W89 LogoW89

Privacy Policy

Last updated: February 2026

1. Introduction and Scope

1.1 W89 GmbH (hereinafter "W89", "we", or "us"), Zugerstrasse 6, 6330 Cham, Switzerland, takes the protection of your personal data very seriously. This privacy policy informs you comprehensively about which personal data we process in connection with our website w89.ch (hereinafter "Website") and our services, for what purposes and on which legal bases this occurs, and what rights you have.

1.2 This privacy policy is governed by the Swiss Federal Act on Data Protection (revDSG/nFADP, SR 235.1) and the associated Data Protection Ordinance (DPO, SR 235.11), as well as, where applicable, the European General Data Protection Regulation (GDPR, Regulation (EU) 2016/679).

1.3 Where the GDPR applies to the processing of your data , in particular if you are located in the European Economic Area (EEA), the provisions below apply in addition to the revDSG. In case of doubt, the stricter provision shall prevail.

2. Responsible Entity

W89 GmbH
Zugerstrasse 6
6330 Cham
Switzerland
Email: legal@w89.ch

W89 has not appointed a data protection advisor within the meaning of Art. 10 revDSG. For all data protection enquiries, please contact the email address above.

3. Personal Data Collected

We process the following categories of personal data:

3.1 Automatically collected data (server log files): When you visit our Website, the hosting provider automatically collects technical data: IP address (truncated/anonymised after no more than 30 days), date and time of access, requested resource (URL), HTTP status code, data volume transferred, referrer URL, browser type and version, operating system, and screen resolution. This data is required for the technical operation of the Website and is automatically deleted after 90 days.

3.2 Contact form: When you use our contact form, we process: name, email address, optionally phone number, and the content of your message. Providing your data is voluntary but necessary for us to process your enquiry.

3.3 Business relationship: In the course of providing our advisory services, we process: company data, names and contact details of contact persons, contract-related information, billing data, and correspondence.

3.4 Applications: If you apply for a position with us, we process the data you submit (CV, references, cover letter) solely for the purpose of the application process.

4. Purposes and Legal Bases of Data Processing

We process your personal data for the following purposes and on the following legal bases:

4.1 Provision and operation of the Website : Legal basis: Legitimate interest (Art. 31 para. 1 revDSG; Art. 6 para. 1 lit. f GDPR) in a secure and functional web presence.

4.2 Responding to contact enquiries : Legal basis: Performance of pre-contractual measures or legitimate interest (Art. 31 para. 2 lit. a revDSG; Art. 6 para. 1 lit. b GDPR).

4.3 Contract performance for advisory services : Legal basis: Contract performance (Art. 31 para. 2 lit. a revDSG; Art. 6 para. 1 lit. b GDPR).

4.4 Web analytics and improvement of our Website : Legal basis: Consent (Art. 6 para. 6 revDSG; Art. 6 para. 1 lit. a GDPR). Analytics are performed exclusively after you grant consent via our cookie banner.

4.5 Compliance with legal obligations : Legal basis: Legal obligation (Art. 6 para. 1 lit. c GDPR), in particular tax and commercial law retention obligations.

4.6 Protection of legitimate interests : Legal basis: Legitimate interest (Art. 31 para. 1 revDSG; Art. 6 para. 1 lit. f GDPR), in particular IT security, abuse prevention, and enforcement of legal claims.

5. Cookies and Tracking Technologies

5.1 Our Website uses cookies and similar technologies. Cookies are small text files stored on your device.

5.2 Strictly necessary cookies: These are essential for the operation of the Website (e.g. session cookies, cookie consent storage). They cannot be deactivated. Legal basis: Legitimate interest.

5.3 Analytics cookies (Google Analytics 4): With your explicit consent, we use Google Analytics 4 (GA4), a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. GA4 uses cookies to statistically evaluate the use of our Website. The data collected (pseudonymised usage data, truncated IP address) is transmitted to Google servers, which may be located in the USA. We have concluded a data processing agreement with Google. Google is certified under the EU-US Data Privacy Framework. You may withdraw your consent at any time via our cookie banner.

5.4 Marketing cookies: With your consent, we may use marketing cookies to display relevant content to you. Currently, no marketing cookies are active.

5.5 You may configure your browser to notify you when cookies are being set, to allow cookies only on a case-by-case basis, to reject cookies for certain cases or in general, and to activate automatic deletion of cookies when closing the browser.

