Lüthi Group Privacy Policy

Lüthi Group Sàrl ("Lüthi Group", "we", "us") respects the privacy of people who visit luthigroup.com, contact us, subscribe to updates, or engage with our services, including 258 by Lüthi Group. This policy explains how we handle personal data in those interactions. Where we process a client's prospect or customer data solely on that client's instructions, the client is generally responsible for its own privacy notice and our processing is governed by the engagement and, where required, a data processing agreement.

1. Who is responsible

Lüthi Group Sàrl, Cours des Bastions 13, 1205 Geneva, Switzerland, Company ID CH-660.1.488.026-1, VAT No. CHE-449.331.428, is responsible for the processing described in this policy when it decides why and how data is used. For privacy requests, use the contact form at luthigroup.com/contact or write to the postal address above. Please mark postal requests "Privacy". We will route requests to the person responsible for privacy and respond within applicable legal deadlines.

2. Information we receive

Depending on your interaction, we may receive your name, role, organisation, contact details, inquiry and correspondence; newsletter signup and preferences; proposal, contract, billing and transaction details; information you or a client provide for a project; and technical information such as IP address, device and browser data, page views, referral source and cookie identifiers. Stripe processes payment details when you pay for a service. We receive payment status and transaction information needed to administer the engagement; we do not require you to send card details through our contact form. If you interact with us through a third-party platform, we may receive the information you choose to share there.

Please avoid sending sensitive personal information unless it is necessary for an agreed purpose and a suitable secure channel has been arranged.

3. Why we use information

We use personal data to respond to inquiries and manage relationships; assess and deliver proposals, contracts and services; administer 258 projects and other advisory, strategy, representation, business development, innovation and related engagements; manage payments and records; send updates where you have requested them or where otherwise permitted; maintain and secure the website and systems; improve services using appropriate analytics; and comply with legal obligations or establish, exercise or defend claims.

Where the EU or UK GDPR applies, the relevant legal basis is typically taking steps at your request before a contract or performing a contract, our legitimate interests in conducting and protecting our business, compliance with a legal obligation, or your consent where required, particularly for optional marketing or nonessential cookies. You may withdraw consent at any time without affecting earlier lawful processing. Swiss law also requires transparent, proportionate and lawful handling of personal data.

4. Website tools and cookies

Our website is hosted on Squarespace. Squarespace uses cookies and similar technologies to operate the site, and its built-in analytics helps us understand visits and use of luthigroup.com, such as traffic sources, pages viewed and interactions with forms. These technologies can involve device information, IP addresses and identifiers. Where law requires consent for optional analytics cookies, we will ask for it before setting them and provide a way to change the choice. You can also manage cookies through your browser. Squarespace describes its own cookies at The cookies Squarespace uses. The actual cookie names and lifetimes depend on site settings and enabled features; the site cookie controls should reflect its live configuration.

5. Newsletter and communications

Our newsletter signup is handled through Squarespace. If you sign up for news and updates, we use your email address to send them and to manage your preferences. You can unsubscribe using the link in a message or by contacting us. Service and transaction communications may continue where needed for an active engagement. We do not promise that a newsletter signup will be used for unrelated outreach.

6. 258 and client data

258 is a Lüthi Group brand, not a separate legal entity. Its work may involve lead capture, qualification, follow-up journeys, lifecycle communications, commerce, integration, analytics and optimisation, as set out in the accepted client proposal. A business client remains responsible for the legality of the prospect and customer data it supplies and its marketing instructions. Where Lüthi Group processes that data on the client's behalf, the parties should agree the required data processing terms before processing begins. Individuals whose data is held by a client should normally contact that client first; we will assist the client with appropriate requests.

7. Sharing and international access

We share information with Squarespace for website hosting, forms, newsletter management and built-in analytics, and with Stripe for payment processing. We may also share relevant information with our personnel, advisers and providers engaged to deliver a particular client service. We may also disclose information when law requires it or in a legitimate business transaction, subject to applicable safeguards. Our network and providers may operate outside Switzerland, including in countries with different privacy protections. Where required, we use an adequacy decision or appropriate contractual and organisational safeguards for international transfers. The destination countries and safeguards for any additional project provider must be described in the relevant engagement or supplementary notice where applicable.

8. Retention and security

We keep inquiry information while handling the inquiry and, afterward, for a reasonable period needed to manage the relationship or defend a claim. We retain client engagement and transaction records for the applicable contractual, accounting and legal periods, and delete or anonymise them when no longer needed. Newsletter subscription data is kept until you unsubscribe, subject to limited suppression records needed to respect your preference. Website analytics data is kept according to our Squarespace settings and then expires or is deleted under that service’s controls. We use reasonable organisational and technical safeguards appropriate to the data and risk. No internet transmission or storage system is completely secure.

9. Your choices and rights

Subject to applicable law, you may request access, correction, deletion, restriction or portability of your personal data, object to certain processing, and withdraw consent. You may also complain to the Swiss Federal Data Protection and Information Commissioner or, where applicable, an EU or UK supervisory authority. Contact us using section 1; we may verify your identity and explain any lawful limits on a request. If data is controlled by a client, we may refer the request to that client.

