Wires Privacy Policy

 

1. General Information

1.1 Our Commitment to Data Protection

Wire Swiss GmbH, Untermüli 9, CH-6300 Zug ("Wire" or "we") is committed to protecting your data. With this privacy policy, we inform you about the collection, processing, and use of data in connection with our website ("Website"), our messenger ("Messenger"), our app ("App") and other services (collectively "Wire Services").

Wire does not rent or sell your data to third parties. Your data is also not used for targeted advertising or other forms of profiling. Unless the context requires otherwise, any reference to "you", "your", or "yourself" in this privacy policy includes the respective organization using the team management functionality of the apps, website, and/or service, the respective team admin, and the respective team member (as defined in our terms of service). 

Any inquiries regarding your data, its protection, and how it is handled by Wire can be directed to the Data Protection Officer (“DPO”) at privacy@wire.com. 

1.2. Scope, Controller

As a company based in Switzerland, Wire and its data processing activities are subject to Swiss data protection law, particularly the Federal Data Protection Act (SR 2351). This privacy policy covers the obligation of Wire for information according to Art. 19 of the Swiss Federal Act of Data Protection ("FADP"). For individuals from the European Union or the European Economic Area, the General Data Protection Regulation ("GDPR") may also apply. 

Unless otherwise stated in this privacy policy, Wire, a limited liability company under Swiss law, based in Zug (Switzerland), with the company identification number CHE 432.881.146, is responsible the processing of data related to the use of Wire Services. You can contact Wire as follows:

Wire Swiss GmbH
Untermüli 9
CH-6300 Zug
Switzerland

E-Mail: legal@wire.com 

You can reach our data protection officer Susanne Klein at:

Beiten Burkhardt Services GmbH
Ganghoferstraße 33
80339 Munich
Germany

Email: privacy@wire.com

2. Data Processing Details: Collected Data, Purposes, Legal Bases

When you use Wire Services, the following personal data may be collected and processed for the purposes and on the legal basis specified below.
 
Please note that below information only applies to the extent that Wire is the controller for the relevant data processing. Insofar as Wire processes personal data on behalf of and on the instructions of a Wire customer (acting as a so-called data processor), Wire cannot provide any details on the purposes or legal bases of the data processing. Please refer to the relevant controller (e.g., your employer) for details on the data processing.

2.1  Content of Conversations

Wire transmits and processes the content of conversations from users of the Wire Messenger only to the extent technically required to provide the relevant services. The content of conversations is encrypted with strong encryption on the sender's device and decrypted only on the recipient's device (end-to-end encryption). This includes all text, voice, and video chats, as well as other files and documents shared in the conversations. Wire does not have access to encryption keys and does not use backdoors. Conversations belong to the users, and Wire has no access to them. Users may delete the content of the conversations on their device specifically and generally at any time. 

Wire also uses transport encryption to secure metadata. Encrypted messages are temporarily stored on Wire's servers for delivery when users come back online. However, this data is immediately deleted from Wire’s servers as soon as the relevant message has been delivered to the recipient of the message. The legal basis for this data processing is Art. 31 sec. 2 lit. a FADP or Art. 6 sec. 1 lit. b GDPR (contract performance).

2.2 Logs

Technical data ("log files") is collected and processed each time the Wire Services are accessed. This data processing is necessary to provide the Wire Services. If the user has concluded a contract with Wire on the provision of the relevant Wire Service, the legal basis is Art. 31 sec. 2 lit. a FADP or Art. 6 sec. 1 lit. b GDPR (contract performance). Otherwise, the legal basis is Art. 6 sec. 1 lit. f GDPR (legitimate interest), since Wire has a legitimate interest in the provision of Wire Services like our Website.

Logs are kept for a maximum of 90 days to assist troubleshooting, improve service, and prevent abuse. Wire has a legitimate interest in the securing and improving its services. Therefore, the legal basis for this storage is Art. 31 sec. 2 lit. a FADP or Art. 6 sec. 1 lit. f GDPR (legitimate interest).

