Skip to main content DE

Data protection

1. Introduction and Scope

The Kündig Group takes the protection of your personal data seriously. This Privacy Policy informs you about what personal data we process, for what purpose, and what rights you have.

This policy applies to all companies within the Kündig Group and covers:

  • visits to our website www.kuendig.com
  • business relationships with customers and suppliers
  • job applications with a company of the Kündig Group
  • the use of AI-supported tools

The Kündig Group consists of several internationally active companies. You can find an overview of the Group companies at www.kuendig.com/ueber-uns. The data controller under data protection law is, in each case, the company with which you have a business relationship or to which you are applying for a job. Please refer to Section 2 for the contact information of the respective company.

2. Responsible Entities

The responsible entity in each case is the one with which you are in contact. For the Swiss company, the following applies:

W. Kündig & Cie AG
Stampfenbachstrasse 38
8006 Zurich, Switzerland
Phone: +41 44 368 25 25
Email: info.ch(at)kuendig.com
Website: www.kuendig.com

Contact person for data protection issues (Switzerland):
Alain Wegmüller, Group CFO & Head of IT
Email: alain.wegmueller(at)kuendig.com

An external data protection officer has been appointed for the German subsidiaries of the Kündig Group. You can obtain their contact information directly from the respective German subsidiary or by sending an email to info.ch(at)kuendig.com.

3. Applicable Legal Basis

The Kündig Group is headquartered in Switzerland and is subject to the revised Federal Act on Data Protection (revDSG), which has been in effect since September 1, 2023. The Group’s German subsidiaries are additionally subject to the EU General Data Protection Regulation (GDPR).

Since we also serve customers and suppliers in the EU, the GDPR may also apply to the Swiss company (Art. 3(2) GDPR, principle of the place of marketing). Where this is the case, the corresponding legal bases under the GDPR are listed in addition.

The Kündig Group does not process special categories of personal data (e.g., health data, biometric data) and does not engage in profiling.

4. A — Website and Online Services

4.1 Technical Access Data (Log Files)
Every time you visit our website, our system automatically collects the following technical data:

  • Browser type and version, operating system
  • IP address (anonymized after the session ends)
  • Date, time, and page accessed
  • Referrer URL

This data is necessary for the technical operation of the website and is deleted after 7 days at the latest. It is not combined with other personal data. Since the collection of this data is absolutely necessary for the operation of the website, there is no option to object.

Legal basis: Legitimate interest (Art. 6 revDSG / Art. 6(1)(f) GDPR)

4.2 Cookies
Our website uses cookies. We distinguish between:

  • Technically necessary cookies: Required for the operation of the website (e.g., language settings). These do not require consent.
  • Analytics and marketing cookies: These are set only with your explicit consent, which you provide via our cookie banner. You can withdraw your consent at any time via the cookie banner.

You can restrict or disable cookies at any time in your browser settings.

Legal basis: Legitimate interest for technically necessary cookies; consent for all other cookies (Art. 6 revDSG / Art. 6(1)(a) GDPR)

4.3 Web Analytics (Matomo)
We use Matomo to analyze website usage. Matomo processes pseudonymized data (e.g., truncated IP address, pages visited, duration of visit). No complete usage profile is created; no merging with other personal data takes place.

Matomo is hosted on our own servers (Hetzner, Germany). No data is transferred to third parties. Analysis takes place only with your consent via the cookie banner.

Legal basis: Consent (Art. 6 revDSG / Art. 6(1)(a) GDPR)

4.4 Google Ads
We run advertisements via Google Ads (Google Ireland Limited, Dublin, Ireland) and use conversion tracking and remarketing for this purpose. These features are activated only after you have given your consent via the cookie banner. Data transfers to the U.S. are based on Standard Contractual Clauses (SCCs) and the EU-U.S. Data Privacy Framework (DPF).

You can disable personalized ads at adssettings.google.com.

Legal basis: Consent (Art. 6 revDSG / Art. 6(1)(a) GDPR)

4.5 Embedded Videos (YouTube)
Videos from YouTube (Google Ireland Limited, Dublin, Ireland) are embedded on our website. We use a 2-click solution: A connection to YouTube is only established once you actively start playback. From that point on, YouTube may process data such as your IP address and usage behavior—and, if applicable, create usage profiles if you are logged in. Data transfers to the U.S. are possible (legal basis: SCC, EU-U.S. DPF).

Legal basis: Consent (Art. 6 revDSG / Art. 6(1)(a) GDPR)

4.6 Contact Form and Email Contact
When you contact us, we process your name, email address, the content of your message, and the date and time of contact. This data is used exclusively to process your inquiry and is deleted upon completion of the conversation, provided there are no legal retention requirements. You may object to the storage of this data at any time; in this case, the conversation cannot be continued.

Legal basis: Pre-contractual measures / legitimate interest (Art. 6 revDSG / Art. 6(1)(b)/(f) GDPR)

5. B — Business Relationships (Customers and Suppliers)

As part of our business operations, we process contact information for points of contact at customers and suppliers (name, title, phone number, email address). This data is used to maintain the business relationship, fulfill contractual obligations, and facilitate communication.

Retention period: For the duration of the business relationship plus the statutory retention periods (typically 10 years).

Legal basis: Contract performance and legitimate interest (Art. 6 revDSG / Art. 6(1)(b)/(f) GDPR)

5.1 Newsletter
The newsletter is sent exclusively on the basis of your explicit consent via the double opt-in procedure. You can unsubscribe from the newsletter at any time using the unsubscribe link in the newsletter or by sending an email to info.ch(at)kuendig.com. After unsubscribing, your email address will be retained for up to 3 years as proof of consent.

