Swiss NewCo Feed

Privacy policy

Version of 12 October 2026.

This policy explains which personal data Swiss NewCo Feed processes, why, where and for how long: about our customers and visitors (section 1) and about the people named in the companies our feed contains (section 2). The controller is Fabian Sigel, Bruggerstrasse 148, 5400 Baden, Switzerland, reachable at hello@tollwyn.com. It follows the Swiss Federal Act on Data Protection (FADP) and, where it applies, the EU General Data Protection Regulation (GDPR).

1. Customers and visitors

  • Account: your e-mail address, a salted hash of your password, hashes of your API keys and sessions, when you signed up and which version of the terms you accepted, your saved filter, your settings (morning mail, webhook endpoints with their recent deliveries, the secret of your CSV link) and the number of records delivered per month. We use them to provide the service, to send you the e-mails it needs and to know which terms apply (performance of the contract, Art. 6(1)(b) GDPR).
  • E-mails we send you: password resets, the welcome mail, the morning mail if you switch it on, and warnings about your monthly limit, a failed payment or a switched-off webhook (performance of the contract).
  • Payment: Stripe processes your e-mail address, payment details, billing address and tax ID. We keep your Stripe customer and subscription numbers, your plan and the state of your subscription, and the amounts and dates of paid invoices. Card details never reach us. We use them to bill the service (performance of the contract) and keep the invoice records afterwards to meet Swiss accounting law (legitimate interest, Art. 6(1)(f) GDPR).
  • Partner links: when you come through a link with ?via=…, the sign-up form passes that partner name on, and we store it with your account; software that signs up over the API may send one in the field via. It holds nothing but the partner name. We use it to know which partners bring customers (legitimate interest). We set no cookie for this.
  • Security and operations: our application logs each request (method, the page or endpoint without the actual address, status, duration) and the events of the service with internal numbers of accounts, companies, Stripe objects and webhook endpoints. It logs no IP addresses, passwords or keys; the error report of an e-mail that could not be sent can name its recipient. Our mail relay logs the recipient and delivery status of each e-mail we send. To limit sign-up, login and password-reset attempts and failed API keys, we count them per IP address and per e-mail address in the memory of the application, never on disk. Our web server keeps no access log (legitimate interest in a secure and working service).
  • E-mails to us: we keep your message and address to answer you and to keep a record of the exchange (legitimate interest; for customers, performance of the contract).

Cookies: we set two cookies, both only for this site, HttpOnly and Secure, and both needed for the web app. snf_session keeps you logged in, for 30 days or until you log out. snf_new_key carries a newly created API key to the dashboard once and is deleted after it was shown, at the latest after five minutes. We use no advertising or analytics trackers. We sell no data about our customers, and we make no decisions about you by automated means. Stripe's payment pages set their own cookies under Stripe's privacy policy.

2. Companies and people in the feed

What we process. Every new entry of the Swiss commercial register as published in the Swiss Official Gazette of Commerce (SOGC, rubric "new entries"). A record holds:

  • the company's name, UID, legal form, seat, address, purpose and capital;
  • the people the entry names (owners, partners, managers, board members, signatories), with their name, place of residence, role and signing authority;
  • the full text of the publication, which can also state their nationality or place of origin and their capital shares.

For a sole proprietorship, the company name contains the owner's name and the address is often their home. For each new company, our crawler looks for the company's own website, at publication and, while nothing is found, again after 14 and 42 days. It works as described on our crawler page. From a site that proves it belongs to the company, it takes the website address, one e-mail address, one Swiss phone number and the contact page. Such an address or number can be a person's own, for example that of a sole proprietor.

Sources. The SOGC, through the open interface of the official gazettes portal, and the company's own website. We use no directories, no search engines and no bought data.

Why. We deliver these records to our business customers. They are service providers for new companies (fiduciaries, insurance and pension advisers, agencies, IT and office suppliers, banks), letter shops, and software companies that show company data in their CRM, lead or compliance products. They use the records to offer their services to new companies and to keep their own company data current. This is our and our customers' legitimate interest (Art. 6(1)(f) GDPR), and under the FADP an overriding private interest. The register data are public by law, and the contact details are published by the company itself.

Who receives them.

  • Customers on a paid plan, through the dashboard, CSV files, a secret CSV link, the API, webhooks and a morning mail.
  • Free accounts, which see the records without the contact details.
  • The public pages of this site, which list the name, seat and legal form of the companies newly entered in the last seven days.
  • The German pages of this site per publication day, which list the name, seat and canton of the companies whose new entry the SOGC published that day for as long as our archive holds it, and are found by search engines, and the German landing page, which lists the name, seat and legal form of the ten newest. Sole proprietorships do not appear on either, nor do entries whose company objected to its contact details or that name a person who objected.

