1. Controller
Responsible for the data processing for which WEBish determines the purposes and means of processing is:
WEBish GmbH
Bärenweg 31
4153 Reinach BL
Schweiz
Contact: via the contact form
Phone: +41 76 570 22 70
In customer-specific applications of the Accident Tool, the data protection roles may be distributed differently. For example, if an insurance company or another organization determines the purpose and means of processing and WEBish processes the data exclusively according to their instructions, the organization in question acts as the controller and WEBish as the processor.
If WEBish decides together with another organization on the purposes and means of processing, the respective responsibilities are regulated in accordance with the legal requirements.
Representative in the European Union according to Art. 27 DSGVO:
WEBish is currently arranging the appointment of a representative in the European Union. The contact details of the representative will be published here once they have been appointed. Until then, data protection concerns can be addressed directly to WEBish GmbH using the contact options listed above.
2. Scope and applicable data protection law
This data protection declaration applies to the webish.ch website, the associated language versions, the browser offerings under report.accident-tool.ch and to the processing of personal data in connection with the Accident Tool, to the extent that WEBish is responsible for the respective processing.
The Swiss data protection law applies in particular to the WEBish. If processing falls within the scope of the European Union's General Data Protection Regulation, the requirements of the DSGVO also apply.
The applicable national regulations also apply to access to end devices and the use of non-technically necessary cookies or comparable technologies, in particular § 25 TDDDG in Germany and § 165 Abs. 3 TKG 2021 in Austria.
If an insurance company or another organization is responsible for data protection for customer-specific use, their data protection information may also apply.
3. Legal basis for processing
To the extent that the DSGVO is applicable, WEBish processes personal data in particular on the following legal bases:
- Art. 6 Abs. 1 lit. a DSGVO if consent has been given, for example for Google Analytics.
- Art. 6 Abs. 1 lit. b DSGVO if the processing is necessary for the performance of a contract or for measures prior to entering into a contract.
- Art. 6 Abs. 1 lit. c DSGVO if WEBish is subject to a legal obligation.
- Art. 6 Abs. 1 lit. f DSGVO if the processing is necessary to protect legitimate interests and is not opposed to any overriding interests or fundamental rights of the data subject. Such interests may include, in particular, the secure and reliable operation of the systems, the prevention of misuse, technical error analysis, the processing and verifiability of claims processes and the billing of services.
If WEBish processes data exclusively on behalf of an insurance company or another organization, the respective controller generally determines the applicable legal basis. In this case, WEBish processes this data in accordance with the contractually agreed instructions.
When using the Accident Tool directly, the processing of the personal data required for the creation, technical processing and delivery of the desired damage report, to the extent that the DSGVO is applicable, is generally carried out to provide the service requested by the user or in connection with the underlying contract or claims process.
If the Accident Tool is used on behalf of an insurance company or other responsible organization, this organization generally determines the legal basis for the processing and WEBish processes the personal case data within the scope of the contractually agreed role.
Reduced billing and evidence data will only be processed to the extent necessary for billing, evidence, legitimate queries, contractual obligations or legal retention requirements.
Stating whether a person was injured (yes/no) can be considered health information. To the extent that the DSGVO is applicable, this yes/no statement will only be processed if, in addition to a legal basis according to Art. 6 DSGVO, a requirement according to Art. 9 Abs. 2 DSGVO is also met.
Depending on the specific claims process, processing to assert, exercise or defend legal claims in accordance with Art. 9 Abs. 2 lit. f DSGVO or another legally provided basis may be relevant.
To the extent that WEBish processes personal case data, including information about whether a person was injured (yes/no), exclusively on behalf of an insurance company or another responsible organization, the respective controller determines the applicable legal basis. In this case, WEBish processes the data in accordance with the contractually agreed instructions.
4. Data when visiting the website
When you access the website, technically necessary connection and log data can be processed. These may include in particular:
- IP address
- Date and time of access
- page or file accessed
- Browser and device information
- operating system
- Referrer information
- technical error and safety information
This data is processed to provide the website in a secure and stable manner, to detect technical errors and to prevent misuse or attacks.
