Privacy Policy
Last updated: 19 August 2026
Proof of this version
1. Introduction and Scope
1.1 W89 GmbH (hereinafter "W89", "we", or "us"), Zugerstrasse 6, 6330 Cham, Switzerland, takes the protection of your personal data very seriously. This privacy policy informs you comprehensively about which personal data we process in connection with our website w89.ch (hereinafter "Website") and our services, for what purposes and on which legal bases this occurs, and what rights you have.
1.2 This privacy policy is governed by the Swiss Federal Act on Data Protection (revDSG/nFADP, SR 235.1) and the associated Data Protection Ordinance (DPO, SR 235.11), as well as, where applicable, the European General Data Protection Regulation (GDPR, Regulation (EU) 2016/679).
1.3 Where the GDPR applies to the processing of your data, in particular if you are located in the European Economic Area (EEA), the provisions below apply in addition to the revDSG. Which regime applies in a given case is determined by the territorial scope of the respective act.
2. Responsible Entity
W89 GmbH
Zugerstrasse 6
6330 Cham
Switzerland
Email: [email protected]
W89 has not appointed a data protection advisor within the meaning of Art. 10 revDSG. For all data protection enquiries, please contact the email address above.
3. Personal Data Collected
We process the following categories of personal data:
3.1 Automatically collected data (server log files): When you visit our Website, the hosting provider automatically collects technical access data: IP address, date and time of access, requested resource (URL), HTTP status code, data volume transferred, referrer URL, browser type, and operating system. This data is required for the secure technical operation of the Website. The log files are held by the hosting provider; their retention is determined by its privacy policy (see Section 6.1). We keep no copy of these log files. This data is not combined with other sources and is not evaluated for analytics purposes.
3.2 Contact by email: Our Website does not include a contact form. If you write to us at the address provided, we process your email address, your name, and any further details you voluntarily include in your message, for the purpose of responding to your enquiry. For scheduling appointments, see Section 3.4.
3.3 Business relationship: In the course of providing our advisory services, we process: company data, names and contact details of contact persons, contract-related information, billing data, and correspondence.
3.4 Appointment booking: The page w89.ch/mw links to booking calendars that we maintain with Proton AG. Those calendars are not embedded in our Website. As long as you press none of the buttons, no connection to Proton AG exists and no data whatsoever is transmitted there. Clicking takes you away from this Website and opens the page calendar.proton.me. In doing so Proton AG learns, as with any website you visit, your IP address as well as browser and device information. Proton AG is itself responsible for the operation of that page, and its own privacy policy applies there. If you book an appointment on it, we process the details you provide, in particular your name, your email address, and the time slot you choose. Proton AG acts as our processor in that respect. Further details are set out in Section 6.3, and on the foreign-country aspect in Section 8.2.
4. Purposes and Legal Bases of Data Processing
We process your personal data for the following purposes and on the following legal bases:
4.1 Provision and operation of the Website : Legal basis: Legitimate interest (Art. 31 para. 1 revDSG; Art. 6 para. 1 lit. f GDPR) in a secure and functional web presence.
4.2 Responding to contact enquiries and scheduling appointments : Legal basis: Performance of pre-contractual measures or legitimate interest (Art. 31 para. 2 lit. a revDSG; Art. 6 para. 1 lit. b GDPR) in straightforward appointment scheduling.
4.3 Contract performance for advisory services : Legal basis: Contract performance (Art. 31 para. 2 lit. a revDSG; Art. 6 para. 1 lit. b GDPR).
4.4 Compliance with legal obligations : Legal basis: Legal obligation (Art. 6 para. 1 lit. c GDPR), in particular tax and commercial law retention obligations.
4.5 Protection of legitimate interests : Legal basis: Legitimate interest (Art. 31 para. 1 revDSG; Art. 6 para. 1 lit. f GDPR), in particular IT security, abuse prevention, and enforcement of legal claims.
5. Cookies, Tracking, and Web Analytics
5.1 We ourselves use no analytics cookies, no marketing cookies, and no tracking technologies. We do not evaluate your behaviour on this Website, nor do we have it evaluated. For this reason there is no cookie banner here: there is nothing for which we would need to obtain your consent. This is to be distinguished from the booking calendar that the page w89.ch/mw links to: it does not sit on this Website but with Proton AG, and what happens there is governed by their privacy policy, see Section 6.3.