Our customers are controllers of their own. Our terms bind them to use the data lawfully, to tell you where they got your data when they contact you, to respect your objection, and to send advertising e-mails only with consent. Customers can be anywhere, also outside Switzerland and the EU, in countries without adequate data protection. Such disclosures rely on Art. 17(1)(f) FADP (data from a public register established by law) and, for the contact details, Art. 17(1)(e) FADP (made generally accessible and not expressly prohibited).

How long. A record shows the entry as it was published; later changes in the register do not change it. Three years after publication, we remove the people and the full text from the record; the company record stays. Customers keep their own copies under our terms.

Objection. If you are named in an entry and do not want to be in our feed, or if your company does not want its website and contact details listed, write to hello@tollwyn.com with the company name or UID. We do the following within 30 days, for good:

  • We remove you from the list of people of every entry that names you, together with the publication text and a c/o line that names you. The same happens to later entries that name you with the same place of residence: we keep your name and place of residence on a list for that, as long as the feed runs.
  • If you own a sole proprietorship, we also remove its name, its address including postcode and town, and its contact details from the record. What stays is the UID, legal form, seat, canton, purpose, capital, dates and the reference to the official publication; that publication itself, in the public register, still names you.
  • If your company objects, we remove its website and contact details and never search them again.

Customers who keep copies through our change list or webhooks are told to replace or delete them, and our terms oblige them to do so within 30 days.

3. Who processes data for us, and where

  • Cloudflare, Inc. (USA) runs in front of Swiss NewCo Feed. It terminates the encrypted connection, passes requests on and filters attacks. It therefore sees every request, including your IP address, in the data centre nearest to you, which can be outside Switzerland and the EU.
  • Application server: Hetzner Online GmbH, Falkenstein, Germany, rented from that provider and administered by the operator. Our crawler also runs there.
  • Database: Neon, LLC (a Databricks company, USA), stored in Amazon Web Services region eu-central-1, Frankfurt, Germany; access from the USA is possible.
  • Payments: Stripe Payments Europe, Limited (Ireland), with transfers to Stripe, Inc. (USA). Stripe also processes data as a controller of its own, for example to prevent fraud and to meet its legal duties; see stripe.com/privacy.
  • E-mail: Infomaniak Network SA (Switzerland) sends our e-mails and keeps our mailbox.

Data may therefore be processed in Switzerland, Germany, Ireland, the USA and, for Cloudflare, in the country of the data centre that answers you. Switzerland and the EU recognise each other's level of data protection as adequate. Cloudflare, Neon (through Databricks) and Stripe are certified under the Swiss–US and EU–US Data Privacy Frameworks; where these do not cover a transfer, the standard contractual clauses of the European Commission, recognised by the FDPIC, apply.

4. How long

  • Account data: your account, keys, settings and endpoints stay until you ask us to delete the account. We then delete it within 30 days; deleting it ends any subscription at once.
  • Invoice records: after deletion, only the amount, currency, date and Stripe number of each paid invoice remain, no longer linked to you. We keep them for ten years, as Swiss accounting law requires (Art. 958f CO). Stripe keeps its own records, including your invoices.
  • Database history: our database provider keeps a history for restoring the database to an earlier point in time; deleted data leave it after at most 30 days.
  • Logs: the application log rotates by size, in three files of 10 MB, and is overwritten as new entries come in; it is also removed whenever a new version starts. The mail relay log is kept for at most 30 days.
  • Sessions, links and counters: a session lasts 30 days or until you log out, and a password-reset link one hour. The counts per IP and e-mail address apply for at most one hour, are kept in memory only and are forgotten at the latest when the application restarts.
  • E-mails to us: as long as the exchange needs it and, for customers, as long as the contract and accounting law require.
  • Records of the feed: see section 2.

5. Your rights

You may ask what we hold about you and receive it in a common electronic format, have it corrected or deleted, have its processing restricted, and object to processing based on legitimate interest; section 2 says how we handle an objection to the feed. Write to hello@tollwyn.com; we answer within 30 days. You may complain to the Federal Data Protection and Information Commissioner (FDPIC) or, in the EU, to the data protection authority of your country.

6. Changes

The version published here applies. We tell customers about important changes by e-mail.