Privacy Policy of Woonig AG

Version 2.0 · Last updated: 29 July 2026

This Privacy Policy explains how Woonig AG processes personal data in connection with its websites, the Woonig platform, its mobile applications and optional AI, chat, telephony and voice functions.

1. Scope

This Privacy Policy applies in particular to the websites and language versions of Woonig AG, the Woonig platform and associated web applications, mobile applications, contact, demo, trial, support and contractual enquiries, newsletters and marketing communications, business relationships with customers, prospects, partners and service providers, and applications for employment with Woonig AG.

The sections relevant to you depend on whether you visit our website, have a business relationship with us, use the Woonig platform or an app, or are affected by a function provided through Woonig.

Additional privacy notices, terms of use or contractual provisions may apply to individual products, functions, customer-specific configurations or particular processing activities.

We process personal data in accordance with the Swiss Federal Act on Data Protection (FADP), the Ordinance on Data Protection (DPO) and, where applicable, the General Data Protection Regulation of the European Union (GDPR), as well as other applicable data protection legislation.

2. Controller and privacy contact

The controller responsible for Woonig AG’s own processing activities is:

Woonig AG

Müligässli 1

8598 Bottighofen

Switzerland

Email: contact@woonig.com

Privacy enquiries and requests to exercise data subject rights may be sent to this email address.

3. Data protection roles

3.1 Woonig as controller

Woonig AG is responsible in particular for processing activities connected with:

• the operation of its public websites;

• contact, demo, trial and contractual enquiries;

• its own customer, partner and supplier relationships;

• contract administration, billing and invoicing;

• its own newsletter and marketing activities;

• support provided directly by Woonig;

• the operation, security and further development of its own systems;

• applications for employment with Woonig AG.

3.2 Woonig as processor

Where property management companies, real estate service providers or other organisations use the Woonig platform to process data relating to their tenants, condominium owners, prospects, employees, service providers or other persons, the respective organisation generally determines the purposes and scope of the processing.

In these cases, the respective organisation is the controller. Woonig AG generally processes the relevant personal data as a processor in accordance with the customer’s documented instructions within the meaning of Art. 9 FADP and, where applicable, Art. 28 GDPR.

Data subjects with questions about such platform data should generally contact the relevant property management company or other Woonig customer first. Woonig AG assists the responsible customer with the handling of such requests.

3.3 Service providers and third-party users

Service providers, tradespeople, suppliers and other parties engaged by a customer receive only the information and access rights intended for the performance of the relevant order or process. Their data protection role depends on the specific cooperation.

4. Principles and legal bases of processing

We process personal data:

• lawfully and in good faith;

• transparently and for specified purposes;

• proportionately and limited to what is necessary;

• as accurately and up to date as reasonably possible;

• only for as long as required for the relevant purpose;

• with appropriate technical and organisational security measures.

Where justification is required, we rely in particular on the data subject’s consent, the conclusion or performance of a contract, a statutory obligation or permission, overriding private or public interests, or the establishment, exercise or defence of legal claims.

Where the GDPR applies, processing is based in particular on Art.

6(1)(a) GDPR (consent), Art. 6(1)(b) GDPR (contract or pre-contractual measures), Art. 6(1)(c) GDPR (legal obligation) or Art. 6(1)(f) GDPR (legitimate interests).

Consent may be withdrawn at any time with effect for the future. The lawfulness of processing carried out before withdrawal remains unaffected.

5. Categories of personal data

Depending on the relevant activity, we process in particular the following categories of personal data:

5.1 Master and contact data

• first name and surname;

• residential, business or correspondence address;

• email address and telephone number;

• company, position and department;

• preferred language;

• customer, user or contract numbers.

5.2 Contractual and business data

• offers, orders and contractual relationships;

• booked services and modules;

• billing and payment information;

• business communications;

• support and service information;

• information relating to partners and suppliers.

5.3 Platform and property data

• property, unit and contract assignments;

• tenancy, ownership or service relationships;

• tickets, requests, damage reports and orders;

• appointment details, status information and processing steps;

• messages, comments, documents, images and videos;

• meeting, voting and eVoting data;

• marketing, prospect and applicant information;

• invoice, transaction, interface and import data.

