WILLEN : ORG

Privacy Policy

Last updated: 2026-08-17

1. Introduction and Scope

This Privacy Policy explains how your personal data is collected, processed, and used when you visit willen.org (the "Website"). It applies to all visitors of the Website.

WILLEN:ORG is an initiative of W89 GmbH. The controller within the meaning of the Swiss Federal Act on Data Protection (DSG, SR 235.1) and, where applicable, the EU General Data Protection Regulation (GDPR) is:

W89 GmbH
Zugerstrasse 6
6330 Cham
Switzerland
Company identification number (UID): CHE-325.824.473
Email: info@willen.org

We take the protection of your personal data seriously and process it in compliance with the applicable data protection legislation, in particular the Swiss DSG and, where applicable, the GDPR.

2. Data Processing When Visiting the Website

When you access the Website, the following technical data is automatically transmitted by your browser to our hosting provider and stored in server log files:

  • IP address
  • Date and time of the request
  • HTTP method and requested URL
  • HTTP status code
  • Volume of data transferred
  • Referring URL (previously visited page)
  • Browser type and version
  • Operating system

This is the only processing that takes place when you simply look at the Website. It is necessary for its secure and reliable operation. Under Swiss law this processing is permitted in principle and complies with the principles of Art. 6 DSG. Where the GDPR applies in addition, we rely on our legitimate interest in operating and securing the Website (Art. 6 para. 1 lit. f GDPR).

These log entries are created and held by our hosting provider. This Website consists of static files; we operate no server of our own, no application code runs when you visit, and we keep no copy of the log files. Their retention is determined by Cloudflare in accordance with its privacy policy: https://www.cloudflare.com/privacypolicy/

3. Hosting

The Website is hosted by Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA ("Cloudflare"). When you visit the Website, your personal data (in particular the technical data described in Section 2) is processed on Cloudflare's servers, which may be located outside of Switzerland and the European Economic Area (EEA).

Cloudflare states that it is certified under both the EU-U.S. Data Privacy Framework and the Swiss-U.S. Data Privacy Framework.

For transfers from Switzerland, the Swiss Federal Council determined on 14 August 2024 that the United States provides an adequate level of data protection for organisations certified under the Swiss-U.S. DPF, with effect from 15 September 2024 (Annex 1 to the Data Protection Ordinance, DSV, SR 235.11). The transfer therefore rests on Art. 16 para. 1 DSG, which permits disclosure abroad where the Federal Council has made such a determination. It does not depend on the additional safeguards of Art. 16 para. 2 DSG.

Where the GDPR applies in addition, Cloudflare relies on its EU-U.S. DPF certification and on the Standard Contractual Clauses adopted by the European Commission (Decision 2021/914), which are appropriate safeguards within the meaning of Art. 46 GDPR and remain in place should a certification lapse.

For more information, see Cloudflare's privacy policy: https://www.cloudflare.com/privacypolicy/

4. Contact via Email

The Website has no contact form. Contact is by email only. If you write to us, the personal data you provide (e.g. name, email address, message content) will be processed solely for the purpose of handling and responding to your inquiry.

Under Swiss law, processing the data you send us in order to answer you is permitted in principle. Where the GDPR applies in addition, the legal basis is the performance of pre-contractual measures at your request or our legitimate interest in responding (Art. 6 para. 1 lit. b and lit. f GDPR).

Please note that standard email is not an encrypted means of communication. Your data will be retained for as long as necessary to process your inquiry and for any applicable statutory retention periods. It will be deleted once it is no longer required.

5. Cookies, Storage, and Analytics

This Website sets no cookies at all, neither its own nor any belonging to a third party. It writes nothing to your browser's local storage or session storage. There is therefore no cookie banner, and there is nothing for you to consent to or to withdraw.

The Website also loads nothing from a third-party server. The fonts, the stylesheet and the one small script it uses are all served from willen.org itself. Opening any page of this Website therefore establishes no connection to any company other than our hosting provider (see Section 3).

Until August 2026, the Website used Google Analytics 4, which loaded only after you accepted it in a consent banner and which recorded that choice in your browser's local storage under the key "willen-cookie-consent". The analytics and the banner have both been removed in full. No data is transmitted to Google.

If you visited the Website before that change, this entry may still be present in your browser. It is no longer read and serves no function. You can remove it at any time by clearing the site data for willen.org in your browser settings.

6. Purpose of Data Processing

We process personal data for the following purposes:

  • Providing, operating, and maintaining the Website
  • Responding to inquiries and communications
  • Ensuring the security of the Website and preventing misuse
  • Fulfilling legal obligations

We do not process personal data in order to analyse how the Website is used. We have no visitor statistics of any kind.

7. Legal Basis for Processing

Swiss and EU law are structured differently, and each is set out here on its own terms.

Under the Swiss DSG, the processing of personal data by private persons is permitted in principle and does not require a separate legal basis. It must comply with the principles of Art. 6 DSG (lawfulness, good faith, proportionality, purpose limitation, accuracy) and the security requirements of Art. 8 DSG. A justification under Art. 31 DSG only becomes relevant if processing would unlawfully infringe someone's personality rights under Art. 30 DSG. We do not rely on such a justification for any of the processing described here.