Technical log data is only stored for as long as necessary for operation, security, error analysis and misuse prevention. They are then deleted or anonymized. If there is a specific security incident or a legal obligation, relevant log data can be retained until the necessary investigations have been completed or for the legally required period.
5. Google Analytics and Consent
On the webish.ch pages where Google Analytics 4 is integrated, WEBish uses Google Analytics to statistically evaluate website usage and to improve the online offering.
Provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Irland. As part of the processing, data may also be processed by Google LLC or other Google companies outside Switzerland or the European Economic Area.
Google Analytics may, in particular, process information about page views, interactions, browser, device, approximate location and cookies or similar identifiers.
Google Analytics is only activated with express consent. The legal basis, insofar as the DSGVO is applicable, is Art. 6 Abs. 1 lit. a DSGVO. The applicable regulations regarding cookies and comparable technologies also apply to access to the end device.
No Google Analytics data may be transmitted to Google for analysis purposes before consent is given.
Consent can be revoked at any time with future effect via “data protection settings” in the page footer. Rejection must be technically just as easy as consent.
The selection is saved locally in the browser for up to 180 days so that the decision can be taken into account the next time you visit. This storage is used exclusively to manage the data protection settings.
If you revoke your consent, the website will stop future analysis and delete the Google Analytics cookies accessible from the website, where technically possible. Data that has already been lawfully transmitted will not be deleted retroactively.
User and event-related data is stored in Google Analytics according to the retention period set in the GA4 property. For a standard GA4 property this is a maximum of 14 months. Aggregated statistical reports may be available for longer periods.
Data transfers to the USA may in particular be based on an adequacy decision for companies participating in the EU-U.S. Data Privacy Framework or, if necessary, on other guarantees provided for by law such as standard contractual clauses.
This website analysis does not affect the Accident-Tool app. Neither Google Analytics nor other analysis or advertising tracking systems are used in the Accident-Tool app.
Google Privacy Policy · Opt out of Google Analytics
6. Contact form and email
If a person contacts WEBish via the contact form or by email, WEBish processes the information provided to process the request and for necessary further communication.
This may include in particular:
- name
- Company
- Email address or other contact information
- Message content
- technical information for transmission
If the request relates to a contract or possible pre-contractual measures, the processing is carried out, where applicable, on the basis of Art. 6 Abs. 1 lit. b DSGVO. For general business or other inquiries, processing may be based on the legitimate interest in processing communications in accordance with Art. 6 Abs. 1 lit. f DSGVO.
Contact requests will be deleted after processing has been completed, generally no later than 30 days after completion of the request.
Longer storage only occurs if the communication is part of a contract, a business relationship or a legal retention obligation or is required to assert, exercise or defend legal claims.
7. Profile, device and QR code exchange
Data on people, vehicles, driver's licenses and club memberships can be saved in the Accident Tool's profile directly on the device.
The exchange of profile data with a counterparty can be done via QR code. If the QR code is generated and read directly between the devices involved, this data exchange takes place without transferring the profile data to the WEBish server.
The club membership is not transferred to the other party during the QR data exchange and is not part of the accident report.
The website and app can reference report.accident-tool.ch for browser notifications or a counterparty form.
Data entered there can be used to generate an exchange QR code or to provide the information required for the selected claims process.
report.accident-tool.ch must have a prominent link to this Privacy Policy when collecting personal information.
8. What data the Accident Tool can process
The Accident Tool only processes personal data to the extent that this is necessary for the recording, documentation, transmission or processing of a claim.