5.2 The only information we ourselves store locally on your device is your choice between the light and the dark appearance. It is kept in your browser's local storage (key «w89-theme»), never leaves your device, and permits no inference about your identity. It is stored only if you actively switch the appearance and serves solely the function you requested. You can delete it at any time via your browser settings. No page of this Website stores anything else in your browser. If you open the booking calendar at Proton AG via the page w89.ch/mw, Proton AG may store data in your browser on its own page. That is decided by Proton AG, not by us, and we have no access to it.
5.3 This Website embeds no third-party content at all: no external fonts, no map services, no video platforms, no social media elements, no review widgets, and no booking calendar. All fonts are served from our own server. When you open any page of this Website, your browser therefore communicates solely with our server. Where we point to third-party offerings, such as the booking calendar under Section 6.3 or a profile on a social network, we do so as an ordinary link: nothing is transmitted until you click it, and doing so takes you away from this Website.
6. Hosting and External Service Providers
6.1 Hosting (Cloudflare, Inc.): Our Website is hosted on the platform of Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. Cloudflare operates a global network, whereby content may be served from servers outside Switzerland and the EEA. Processing takes place on our behalf on the basis of a data processing agreement (Data Processing Addendum), which forms part of Cloudflare's Self-Serve Subscription Agreement. On safeguards for the transfer to the USA, see Section 8. Cloudflare processes exclusively the server log files described in Section 3.1 on our behalf.
6.2 Email correspondence (Proton AG): Messages you send to our contact address are transmitted via Proton AG, Route de la Galaise 32, 1228 Plan-les-Ouates, Switzerland (UID CHE-354.686.492), and stored there in our mailbox. Proton AG acts as our processor on the basis of its Data Processing Agreement, which is governed by Swiss law. They are not disclosed to any further third parties unless necessary to process your enquiry. Please note that the content of unencrypted email can in principle be read by third parties in transit; this holds regardless of provider whenever sender and recipient do not use the same encryption method. For confidential information, we will agree a secure transmission channel on request.
6.3 Appointment booking (Proton AG): For scheduling appointments we maintain booking calendars with Proton AG, Route de la Galaise 32, 1228 Plan-les-Ouates, Switzerland (UID CHE-354.686.492). These calendars are not embedded in our Website; the page w89.ch/mw points to them with ordinary links. If you open a calendar without booking an appointment, Proton AG is itself responsible for the operation of that page. If you do book an appointment, we are the controller for the resulting appointment data. Proton AG processes it as our processor, on the basis of its Data Processing Agreement. That agreement is governed by Swiss law, with Geneva as the place of jurisdiction. The sub-processors engaged by Proton AG are published in its privacy policy at proton.me. On the foreign-country aspect, see Section 8.2. If you would rather not use the calendar, an email to the address given in Section 2 is enough to arrange a meeting.
7. Disclosure of Data to Third Parties
7.1 We only disclose your personal data to third parties in the following cases:
To processors who support us in providing our services and who are contractually bound to comply with data protection requirements (see Section 6).
Where we are legally required to do so (e.g. vis-à-vis tax authorities, law enforcement agencies).
To enforce or defend legal claims.
With your explicit consent.
7.2 We do not sell personal data to third parties.
8. Data Transfers Abroad
8.1 In the context of website hosting (Cloudflare), technical access data may be transferred to the USA. Cloudflare states that it is certified under the Swiss-U.S. Data Privacy Framework. Switzerland recognises the United States as providing an adequate level of data protection for organisations certified under that framework (Annex 1 no. 44 of the Data Protection Ordinance, DSV), so the disclosure rests on Art. 16 para. 1 DSG.
8.2 Email correspondence and appointment booking run via Proton AG (Sections 6.2 and 6.3). Proton AG is seated in Geneva, so processing takes place primarily in Switzerland. According to its own statements, Proton AG also operates data centres in other European countries. Where data reaches those, they are countries listed in Annex 1 of the Data Protection Ordinance (DSV) as providing an adequate level of data protection, namely Germany (no. 1) and Norway (no. 32). This disclosure is therefore based on Art. 16 para. 1 revDSG; no additional safeguards such as standard data protection clauses are required for it. Proton AG's Data Processing Agreement further provides for transfers only to Switzerland, the EU, or countries covered by an adequacy decision.
