Security and data protection
The contracting party and invoice issuer is the operator ([to follow]); Wichtli is one of its brands.
Stored in the EU; some providers are US-based, safeguarded by DPF + SCCs. List: /en/legal/subprocessors.
Sub-processors
| Provider | Purpose | Country of seat | Storage / processing location | Transfer mechanism | Status |
|---|---|---|---|---|---|
| Cloudflare Inc. (Workers, D1, R2, CDN) | hosting, DB | US (parent) | EU storage (D1 EU jurisdiction); global edge | DPF (EU-US, Swiss-US) + SCCs in the Cloudflare DPA | active |
| Cloudflare Email Service | transactional mail, chat relay | US (parent) | global edge, transit only | DPF + SCCs (Cloudflare DPA) | not yet active |
| Stripe Payments Europe Ltd. / Stripe Inc. | payment (business contact + card data; Stripe is independent controller for payment compliance) | IE / US | EU/US | Stripe certified to EU-US DPF incl. Swiss-US DPF; Data Transfers Addendum as fall-back | not yet active |
| Gelato (print, gift, home delivery) | process recipient name and address | NO (EEA) | CH/EU/EEA, only once confirmed in writing (DPA or API setting) before activation; Gelato's own sub-processors listed or linked here before activation | EEA, adequate; signed DPA before activation | not yet active |
| Prodigi Group Ltd (print, backup) | process recipient name and address | UK | UK, EU; CH/EU/EEA/UK only once confirmed in writing before activation | UK adequacy (CH and EU) | not yet active |
| Swiss Post (when live) | printing and posting postcards: the recipient's name and office address, first name on the front, card text | CH | CH, only once confirmed in writing before activation | none needed (domestic) | not yet active |
| AI/GIF generation provider (if used) | personalised GIFs | not yet chosen | not yet chosen | only with DPA; no real photos of persons uploaded at launch, text-based personalisation only | not yet active |
Storage location
The database (Cloudflare D1) is set up with EU jurisdiction; files are stored only in Cloudflare R2 buckets with EU jurisdiction. Nothing is hosted in Switzerland; Switzerland treats the EU as adequate.
Encryption
- All connections over TLS (HSTS).
- Home addresses and food intolerances with AES-256-GCM, key derived per company, only as a Worker secret.
- Addresses are decrypted only for shipping; every decryption is logged.
- We don't read messages, unless someone reports a message.
Deletion dates
On 31 January we delete your participants' data automatically; backups expire 30 days later at the latest. Exceptions (invoices 10 years, reported messages 90 days, previous-year pairs if you choose) are listed in the privacy policy.
DPA and TOMs
You can read and print the data processing agreement (DPA) with the technical and organisational measures (TOMs) before you buy. As PDF: DPA with TOMs · TOMs only.
Sender domain
Wichtli sends email from mail.wichtli.ch, with SPF, DKIM and DMARC. Emails never say who drew whom.
Contact
Security and data protection questions: privacy@wichtli.ch