2.3 Personal User Data

When users create a Wire account, they are required to provide a user name, a display name, and an email address. If a Team-Admin or Team-Member account is created, additional billing information might be required. This profile data is used to provide and support the service and can be displayed to other Wire users who search for or connect with them. Personal data is stored only for the duration of the account. The legal basis for this is contract performance according to Art. 31 sec. 2 lit. a FADP or Art. 6 sec. 1 lit. b GDPR. Wire collects and processes the personal data that users voluntarily provide when registering for a Wire Service. This data is processed for the purpose of operating the relevant Wire Service and providing it to the user.

Users are only required to provide a username, email, and password to register for the Wire Messenger. Adding further information to a user profile is optional. Wire uses the so-called double opt-in procedure as part of the registration process to verify the provided email address. This means that after a user has registered for the Wire Messenger, an email with a verification code is sent to the user to confirm ownership of the email address. If an email address is not verified, the provided data will be deleted after one month. In addition to the information provided by the user in the registration form, Wire may also store the date and time of registration and verification, and the IP address of the device used in the registration process. This data is necessary to prove that the relevant account has been registered by a certain user or to trace the (possible) misuse of a user’s email address later. 

The processing is necessary for the provision of the Wire Services to the user and, thus, based on Art. 31 sec. 2 lit. a FADP or Art. 6 sec. 1 lit. b GDPR (contract performance). 

2.4 Payment-Related Data

For Team-Admin or Team-Member accounts, additional billing information may be required and shared with the billing provider. To make purchases, admins must provide payment methods and possibly additional account data. Some transaction-related personal information, such as transaction amounts, is also processed. 

Wire processes the payment-related data for the billing of our customer's purchases and to comply with tax laws. If you are our customer, i.e. our direct contractual partner, the legal basis for the processing of the above-mentioned is contract performance according to Art. 31 sec. 2 lit. a FADP or Art. 6 sec. 1 lit. b GDPR. Otherwise, for example if your employer is our customer, the data processing is based on Art. 6 sec. 1 lit. f GDPR (legitimate interest), in which case Wire has a legitimate interest in the billing of purchases to its customers. Insofar as we collect and store data for tax reasons, the legal basis is Art. 6 sec. 1 lit. c GDPR (compliance with legal obligations). Data is deleted within 12 months after contract termination or expiration of legal retention periods.

2.5 Processing Data Upon Requests

When users submit inquiries (e.g., via email or a web form), the data they provide, such as their name, email address, telephone number, affiliation with a company, role in the company or other information, is processed to respond to their request. The legal basis is Art. 31 sec. 2 lit. a FADP or Art. 6 sec. 1 lit. b GDPR (pre-contractual measures), insofar as the request serves to prepare a contract with the user. Otherwise, the legal basis is Art. 6 sec. 1 lit. f GDPR (legitimate interest), in which case Wire’s legitimate interest is to appropriately respond to the user’s request. Data is deleted once the inquiry is fully processed and further communication is unnecessary.

2.6 Newsletter Distribution

If users subscribe to Wire's newsletter, their email address and name are processed to send the newsletter. Users can subscribe to Wire's newsletter using the form on our Website. Details on the content of Wire’s newsletter are available in the declaration of consent or in the newsletter subscription form.  

Wire uses the so-called double opt-in procedure as part of the registration process to verify the provided email address. This means that after a user has registered for the newsletter, an email with a verification code is sent to the user to confirm the subscription and ownership of the relevant email account. If the subscription is not verified, the provided data will be deleted after one month at the latest. In addition to the information provided by the user in the registration form, Wire may also store the date and time of registration and verification, and the IP address of the device used in the registration process. This data is necessary to prove that the relevant account has been registered by a certain user or to trace the (possible) misuse of a user’s email address later.