8.3 Apart from those named in Sections 8.1 and 8.2, no transfers abroad take place in connection with this Website.
8.4 We ensure that appropriate safeguards are in place for any data transfer to countries without an adequate level of data protection: EU Standard Contractual Clauses (SCC) pursuant to Art. 46 para. 2 lit. c GDPR and Art. 16 para. 2 lit. d revDSG, supplemented by additional technical and organisational measures (Transfer Impact Assessment).
8.5 With effect from 15 September 2024, the Swiss Federal Council added the United States to the list of countries with adequate data protection under Annex 1 of the Data Protection Ordinance, insofar as the receiving company is certified under the Swiss-U.S. Data Privacy Framework. For certified recipients we rely on this recognition pursuant to Art. 16 para. 1 revDSG; for the European area, a corresponding adequacy decision of the European Commission of 10 July 2023 exists under the EU-US Data Privacy Framework. For recipients that are not certified, we rely on standard data protection clauses pursuant to Art. 16 para. 2 lit. d revDSG or Art. 46 para. 2 lit. c GDPR, supplemented by additional technical and organisational measures.
9. Retention Periods
We retain your personal data only for as long as necessary to fulfil the stated purposes or as required by statutory retention obligations:
Server log files: retained by the hosting provider under its privacy policy, with no copy held by us (Section 3.1)
Contact enquiries by email: 12 months after completion of processing, then deletion
Appointment bookings: retained by the calendar provider under its privacy policy; it states no fixed period (Section 6.3). The agreed appointment itself we retain like a contact enquiry
Contract data: 10 years after contract termination (Art. 958f CO, tax law)
Billing data: 10 years (Art. 958f CO)
10. Data Security
10.1 We take appropriate technical and organisational measures (TOM) to protect your personal data, including: encryption of data transmission via TLS (HTTPS), restriction of access to those persons who require the data for their work, multi-factor authentication for administrative accounts, continuous updating of the software we use, and browser-level security policies (Content Security Policy, HSTS).
10.2 Despite these measures, absolute security cannot be guaranteed. We regularly review and update our security measures in line with the state of the art.
11. Your Rights
11.1 You have the following rights regarding your personal data:
Right of access (Art. 25 revDSG; Art. 15 GDPR): You may request information about whether and which personal data we process about you, as well as a copy of such data.
Right to rectification (Art. 32 para. 1 revDSG; Art. 16 GDPR): You may request the correction of inaccurate or incomplete data.
Right to erasure (Art. 32 para. 2 lit. c revDSG; Art. 17 GDPR): You may request the deletion of your data, provided no statutory retention obligations apply.
Right to restriction of processing (Art. 18 GDPR): You may request the restriction of processing where the accuracy of data is contested or processing is unlawful.
Right to data portability (Art. 28 revDSG; Art. 20 GDPR): You may request that we provide your data in a structured, commonly used, and machine-readable format or transmit it to another controller.
Right to object (Art. 21 GDPR): You may object to the processing of your data based on legitimate interests.
Right to withdraw consent (Art. 7 para. 3 GDPR): You may withdraw consent at any time with effect for the future. Under Swiss law, withdrawal is possible at any time without any particular form.
11.2 To exercise your rights, please contact: [email protected]. We will respond to your request without undue delay, and in any event within 30 days.
12. Automated Decision-Making
We do not use automated decision-making within the meaning of Art. 22 GDPR or Art. 21 revDSG that produces legal effects concerning you or similarly significantly affects you.
13. Right to Lodge a Complaint
13.1 Switzerland: You have the right to lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC):
FDPIC
Feldeggweg 1
3003 Bern
Switzerland
www.edoeb.admin.ch
13.2 EU/EEA: If the GDPR applies to you, you also have the right to contact the competent data protection supervisory authority in your EU/EEA member state.
14. Changes to This Privacy Policy
We reserve the right to amend this privacy policy at any time. The current version is always available on our Website. Material changes will be communicated to you separately, provided we have your contact details.
15. Contact for Data Protection Enquiries
W89 GmbH
Data Protection
Zugerstrasse 6
6330 Cham
Switzerland
Email: [email protected]
Proof of this version