Privacy notice

Controller

The controller for the processing of personal data on this website is the operator of this website named below, a GmbH in the process of being founded («in Gründung»). Its name, address and email address follow directly below this paragraph.

Please send questions about data protection and requests concerning your rights to the email address given below.

Scope

This notice applies only to the website werkapp.ch in all its language versions. It does not apply to the WERK application at app.werkapp.ch.

The website uses no analytics or advertising tools and sets no cookies of its own. Fonts are loaded from our own server, not from third parties.

If you use the calculator on the website, your browser stores the result in session storage (sessionStorage) so that it can be suggested in the form. This value stays on your device and only reaches us if you submit it with the form.

Legal bases

We process personal data in accordance with the principles of the FADP (Art. 6 FADP). Where a justification is required, we rely on your consent or on an overriding private interest (Art. 31 FADP).

Where the GDPR applies, the form is based on your consent (Art. 6(1)(a) GDPR) and, for a trial access request, on steps taken at your request prior to entering into a contract (Art. 6(1)(b) GDPR).

Delivering the website, the server logs and Cloudflare are based on our legitimate interest in secure and stable operation and in protection against abuse and spam (Art. 6(1)(f) GDPR).

You can withdraw your consent at any time with effect for the future (Art. 7(3) GDPR). This does not affect the lawfulness of processing carried out before the withdrawal.

Server logs

The website runs on Google Cloud in the Cloud Run service, region europe-west6 in Zurich. Every request automatically creates log entries. They may contain in particular the requested address, the time, the status code, the IP address, the browser identifier (user agent) and the previously visited page (referrer).

Google stores these logs in the «global» location of the Cloud Logging service, that is, in data centres worldwide, and deletes them after 30 days.

We use these entries only to find errors and to keep operation secure. We do not analyse them for statistics and do not combine them with other data.

Cloudflare

All requests to this website pass through the network of Cloudflare, Inc. (USA). Cloudflare forwards the requests to our server (proxy), keeps pages in a cache (CDN) and protects the website against attacks and against excessive numbers of requests.

For this purpose, Cloudflare processes the technical data of each request, in particular the IP address, the requested address, the time and the browser identifier. Requests may also be processed outside Switzerland.

For its security and protection features, such as limiting excessive numbers of requests, Cloudflare may set technically necessary cookies, for example __cfruid. The website itself sets no cookies of its own.

Further information is available in Cloudflare’s privacy policy at cloudflare.com/privacypolicy.

Contact and request form

When you submit the form, we process the following information.

Required: type of request (contact, trial access or waitlist), name, email address and your consent.

Optional: phone, company, role and message.

Added automatically: language of the page, origin of the request (page visited, previously visited page as referrer and campaign tags in the address, known as UTM parameters) and the time of your consent.

We use this information only to answer your request, to set up trial access for you or to put you on the waitlist, and to understand through which channels requests reach us. Without the required information we cannot process the request.

To block automated requests, we check a field that is invisible to humans. How long the form was open before sending is also transmitted. Neither is stored.

We do not store your IP address with the request; for server logs, see above. No automatic emails are sent; we contact you personally. There is no automated individual decision-making and no profiling.

Storage of requests

Requests submitted via the form are stored in a database at MongoDB Atlas, a service of MongoDB, Inc. (USA). The database is located in the EU.

The application that receives and checks the requests runs on Google Cloud in Zurich (region europe-west6).

Recipients

The following service providers process personal data for the operation of this website:

Google Cloud: hosting of the website and the application (Cloud Run, region europe-west6 in Zurich) as well as the server logs (Cloud Logging, stored worldwide, see «Disclosure abroad»).

Cloudflare, Inc.: forwarding and caching (proxy and CDN) as well as protection against attacks.

MongoDB, Inc. (MongoDB Atlas): storage of requests submitted via the form in the EU.

Beyond this, we only disclose personal data where we are required to do so by law or by an authority.

Disclosure abroad

Cloudflare, Google and MongoDB have their headquarters in the USA. Access from the USA or processing there can therefore not be ruled out. The database for the requests is located in the EU.

Google stores the server logs in the «global» location of Cloud Logging, that is, in data centres worldwide. Cloudflare processes requests in data centres of its global network, and therefore potentially in any country in which Cloudflare operates a data centre.

For the EU member states, the Federal Council has determined that data protection is adequate (Art. 16(1) FADP, Annex 1 to the Data Protection Ordinance (DPO)). For the USA, this applies to organisations certified under the Swiss-U.S. Data Privacy Framework. For transfers from the EU to the USA, the European Commission’s adequacy decision on the EU-U.S. Data Privacy Framework applies (Implementing Decision (EU) 2023/1795).

Cloudflare, Inc., Google LLC and MongoDB, Inc. are listed by the U.S. Department of Commerce as participants in both frameworks (dataprivacyframework.gov, accessed on 25 September 2026).

For countries without an adequate level of data protection, disclosure is based on the European Commission’s standard contractual clauses: for Cloudflare, those of Implementing Decision (EU) 2021/914 in Cloudflare’s data processing agreement; for Google, those in the Google Cloud Data Processing Addendum including its Swiss supplement (cloud.google.com/terms/data-processing-addendum).

For individuals in the EU, Switzerland is recognised as a country with an adequate level of protection (Commission Decision 2000/518/EC).

Retention

We keep requests submitted via the form until their purpose has been fulfilled, or until you withdraw your consent or request erasure. No automatic deletion period is configured; we delete the data manually unless a statutory retention obligation applies.

Server logs are deleted automatically after 30 days. The technical data at Cloudflare is deleted according to Cloudflare’s retention periods.

Your rights

Under the FADP you have in particular the right of access (Art. 25 FADP), the right to receive or transfer your data (Art. 28 FADP) and the right to rectification and erasure (Art. 32 FADP). You can object to processing and withdraw consent at any time.

Where the GDPR applies, you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and the right to object (Art. 21), as well as the right to withdraw consent at any time (Art. 7(3)).

To exercise your rights, an email to the address given above under «Controller» is sufficient. We may ask you to prove your identity.

Complaint to a supervisory authority

In Switzerland, you can contact the Federal Data Protection and Information Commissioner (FDPIC).

Where the GDPR applies, you can also lodge a complaint with a supervisory authority in the EU, in particular in the member state of your habitual residence, your place of work or the place of the alleged infringement (Art. 77 GDPR).

Changes

We update this notice when the website, the services used or the legal situation change. The version published on this page, with the date shown, applies.