Depending on the claim, the following data in particular can be processed:
- Personal and contact details of those involved
- vehicle data
- control plate
- Insurance details
- Policy and Green Card numbers
- Driver's license data
- Information about drivers, passengers, witnesses and other parties involved
- Accident scene
- Date and time
- Weather and lighting conditions
- Damage type
- Circumstances of the accident
- Impact point
- Remarks
- Photos
- sketches
- signatures
- Indicates whether a person was injured (Yes/No)
Regarding the injury status, the Accident Tool only records whether a person was injured (yes/no). No information about the type, severity or cause of the injury, no diagnoses, no treatment details and no other medical or detailed health information are recorded. This yes/no statement can also be considered health information in accordance with Art. 9 DSGVO or as particularly sensitive personal information under Swiss data protection law and will be protected accordingly.
The Accident-Tool app does not use advertising tracking, does not create advertising profiles and does not analyze usage behavior for advertising purposes.
9. Data of other people involved in the accident and origin of the data
In the event of a claim, data from people who have not provided their information directly to WEBish can also be processed. This may include, for example, counterparties, drivers, passengers, witnesses or other parties involved.
Such data may come in particular from:
- Information from a person involved in the accident
- Information provided by the data subject himself
- QR data exchange
- browser forms
- read or photographed documents
- driving licenses
- Insurance documents
- Information from connected insurance companies or specialist systems, insofar as this is necessary for the intended process
This data is processed exclusively for the documentation, processing and transmission of the relevant claim as well as for related legally permissible purposes.
If personal data is not collected directly from the data subject and Art. 14 DSGVO is applicable, WEBish or the respective controller will provide the legally required information within the stipulated deadlines.
The information is generally provided within a reasonable period of time, at the latest within one month of receiving the data. If there is direct communication with the person concerned beforehand, the information will be provided at the latest when this first contact is made. If disclosure to another recipient is intended, the information will be provided at the latest upon the first disclosure, unless there is a legal exception to the obligation to provide information.
The relevant data protection information is made accessible via the Accident Tool, the browser application or the linked data protection declaration.
10. Server processing of the accident report
The Accident Tool requires time-limited server processing to create, process and deliver a damage report.
After confirmation in the app, the data required for the relevant claim is transferred to the server infrastructure of the Accident Tool.
The server can in particular:
- Generate damage reports
- Create PDFs
- provide the report in the language intended for the intended recipient
- Generate data formats for connected systems
- intended information to be transmitted to insurance companies or other connected recipients
Simplified process:
smartphone → Accident-Tool server → intended recipients → report back to app
The transmission and server-side processing of personal case data takes place with appropriate technical security measures.
WEBish does not maintain a permanent personal accident archive on the server.
11. Duration of server processing and deletion
Personal data from a normal damage report is stored on the server for a maximum of 30 days and then deleted.
The personal case data is stored in encrypted form during server processing for a limited period of time.
The maximum retention period of 30 days serves in particular to ensure the complete creation and delivery of the damage report and to be able to deal with any technical transmission or delivery problems within this period.
After this period has expired, the personal case data will be deleted.
WEBish does not maintain a permanent personal accident archive on the server.
Practice reports are deleted after seven days at the latest.
In the event of a failed delivery, the data may only be processed within these deadlines for as long as is necessary to deal with the delivery error.
The generated report is transmitted to the app or to the intended recipients.
A report stored on a smartphone can remain available in the device's archive until it is deleted by the respective user. This also applies to read-only report copies taken via the app or a App Clip.
WEBish generally has no access to further local storage of a report transferred to a terminal device.
Data transmitted to an insurance company or another independently responsible person is subject to their own storage and data protection responsibility after transmission.
Backup systems and backups may not be used to circumvent the specified deletion periods for personal case data.
To the extent that backup or statistical data persists beyond these periods, they may no longer contain any direct personal accident information or must comply with the rules for billing and statistical data described below.
Injury status processing is limited to indicating whether a person has been injured (yes/no).
This yes/no information is transmitted together with the other personal case data to the server infrastructure of the Accident Tool, where it is processed in encrypted form and transmitted to the recipients intended for the respective claim.
The yes/no information about the injury status is not permanently stored separately. The same deletion periods apply to them as to the other personal case data: for normal claims, no later than after 30 days and for practice reports, no later than after 7 days.
