Privacy policy

The controller for the processing of your personal data on wgzimmer.ch is esense GmbH, Burgweg 7, 4058 Basel, Switzerland. Send questions about data protection and requests regarding your rights to info@wgzimmer.ch. Further details are in the legal notice.

We process personal data under the Swiss Federal Act on Data Protection (FADP). This policy describes which data we process on the website wgzimmer.ch, for what purpose and for how long.

• We do not sell personal data.
• We show ads through Google AdSense. Google only shows personalised ads if you agree in its message (section 9).
• For statistics we use Matomo on our own server and Google Analytics (section 10). They and Google’s ads set cookies; all other cookies are needed for the site.
• Your e-mail address, phone number and name are not shown in the ad. People who write to you only get your e-mail address when you reply.
• For an offer, the address and location of the room are public so that people looking for a room can find it.
• We remove hidden information such as the location where a photo was taken.
• We delete ads 2 years after they end and accounts 5 years after the last visit. You can also delete both yourself at once.

Server logs

With every request your browser transmits technical information: IP address, time, page requested, browser and operating system. The server stores it in logs to run the site, find errors and fend off attacks. We delete the logs after a short time.

Ad views

We count how often an ad is viewed and show the number to the person who posted it. So that a visit only counts once a day, we form a check value from the IP address and browser, which we keep only in memory and only until midnight. Only the number is stored.

Cookies

The site needs these cookies:

• a session cookie while your browser is open,
• a security cookie against forged forms,
• when you are logged in: a login cookie so you stay logged in for 10 days.

In addition there are Google’s cookies for advertising (section 9) and those of Matomo and Google Analytics for statistics (section 10).

Browser storage

Some settings are stored only in your browser: light or dark display, colour, your wishlist without an account, your memory game records and the last list of results you viewed. This information does not leave your browser. You can delete it in your browser settings.

Recipes

If you send us a recipe, we store it with the language of the page and the first name you give if you wish, until we publish or discard it. We show the first name with the published recipe. We keep your IP address only briefly in memory to limit the number of submissions.

Radius and your location

For a search within a radius you choose a place, a point on the map or tap «My location». Your browser only gives out your location if you allow it. We round the point to about 100 m and put it into the address of the search page. It is only stored if you save the search as a search alert or in a search ad (sections 4 and 5).

• For the account we store your e-mail address, your name if you wish (it is pre-filled in the contact form), the language of your e-mails, the date you opened it and of your last visit, and your wishlist.
• We only store the login code in encrypted form (as a check value); it is valid for 10 minutes.
• For each logged-in device we store the browser and system roughly (for example “Firefox on Windows”), the login date and the day it was last used, but no IP address. This lets you see in the settings where you are logged in and log devices out.
• To prevent abuse we limit the number of codes per e-mail address and per IP address; these counters are kept only briefly in memory.
• We delete an account whose e-mail address was never confirmed after 24 hours. We delete an account with no visit for 5 years together with all its data. You can delete your account yourself at any time under “My account”.
• If you save a search as a search alert, we store its filters (for example region, place or a radius rounded to about 100 m, and the rent), the language, until when it runs and how many e-mails we have sent. For every new matching ad we send you an e-mail. A search alert runs for 30 days; 3 days before the end we remind you. We delete ended search alerts at once, expired ones after 30 days, all of them together with the account. Every e-mail has a link to unsubscribe, and you manage them under «Search alerts».

What is public

• texts, photos, rent, dates, type of flatshare and the details of the room
• for offers, the address of the room and its location on the map
• for searches, only the chosen regions or the radius as «15 km around Winterthur», never its centre

What is not public

Name, e-mail address and phone number are not shown in the ad. We need them to send you e-mails (code, approval, reminders) and to forward messages to you. We neither show nor use the home address of people looking for a room.

Photos

We store photos on our own image server. We re-encode them and thereby remove all embedded information, for example camera, time and place the photo was taken.

Location

To show an offer on the map, we send its address to the federal address search (geo.admin.ch, Federal Office of Topography swisstopo) and store the coordinates.

How long

An ad is online for up to 42 days, and for another 42 days after each renewal. After that, and when you delete it, it goes to the archive, where only you see it and can reactivate it. 2 years after it ends we delete it for good, with its photos and messages. For ads posted before the new site, we took over the IP address and browser stored at the time; they are deleted with the ad.

E-mails about new ads

If the box for new matching ads is ticked in your ad, we send you an e-mail for every new ad of the other kind that matches the region or radius and the rent. Whoever gets such an e-mail about your ad only sees what is public in the ad. For every ad we remember whom we have already written to about it, so no e-mail comes twice; we delete this with the ad. You can unsubscribe with one click in every e-mail, when editing the ad or under «Search alerts».

• When you write to an ad, we store your name, your e-mail address, your phone number if you wish, the text, the time and your IP address.
• The message is sent by e-mail to the person who posted the ad, with your e-mail address as the reply address. They thereby receive your e-mail address. You get a copy.
• We need the IP address to limit the number of messages and to detect abuse.
• We delete messages together with the ad, so at the latest 2 years after it ends. In your account you can hide sent messages; the recipient keeps them. If you delete your account, your sent messages stay with the recipient.

Cloudflare Turnstile

We protect the forms for posting an ad, logging in and writing to an ad against automated access with Turnstile by Cloudflare, Inc. (USA). When you post an ad or log in, your browser loads a program from Cloudflare with the page; in the contact form of an ad, in the recipe form and in “Check a scam e-mail” only when you start writing. It checks technical characteristics of your browser and thereby transmits your IP address to Cloudflare. When you submit, we check the result with Cloudflare and also send your IP address. Cloudflare does not use cookies for this. Cloudflare is certified under the Swiss-U.S. Data Privacy Framework.