6. Hosting and External Service Providers

6.1 Hosting (Vercel Inc.): Our Website is hosted on the platform of Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. Vercel operates a global Edge Network, whereby content may be served from servers outside Switzerland and the EEA. We have concluded a data processing agreement (Data Processing Addendum) with Vercel. Data transfers to the USA are safeguarded by EU Standard Contractual Clauses (SCC) pursuant to Art. 46 para. 2 lit. c GDPR. Vercel processes exclusively the server log files described in Section 3.1 on our behalf.

6.2 Google Analytics 4: See Section 5.3.

6.3 Contact form: Data submitted via the contact form is transmitted in encrypted form (TLS) and stored by us. It is not disclosed to third parties unless necessary to process your enquiry.

7. Disclosure of Data to Third Parties

7.1 We only disclose your personal data to third parties in the following cases:

  • To processors who support us in providing our services and who are contractually bound to comply with data protection requirements (see Section 6).
  • Where we are legally required to do so (e.g. vis-à-vis tax authorities, law enforcement agencies).
  • To enforce or defend legal claims.
  • With your explicit consent.

7.2 We do not sell personal data to third parties.

8. Data Transfers Abroad

8.1 In the context of website hosting (Vercel) and web analytics (Google Analytics), personal data may be transferred to the USA.

8.2 We ensure that appropriate safeguards are in place for any data transfer to countries without an adequate level of data protection: EU Standard Contractual Clauses (SCC) pursuant to Art. 46 para. 2 lit. c GDPR and Art. 16 para. 2 lit. d revDSG, supplemented by additional technical and organisational measures (Transfer Impact Assessment).

8.3 The Swiss Federal Council has not yet recognised the USA as a country with an adequate level of data protection. The European Commission adopted the adequacy decision for the EU-US Data Privacy Framework on 10 July 2023. We additionally rely on this adequacy decision insofar as our processors are certified under the DPF.

9. Retention Periods

We retain your personal data only for as long as necessary to fulfil the stated purposes or as required by statutory retention obligations:

  • Server log files: 90 days
  • Contact enquiries: 12 months after completion of processing, then deletion
  • Contract data: 10 years after contract termination (Art. 958f CO, tax law)
  • Billing data: 10 years (Art. 958f CO)
  • Application documents: 6 months after conclusion of the application process (unless an employment relationship is established)
  • Cookie consent data: 12 months
  • Google Analytics data: 14 months (automatic deletion by GA4)

10. Data Security

10.1 We take appropriate technical and organisational measures (TOM) to protect your personal data, including: encryption of data transmission via TLS 1.2+ (HTTPS), access controls and role-based access concepts, regular security updates and vulnerability assessments, awareness training for our employees, backup concepts and disaster recovery planning.

10.2 Despite these measures, absolute security cannot be guaranteed. We regularly review and update our security measures in line with the state of the art.

11. Your Rights

11.1 You have the following rights regarding your personal data:

  • Right of access (Art. 25 revDSG; Art. 15 GDPR): You may request information about whether and which personal data we process about you, as well as a copy of such data.
  • Right to rectification (Art. 32 para. 1 revDSG; Art. 16 GDPR): You may request the correction of inaccurate or incomplete data.
  • Right to erasure (Art. 32 para. 2 lit. c revDSG; Art. 17 GDPR): You may request the deletion of your data, provided no statutory retention obligations apply.
  • Right to restriction of processing (Art. 18 GDPR): You may request the restriction of processing where the accuracy of data is contested or processing is unlawful.
  • Right to data portability (Art. 28 revDSG; Art. 20 GDPR): You may request that we provide your data in a structured, commonly used, and machine-readable format or transmit it to another controller.
  • Right to object (Art. 21 GDPR): You may object to the processing of your data based on legitimate interests.
  • Right to withdraw consent (Art. 7 para. 3 GDPR; Art. 6 para. 7 revDSG): You may withdraw consent at any time with effect for the future.

11.2 To exercise your rights, please contact: legal@w89.ch. We will respond to your request without undue delay, and in any event within 30 days.

12. Automated Decision-Making

We do not use automated decision-making within the meaning of Art. 22 GDPR or Art. 21 revDSG that produces legal effects concerning you or similarly significantly affects you.

13. Right to Lodge a Complaint

13.1 Switzerland: You have the right to lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC):

FDPIC
Feldeggweg 1
3003 Bern
Switzerland
www.edoeb.admin.ch

13.2 EU/EEA: If the GDPR applies to you, you also have the right to contact the competent data protection supervisory authority in your EU/EEA member state.

14. Changes to This Privacy Policy

We reserve the right to amend this privacy policy at any time. The current version is always available on our Website. Material changes will be communicated to you separately, provided we have your contact details.

15. Contact for Data Protection Enquiries

W89 GmbH
Data Protection
Zugerstrasse 6
6330 Cham
Switzerland
Email: legal@w89.ch