram, optimizing ad delivery, and statistical analysis of user behavior on the website.

Legal Basis

Art. 6(1)(f) GDPR (legitimate interest in effective advertising and reach measurement). Option to object is described in § 12.

Recipients and Third-Country Transfer

Recipient: Meta Platforms Ireland Limited (EU). A transfer to the parent company Meta Platforms Inc. in the USA cannot be ruled out. Meta bases this transfer on the EU Standard Contractual Clauses. Details: facebook.com/privacy/policy.

§ 10Custom Audiences and Lookalike (Meta)

We use the advertising functions "Custom Audiences" and "Lookalike Audiences" of Meta Platforms Ireland Limited to deliver advertising in a more targeted way.

What is Processed

• Custom Audiences from customer list: we transmit hashed email addresses (SHA-256, irreversibly pseudonymized) of our newsletter subscribers and reservation prospects to Meta. Meta matches these against its own user profiles in order to deliver advertising more precisely.
• Custom Audiences from website visits: based on the Meta Pixel (§ 9), we build lists of people who have visited our website.
• Lookalike Audiences: based on our Custom Audiences, Meta automatically creates anonymous profiles of people with similar characteristics, to whom our advertising is then delivered.

Purpose

Delivery of advertising to relevant target groups and increasing the efficiency of our marketing measures.

Legal Basis

Art. 6(1)(f) GDPR (legitimate interest in effective advertising). For newsletter subscribers, additionally the consent given as part of the newsletter opt-in (Art. 6(1)(a) GDPR).

Objection

You can object to the use of your data for Custom Audiences at any time by email to energy@ry3t.com. We will then remove your data from the uploaded audience lists.

§ 11Google Analytics 4

We use Google Analytics 4 (GA4) of Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) for the statistical analysis of website usage.

What is Processed

When the website is visited, GA4 records: IP address (shortened / anonymized), browser data, pages visited, time spent, device type, and approximate location (country/region). This data is stored in the _ga and _ga_* cookies (see § 8).

Purpose

Reach measurement, detection of technical problems, and statistical analysis of user behavior.

Legal Basis

Art. 6(1)(f) GDPR (legitimate interest in reach measurement).

Third-Country Transfer

A transfer to Google LLC in the USA is possible. Google relies on the EU Standard Contractual Clauses. Details: policies.google.com/privacy.

Objection / Opt-Out

You can prevent collection by GA4 by installing the browser add-on: tools.google.com/dlpage/gaoptout.

§ 12Objection and Opt-Out

You can object to the processing of your data for advertising and analytics purposes at any time:

• Meta Pixel and Custom Audiences: deactivate in your Meta ad settings or by email to us: energy@ry3t.com.
• Google Analytics: browser add-on tools.google.com/dlpage/gaoptout.
• Cookies in general: browser settings or incognito mode. You can also decline analytics and marketing cookies via the "Reject" option in our cookie banner.
• Newsletter: unsubscribe link in every email or message to energy@ry3t.com.

§ 13Reservation Form

When you use the reservation form for the RY3T NOVA, we collect the following data:

• Name
• Email address
• Postal code
• Details of your existing PV system (capacity in kWp)
• Number of reserved NOVA units
• Optional notes

This data is processed to handle your reservation, to carry out the payment, and to prepare the subsequent delivery. Legal basis: Art. 6(1)(b) GDPR (contract initiation and performance).

Your data is passed on to the following processors insofar as this is necessary for the performance of the contract:

• PayPal (see § 15) — for processing the deposit payment
• ActiveCampaign (see § 14) — for sending the confirmation email and further information relating to your reservation

Processing is confidential and exclusively for the stated purposes.

§ 14Newsletter and Reservation Communication (ActiveCampaign)

For communication relating to your reservation (confirmation, production status, delivery information) as well as for our voluntary newsletter, we use the service ActiveCampaign of ActiveCampaign, LLC, 1 N Dearborn, 5th Floor, Chicago, Illinois 60602, USA.

The data you provide during reservation or newsletter sign-up (in particular email address, name, postal code, reservation details) is stored on ActiveCampaign's servers in the USA and used for sending emails and for evaluating campaigns (open and click rates).

The legal basis for reservation-related emails is Art. 6(1)(b) GDPR (contract performance). The legal basis for the voluntary newsletter is your consent pursuant to Art. 6(1)(a) GDPR. You can revoke your consent at any time, e.g., via the unsubscribe link in every newsletter email.

The transfer of data to the USA is based on the EU Commission's Standard Contractual Clauses. Details: activecampaign.com/privacy-policy.

§ 15Payment Processing (PayPal)

We offer payment of the reservation deposit via PayPal. The provider of this payment service is PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg.

If you choose to pay via PayPal, the payment data you enter is transmitted directly to PayPal. We ourselves only receive a confirmation of the payment status, a transaction ID, and — where held at PayPal and required for contract processing — the payer's name and email address.

