Privacy policy
The contracting party and invoice issuer is the operator ([to follow]); Wichtli is one of its brands.
This policy applies under the Swiss Federal Act on Data Protection (revFADP, «revDSG») and the EU General Data Protection Regulation (GDPR). Where the two differ, we follow the stricter rule.
Controller and processing on behalf
Participant data (names, work emails, teams, draw, wishlists, messages, delivery addresses): the company that orders a Wichtli round is the controller. We process this data only on its behalf (Art. 9 revDSG / Art. 28 GDPR) under the DPA. Participants have their own participant notice.
Customer and website data (admin contacts, billing data, Stripe customer id, support emails, security logs, abuse reports): the controller is the operator [to follow], [to follow], privacy@wichtli.ch.
We are not required to appoint a data protection officer. No EU representative (Art. 27 GDPR) is appointed at launch.
What data
- Uploaded by the company: name, work email, optionally team, location and manager email (for draw rules).
- From participants themselves: acceptance, questionnaire, wishlist, hints, office days and desk, fun facts, messages in the anonymous chat, voluntarily food intolerances (only from age 16 and with explicit consent), home address only for an ordered home delivery.
- From admins and buyers: name, business email, company, UID or VAT ID, billing address, the company's privacy contact.
- Technical: security and access logs without content; Cloudflare Web Analytics without cookies and without personal data.
Purposes and legal bases
We use the data only to run and bill the Wichtli round and to operate the service securely; never for advertising to participants and never for product analytics beyond aggregate counts. The draw is random; there are no automated individual decisions.
| Processing | Legal basis |
|---|---|
| Invite and reminders | Legitimate interest of the employer (Art. 6(1)(f) GDPR / Art. 31 revDSG) |
| Participation, questionnaire, office presence and desk | Voluntary participation (Art. 6(1)(a)/(b) GDPR; in DE Art. 88 GDPR / §26 BDSG voluntariness) |
| Fun facts | Consent |
| Allergies and food intolerances | Explicit consent (Art. 9(2)(a) GDPR; Art. 6(7) revDSG) |
| Home address | Entered by the recipient for the requested delivery (Art. 6(1)(a) GDPR) |
For customer data: performance of the contract (Art. 6(1)(b) GDPR), statutory retention duties (c) and legitimate interest in secure operation (f). Offer emails to buyers only with an unsubscribe link in every email; «Remind me for 2027» only after confirmation (double opt-in).
Free-text fields (wishlist, hints) carry the notice «Please do not enter health information.» Food intolerances are stored encrypted, never sent by email, never exported and never shown to HR.
We do not read messages in the anonymous chat unless someone reports a message; then only the Wichtli team reads it, and only the reported message. Emails never contain the name of the Wichtelkind or Wichtel and by default no message text.
Recipients and sub-processors
We pass data only to the following sub-processors, to authorities only on a valid official or court order, and the sender of a reported message only on written request of the customer's HR contact (logged). Stripe is an independent controller for payment compliance. We announce changes to our customers by email 30 days ahead.