10. Other websites and changes

Links to other websites and third-party services are subject to their own privacy practices. We may update this policy as our operations or legal requirements change. We will post the revised version with a new date and provide additional notice where required.

Lüthi Group Website and General Service Terms

These terms govern use of luthigroup.com and provide a general framework for services supplied by Lüthi Group Sàrl. A signed or accepted proposal, statement of work or other written agreement defines each paid engagement. The 258 Service Terms apply specifically to 258 engagements and remain controlling for their 90 day implementation, instalments, continuation, cancellation and other service specific provisions.

1. Identity and acceptance

Lüthi Group Sàrl, Cours des Bastions 13, 1205 Geneva, Switzerland, Company ID CH-660.1.488.026-1, VAT No. CHE-449.331.428, operates the website. Accessing the website is subject to these website terms. A paid service engagement forms only through a mutually accepted proposal, statement of work or other recorded agreement. A person accepting on behalf of an organisation confirms authority to bind it.

2. Website use

You may use the website for lawful information and inquiries. Do not interfere with its security or operation, attempt unauthorised access, scrape it in a way that disrupts service, introduce malicious code, or use its content unlawfully. We may restrict access to protect the site or comply with law. Information on the site is general and may change; it is not an offer to supply a particular service on fixed terms.

3. Our services

Depending on the agreed scope, Lüthi Group may provide strategic, reputation and positioning, representation, business development, innovation, governance related and other professional services across its areas of work. The particular deliverables, timetable, fees, expenses, dependencies and named contracting party must appear in the accepted engagement document. We perform agreed work with reasonable skill, care and diligence. Strategic observations and forecasts involve uncertainty; no business, financial, regulatory or market outcome is guaranteed unless expressly agreed in writing. Nothing on the website itself creates a professional adviser or fiduciary relationship.

4. 258 services

258 is a brand of Lüthi Group Sàrl. Its digital growth, lead management, commerce, automation and optimisation services are governed by the accepted 258 proposal and the 258 Service Terms. Those terms currently specify an initial 90 calendar day implementation, a default 50%, 25%, 25% instalment schedule unless the proposal differs, automatic monthly continuation unless timely cancelled, at least 14 calendar days' notice to stop at the end of the initial phase, and a default 30 calendar day notice period thereafter unless the proposal differs. The accepted proposal states the actual price, dates, plan and contact for cancellation. These general terms do not amend an existing accepted 258 engagement.

5. Client cooperation and third parties

A client will provide accurate information, lawful materials, timely decisions and access reasonably needed for agreed work. The client remains responsible for its own business decisions, approvals, accounts and regulatory obligations unless the engagement expressly assigns a task to us. We may use qualified personnel and third-party tools or providers, subject to confidentiality and data protection obligations. Separate third-party costs are charged only as agreed in the engagement.

6. Fees and changes

Fees, taxes, payment dates, expenses and any renewal or cancellation arrangement are those stated in the applicable accepted engagement. Any material change to scope, price or timetable requires written agreement, including recorded electronic agreement. No automatic renewal applies to a general service engagement unless it is clearly stated in its accepted agreement; the specific 258 continuation arrangement is described in section 4. Failure to pay may lead to a proportionate suspension after notice, subject to the engagement and applicable law.

7. Confidentiality, data and publicity

Each party will protect the other's nonpublic information and use it for the engagement, allowing access to people who reasonably need it and are subject to suitable duties. This does not cover information lawfully public, independently developed or lawfully required to be disclosed. Each party will comply with applicable privacy law. Client data may be processed under a separate data processing agreement where required. Neither party may use the other's name, logo or project as a public case study without prior written permission.

8. Intellectual property

Each party retains its pre-existing materials and rights. Unless the accepted engagement states otherwise, Lüthi Group retains its methods, frameworks, templates and reusable know-how; after payment, the client may use client-specific deliverables for its internal business purposes, subject to third-party licences and any express terms. Website text, design, names and marks may not be reproduced or used commercially without permission, except as allowed by law.

9. Responsibility and disputes

Each party is responsible for its own breach of the applicable agreement and law. Any service-specific liability allocation in an accepted agreement or applicable service terms controls. For website use, we do not warrant uninterrupted or error-free access; any exclusion or limitation applies only to the extent permitted by mandatory law. Nothing excludes liability that cannot lawfully be excluded. The parties will first seek to resolve a service dispute in good faith. Unless mandatory rules or a service agreement require otherwise, Swiss substantive law governs and the competent courts of Geneva, Switzerland have jurisdiction.

10. Priority and updates

For a paid engagement, the accepted client-specific document governs scope, price and dates; applicable service-specific terms govern their subject matter; these general terms fill any remaining gap. We may update website terms prospectively by posting a revised date. Changes to an existing paid engagement require agreement where its terms or applicable law require it. Contact us at luthigroup.com/contact.