Legal basis: Art. 6(1)(b) GDPR (contract performance) and Art. 6(1)(f) GDPR (interest in smooth payment processing).

The transfer of data to the USA is based on the EU Commission's Standard Contractual Clauses. Details: paypal.com/us/webapps/mpp/ua/privacy-full.

§ 16Contact by Email

If you contact us by email, your inquiry including all personal data resulting from it (name, email address, content of the message) will be stored and processed by us for the purpose of handling your request. We do not pass this data on without your consent.

Processing is based on Art. 6(1)(b) GDPR if your inquiry is related to the performance of a contract or is necessary for the implementation of pre-contractual measures. In all other cases, processing is based on our legitimate interest in the effective handling of inquiries addressed to us (Art. 6(1)(f) GDPR).

§ 17Retention Period

Unless a more specific retention period is stated within this Privacy Policy, your personal data will remain with us until the purpose for the data processing no longer applies. If you assert a justified request for deletion or revoke your consent to data processing, your data will be deleted, provided we have no other legally permissible reasons for storing it (e.g., retention periods under tax or commercial law). In the latter case, deletion takes place after these reasons cease to apply.

For business records (e.g., reservation and payment receipts), statutory retention periods apply — in Switzerland generally 10 years pursuant to Art. 958f of the Swiss Code of Obligations.

§ 18Data Transfers to Third Countries

We use tools from companies based in the USA or with potential data transfer to the USA (in particular Vercel, ActiveCampaign, PayPal, Meta Platforms, Google). When these tools are active, your personal data may be transferred to and processed in the USA. We point out that the USA cannot guarantee a level of data protection comparable to that of the EU.

Each data transfer is based on the EU Commission's Standard Contractual Clauses. Details can be found in the linked privacy policies of the respective providers.

§ 19Changes to This Policy

We reserve the right to adapt this Privacy Policy so that it always complies with current legal requirements or in order to reflect changes to our services. The version in force at the time of your renewed visit then applies.

§ 20U.S. State Privacy Rights (California and Others)

This section provides additional information for residents of the United States, in particular California (under the California Consumer Privacy Act as amended by the California Privacy Rights Act, "CCPA/CPRA") and other states with comprehensive consumer privacy laws (e.g., Virginia, Colorado, Connecticut, and Utah). Where this section conflicts with the sections above, this section prevails for U.S. residents to the extent required by applicable state law.

Categories of Personal Information We Collect

In the past 12 months we have collected the following categories of personal information from website visitors and prospects:

We do not collect or process sensitive personal information (such as government IDs, precise geolocation, or account credentials) for the purpose of inferring characteristics, and we do not knowingly collect personal information from minors under 16 years of age.

Purposes

We use this information to operate and secure the website, to process reservations and payments, to communicate with you, and to measure and deliver advertising. See §§ 6–16 for details.

"Sale" and "Sharing" of Personal Information

We do not sell your personal information for money. However, our use of advertising cookies and pixels (Meta, Google — see §§ 9–11) to deliver targeted advertising may qualify as a "sale" or as "sharing" for cross-context behavioral advertising under the CCPA/CPRA and similar state laws. The categories potentially "sold" or "shared" in this sense are identifiers, internet/network activity, and inferences. We do not knowingly "sell" or "share" the personal information of consumers under 16 years of age.

Your Rights

Subject to your state of residence and applicable law, you have the right to:

• Know / access the personal information we have collected about you and how we use and disclose it;
• Delete personal information we have collected from you, subject to legal exceptions;
• Correct inaccurate personal information;
• Opt out of the "sale" or "sharing" of your personal information and of targeted advertising;
• Limit the use of sensitive personal information (note: we do not use sensitive personal information for purposes that would trigger this right);
• Non-discrimination: we will not discriminate against you for exercising any of these rights.

How to Exercise Your Rights

You can exercise these rights as follows:

• Opt out of targeted advertising / "sale" or "sharing": select "Reject" in our cookie banner, adjust your Meta ad settings and Google ad settings, or email us at energy@ry3t.com. We aim to honor recognized opt-out preference signals (such as Global Privacy Control) where legally required.
• Access, deletion, correction, and other requests: email us at energy@ry3t.com with the subject line "U.S. Privacy Request." We will verify your request by matching the information you provide (e.g., your email address) against our records. You may use an authorized agent to submit a request on your behalf, subject to verification.

We will respond within the timeframe required by applicable law (generally 45 days, extendable where permitted). If we deny your request, you may appeal by replying to our decision; where your state provides one, you may also contact your state attorney general.

Retention

We retain personal information for as long as necessary for the purposes described in this Policy and as required by law (see § 17).

RY3T AG · Wil, Switzerland · CHE-374.956.594 · As of 09.07.2026