5.4 Technical and usage data

• IP address;

• date and time of access;

• browser type, browser version, operating system and device type;

• language and screen resolution;

• pages accessed and functions used;

• referrer URL;

• session, error and log data;

• user, device and session identifiers;

• approximate location based on country, region or city;

• cookie and consent information.

5.5 Recruitment data

• CV, certificates and qualifications;

• education and professional experience;

• contact details and correspondence;

• salary expectations;

• other application documents voluntarily submitted.

5.6 Sensitive personal data

Depending on the specific use, content may include sensitive personal data, such as health information in damage, accident or support cases, information from debt enforcement register extracts, or information from administrative or judicial proceedings.

Woonig does not ask website visitors to submit sensitive personal data through general contact forms or the website assistant unless this is expressly necessary for the specific matter. When the platform is used, the responsible customer generally determines which information is required for a particular process.

6. Sources of personal data

We obtain personal data in particular:

• directly from the data subject;

• from Woonig AG customers;

• from property management companies and real estate service providers;

• from service providers, partners and suppliers;

• through manual entry into the platform;

• through interfaces and data imports;

• from connected ERP, CRM, DMS or accounting systems;

• from publicly accessible sources, where permitted;

• automatically when our website, platform or apps are used;

• through devices, browsers, operating systems and app platforms.

Part A: Woonig AG website

7. Visiting our website

7.1 Technical provision and log data

When our website is accessed, technically necessary data is processed. This may include the IP address, date and time of access, the page or file requested, browser and device information, the operating system, the referrer URL and technical error and security information.

This processing serves to provide and correctly display the website, ensure stability and security, analyse errors, prevent misuse and attacks, and optimise the website technically.

Our website is operated using services provided by Wix.com Ltd. and affiliated companies. Wix may engage additional subprocessors for infrastructure, hosting, communications, security and the provision of website functions.

7.2 Contact, demo and trial enquiries

If you contact us through a form, by email, by telephone or through another contact channel, we process in particular your name, email address, telephone number, company and role, details of your enquiry, requested appointments and other information voluntarily provided.

We use this data to process and respond to your enquiry, organise and prepare a product demonstration, set up or support a trial account, prepare an offer, initiate or perform a business relationship, document communications and carry out reasonable follow-up contact.

Wix Forms, Wix CRM and Wix Bookings may be used in particular for forms, contact management and appointment bookings.

7.3 Video conferences

We may use video conferencing services such as Zoom for demonstrations, consultations, meetings or support appointments. In this context, names and contact details, meeting and dial-in data, IP address and device information, meeting metadata, chat messages and audio and video content may be processed if the camera or microphone is activated.

Meetings are recorded only where participants have been informed in advance and the applicable requirements have been met.

8. Cookies and similar technologies

We use cookies and similar technologies on our website. These include in particular cookies, local storage, session storage, pixels and tags, device and session identifiers and embedded scripts.

8.1 Necessary technologies

These technologies are required for essential functions, including security and fraud prevention, network and session management, correct display of the website, storage of privacy and cookie choices, login and authentication, and technical form functions.

8.2 Functional technologies

These technologies enable additional functions and personalisation, such as language settings, embedded content, chat and assistance functions, video or map content, and the storage of certain user preferences.

8.3 Analytics technologies

These technologies help us evaluate visitor numbers and page views, understand how the website is used, identify technical errors and improve content, navigation and the performance of individual pages.

8.4 Marketing technologies

These technologies are used in particular to measure advertising campaigns, track conversions, create audiences, attribute website actions to advertising measures, display relevant advertising and conduct retargeting.

9. Consent management with Usercentrics for Wix

We use Usercentrics for Wix to inform visitors about cookies and comparable technologies and to manage their choices. The provider is Usercentrics GmbH, Germany.

The data processed may include the consent or refusal status, selected categories and services, the date and time of the decision, a consent or device identifier, IP address and technical browser information, and the version of the consent configuration displayed.

