Privacy notice | Chelini

1. Who is responsible

The controller responsible for processing your personal data on this website and in connection with Chelini is CHW-Services GmbH.

Controller: CHW-Services GmbH
Ettenhauserstrasse 46
8620 Wetzikon
Switzerland
Contact person: Winn Chelini, Managing Director
E-mail: winn@chelini.ch
Phone: +41 78 239 12 12

Where this notice says ‘I’, it means Winn Chelini acting for CHW-Services GmbH. Further company details are in the imprint.

2. Scope and principles

This notice covers the website chelini.ch and everything I do with personal data as part of Chelini: enquiries, confidential conversations, sessions and invoicing. It is governed by the Swiss Federal Act on Data Protection (FADP) as revised, in force since 1 September 2023.

Three principles guide me:

Purpose limitation. I use your data only for the purpose you gave it to me for, or the one described here.
Proportionality. I process as little data as necessary and keep it only as long as it is needed or required by law.
Data security. The website can only be reached over an encrypted connection (HTTPS). I keep notes and documents securely, and only I have access to them.

3. Website hosting and server logs

This website is hosted by Infomaniak Network SA in Geneva, Switzerland. When you open a page, the server automatically records technical access data, including:

your IP address,
the date and time of access,
the page or file requested,
the page you came from (referrer),
your browser and operating system (user agent).

This data is needed to deliver the website and to detect and fend off faults and attacks. I do not use it to find out who you are, I build no profiles from it and I do not combine it with other data. The host deletes the log files automatically after a short period that it sets.

4. No cookies, no tracking, no third-party content

This website sets no cookies and does not use your browser’s local storage or anything similar. There are also:

no analytics or statistics tools and no tracking pixels,
no social media plug-ins and no share buttons,
no embedded maps or videos,
no fonts from other servers: Source Sans 3 and Source Serif 4 are served directly from this server.

So when you visit this website, your browser connects to no one but my host. That is why there is no cookie banner. Links to other websites only open if you click them; the privacy policy of that site then applies.

5. Contact form, e-⁠mail and phone

What I receive

When you use the contact form, I process:

your name (a first name is enough),
your e-mail address or phone number,
your preferred language, English or German (taken from the language version of the page),
the format you prefer,
your message, if you write one. It is optional.

What for

I need these details to answer your request and arrange the first, confidential conversation. For nothing else.

How it reaches me

The form is sent to the server over an encrypted connection (HTTPS). From there, your details reach me as an e-mail through Infomaniak’s mail servers in Switzerland, again encrypted in transit (TLS). The form stores nothing in a database; once the e-mail has been sent, the web server discards your details. The subject line of the e-mail contains neither your name nor your concern.

Spam protection

The form contains a field that people cannot see (a honeypot). Automated programs fill it in, and those submissions are discarded. The number of requests per hour is also limited. For this, the server never stores your IP address itself, only a hash of it made with a secret key (HMAC-SHA-256), together with the times of your requests. Once your last request is more than an hour old, these records are deleted – at the latest the next time the form is used.

How long

If your enquiry does not lead to us working together, I delete your message and contact details 12 months after our last contact. If it does, section 6 applies.

E-mail and phone

If you e-mail me directly or call, the same applies: I use your details only to reply, and I delete them on the same schedule.

A note on e-mail: how well a message is protected on its way to me also depends on your own e-mail provider. If your concern is very personal, it is better to write only that you would like to talk. We can discuss everything else by phone or in person.

6. Conversations and engagements

What I process

If we work together, I process your contact details, our appointments and what I need for the invoice: name and address – your company’s, if you prefer – date, format and amount.

Then there is what you tell me in our conversations. This can include information the law treats as sensitive, for example about your health, your intimate life or your beliefs (Art. 5 let. c FADP). Conversations often involve other people too; their information is handled with the same care.

How I handle it

I do not record conversations – neither audio nor video.
I keep only brief notes, store them securely and destroy them no later than 12 months after our work together ends.
My calendar shows initials, not names.
I do not have conversations transcribed or summarised by AI services.
If I discuss my work with a supervisor, I do so only in fully anonymised form.

I share nothing unless you authorise me explicitly and in writing. My confidentiality ends only where a court or authority legally compels me, or where there is an acute danger to someone’s life or safety or to a child’s welfare. What that means in practice is set out under ‘Confidentiality and its limits’ on the Sparring page.

Invoices and accounting

I keep invoices and accounting records for the statutory 10 years (Art. 958f of the Swiss Code of Obligations). They contain no description of what we talked about.

Video sessions

For remote sessions, we agree together which video service to use. I record nothing there either. The provider of the service processes data under its own privacy policy and, depending on the service, may do so outside Switzerland. If that matters to you, say so – or we talk by phone.

I do not sell data or use it for advertising or newsletters. Personal data goes only to the following:

Infomaniak Network SA, Geneva – website hosting and e-mail, on my behalf.
An accounting firm, where applicable – for bookkeeping, on my behalf. It sees invoices and receipts, but no notes and nothing from our conversations.
Payments – if you pay by TWINT or bank transfer, TWINT AG or the banks involved process the payment data (name, amount, date, reference) under their own responsibility. The invoice shows the format and date, not your topic.

Beyond that, I share data only in the cases described in section 6.

I do not transfer personal data abroad. The website, the contact form and e-mail are hosted by Infomaniak in Switzerland, and my notes and documents stay here too. The only possible exception is a video service we choose together for a remote session (section 6).

8. Your rights

Under the FADP you have, in particular, these rights:

Access. You can find out whether and what data I hold about you. This is free of charge and normally answered within 30 days.
Correction. I correct inaccurate data.
Deletion. You can ask me to delete your data, unless a legal duty to keep it applies – to invoices, for example.
Objection. You can object to processing and withdraw your consent at any time.
Data portability. You can ask me to hand over the data you gave me in a common electronic format, or to pass it on to someone else.

An e-mail to winn@chelini.ch is enough. So that your data does not go to the wrong person, I may ask you to briefly confirm your identity.

If you feel I am not handling your data properly, please talk to me first. You can also contact the supervisory authority at any time and lodge a complaint: the Federal Data Protection and Information Commissioner (FDPIC) in Bern, www.edoeb.admin.ch.

9. Changes

I update this privacy notice when something changes on the website or in the way I work. The version published here applies.

Last updated: October 2026

What happens to your data here. And what doesn’t.