This website processes as little as it can: server logs, two technical markers in your browser, what you enter in the forms, and one service that recognises companies by their IP address. All of it is set out below, in full.
The controller for the processing described here, within the meaning of Article 4(7) GDPR, is:
We have not appointed a data protection officer. Our processing does not require one under Article 37 GDPR: we are a small company, and we neither monitor individuals systematically nor process special categories of data on a large scale.
This section is here because it is shorter than the alternative. Apart from the company recognition described further down, none of the following happens on this site:
This website is hosted by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. Every request to a web server is recorded in a log. That log contains the IP address of the requesting device, the date and time, the address requested, the HTTP status, the amount of data transferred, and — if the browser sends them — the referring page and the browser identification.
We process these logs to deliver the site, to keep it stable and to detect attacks. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is the secure operation of the site. We do not use the logs to identify individuals and do not combine them with other data.
The site stores two short technical markers in your browser's session storage. One records that the page transition animation has already played, the other that the start page has already been loaded once in this tab. Both hold the value “1”, contain no personal data, are never sent to us, and disappear when you close the tab.
This site loads Albacross, a service of Albacross Nordic AB, Malmskillnadsgatan 42, 111 57 Stockholm, Sweden (company reg. no 556942-7338). Albacross matches the IP address of your connection against a database of companies and reports to us which companies have opened our pages. For this it sets a cookie in your browser and transmits, besides the IP address, the pages you opened, the referrer you came from, your screen size and your browser identification.
The purpose is our sales work: we want to know which companies take an interest in monitoring their infrastructure. The service is aimed at organisations, not at you as a person, and we do not use it to identify individuals. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is approaching possible business partners. You may object at any time — a message to info@d-rail.com is enough.
Albacross processes this data on our behalf; the data processing agreement under Article 28 GDPR takes effect when their terms of service are accepted, so it needs no separate signature. Beyond that, Albacross states that it also uses the IP address and the technical details to extend its own company database. For that purpose Albacross acts as an independent controller and is not bound by our instructions; the details are in Albacross’ own privacy policy.
Albacross Nordic AB is established in Sweden and processes within the EU, so no transfer to a third country takes place for this service. The service is only loaded on d-rail.com; on preview addresses and during development it stays switched off.
If you use the contact form, we process what you enter: your name, your company, your email address, your phone number if you give one, the subject you select and your message. Fields marked optional may be left empty; without the rest we cannot answer.
We use this only to answer your enquiry and to follow it up. The legal basis is Article 6(1)(b) GDPR where the enquiry concerns a contract or its preparation, and otherwise Article 6(1)(f) GDPR — our legitimate interest in answering people who write to us. The confirmation checkbox documents that you know what happens with your details; it is not the legal basis, so withdrawing it does not undo an answer we have already given.
The form is protected against automated submissions without a CAPTCHA and without any third party: it contains a field that is invisible to people (a filled field means a bot), it measures how long the form was open, and it checks the length and format of what was entered. None of this is used to recognise or profile you.
Your message is sent to our mailbox as an email. It goes out through a mail account that Autech AG (Wiesenweg 36, 5102 Rupperswil, Switzerland) operates at the Swiss hosting provider cyon GmbH (Brunngässlein 12, 4052 Basel, Switzerland). It then remains in our mailbox for as long as the matter requires, and afterwards for as long as statutory retention periods apply to business correspondence.
Nothing on this website is offered as a direct download. Datasheets and other technical documents are sent on request.
For a request we process your name, your company, your email address and, if you write one, your note. We use them for two things: we send you the documents you selected, and we may come back to you about D-RAIL. The legal basis is Article 6(1)(b) GDPR — you asked us for the documents — and Article 6(1)(f) for the follow-up.
Your request reaches us the same way as the contact form (see above). The documents are then sent to you by email by one of our engineers. You can object to the follow-up at any time; a single line in reply is enough.
Apart from the service providers named below, we pass your data to no one. They act as processors under Article 28 GDPR, on our instructions and, unless the table says otherwise, for no purpose of their own:
Vercel is established in the United States, so data may be transferred outside the EU. Such a transfer requires a safeguard under Chapter V GDPR — certification under the EU–U.S. Data Privacy Framework or standard contractual clauses under Article 46(2)(c). Albacross Nordic AB is established in Sweden and therefore within the EU. Autech AG and cyon GmbH are established in Switzerland, for which the European Commission has adopted an adequacy decision under Article 45 GDPR.
The footer links to our profiles on LinkedIn, X, YouTube and Facebook, and the site links to autech.ch. These are ordinary links, not embedded content: nothing is loaded from those services until you click. From then on, the privacy notice of the site you have reached applies.
Under the GDPR you may ask us at any time what we hold about you (Article 15), have it corrected (Article 16) or erased (Article 17), have its processing restricted (Article 18), and receive it in a portable form (Article 20). Where we rely on a legitimate interest, you may object to the processing (Article 21). A message to info@d-rail.com is enough; we do not require a particular form.
You may also lodge a complaint with a supervisory authority (Article 77). Ours is the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, Box 8114, 104 20 Stockholm, imy@imy.se). You may equally complain to the authority in the EU country where you live or work.
We update this notice when the site changes what it processes — for example if a video is embedded or a content management system is connected. The date at the top of the page always shows the current version.
Tell us about your network. We come back with a focused proposal —
your network, your priorities, the next practical step.