The maximum retention period of 30 days serves in particular to ensure the complete technical preparation and delivery of the damage report and to be able to deal with any transmission or delivery problems within this period.
After the respective deadline has expired, the yes/no information on the violation status is also deleted from the Accident-Tool server.
After the respective deletion period has expired, the following data in particular may not remain with WEBish:
- Indicates whether a person was injured (Yes/No)
- personal photos
12. Billing data and anonymized statistics
After the personal case data has been deleted, reduced case data can be further processed for billing, evidence to affiliated insurance companies and internal statistical purposes.
This reduced data may include in particular:
- insurance involved
- Accident scene
- Date
- point in time
- Vehicle type or vehicle category
- vehicle make
Not used for this longer-term processing are, in particular:
- names
- first names
- private addresses
- phone numbers
- email addresses
- Control plates
- policy numbers
- Driver's license data
- signatures
- personal photos
- full accident reports
- other direct personal identifiers
This reduced billing data is used in particular to bill services, allocate services to affiliated insurance companies, check bills and deal with any queries.
WEBish does not use this data to identify those involved in the accident and does not combine it with the previously deleted personal case data.
Since a recipient, for example an insurance company, may be able to use their own additional information to identify which person a claim belongs to, reduced billing data is not generally considered to be completely anonymous. This data remains appropriately protected and is only processed for the intended billing and verification purposes.
Billing data is only retained for as long as is necessary for billing, proof, legitimate queries, legal retention obligations or the assertion or defense of claims.
Once these purposes no longer apply, they will be deleted or aggregated or anonymized in such a way that no personal reference can be made.
For permanent statistical evaluations, only data may be used for which direct or indirect identification of individual persons is no longer possible using reasonably usable means.
If the combination of precise time, location, vehicle or other information could enable indirect identification, the data must be further generalized or aggregated for statistical purposes, for example by using more coarse location or time information.
Permanently anonymized statistical data does not contain any personal reference and is not used to subsequently identify individual people or individuals involved in an accident.
The yes/no information on the injury status is not part of the reduced billing data and is not permanently processed for statistical or billing purposes.
13. Recipients and status feedback
Depending on the claim and the selected process, personal data may be transmitted to the intended recipients.
This may include in particular:
- Insurance
- Claims adjuster
- Brokers
- repair companies
- Guarantee Fund
- connected specialist systems
- other entities involved in the selected claims process
Only the data that is intended or required for the respective recipient and process is transmitted.
Connected insurance companies can, for example, report receipt of a case, a claim number or a processing status.
Each party only receives or sees the status information intended for their own case and role.
Push notifications are intended to be implemented so that no personal or sensitive information about the claim is displayed on the lock screen. The content actually displayed may also depend on the notification settings of the device.
If a recipient subsequently processes the data received for their own purposes, they are generally responsible for this processing under data protection law.
Push notifications and device tokens
If desired, the Accident Tool can use push notifications to send status information from a connected insurance company to a person involved in an accident.
Push notifications are only used if the user allows the corresponding notifications on their device or activates the intended function.
Depending on the operating system, the following services in particular can be used for technical delivery:
- Apple Push Notification service (APNs) for Apple devices
- Firebase Cloud Messaging (FCM) from Google for supported devices or technical delivery processes
A device-specific push or device token is used for delivery. This token is technically assigned to the respective claim or party in question so that feedback from the intended insurance company can be delivered to the correct device.
The device token itself does not contain an accident report and is not used for advertising or profiling.
The push or device token used for a claim will be deleted no later than 30 days after the relevant claim. After deletion, no further status report can be sent by the connected insurance company using this case-related token.
The user can also deactivate push notifications at any time via the settings of their device.
When technically delivering push notifications, the respective platform providers may process technical information such as the device token, delivery information and technical device or connection information. For processing by Apple or Google, their data protection regulations also apply.
14. Data security
WEBish protects personal data through appropriate technical and organizational measures.