Checking e-mail addresses and texts

• When you post an ad or write a message, we check in the Checkscammail database whether the e-mail address is known as a fraudulent address. We run Checkscammail ourselves as esense GmbH.
• We compare texts with blocked ads and with known fraud patterns.
• If we block an ad for fraud, we add its e-mail address to Checkscammail.
• On the page “Check a scam e-mail” you can check an address yourself. We compare it with the blocked ads and with Checkscammail and don’t store it. So that nobody queries whole lists, we count the checks per IP address in memory for at most one day.

Blocked ads

We keep blocked ads and messages to recognise further fraud attempts and may show them as a warning on the page “Blocked ads”. If your address, name or photo appears there wrongly, contact us.

The maps in the search and on the ad pages come from swisstopo, the Federal Office of Topography in Switzerland. Your browser only loads them when you open the map and thereby transmits your IP address to swisstopo.

Google AdSense

On most pages we show ads from Google AdSense (Google Ireland Limited, Ireland, and Google LLC, USA). For this your browser loads programs from Google. Google receives your IP address, information about your browser and device and the page you visit, and may use cookies and similar technologies to select ads, measure their effect and detect fraud. We do not receive any personal data from Google, only aggregated figures on ads and revenue.

There are no ads when you place or edit an ad, on ads with the “No ads” package and in the app.

Your consent

If you come from Switzerland, the EEA or the United Kingdom, Google asks you in its own message on your first visit to a page with ads whether you agree to personalised ads and the cookies they need. Without your consent Google does not show personalised ads. You can change your choice at any time with “Privacy settings” at the bottom of the page. Google explains the details at policies.google.com/technologies/ads.

Our own ads

If Google delivers no ad for an ad place or Google’s ads do not load, we show our own ads there: for our own offers or for partners, then marked “Ad”. Images and links come from our server; no third party receives any data.

To know how often our own ads are seen and clicked, your browser reports it to our server when an ad was at least half visible for one second and when you click it. We store only numbers per ad, place and day, without cookies, and keep these numbers for 2 years. So that nobody can inflate the numbers, we derive a check value from your IP address and browser that we keep only in memory and only until midnight. If you click an ad of a partner, the partner’s privacy policy applies on their site.

Matomo

To see which pages are used and how, we use Matomo, a statistics program on our own server (matomo.wgzimmer.ch). Matomo records the pages visited, the time, the page you came from, browser, device and screen size as well as your IP address, and sets cookies to recognise repeat visits. This data stays with us.

Google Analytics

We also use Google Analytics (Google Ireland Limited, Ireland, and Google LLC, USA). Google receives the page visited, information about your browser and device and your IP address, and sets cookies. According to Google, Google Analytics does not store IP addresses. We only see aggregated figures.

You can also prevent statistics and ads with your browser settings or a blocker; the site still works.

If you pay for an extra or support wgzimmer.ch, you enter your payment details directly with the payment provider: Stripe (Stripe Payments Europe, Limited, Ireland: card, Apple Pay, Google Pay, TWINT), PostFinance Checkout (PostFinance Ltd, Switzerland: TWINT, PostFinance Pay, PostFinance Card) or, in the app, Apple or Google. We pass on to the provider you chose the amount, our payment number, the language and an e-mail address (the one of your account, of your ad or the one you enter when supporting), so that it can send you the receipt. On its payment page the provider also records details of your device and sets its own cookies to detect fraud. Stripe also processes the data at Stripe, LLC in the USA.

We store the amount, date, package, our payment number and the provider’s, the ad, the language and the e-mail address, no card or account details. We keep these details for 10 years, as the law requires for business records, and then delete them. Processing by the payment provider is governed by its own privacy policy.

We only pass on personal data as far as necessary for the purposes described or required by law:

• our hosting provider oriented.net in Switzerland (website, image server, database, sending e-mails),
• Cloudflare, Inc. in the USA (Turnstile, section 7),
• swisstopo in Switzerland (maps and address search, sections 5 and 8),
• Google Ireland Limited in Ireland and Google LLC in the USA (advertising and statistics, sections 9 and 10),
• the payment providers Stripe Payments Europe, Limited in Ireland with Stripe, LLC in the USA and PostFinance Ltd in Switzerland (section 11),
• authorities, if we are legally obliged to do so.

The USA is considered to provide adequate data protection for companies certified under the Swiss-U.S. Data Privacy Framework; this applies to Cloudflare, Google and Stripe. Ireland is part of the EU, whose data protection Switzerland recognises as adequate.

The connection to wgzimmer.ch is encrypted. There are no passwords; we store login codes and ad codes only as check values. Only the people who look after wgzimmer.ch have access to the data, and only as far as they need it for their task.

You can request access to your data, have incorrect data corrected and data deleted, object to processing and receive your data in a common format. You can do much of this yourself: delete ads and your account, unsubscribe from search alerts and e-mails about new ads, log devices out, hide sent messages, clear your browser storage. For everything else, write to info@wgzimmer.ch. So that nobody receives someone else’s data, we check that the request comes from you, for example with a code sent to your e-mail address.

You change your choice about Google’s ads with “Privacy settings” at the bottom of the page.

If you disagree with our answer, you can contact the Federal Data Protection and Information Commissioner (www.edoeb.admin.ch).

We adapt this policy when the site or the law changes. The version published here applies. The German version is binding; translations are for information only. The terms of use are in the terms of use.

Version of 23 October 2026 (draft)