Sign up / Login

Privacy Policy

Last updated: 22 September 2026

In this privacy policy, we, FutureTree AG (hereinafter "FutureTree", "we" or "us"), explain how we collect and otherwise process personal data. This privacy policy is addressed to our customers, website visitors, business partners, employees, and any other data subjects (hereinafter "you"). This is not an exhaustive description; specific circumstances may be governed by additional privacy notices or contractual terms. Personal data means any information relating to an identified or identifiable individual.

Controller

FutureTree AG
Stadthausgasse 10
4051 Basel
Switzerland
Email: datenschutz@futuretree.com

Collection and Processing of Personal Data

We primarily process personal data that we receive in the context of our business relationship with customers, partners, employees, or website users, or that is collected through your use of our services. Additionally, we may receive data from third-party sources, including publicly accessible registers (e.g., commercial registers, land registries, media, internet), or from authorities or business partners.

Categories of Personal Data

The personal data we collect may include:

  • Identity information (name, date of birth, address, nationality, etc.)
  • Contact details (email address, phone number)
  • Financial data (payment details, billing information)
  • Data concerning business relationships and contracts
  • Usage data and tracking information (IP address, browser type, session details, etc.)
  • Technical data from interaction with our platforms and services

Purpose and Legal Basis for Processing

We process your data primarily to:

  • Fulfill contractual obligations and perform our services
  • Respond to inquiries and communicate with you
  • Operate and improve our digital platforms and offerings
  • Carry out marketing activities and customer analytics
  • Comply with legal obligations in Switzerland and abroad
  • Ensure internal security, fraud prevention, and IT integrity

If you have given us your consent to process your personal data for specific purposes (e.g., subscribing to newsletters), we will process your data based on that consent. Consent can be revoked at any time, which will not affect prior processing.

Use of Cookies and Similar Technologies

We use cookies and similar technologies to operate and optimize our website. Cookies are small files stored on your device to track usage and enable various functionalities. You can manage cookie preferences through your browser settings. Disabling cookies may limit certain website features.

We use Google Tag Manager and Google Analytics (Google Ireland Limited) to understand how visitors use our website. These Google tools only run after you have given cookie consent, and may transfer data to Google servers, including outside Switzerland/the EEA. You can find more information on Google's data processing practices at https://policies.google.com/privacy.

We also use PostHog (EU Cloud, Frankfurt) to understand how our pages are used. What it does depends on your choice, and the difference matters:

  • Before you choose: nothing is measured and nothing is stored on your device.
  • If you accept: PostHog sets a cookie so that repeat visits can be recognised as the same session, and we can follow a journey through the site.
  • If you decline: we still count the visit, but without any cookie or other storage on your device and without an identifier that persists. PostHog derives a short-lived, non-reversible value on its servers instead, which cannot be used to recognise you on a later visit. The legal basis for this reduced measurement is our legitimate interest in knowing how many people use the site (Art. 6(1)(f) GDPR); you can object at any time using the contact address below.

On our public website — never in the logged-in dashboard — PostHog also records how pages are used, for example scrolling and where clicks land. All text and all form fields are masked before anything leaves your browser, so the recording shows the shape of the interaction and not what you read or typed. These recordings are only made if you accept cookies.

We do not use PostHog to build advertising profiles, we do not sell this data, and on the public website we do not attach a name or an email address to it. In the logged-in dashboard your activity is linked to your internal user number and whether your account is private or business, so that we can see how the product is used; your name, email address and telephone number are not sent to PostHog. You can change your cookie choice at any time using the cookie settings link in the footer.

Data Sharing and Transfers Abroad

We may disclose personal data to trusted service providers, authorities, legal entities, and affiliated companies when necessary for our business operations. Some recipients may be located abroad. In such cases, we ensure adequate protection of personal data, such as using standard contractual clauses approved by the European Commission.

Service Providers and Processors

We work with the service providers listed below. Each processes personal data only on our instructions and under a data processing agreement. Where a provider processes data outside Switzerland or the EEA, transfers are covered by appropriate safeguards such as the European Commission's standard contractual clauses.