| Provider | Purpose | Country of seat | Storage / processing location | Transfer mechanism | Status |
|---|---|---|---|---|---|
| Cloudflare Inc. (Workers, D1, R2, CDN) | hosting, DB | US (parent) | EU storage (D1 EU jurisdiction); global edge | DPF (EU-US, Swiss-US) + SCCs in the Cloudflare DPA | active |
| Cloudflare Email Service | transactional mail, chat relay | US (parent) | global edge, transit only | DPF + SCCs (Cloudflare DPA) | not yet active |
| Stripe Payments Europe Ltd. / Stripe Inc. | payment (business contact + card data; Stripe is independent controller for payment compliance) | IE / US | EU/US | Stripe certified to EU-US DPF incl. Swiss-US DPF; Data Transfers Addendum as fall-back | not yet active |
| Gelato (print, gift, home delivery) | process recipient name and address | NO (EEA) | CH/EU/EEA, only once confirmed in writing (DPA or API setting) before activation; Gelato's own sub-processors listed or linked here before activation | EEA, adequate; signed DPA before activation | not yet active |
| Prodigi Group Ltd (print, backup) | process recipient name and address | UK | UK, EU; CH/EU/EEA/UK only once confirmed in writing before activation | UK adequacy (CH and EU) | not yet active |
| Swiss Post (when live) | printing and posting postcards: the recipient's name and office address, first name on the front, card text | CH | CH, only once confirmed in writing before activation | none needed (domestic) | not yet active |
| AI/GIF generation provider (if used) | personalised GIFs | not yet chosen | not yet chosen | only with DPA; no real photos of persons uploaded at launch, text-based personalisation only | not yet active |
Countries
Stored in the EU (Cloudflare D1, EU jurisdiction). Some providers are US-based, safeguarded by the Data Privacy Framework (EU-US and Swiss-US) and standard contractual clauses. Nothing is hosted in Switzerland. Switzerland recognises the EU and EEA as adequate and vice versa.
Retention and deletion
On 31 January we delete participant data automatically; backups expire 30 days later at the latest. The exceptions are in the table. Email copies in company mailboxes are outside Wichtli's deletion.
| Data | Where | Keep | Delete |
|---|---|---|---|
| Invite records unconfirmed (invited, neither joined nor declined) | D1 | until J + 1 day | J + 1 day, automatic job purge-unjoined; non-joiners then only as a count |
| Declined invite («Nein, danke») | D1 | name and data: none; salted email hash for this Runde only | data at once; hash 31.1. |
| Allergy field (encrypted, consent) | D1 | until withdrawal or season end | on withdrawal, else 31.1. |
| Participant profile (name, work email, wishlist, hint text) | D1 | until season end | 31.1. automatic job; plus self-service delete anytime |
| Draw/pairing | D1 | until season end | 31.1. |
| Messages and hints (anonymous relay) content | D1 | until season end; reported messages and hints, including the sender's identity, kept as evidence up to 90 days after the report | 31.1. (flagged: +90 days) |
| Delivery address (encrypted) | D1 | from entry until delivery confirmed | 14 days after delivered (no delivery report: 30 days after shipping), 14 days after a failed or credited order, by 31.1. at the latest; decrypt only for the fulfilment export |
| Personalised GIF/card assets | D1 (file: R2 EU once enabled) | until season end; earlier if sender or recipient leaves | 31.1. |
| Year-two pair memory (keyed HMAC, per-company secret; only if the company chooses it) | D1 | until the next Runde, max. 13 months | at 13 months, on cancellation of the Abo/renewal, or on the participant's own deletion request |
| Company account (admin name, email) | D1 | while customer relationship runs | on request; inactive 24 months: deleted |
| «Für 2027 vormerken» (double opt-in email + timestamp) | D1 | until 31.10.2027 | 31.10.2027 or on unsubscribe |
| Invoices, Stripe payment records, order records | Stripe + D1 | 10 years statutory (Art. 958f OR) | after 10 years |
| Security/access logs (no content) | Workers logs | 30 days | rolling |
| Address-decrypt audit log (who/when, no address) | D1 | 12 months | rolling |
| Breach log | internal | 2 years from report | then delete |
| Backups/Time Travel | D1 | up to 30 days | rolls off |
J = the join deadline of the Runde. Season end is 31 January. Aggregated, non-personal statistics (e.g. participants per Runde) may be kept.
Your rights
You have the right of access, rectification, erasure, restriction, data portability and objection (Art. 25, 28, 32 revDSG; Art. 15–22 GDPR) and may withdraw consent at any time. We answer within 30 days.
Participants can export and delete their data and end their participation in the app themselves. Requests about participant data are forwarded to the responsible company within 3 business days, and we carry out its instruction within 5 business days.
Complaints
You can complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC/EDÖB), and in the EU to the supervisory authority of your country or German state.
Contact
Data protection questions: privacy@wichtli.ch