B2B website visitor identification in Switzerland

Not as Swiss domestic law. Switzerland applies the revised Federal Act on Data Protection (revFADP / revDSG), supervised by the FDPIC, and it is a separate statute from the EU regulation even though the two were deliberately aligned. The GDPR can still apply in parallel to a Swiss company through its own extraterritorial scope, for example when that company offers goods or services to people in the EU or monitors their behaviour there — which is why many Swiss B2B vendors end up documenting compliance with both frameworks rather than treating them as interchangeable. For a website serving Swiss and EU visitors together, the practical approach is to build to the stricter of the two baselines and be able to name, on request, which duty rests on which law. Swiss reviewers notice quickly when a vendor cannot tell the two apart.

Swiss law does not require a legal basis such as consent for private processing by default; unlike the GDPR's closed list, revFADP processing is permitted unless it unlawfully breaches a data subject's personality rights — through a lack of transparency, disproportionate processing, or processing carried out against an express objection. That makes recognisability, proportionality and respecting objections the practical requirements rather than a consent form. lead.box is built around exactly those three: identification is disclosed in your privacy statement in plain language, the scope is limited to resolving the organisation behind a visit, and every visitor can object at any time through a public, independently reachable opt-out page that the FDPIC can be shown on request.

No, and this is one of the sharpest differences from the old Swiss regime. The revised act protects data of natural persons only; the previous Federal Act on Data Protection also covered legal persons such as companies, but that protection was deliberately dropped in the 2023 revision. Company-level identification resolves the organisation behind a visit — an entity entered in the commercial register, not an individual person — and therefore falls outside the revFADP's protected scope in the first place, rather than merely satisfying an exception within it. Individual employees browsing the site are never singled out, profiled or exported by name, which keeps the product's Swiss legal position noticeably clearer than a tool built around personal profiles.

Yes. The EEA states appear on the Federal Council's list of countries recognised as having an adequate level of data protection, so processing Swiss-related visitor data in ISO-certified EU data centres rests on that adequacy decision rather than on additional contractual safeguards such as standard contractual clauses. That is one of the reasons an EU processing location is straightforward to defend in a Swiss procurement review: there is no separate transfer mechanism to negotiate on top of the ordinary processing agreement. The Swiss data processing agreement, aligned with revFADP terminology, and the versioned sub-processor list are both published so a Swiss buyer's legal or compliance team can review the chain before signing.

Switzerland has no direct equivalent to the EU's ePrivacy Directive, and the Telecommunications Act (FMG) does not impose a general cookie-consent duty the way EU member states' implementations do. What governs a Swiss company's own website is still the revFADP's proportionality-and-transparency test, plus any contractual duties under the Ordinance on Telecommunication Services if the visitor uses a Swiss telecom-provided connection. lead.box does not place advertising identifiers or tracking cookies on the visitor's device and does not read information already stored there, so it sits outside the narrow set of technologies that Swiss privacy guidance treats as consent-relevant — though a site's own analytics or advertising pixels may still require attention independently of this tool.

Every company entered in a Swiss cantonal commercial register carries a unique business identification number, the UID, and Swiss B2B buyers expect vendor documentation, invoices and data processing agreements to reference it correctly rather than using a generic international format. Company-level identification resolves the organisation from network information and matches it against firmographic company data; where a Swiss visitor's organisation is registered domestically, the match can be presented with its Swiss legal name and canton of registration rather than a foreign holding entity's name, which is what a Swiss sales team actually needs to open a relevant, correctly addressed conversation instead of chasing an ambiguous international group name.

The Swiss Federal Act on Information and Consultation of Employees (Mitwirkungsgesetz) gives staff representation rights mainly around larger organisational, safety and transfer decisions in companies above a headcount threshold; it does not generally require consultation for adopting a marketing or sales tool that identifies visiting organisations rather than monitoring individual employees. Because lead.box does not track identifiable individuals, log keystrokes or evaluate staff performance, it typically falls outside the kind of employee-monitoring measure that would trigger participation rights or a works-committee consultation in Swiss companies that have one, though internal IT and data protection policies should still be checked case by case.

Most Swiss teams start by installing a small JavaScript snippet on their main marketing domain and reviewing the first identified companies within the first day, checking that Swiss cantons and language regions are represented correctly before rolling the tool out to additional properties. From there, results flow into daily or weekly digests, CSV or Excel exports for reporting in German, French or Italian as needed, and webhooks into the CRM systems common in Swiss B2B — typically HubSpot, Pipedrive or Microsoft Dynamics. Seats can be added per sales or marketing team member, and the subscription can be cancelled directly in the account without a retention call, which matters to procurement teams used to Swiss vendors requiring a notice period.