  • Hosting and infrastructure: flow.swiss (Switzerland) — our application, database and file storage are operated in Swiss data centres.
  • Email delivery: Mailgun, operated by Sinch (EU region endpoint), with Resend as a fallback provider. These deliver transactional messages such as password resets and document downloads, and any newsletter you have explicitly subscribed to.
  • Payments: Stripe — payment processing and payment links. Card details are entered on Stripe's systems and are never stored by FutureTree.
  • Electronic signatures: DocuSign — preparation, delivery and signing of contracts.
  • Customer relationship management: Pipedrive — contact and opportunity records for business enquiries.
  • Telephony and transcription: Telnyx and Aircall — inbound and outbound calls and, where recording is enabled and disclosed, call recordings and transcripts.
  • Media delivery: Cloudinary — delivery of images used on our websites.
  • Analytics: Google Tag Manager and Google Analytics (Google Ireland Limited) — loaded only after you give cookie consent, as described above.
  • Product analytics: PostHog (PostHog Inc., EU Cloud) — we use the European instance, which processes and stores data on servers in Frankfurt, Germany. It tells us how our pages are used and where people get stuck, so we can improve them.

Plantation monitoring data collected by field sensors is technical environmental data (soil, weather and growth measurements) and contains no personal data.

Gated Documents and Email Subscriptions

Our websites offer documents — such as the Kiri Tree and CO₂ Certificates trust documents — that we send by email on request. When you request one, we process your email address, the country you select, the language of the request, the two consent choices you make and the time of the request.

Sending you the document is necessary to provide what you asked for (Art. 6(1)(b) GDPR, and the corresponding provisions of the Swiss FADP). We send the document whether or not you also subscribe to news from us — the download is never conditional on that second choice.

If you also ask to receive news, we send a separate confirmation link and only begin sending you anything further once you click it (double opt-in). That consent is the legal basis for those messages (Art. 6(1)(a) GDPR) and you may withdraw it at any time, with no effect on processing already carried out.

The download link in the email is personal to you, and we record when it is first used and how often, so we can tell whether a requested document actually reached the person who asked for it. We do not use these link records to build a profile of you.

If your email address belongs to a company domain, we may record your request against a business contact record for that company, so that our team can follow up appropriately. Addresses at consumer email providers are recorded without being linked to any company.

Every marketing email contains an unsubscribe link, and unsubscribing takes effect across all of our marketing communications, not only the one you received. Transactional messages — for example a password reset you request yourself — are still delivered, because they are necessary to operate your account.

We keep these records for as long as the business contact remains relevant and, in any case, for as long as needed to evidence the consent you gave. You can ask us to erase them at any time using the contact address below; we retain a record of the unsubscribe itself so that your address is not re-added by a later import.

Retention Period

We retain your personal data for as long as it is necessary for the purposes outlined in this policy or as required by legal retention periods. After this, data is either deleted or anonymized, unless legitimate interests require further retention (e.g., documentation or evidence).

Data Security

We implement appropriate technical and organizational measures to protect your personal data from unauthorized access, loss, or misuse. These include encryption, firewalls, secure data centers, and restricted access protocols.

Obligation to Provide Data

In general, you are not legally obliged to provide us with personal data. However, we may not be able to enter into or fulfill a contract if required information is not provided. Certain technical data (e.g., IP address) must be collected to ensure the proper operation of our digital services.

Your Rights

You have the right to:

  • Access, correct, delete, or restrict the processing of your personal data
  • Data portability (where applicable)
  • Object to processing, especially regarding direct marketing or profiling
  • Withdraw consent at any time (without affecting prior processing)
  • Lodge a complaint with a supervisory authority
  • Receive clear information about data processing

To exercise your rights, please contact us at datenschutz@futuretree.com.

Updates to This Privacy Policy

We may update this privacy policy at any time without prior notice. The latest version is published on our website and applies upon publication.

EN|DE