This data is used to implement the cookie decision, remember the choice on subsequent visits, enable later withdrawal and provide evidence of consent or refusal.

Visitors can accept, reject or select non-essential technologies by category. The choice can be changed at any time through the permanently accessible privacy or cookie settings widget.

An up-to-date list of the technologies, providers, purposes and storage periods identified is available directly within the cookie settings.

10. Website analytics and tag management

10.1 Wix Analytics

We may use Wix Analytics to obtain statistical information about the use of our website. This may include page views, session information, device and browser information, the source of the visit, approximate location and interactions with website elements.

Where Wix Analytics uses non-essential analytics technologies, processing takes place in accordance with the selection made in the consent manager.

10.2 Google Analytics

We use Google Analytics to analyse the use of our website and improve our offering. The provider for users in Switzerland and the European Economic Area is generally Google Ireland Limited, Ireland.

The data processed may include device and browser information, pages accessed, date and duration of visits, source of access, interactions and events, approximate location and pseudonymous user or session identifiers.

Google Analytics is activated only in accordance with the choice made in the consent manager. Google may also process data in the United States or other countries.

10.3 Google Tag Manager

We use Google Tag Manager to manage website tags and associated analytics, functional or marketing services. The specific data processed depends on the services integrated through Tag Manager.

Tags triggered through Google Tag Manager are classified according to their actual purpose and controlled in accordance with the choice made in the consent manager.

11. LinkedIn Insight Tag

We may use the LinkedIn Insight Tag to measure the success of LinkedIn campaigns, track conversions, analyse reach and audiences, and create audiences for LinkedIn advertising. The provider is generally LinkedIn Ireland Unlimited Company, Ireland.

The data processed may include the URL and referrer URL, IP address, device and browser information, timestamps, interactions and conversion events, and pseudonymous LinkedIn or campaign identifiers.

The LinkedIn Insight Tag is activated only where consent has been given for marketing technologies in the consent manager. LinkedIn may process data within the LinkedIn or Microsoft group of companies and in other countries.

12. Pop-ups, forms and Poptin

We may use Poptin for pop-ups, notices, forms, lead generation and email marketing. The data processed may include IP address, browser and device information, pages accessed, source of access, interactions with pop-ups, display or closure of a pop-up, completion of a form, voluntarily entered contact details, and cookies and browser storage information.

The processing serves in particular to display notices and offers, prevent repeated displays, record and manage enquiries, generate leads and measure the success of forms and campaigns.

Poptin is activated as a functional or marketing service in accordance with the cookie choice made.

13. Website assistant and Woonig Bubble

A digital chat or website assistant known as the Woonig Bubble may be provided on selected pages. The technical service is supplied through an external service under the domain portal.ci-platform.app.

When the service is used, the data processed may include IP address, browser and device information, session and storage information, the page accessed, the time of interaction, questions and messages entered, responses generated by the system, technical error and log data and contact information voluntarily provided.

The processing serves in particular to answer general questions, assist with website navigation, provide product information, forward contact enquiries, and improve and secure the assistance function.

The function is not intended for visitors to enter sensitive personal data, passwords, confidential documents, payment information or specific tenancy and damage cases.

The Woonig Bubble is loaded as a functional service in accordance with the choice made in the consent manager.

14. Embedded content and iframes

Our website may embed content from third parties, including videos, maps, forms, booking functions, social media content, software demonstrations or other iframes and widgets.

Loading such content may create a direct connection to the relevant third party. The data transmitted may include the IP address, browser information, referrer URL, page accessed and interaction data.

Non-essential external content is classified as functional, analytics or marketing according to its purpose and is loaded in accordance with the choice made in the consent manager.

15. Social media profiles and links

Our website may contain links to external social media platforms such as LinkedIn, YouTube, Facebook or Instagram. In the case of a simple link, data is generally transferred to the relevant platform only when you click the link.

The relevant sections of this Privacy Policy apply to embedded social media content or tracking tags. After an external platform is accessed, the respective platform operator is responsible for the processing carried out there.

