W89 LogoW89

Privacy Policy

Last updated: 17 August 2026

1. Introduction and Scope

1.1 W89 GmbH (hereinafter "W89", "we", or "us"), Zugerstrasse 6, 6330 Cham, Switzerland, takes the protection of your personal data very seriously. This privacy policy informs you comprehensively about which personal data we process in connection with our website w89.ch (hereinafter "Website") and our services, for what purposes and on which legal bases this occurs, and what rights you have.

1.2 This privacy policy is governed by the Swiss Federal Act on Data Protection (revDSG/nFADP, SR 235.1) and the associated Data Protection Ordinance (DPO, SR 235.11), as well as, where applicable, the European General Data Protection Regulation (GDPR, Regulation (EU) 2016/679).

1.3 Where the GDPR applies to the processing of your data, in particular if you are located in the European Economic Area (EEA), the provisions below apply in addition to the revDSG. Which regime applies in a given case is determined by the territorial scope of the respective act.

2. Responsible Entity

W89 GmbH
Zugerstrasse 6
6330 Cham
Switzerland
Email: [email protected]

W89 has not appointed a data protection advisor within the meaning of Art. 10 revDSG. For all data protection enquiries, please contact the email address above.

3. Personal Data Collected

We process the following categories of personal data:

3.1 Automatically collected data (server log files): When you visit our Website, the hosting provider automatically collects technical access data: IP address, date and time of access, requested resource (URL), HTTP status code, data volume transferred, referrer URL, browser type, and operating system. This data is required for the secure technical operation of the Website. The log files are held by the hosting provider; their retention is determined by its privacy policy (see Section 6.1). We keep no copy of these log files. This data is not combined with other sources and is not evaluated for analytics purposes.

3.2 Contact by email: Our Website does not include a contact form. If you write to us at the address provided, we process your email address, your name, and any further details you voluntarily include in your message, for the purpose of responding to your enquiry. For scheduling appointments, see Section 3.4.

3.3 Business relationship: In the course of providing our advisory services, we process: company data, names and contact details of contact persons, contract-related information, billing data, and correspondence.

3.4 Appointment booking: The page w89.ch/mw embeds a booking calendar provided by zcal, Inc. It is loaded as soon as that page opens. In doing so, your IP address, browser and device information, your language preference, and the page you accessed are transmitted to zcal. If you book an appointment, zcal additionally processes the details you enter in the booking window, in particular your name, your email address, and the time slot you choose. This calendar is not embedded on any other page of this Website, and no connection to zcal exists there. Further details on the provider are set out in Section 6.3, and on the transfer to the USA in Section 8.2.

4. Purposes and Legal Bases of Data Processing

We process your personal data for the following purposes and on the following legal bases:

4.1 Provision and operation of the Website : Legal basis: Legitimate interest (Art. 31 para. 1 revDSG; Art. 6 para. 1 lit. f GDPR) in a secure and functional web presence.

4.2 Responding to contact enquiries and scheduling appointments : Legal basis: Performance of pre-contractual measures or legitimate interest (Art. 31 para. 2 lit. a revDSG; Art. 6 para. 1 lit. b GDPR) in straightforward appointment scheduling.

4.3 Contract performance for advisory services : Legal basis: Contract performance (Art. 31 para. 2 lit. a revDSG; Art. 6 para. 1 lit. b GDPR).

4.4 Compliance with legal obligations : Legal basis: Legal obligation (Art. 6 para. 1 lit. c GDPR), in particular tax and commercial law retention obligations.

4.5 Protection of legitimate interests : Legal basis: Legitimate interest (Art. 31 para. 1 revDSG; Art. 6 para. 1 lit. f GDPR), in particular IT security, abuse prevention, and enforcement of legal claims.

5. Cookies, Tracking, and Web Analytics

5.1 We ourselves use no analytics cookies, no marketing cookies, and no tracking technologies. We do not evaluate your behaviour on this Website, nor do we have it evaluated. For this reason there is no cookie banner here: there is nothing for which we would need to obtain your consent. This is to be distinguished from the booking calendar embedded on the page w89.ch/mw: what happens inside that calendar is zcal's responsibility, see Section 6.3.