The newsletter is sent via Mailchimp (The Rocket Science Group LLC, Atlanta, USA). A data processing agreement is in place with Mailchimp; Data transfers to the U.S. are based on the Standard Contractual Clauses (SCCs) and the EU-U.S. Data Protection Framework (DPF).

When you open the newsletter, technical information may be collected (e.g., IP address, time of access, browser used, links clicked). This is done via a so-called web beacon and serves to improve the content of our newsletter. The analysis is conducted anonymously; there is no intention to track individual persons. You can prevent email tracking by disabling the loading of images in your email program.

Legal basis: Consent (Art. 6 revDSG / Art. 6(1)(a) GDPR)

6. C — Job Applications

When you apply for a position at a company within the Kündig Group, we process the application documents you submit (name, contact information, resume, transcripts, cover letter) solely for the purpose of filling the position.

Retention period: If your application is rejected, your documents will be deleted no later than 3 months after the rejection, unless you have expressly consented to longer retention for future job openings.

Application documents will not be disclosed to third parties, except to internal decision-makers as part of the selection process.

Legal basis: Pre-contractual measures (Art. 6 revDSG / Art. 6(1)(b) GDPR)

7. D — Use of Artificial Intelligence (Langdock)

We use the AI platform Langdock to support internal work processes (e.g., text creation, summaries, research). Langdock is a German company; data is stored within the EU and is not used for training AI models.

In the course of using the platform, personal data may be processed that we also handle in our other business processes (e.g., contact information for customers and suppliers). We have a Data Processing Agreement (DPA) in place with Langdock. Our employees are instructed to enter only the data necessary for the task at hand (principle of data minimization). Sensitive personal data (e.g., AHV numbers, bank account information) is not entered into AI tools.

All AI-generated content is reviewed by an employee before further use. There is no fully automated decision-making with legal effect (Art. 21 revDSG / Art. 22 GDPR).

Legal basis: Legitimate interest (Art. 6 revDSG / Art. 6(1)(f) GDPR)

8. Disclosure of Data to Third Parties and Transfers Abroad

We disclose personal data only if it is necessary to fulfill a contract, if there is a legal obligation to do so, or if there is a legitimate interest.

The following external service providers act as data processors on our behalf:

  • Google Ireland Ltd. (Ads, YouTube)
    • Purpose: Advertising, videos
    • Location: EU / USA
    • Safeguards: SCC, EU-US DPF
  • Mailchimp (Rocket Science Group LLC)
    • Purpose: Newsletter distribution
    • Location: USA
    • Safeguards: SCC, EU-US DPF
  • Langdock
    • Purpose: AI-supported work processes
    • Location: Germany / EU
    • Safeguards: DPA, EU hosting
  • Hetzner Online GmbH
    • Purpose: Web hosting, Matomo
    • Location: Germany
    • Guarantees: EU, GDPR-compliant

Intra-group transfer: In individual cases, personal data may be transferred to other companies within the Kündig Group (e.g., for order processing). For transfers to countries without an adequate level of data protection (in particular Canada, unless covered by an adequacy decision), we rely on appropriate safeguards in accordance with Art. 16 revDSG (e.g., standard contractual clauses).

9. Retention Period

Personal data is deleted or anonymized as soon as the purpose of processing no longer applies and there are no legal retention requirements to the contrary:

  • Technical log files (website): Max. 7 days
  • Contact inquiries: Upon completion of the conversation
  • Newsletter unsubscriptions: 3 years (proof of consent)
  • Job application documents (rejection): Max. 3 months
  • Business records: 10 years (statutory retention requirement in Switzerland/Germany)

10. Your Rights as a Data Subject

You have the following rights with respect to the Kündig Group company responsible for you:

  • Access to processed data: Art. 25 revDSG / Art. 15 GDPR
  • Rectification of inaccurate data: Art. 32 revDSG / Art. 16 GDPR
  • Erasure, provided there is no retention obligation: Art. 32 revDSG / Art. 17 GDPR
  • Restriction of processing: Art. 18 GDPR
  • Objection to processing based on legitimate interests: Art. 21 GDPR
  • Data portability (GDPR only): Art. 20 GDPR
  • Withdrawal of consent at any time without providing reasons: Art. 7(3) GDPR

Please direct inquiries to the company responsible for you (see Section 2). For the Swiss company: alain.wegmueller(at)kuendig.com — we will respond within 30 days.

Right to lodge a complaint:

  • Switzerland: Federal Data Protection and Information Commissioner (FDPIC), www.edoeb.admin.ch
  • EU/Germany: Federal Commissioner for Data Protection and Freedom of Information (BfDI) or the competent national supervisory authority

11. Data Security

We take appropriate technical and organizational measures to protect your personal data, including:

  • Encrypted data transmission (SSL/TLS)
  • Access protection and role-based permissions
  • Two-factor authentication for internal systems
  • Regular backups and security updates
  • Data processing agreements with all external service providers

12. Validity of This Privacy Policy

This Privacy Policy was last updated in August 2026. We reserve the right to amend it as necessary—for example, in the event of changes to our data processing practices, new legal requirements, or the use of new technologies.

The current version is available at www.kuendig.com/datenschutz.

Zurich, August 2026
W. Kündig & Cie AG