We evaluate the use of the newsletter emails (e.g., opening rate, clicks) to improve the newsletter content with the help of so-called tracking pixels. Using the embedded tracking pixel, we can recognize whether and when a newsletter email has been opened and which links in the email have been accessed. By analyzing this information, we can draw conclusions about the recipients' interest in our newsletter content and improve and develop the newsletter accordingly.

The legal basis for the data processing as described above is user consent (Art. 31 sec. 1 FADP or Art. 6 sec. 1 lit. a GDPR). Users can unsubscribe at any time, i.e. users can freely withdraw their consent at any time and with effect for the future, for example by clicking on the unsubscribe link at the bottom of every newsletter email. User data is only retained while the subscription is active.

2.7 Additional Technical Data

Wire collects and processes additional technical data, such as device types, as part of the provision of the Wire Messenger to facilitate the transfer of data between devices. The service is designed to minimize the collection of technical data necessary for service operation. The legal basis for this processing is user consent and contract performance (Art. 31 sec. 1 FADP or Art. 6 sec. 1 lit. a, lit. b GDPR). Further information on additional data can be found in the Privacy Whitepaper and Security Whitepaper.

 

We process individual data about the use of the Wire Services in order to compile anonymous usage statistics and crash logs. Furthermore, we may record pseudonymized Team IDs to monitor customer success and enhance our services. Insofar as personal data is processed for this purpose and your consent is not required for processing, we process your data on the basis of a legitimate interest (Art. 31 sec. 2 lit. a FADP or Art. 6 sec. 1 lit. f GDPR). Our legitimate interest is the smooth provision of Wire Services. Insofar as personal data is processed for this purpose and your consent is required for processing, we will only process your data after you have given your consent (Art. 31 sec. 1 FADP or Art. 6 Sec. 1 lit a GDPR). You can prevent the processing of your data for these purposes at any time, see FAQ. This data will be deleted after 365 days latest.

 

 

If you contact Wire customer service, the personal data you provide may be stored for the duration of the support case resolution. Wire uses Zendesk to process customer enquiries. The legal basis for the processing of your data for processing the support request is a legitimate interest (Art. 31 sec. 1, sec. 2 FADP or Art. 6sec. 1 lit. f GDPR). Our legitimate interest is to provide a support service for our customers. We delete your personal data processed for the processing of the support enquiry after the processing of your enquiry has been completed.

 

 

You can apply to us online via the link on our website. If you apply to us by e-mail, we would like to expressly point out that sending unencrypted e-mails or e-mail attachments is not secure.

Your data will be processed for the purpose of carrying out the application process. The legal basis for data processing is Art. 31 sec. 2 lit. a FADP and Art. 6 sec. 1 lit. b GDPR (preparation of a contract). In addition, your personal data may be processed if this is necessary for the defence of legal claims asserted against us during the application process. The legal basis for this is Art. 31 sec. 2 lit. a GDPR or Art. 6 sec. 1 lit. f GDPR. The legitimate interest in the processing also lies in the aforementioned purposes. If an employment relationship is established between you and us, we may process the personal data that we have already received from you for the purposes of the employment relationship in accordance with Art. 31 sec. 2 lit. a FADP or Art. 6 sec. 1 lit. b GDPR (performance of a contract).

With your consent, we will also pass on your application data to affiliated companies or store your application data for a longer period if we consider your application suitable but are unable to offer you a position. The legal basis for data processing is Art. 31 sec. 1 FADP or Art. 6 sec. 1 lit. a GDPR. You can revoke your consent at any time with effect for the future.

Your application data will not be processed beyond the use described above. Your personal data will be deleted no later than 6 months after the end of the application process, unless deletion conflicts with other legitimate interests on our part or you have not given us your consent to longer storage. Another legitimate interest in this sense is, for example, a burden of proof in proceedings under the General Equal Treatment Act (AGG).