16. Newsletters and marketing communications

If you subscribe to a newsletter or other marketing information, we process in particular your name, email address, company and role, language, information about registration and consent, and, where applicable, opening, click and interaction data.

We use this data to inform you about products and modules, new functions and releases, events and webinars, specialist articles and industry information, and offers, demonstrations and trial opportunities.

Where required, we use a confirmation procedure in which the registration must be confirmed again.

You can unsubscribe at any time using the unsubscribe link in the relevant message or by emailing datenschutz@woonig.com.

Necessary system, security, support and contractual messages are not marketing communications and may continue to be sent where required for contract performance or secure operation.

17. Applications for employment with Woonig

If you apply for a position with Woonig, we process in particular your name and contact details, CV, certificates, qualifications, education and professional experience, correspondence, salary expectations and other information voluntarily provided.

The data is used to assess your application, communicate with you, organise interviews, evaluate a potential employment relationship and document the recruitment process.

If no employment relationship is established, recruitment data is deleted after the process has ended as soon as it is no longer required for the recruitment process, statutory obligations or the defence of possible claims. With your separate consent, documents may be retained for longer so that you can be considered for future positions.

Part B: Woonig platform

18. User groups of the Woonig platform

18.1 Business users

Business users are organisations and their employees that use the Woonig platform to manage their business processes, including property management companies, property managers, owner representatives and real estate service providers.

18.2 End users

End users are persons who use the Woonig platform or related channels to communicate and interact with a business user, including tenants, prospective tenants, condominium owners, residents, property owners and other contact persons.

18.3 Third-party users and service providers

Third-party users are organisations and their employees that receive, process or report on orders through the Woonig platform, including tradespeople, caretaking services, technical service providers, suppliers and external partners.

19. User accounts and access management

Personal user accounts may be required to use the Woonig platform. The data processed may include name and contact details, the company or responsible property management company, user role and permissions, user identifier, authentication data, language settings, login and security information and device and session data.

This data is used to create and manage the account, authenticate users, manage roles and permissions, provide platform functions, protect against unauthorised access, log security-relevant events and communicate about the account.

Processing takes place in particular to provide the agreed platform services and in accordance with the relationship with the respective Woonig customer.

20. Processing within the platform

Personal data may be processed through the Woonig platform in particular for the following purposes:

• communication between property management companies, tenants, owners and service providers;

• recording and processing enquiries, tickets and damage reports;

• categorisation, prioritisation and assignment of processes;

• engaging and coordinating service providers;

• appointment scheduling;

• providing and exchanging documents;

• marketing, letting and applicant management;

• managing properties and units;

• conducting condominium owners’ meetings;

• eVoting and documentation of votes;

• processing invoices, forms and dossiers;

• preparing reports and evaluations;

• translation of communications;

• connecting ERP, DMS, CRM and communication systems;

• sending emails, SMS messages, letters or other communications;

• support, troubleshooting, quality assurance, IT security and prevention of misuse;

• compliance with statutory and contractual obligations.

21. Platform content

Business users, end users and third-party users may enter or upload texts, messages, tickets, reports, orders, photos, videos, documents, forms, appointment and status details, invoices, voting and meeting documents and other process-related content within the Woonig platform.

The relevant data is generally made available only within the respective customer or company area and in accordance with the access rights configured.

22. Data imports and interfaces

Platform data may be entered manually, imported through interfaces, transferred from connected systems or transmitted to authorised recipient systems.

These systems may include ERP and property management systems, CRM systems, document management systems, accounting and invoicing systems, property portals, communication services, postal and delivery providers, and service provider and partner systems.

The respective customer is generally responsible for ensuring that imported or transmitted personal data has been collected lawfully and may be processed for the relevant purpose.

23. Platform analytics, security and product improvement

We may process technical usage, log, security and error data to provide the platform, identify and resolve disruptions, ensure stability and security, prevent misuse and unauthorised access, handle support cases and improve functions and user guidance.

