Privacy policy
How we handle personal data when you visit collectionshub and register your institution.
Last updated: 14 August 2026
1Controller
Controller for the data processing on this website:
zetcom Informatikdienstleistungs AGSandrainstrasse 3, 3007 Bern, Switzerland
Email: privacy@zetcom.com
2Scope
This policy covers collectionshub.org: what personal data we process, on what legal basis, and the rights you have.
3Hosting
This website is hosted by united-domains GmbH, Gautinger Strasse 10, 82319 Starnberg, Germany, as a processor under Article 28 GDPR and governed by a data processing agreement concluded on 13 August 2026. The servers are in Germany.
4Server log files
Every visit is recorded in server log files: your IP address, the date and time of the request, the page requested, the referring page, and your browser and operating system. We use this to run the site securely and to detect and prevent abuse. Legal basis: our legitimate interest in a secure, functioning website (Article 6(1)(f) GDPR). The logs are deleted after 14 days at the latest, backups of them included.
5Web fonts
The "DM Sans" web font is hosted on our own server. Loading it contacts no third party and sends no data to Google or anyone else.
6Cookies, consent and analytics
Change or withdraw your cookie settings
Cookies that are not strictly necessary are used only with your consent. On your first visit a banner asks you to choose per category, and you can change or withdraw that choice at any time, with effect for the future, using the link at the end of this section. If you decline, the tools below are not loaded at all and set no cookies; the site and the registration form keep working. Unless a paragraph says otherwise, the legal basis for everything in this section is your consent (Article 6(1)(a) GDPR, and for the storage on your device the applicable national implementation of Article 5(3) ePrivacy Directive).
Consent management (HubSpot). The banner is provided by HubSpot (provider details in section 7). Your choice is stored in your browser in the cookie __hs_cookie_cat_pref for 6 months, so that we can demonstrate consent and you are not asked again on every page. It is strictly necessary, is set whichever way you choose, and carries no analytics identifier. Legal basis: our obligation to document consent and our legitimate interest in a compliant website (Article 6(1)(c) and (f) GDPR).
Statistics: Google Analytics 4. With your consent we use Google Analytics 4, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Its cookies record how the site is used, for example which pages are opened, how long a visit lasts and which campaign led to it. Requests from the European Union, Switzerland and the United Kingdom are received on Google servers inside that region, and Google states that it discards the IP address before it is written to any log: it is neither stored nor passed on to us. We do not use Google Analytics for cross-site profiling. Data retention in Google Analytics: 14 months. Google Signals, the cross-device tracking through Google accounts, is switched off. Google may process data in the United States, see section 9.
Statistics: HubSpot analytics. With the same consent HubSpot's analytics part (provider details in section 7) sets cookies, above all hubspotutk, which recognise your browser across visits and let us see which pages an institution looked at before registering. Without that consent a registration you send stays unconnected to your visit.
Advertising. With your consent to the advertising category two advertising tools run. The HubSpot tracking code loads the advertising pixel of the connected HubSpot portal, which pulls in tags of Google Ads (Google Ireland Limited, address above); they set _gcl_au on this domain and test_cookie on .doubleclick.net and show us whether a visit that started from an advertisement ended in a registration. The LinkedIn Insight Tag of LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland (partner ID 7896018) measures the same for advertising on LinkedIn, reports a registration and a newsletter signup as conversions, and can set cookies in your browser and add it to an audience for retargeting; the cookies it sets on linkedin.com are bcookie, li_gc and lidc, listed in the table below. Our Google Analytics property is also linked to our Google Ads account: registrations measured under the statistics category can therefore be counted as conversions in our advertising account and set against the advertisement that led to them. Whether Google may additionally use that data to personalise advertising depends on your answer in the advertising category, which we pass on to Google with every request.
7Registration form (HubSpot)
Institutions can register their interest with a form on this site. The form is our own, not an embedded HubSpot form, and it loads nothing from HubSpot when the page opens. Only when you press send are your entries (institution name, your name, email address, country, collection system and any message), your IP address and the URL of the page you sent it from transmitted to HubSpot, a CRM platform, and stored there on our behalf. Our contracting party and processor is HubSpot Germany GmbH, Am Postbahnhof 17, 10243 Berlin, Germany, which engages other companies of the HubSpot group, including HubSpot, Inc. in the United States, as sub-processors.
If you accepted the statistics category (section 6), the submission also carries the identifier from the hubspotutk cookie, so that your registration and the pages you viewed beforehand become one record.
We process this data to handle your registration and to contact you about joining collectionshub. Legal basis: steps taken at your request prior to entering into a participation agreement (Article 6(1)(b) GDPR). Where you register on behalf of an institution rather than in your own name, we process your contact details on the basis of our legitimate interest in dealing with that institution's enquiry through a named contact person (Article 6(1)(f) GDPR). We do not rely on your consent for this, so there is no consent here for you to withdraw; you can object to the processing at any time under Article 21 GDPR. Your data is stored in HubSpot's EU data centre under a data processing agreement; where processing involves a transfer to the United States, it is safeguarded by Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework. We keep the data for as long as we are handling your registration and, if your institution joins collectionshub, for as long as it takes part and for as long as statutory retention periods require. If no participation comes about, we delete the registration once the enquiry is settled and no further contact is to be expected.
8Recipients
Data reaches only the recipients named in the sections above, and no others.
united-domains GmbH, which hosts this site, and HubSpot Germany GmbH, which runs the registration form, the newsletter, the consent banner and its own analytics, process the data on our behalf and on our instructions, each under a data processing agreement pursuant to Article 28 GDPR. HubSpot in turn engages Cloudflare as a sub-processor for the delivery and the bot detection of the services this page loads.
Google Ireland Limited and LinkedIn Ireland Unlimited Company receive data only once you have accepted the statistics or the advertising category. Both also process data for purposes of their own, which we neither determine nor control, so their own privacy notices apply alongside this one.
We do not sell your data, and we pass it to no one beyond these recipients.
9International transfers
Where personal data is processed outside the EU or EEA, we rely on appropriate safeguards: an adequacy decision, Standard Contractual Clauses, or the EU-US Data Privacy Framework.
10Your rights
Under the GDPR you have the right to:
- access your data (Article 15)
- have inaccurate data corrected (Article 16)
- have your data erased (Article 17)
- restrict processing (Article 18)
- receive your data in a portable format (Article 20)
- object to processing based on legitimate interest (Article 21)
- withdraw consent at any time, without affecting prior processing (Article 7(3))
To exercise any of these, contact us using the details in section 1.
11Right to complain
You can report a suspected breach of Swiss data protection law to the Federal Data Protection and Information Commissioner (FDPIC), Bern. Where the GDPR applies, you can also lodge a complaint with a competent supervisory authority, in particular where you live, where you work or where the alleged infringement took place.
12Data security
The site is served over an encrypted TLS/HTTPS connection, and we use appropriate technical and organisational measures to protect your data against loss, misuse and unauthorised access.
13Changes to this policy
We may update this policy to reflect changes to the site or the law. The current version always applies and is published on this page.