Depending on the processing, these include in particular:
- encrypted data transmission
- encrypted storage, where provided
- Access restrictions
- Authorization concepts
- Data minimization
- time-limited server processing
- technical logging of security-relevant processes
- Protection against unauthorized access
- Measures against loss, manipulation and misuse
Access to personal case data is limited to those people and systems that need this data for the respective process.
Since no electronic data transmission and no technical system can completely exclude all conceivable risks, absolute security cannot be guaranteed despite appropriate protective measures.
15. Service providers, hosting and international data transfers
WEBish can use specialized service providers for the website, communication and technical infrastructure.
The website and, if used, the email infrastructure are operated by cyon in Switzerland.
WEBish's website infrastructure is operated in Switzerland.
In connection with Google Analytics, data may in particular be processed by Google Ireland Limited in the European Economic Area and by Google companies or technical systems in the United States.
If personal data is transferred to countries for which there is no generally recognized adequacy decision, the legally provided guarantees will be used to the extent necessary.
If service providers process personal data on behalf of WEBish, they are contractually obliged to process the data exclusively for the agreed purposes and with appropriate security measures.
Google Ireland Limited is used for Google Analytics provided that appropriate consent has been given.
Personal data can also be processed outside of Switzerland or the European Economic Area, depending on the service used.
There is an adequacy decision by the European Commission for transfers from the European Economic Area to Switzerland.
For transfers to other countries, WEBish ensures, where necessary, appropriate data protection through the mechanisms provided for by law. These may include in particular:
- an adequacy decision
- the EU-U.S. Data Privacy Framework for appropriately certified US companies
- Standard Contractual Clauses
- other guarantees provided by law
Sales and support in the European Union can be carried out by independent sales or cooperation partners of WEBish.
Such a sales partner does not become the controller of the claim data processed in the Accident Tool solely by virtue of its sales activities.
If a partner processes its own personal data, for example contact information from insurance companies or business customers in the context of sales, advice or contract processing, the data protection role must be determined according to the specific activity and the respective contractual agreement.
If a partner receives access to personal data of the Accident Tool or processes such data on behalf of WEBish or an insurance company, the necessary data protection agreements will be concluded.
16. Rights of data subjects
Data subjects have the right, in particular, within the framework of the applicable data protection law:
- to request information about the personal data processed about you
- to have incorrect data corrected
- to request the deletion of your data under the legal requirements
- to request restriction of processing
- to receive data in a transferable format under the legal requirements
- to object to processing if this is based on a legitimate interest
- to revoke your consent at any time with effect for the future
- to complain to a responsible data protection supervisory authority
The revocation of consent does not affect the lawfulness of the processing carried out based on the consent before its revocation.
If WEBish only processes data on behalf of an insurance company or another organization, the organization in question may be the controller for processing a data subject's request. In this case, WEBish supports the controller within the framework of the legal and contractual obligations.
Data protection inquiries can be made via the contact details provided on WEBish.
If Swiss data protection law is applicable, there may also be a complaint or supervisory route to the Federal Data Protection and Information Commissioner.
To the extent that the DSGVO is applicable, a complaint can be submitted in particular to the data protection supervisory authority of the usual place of residence, place of work or place of the alleged violation.
17. Obligation to provide data and automated decisions
The provision of personal data is generally voluntary.
However, certain information may be required to fully prepare or submit a requested loss report or to provide a related service.
If required information is not provided, the process in question may not be able to be carried out or not be carried out completely.
WEBish does not use personal data for exclusively automated decisions that have legal effects on a person or have a similar significant impact on them.
The Accident Tool does not create personal advertising profiles.
18. External links and app stores
The website and the Accident Tool may contain links to external services, in particular to app stores or websites of partners and recipients.
When opening an external link, the data protection regulations of the respective provider apply.
WEBish has no influence on data processing that an external provider carries out independently outside of the systems operated by WEBish.
19. Changes to this Privacy Policy
WEBish can adapt this data protection declaration if technical processes, the product, service providers used, business processes or legal requirements change.
The version published on this website applies.