5.2 The only information we ourselves store locally on your device is your choice between the light and the dark appearance. It is kept in your browser's local storage (key «w89-theme»), never leaves your device, and permits no inference about your identity. It is stored only if you actively switch the appearance and serves solely the function you requested. You can delete it at any time via your browser settings. The booking calendar on w89.ch/mw may in addition store its own data in your browser. That is decided by zcal, not by us, and we have no access to it.

5.3 We embed no external fonts, no map services, no video platforms, no social media elements, and no review widgets. All fonts are served from our own server. The only embedded third-party content on this Website is the booking calendar on the page w89.ch/mw (Section 6.3).

6. Hosting and External Service Providers

6.1 Hosting (Cloudflare, Inc.): Our Website is hosted on the platform of Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. Cloudflare operates a global network, whereby content may be served from servers outside Switzerland and the EEA. Processing takes place on our behalf on the basis of a data processing agreement (Data Processing Addendum), which forms part of Cloudflare's Self-Serve Subscription Agreement. On safeguards for the transfer to the USA, see Section 8. Cloudflare processes exclusively the server log files described in Section 3.1 on our behalf.

6.2 Email correspondence: Messages you send to our contact address are transmitted via our email provider and stored by us. They are not disclosed to third parties unless necessary to process your enquiry. Please note that the content of unencrypted email can in principle be read by third parties in transit. For confidential information, we will agree a secure transmission channel on request.

6.3 Appointment booking (zcal, Inc.): For scheduling appointments we use the service of zcal, Inc., 9800 Centre Pkwy, Houston, TX 77036, USA. The calendar is embedded exclusively on the page w89.ch/mw and is loaded there as soon as the page opens; we say so directly next to the calendar. According to its own statement, zcal processes the data as a processor on our behalf, with us as the controller, on the basis of zcal's Data Processing Addendum, which forms part of its terms of use. zcal in turn engages sub-processors, including a usage analytics service and a service for managing an affiliate programme. That processing takes place inside the calendar. We receive no data from it and evaluate nothing. zcal publishes the current list at zcal.co/data-processors. On the transfer to the USA, see Section 8.2. If you would rather not use the calendar, an email to the address given in Section 2 is enough to arrange a meeting.

7. Disclosure of Data to Third Parties

7.1 We only disclose your personal data to third parties in the following cases:

  • To processors who support us in providing our services and who are contractually bound to comply with data protection requirements (see Section 6).
  • Where we are legally required to do so (e.g. vis-à-vis tax authorities, law enforcement agencies).
  • To enforce or defend legal claims.
  • With your explicit consent.

7.2 We do not sell personal data to third parties.

8. Data Transfers Abroad

8.1 In the context of website hosting (Cloudflare), technical access data may be transferred to the USA. Cloudflare states that it is certified under the Swiss-U.S. Data Privacy Framework. Switzerland recognises the United States as providing an adequate level of data protection for organisations certified under that framework (Annex 1 no. 44 of the Data Protection Ordinance, DSV), so the disclosure rests on Art. 16 para. 1 DSG.

8.2 When the page w89.ch/mw is opened, data is transferred to zcal, Inc. in the USA (Sections 3.4 and 6.3). We are not aware of any certification of zcal under the Swiss-U.S. Data Privacy Framework. We therefore do not base this disclosure on the recognition under Annex 1 no. 44 DSV, but on standard data protection clauses pursuant to Art. 16 para. 2 lit. d revDSG and Art. 46 para. 2 lit. c GDPR. zcal expressly provides for these clauses in its Data Processing Addendum for data originating from Switzerland, the EEA, and the United Kingdom. We point out that authorities in the receiving country may under certain circumstances access data, and that such access is beyond our control.