Where possible, we use aggregated or anonymised data for these purposes. Personal platform content is not used for general product analytics without an appropriate purpose or authorisation.

Part C: Mobile applications

24. Use of the Woonig apps

Woonig provides mobile applications for various user groups. Depending on the function used, the data processed may include master and contact data, user and account identifiers, device and session identifiers, platform content, messages, photos and documents, usage and diagnostic data, push notification tokens and technical error data.

24.1 Device permissions

Depending on the function, the app may request access to the camera, photos and media files, microphone, notifications, device storage or other areas required for a specific function.

A permission is generally granted only after you confirm it through the operating system. You can change device permissions at any time in your device settings.

24.2 Push notifications

If you enable push notifications, a technical device or notification token is processed. Push notifications may inform you about new messages, status changes, appointments, documents, orders or tasks.

You can disable push notifications at any time in your device settings.

24.3 App stores

When an app is downloaded, Apple or Google independently processes data in connection with your app store account, the download, the device used, technical diagnostic data and, where applicable, payments. The privacy policies of the respective app store operators apply to this processing.

Part D: AI, voice and telephony functions

25. AI-supported processing

Depending on the functions booked and activated, Woonig may use automated or AI-supported functions, for example to identify and categorise requests, detect possible duplicates, prioritise and assign processes, translate, summarise, prepare response suggestions, analyse documents and invoices, support marketing and letting processes, prepare reports and provide chat, assistance and voice functions.

These functions are generally intended to support natural persons and make the processing of activities more efficient.

Unless expressly communicated otherwise, these functions do not make decisions based solely on automated processing that have legal or similarly significant effects on data subjects.

26. Automated individual decisions

An automated individual decision exists in particular where a decision is made without human involvement and has legal or similarly significant effects on a data subject.

If such an automated individual decision is used, the relevant controller informs the data subject appropriately. Subject to the statutory requirements, the data subject may state their position and request that the decision be reviewed by a natural person.

27. Telephony and voice processing

Where a customer uses telephony functions or an AI telephone assistant provided by Woonig, the data processed may include the telephone number, date and time of the call, duration of the conversation, voice and audio content, transcripts, recognised language, content and category of the request, assignment to a property management company or property, and tickets and processing steps created from the call.

The processing may serve in particular to receive and document requests, create a ticket, categorise and forward the request, translate content, assure quality and make communications traceable.

Whether and to what extent a call is recorded or transcribed depends on the customer’s specific configuration and the applicable legal requirements. Data subjects are informed at the beginning of the call or in another appropriate manner where required.

The respective Woonig customer generally remains responsible for the use of the telephony function in relation to its tenants, owners, service providers or other callers.

Part E: General provisions

28. Recipients and service providers

Personal data may in particular be disclosed to the following categories of recipients:

• employees and authorised persons of Woonig AG;

• customers of Woonig AG and authorised platform users;

• property management companies, real estate service providers, tradespeople and other service providers;

• hosting, cloud, IT, software and security providers;

• email, SMS, telephony, video conferencing and postal service providers;

• form, appointment, CRM and support providers;

• analytics and marketing providers;

• AI, translation and document processing providers;

• ERP, DMS and interface partners;

• payment, accounting and invoicing providers;

• legal, tax and corporate advisers;

• authorities, courts and other public bodies;

• potential parties to a corporate transaction.

Providers used or envisaged in connection with the website include in particular Wix, Usercentrics, Google, LinkedIn, Poptin, Zoom and the technical provider of the Woonig Bubble. Apple and Google may also process data in connection with the mobile applications.

Where required by their role and applicable law, we contractually require processors to process personal data only for the agreed purposes and in accordance with our instructions.

29. Disclosure of personal data abroad

Personal data is generally processed in Switzerland and, depending on the service used, in the European Economic Area. Because international service providers are used, processing may also take place in Israel, the United States of America, the United Kingdom or other countries in which a provider or its subprocessors operate.

The productive core data system of the Woonig platform is generally operated in Switzerland or the European Economic Area in accordance with the relevant contractual arrangement. Website, analytics, communications, support and app services may nevertheless result in international data processing.

