Privacy Policy of WinTogether GmbH / wintogether.ch

A. General Information
The protection of your personal data is particularly important to us at WinTogether GmbH. We strictly adhere to the applicable data protection laws of Switzerland (in particular the DSG, revDSG as of 1.9.2023) as well as to this privacy policy.
This statement provides you with an overview of which personal data we collect, how we use it, and what rights you have.
Please note that data transmission over the Internet (e.g., communication via email) may have security gaps. Complete protection of data against access by third parties is not possible.

B. Data Processing within Our Business Model
WinTogether GmbH mediates partnerships between clubs and companies, especially in the context of product sales with rebate mechanisms (kickbacks) for clubs.

1. Which data is processed?
As part of using our platform and our mediation services, we process, among other things, the following personal data:

  • Name, address, email address, telephone number
  • Club membership
  • Order and transaction information
  • For companies: company data, contact persons, communication history
  • Technical metadata such as IP address, access time, browser type

2. Data sharing and access
Our system provides the following data flows:
  • Companies see a detailed list of club members who have benefited from their offer via the platform. This list contains personal data (e.g., name, address, email).
  • Clubs do not have access to personal data of their own or other members regarding used offers.
  • Clubs can view information from companies that wish to partner with them via their personal login. Companies that do not submit a partnership request to a club remain hidden from that club.
  • Companies see all registered clubs including their club data (e.g., club name, address, contact person).

3. How do we collect data?
  • Direct collection: e.g., through registration, orders, inquiries via email or contact form
  • Indirect collection: e.g., through interactions with a club or company connected to us
  • Automated collection: via server log files (e.g., IP address, date/time, browser information)


C. Technical Implementation and Data Security
Our entire infrastructure is based on Amazon Web Services (AWS). We use the following services:
  • AWS Lambda
  • Amazon Cognito
  • AWS Step Functions
  • API Gateway
  • Amazon S3
  • Amazon DynamoDB
These systems partially process personal data. All sensitive data is encrypted according to current technical standards – both during storage and transmission. We use Customer Managed Keys (CMK) for encryption, as provided by AWS KMS.
Registration and identity management is handled via Amazon Cognito, which supports security mechanisms such as multi-factor authentication (MFA).

D. Analytics Tools and Cookies
We currently do not use third-party analytics tools.
Technically necessary cookies may be used to improve the user experience. These cookies do not contain personal data and can be disabled in the browser – however, this may limit the functionality of the platform.

E. Your Rights
You have the right at any time to:
  • Obtain information about your stored personal data
  • Request correction of incorrect data
  • Request deletion of your data, unless there is a legal retention obligation
  • Withdraw your consent to data processing with effect for the future
Please send your request via email to: info@wintogether.ch

F. Data Retention and Deletion
Unless otherwise required by law or contract, we store personal data for a maximum of 10 years or delete it earlier upon explicit request.

G. Changes to This Privacy Policy
We reserve the right to adjust this privacy policy as needed – for example, due to new legal requirements or changed technical processes. The version published on our website always applies.

WinTogether GmbH
Moosseedorf, Switzerland

Optional website statistics

With your consent, we count page views, selected clicks, registration steps and campaign sources on our AWS infrastructure. Statistics contain no form inputs or individual visitor identifiers. Counters expire after 90 days. Your choice is stored locally; campaign sources are stored for the lifetime of the browser tab. You can disable measurement in the footer. Previously counted, unidentifiable events remain until retention expires.