8.3 Apart from those named in Sections 8.1 and 8.2, no transfers abroad take place in connection with this Website.

8.4 We ensure that appropriate safeguards are in place for any data transfer to countries without an adequate level of data protection: EU Standard Contractual Clauses (SCC) pursuant to Art. 46 para. 2 lit. c GDPR and Art. 16 para. 2 lit. d revDSG, supplemented by additional technical and organisational measures (Transfer Impact Assessment).

8.5 With effect from 15 September 2024, the Swiss Federal Council added the United States to the list of countries with adequate data protection under Annex 1 of the Data Protection Ordinance, insofar as the receiving company is certified under the Swiss-U.S. Data Privacy Framework. For certified recipients we rely on this recognition pursuant to Art. 16 para. 1 revDSG; for the European area, a corresponding adequacy decision of the European Commission of 10 July 2023 exists under the EU-US Data Privacy Framework. For recipients that are not certified, we rely on standard data protection clauses pursuant to Art. 16 para. 2 lit. d revDSG or Art. 46 para. 2 lit. c GDPR, supplemented by additional technical and organisational measures.

9. Retention Periods

We retain your personal data only for as long as necessary to fulfil the stated purposes or as required by statutory retention obligations:

  • Server log files: retained by the hosting provider under its privacy policy, with no copy held by us (Section 3.1)
  • Contact enquiries by email: 12 months after completion of processing, then deletion
  • Appointment bookings: retained by the calendar provider under its privacy policy; it states no fixed period (Section 6.3). The agreed appointment itself we retain like a contact enquiry
  • Contract data: 10 years after contract termination (Art. 958f CO, tax law)
  • Billing data: 10 years (Art. 958f CO)

10. Data Security

10.1 We take appropriate technical and organisational measures (TOM) to protect your personal data, including: encryption of data transmission via TLS (HTTPS), restriction of access to those persons who require the data for their work, multi-factor authentication for administrative accounts, continuous updating of the software we use, and browser-level security policies (Content Security Policy, HSTS).

10.2 Despite these measures, absolute security cannot be guaranteed. We regularly review and update our security measures in line with the state of the art.

11. Your Rights

11.1 You have the following rights regarding your personal data:

  • Right of access (Art. 25 revDSG; Art. 15 GDPR): You may request information about whether and which personal data we process about you, as well as a copy of such data.
  • Right to rectification (Art. 32 para. 1 revDSG; Art. 16 GDPR): You may request the correction of inaccurate or incomplete data.
  • Right to erasure (Art. 32 para. 2 lit. c revDSG; Art. 17 GDPR): You may request the deletion of your data, provided no statutory retention obligations apply.
  • Right to restriction of processing (Art. 18 GDPR): You may request the restriction of processing where the accuracy of data is contested or processing is unlawful.
  • Right to data portability (Art. 28 revDSG; Art. 20 GDPR): You may request that we provide your data in a structured, commonly used, and machine-readable format or transmit it to another controller.
  • Right to object (Art. 21 GDPR): You may object to the processing of your data based on legitimate interests.
  • Right to withdraw consent (Art. 7 para. 3 GDPR): You may withdraw consent at any time with effect for the future. Under Swiss law, withdrawal is possible at any time without any particular form.

11.2 To exercise your rights, please contact: [email protected]. We will respond to your request without undue delay, and in any event within 30 days.

12. Automated Decision-Making

We do not use automated decision-making within the meaning of Art. 22 GDPR or Art. 21 revDSG that produces legal effects concerning you or similarly significantly affects you.

13. Right to Lodge a Complaint

13.1 Switzerland: You have the right to lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC):

FDPIC
Feldeggweg 1
3003 Bern
Switzerland
www.edoeb.admin.ch

13.2 EU/EEA: If the GDPR applies to you, you also have the right to contact the competent data protection supervisory authority in your EU/EEA member state.

14. Changes to This Privacy Policy

We reserve the right to amend this privacy policy at any time. The current version is always available on our Website. Material changes will be communicated to you separately, provided we have your contact details.

15. Contact for Data Protection Enquiries

W89 GmbH
Data Protection
Zugerstrasse 6
6330 Cham
Switzerland
Email: [email protected]