Where the GDPR applies in addition, we rely on the following legal bases:

  • Pre-contractual measures at your request (Art. 6 para. 1 lit. b GDPR), when you contact us
  • Our legitimate interests (Art. 6 para. 1 lit. f GDPR), for the operation and security of the Website
  • Compliance with legal obligations (Art. 6 para. 1 lit. c GDPR)

We do not rely on consent as a legal basis. No processing described in this Privacy Policy requires it.

8. Data Sharing and Recipients

We do not sell, trade, or rent your personal data.

There is exactly one recipient category: Cloudflare, Inc., for hosting and content delivery. No advertising network, no analytics provider and no other third party receives data through this Website.

Cloudflare is contractually bound to process data exclusively in accordance with our instructions and to implement appropriate technical and organisational measures to protect your data. That obligation arises from Cloudflare's Data Processing Addendum, which forms part of its Self-Serve Subscription Agreement and applies to our account.

We make no automated individual decisions within the meaning of Art. 21 DSG or Art. 22 GDPR, and we carry out no profiling within the meaning of Art. 5 lit. f DSG or Art. 4 no. 4 GDPR.

9. International Data Transfers

Our hosting provider is based in the United States. This is the only transfer of personal data abroad that the operation of this Website involves.

Under Swiss law, the Federal Council determines which states provide an adequate level of data protection (Art. 16 para. 1 DSG). The binding list is Annex 1 to the Data Protection Ordinance (DSV, SR 235.11), and the United States is included for organisations certified under the Swiss-U.S. Data Privacy Framework. Cloudflare states that it holds that certification.

Where the GDPR applies in addition, the transfer is covered by Cloudflare's EU-U.S. DPF certification and by the Standard Contractual Clauses approved by the European Commission.

No further transfers abroad take place. There is no analytics provider, no advertising network and no other recipient.

10. Data Retention

We retain personal data only for as long as necessary for the purposes described in this Privacy Policy or as required by law.

  • Server log files: retained by our hosting provider under its own retention practice, see Section 2. We hold no copy of them.
  • Email correspondence: for as long as needed to handle your inquiry and for any applicable statutory retention periods

No other data is retained. We hold no user accounts, no mailing list and no analytics records.

Once the retention period expires, data is securely deleted or anonymised.

11. Your Rights

Under the Swiss DSG and, where applicable, the GDPR, you have the following rights:

  • Right to information and access: you may request information about whether and what personal data we process about you (Art. 25 DSG; Art. 15 GDPR).
  • Right to rectification: you may request the correction of inaccurate personal data (Art. 32 para. 1 DSG; Art. 16 GDPR).
  • Right to erasure: under the GDPR you may request deletion (Art. 17 GDPR). Under Swiss law, deletion or destruction of data is claimed under Art. 32 para. 2 DSG in conjunction with Art. 28, 28a and 28g to 28l of the Swiss Civil Code. We act on well-founded deletion requests without requiring recourse to the courts.
  • Right to restriction of processing (Art. 18 GDPR).
  • Right to data portability: you may request your data in a structured, commonly used, machine-readable format (Art. 28 DSG; Art. 20 GDPR).
  • Right to object to processing based on legitimate interests (Art. 21 GDPR).

The scope of these rights in relation to this Website is limited by what is processed here. The Website operates no user accounts, no logins, no mailing list, no analytics profiles and no contact form. Unless you have written to us by email, the only personal data relating to your visit is a server log entry held by our hosting provider, which we neither read nor copy. Requests concerning those log entries are directed to Cloudflare as the party holding them.

To exercise your rights, please contact us at info@willen.org. We will respond within 30 days.

You may also report a suspected breach of data protection law to the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern (https://www.edoeb.admin.ch). Please note that Swiss law provides for a report leading to a supervisory investigation under Art. 49 DSG, not a right of appeal in the sense of Art. 77 GDPR; under Art. 52 para. 2 DSG the only party to that investigation is the person or body being investigated, so the reporting person is not a party. To enforce your rights directly, you may bring a civil claim under Art. 32 DSG. Where the GDPR applies, you may lodge a complaint with a competent EU supervisory authority.

12. Data Security

We implement appropriate technical and organisational security measures in accordance with Art. 8 DSG to protect your personal data against unauthorised access, loss, destruction, or alteration. These measures include:

  • TLS/HTTPS encryption for all data in transit
  • Secure hosting infrastructure with access controls
  • A Content Security Policy that permits no scripts, styles, fonts or images from any other domain
  • Regular review of security practices

Despite these measures, no method of transmission or storage is completely secure. We cannot guarantee the absolute security of your data.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our data practices or legal requirements. The current version is always available on this page with the date of the last update.

We recommend reviewing this Privacy Policy periodically.

14. Contact

If you have questions about this Privacy Policy or wish to exercise your data protection rights, please contact:

W89 GmbH
Zugerstrasse 6
6330 Cham
Switzerland
Email: info@willen.org