Where the recipient country does not provide a recognised adequate level of data protection, we use appropriate safeguards where required, such as recognised standard contractual clauses, Swiss supplements, recognised data protection frameworks, contractual privacy and security provisions or technical protective measures. In cases provided for by law, disclosure may also be based on an exception.

30. Retention and deletion

We retain personal data only for as long as required for the relevant purpose or where statutory, contractual, security-related or evidentiary reasons require longer retention.

When determining the retention period, we consider in particular the purpose of processing, the duration of the contractual or business relationship, documented instructions of the responsible customer, statutory retention obligations, limitation and appeal periods, security and misuse risks, and the need to provide evidence of consents or business transactions.

30.1 Website and log data

Technical log data is generally retained only for as long as required for operation, security, error analysis and prevention of misuse. Relevant data may be retained for longer in the event of a security incident.

30.2 Contact, demo and trial enquiries

Enquiry data is retained until the enquiry has been fully processed and thereafter for as long as required for documentation, further business initiation or defence against possible claims. If a contractual relationship is established, the retention periods for contractual and business data apply.

30.3 Newsletter and consent data

Newsletter data is generally retained until consent is withdrawn or the subscription is cancelled. After cancellation, minimal suppression information may be retained to ensure that the objection continues to be respected.

Records of consents and refusals are retained for as long as required to implement and evidence the respective privacy decision.

30.4 Platform data

Platform data is deleted, returned, restricted or anonymised during and after the contractual term in accordance with the contractual arrangements, instructions of the responsible customer, statutory retention obligations and necessary backup and transition periods.

Data in backups is overwritten or deleted in accordance with the regular backup cycles unless a legal obligation or legitimate reason requires longer retention.

30.5 Business and recruitment records

Contracts, invoices, accounting records and business correspondence are retained in accordance with the applicable statutory retention obligations.

Recruitment data is deleted after the recruitment process has ended as soon as it is no longer required for the process, statutory obligations or the defence of possible claims.

31. Data security

We take appropriate technical and organisational measures to protect personal data in accordance with the relevant risk.

These measures may include in particular:

• role and permission concepts;

• authentication and password protection;

• access controls;

• encryption during transmission;

• encryption of stored data where appropriate;

• logging of security-relevant events;

• tenant and data separation;

• backup and recovery procedures;

• monitoring and error detection;

• protection against malware and attacks;

• training and confidentiality obligations for employees;

• contractual obligations for service providers;

• regular review and further development of security measures.

Despite appropriate measures, absolute protection against all risks cannot be guaranteed.

32. Rights of data subjects

Subject to applicable data protection law, data subjects may in particular have the following rights:

• access to personal data being processed;

• rectification of inaccurate or incomplete data;

• deletion or destruction of data;

• objection to certain processing activities;

• restriction of processing, where applicable;

• withdrawal of consent;

• release or transfer of certain data in a commonly used electronic format;

• human review of an automated individual decision;

• assertion of other statutory rights.

To exercise your rights, you may contact datenschutz@woonig.com. We may request suitable proof of identity to prevent unauthorised disclosure of data.

32.1 Data of a Woonig customer

If a request relates to data processed by a property management company or another customer through the Woonig platform, you should generally contact that customer directly. Woonig AG may forward the request to the responsible customer or assist the customer in handling it.

33. Right to lodge a complaint

You may first contact Woonig AG with privacy concerns. You may also contact the competent data protection supervisory authority.

In Switzerland, this is the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, Switzerland.

Where the GDPR applies, you may additionally have the right to lodge a complaint with a competent European data protection supervisory authority.

34. Changes to this Privacy Policy

We may amend this Privacy Policy if our processing activities change, new products or functions are introduced, other service providers are used, statutory or regulatory requirements change, or organisational or technical adjustments make this necessary.

The current version published on our websites or in our applications applies. Where necessary and proportionate, we will inform data subjects appropriately about material changes.

Continued use of the website, platform or app does not automatically constitute consent to new processing activities. Where consent is required, it will be obtained separately.