 

 

Certain Wire Services use cookies and similar technologies (hereinafter collectively referred to as "Cookies"). Cookies are small text files that are stored on your device by your browser or app. They contain various information, e.g. duration of the website visit or user input. They may be set by Wire as the provider of the Website (so-called first-party cookies) or by third parties whose services are integrated in the Wire Services (so-called third-party cookies). Cookies can be stored for different lengths of time (e.g. duration of page use, several weeks up to a maximum of two years).

 

Wire uses Cookies for various purposes, which can be roughly differentiated as follows:

 

3. Website

3.1 Informative Use of the Website (Logs)

As part of a visit of the Wire Website for information purposes only (i.e. use without registration, login or communication with the provider via the website), information is automatically sent to the provider's server by the user's browser and temporarily stored there in a so-called log file. In this context, Wire collects and processes the following information and personal data in particular:

• IP address
• Date and time of accessing the Website
• Time zone difference to Greenwich Mean Time (GMT)
• Content of the request (specific page)
• Amount of data transferred
• Browser type and browser settings
• Language and version of the browser software
• Operating system used
• Last page visited by the user
• Access status/HTTP status code.

This information  is technically necessary for Wire to deliver the Website and to ensure its stability and security. The personal data collected when the website is accessed, in particular the user's IP address, will be deleted no later than thirty (30) days after collection, unless an attack or threat by the user has been recognized.

Insofar as Wire collects and processes the user's personal data, in particular the user's IP address, when the Wire Website is accessed and visited, the legal basis for this is Art. 6 sec. 1 lit. f GDPR. Wire has a  legitimate interest  in providing the Website in a stable, secure, and safe manner. In particular, Wire intends to ensure a level of protection appropriate to the risk for the personal data it processes, to ensure network and information security and to optimize the Wire Website and protect it from attacks, disruptions and damage.

3.2 HubSpot: Hosting, Cookie Banner, CRM, Analytics

We use tools and hosting services provided by HubSpot, Inc., Cambridge, Massachusetts, US ("HubSpot") with a branch in Ireland (HubSpot European Headquarters, Ground Floor, Two Dockland Central, Guild Street, Dublin 1, Ireland) to provide the Website and certain features. In particular:

• We host the Website on EU servers operated by HubSpot to make it available on the internet;
• We have integrated the HubSpot Cookie Banner on our Website to obtain and document visitors’ consent to the storage of Cookies on our Website;
• We have integrated HubSpot Forms on our Website to provide a user-friendly way to contact us via we forms;
• We use the HubSpot CRM tool to process requests by visitors, users, or customers properly and efficiently.

When you visit our Website or when you use a service provided by HubSpot (e.g., the HubSpot Cookie Banner or form), certain technical data about your end device (IP address, information about the operating system and browser used, browser language, etc.) and any information entered by you in the respective tool (e.g., cookie settings, entries in the respective forms) are transmitted to Hubspot's servers. We use European server locations (i.e. servers of our partner HubSpot Ireland), so that the data is generally not transmitted to server locations in third countries outside the EU or the EEA. If Hubspot transfers data to the USA in individual cases, this data transfer takes place on the basis of Art. 45 GDPR, as Hubspot is certified according to the so-called EU-US Data Privacy Framework and is therefore subject to an adequacy decision of the EU Commission.

We have concluded a data processing agreement with Hubspot. Hubspot only processes the data in accordance with our instructions and on our behalf. The transfer of data to Hubspot is therefore based on Art. 28 GDPR. Hubspot only uses the data received as part of the CRM system for the technical processing of inquiries and does not pass it on to third parties.

The above data processing is based on Art. 6 sec. 1 lit. f GDPR (legitimate interest). Our legitimate interests are to provide site visitors with our Website featuring a legally compliant and user-friendly cookie banner solution, easy to use contact forms, and to provide us with an efficient CRM system to properly process user requests.

With your consent, HubSpot also uses Cookies to analyze your use of the Website and the use of the newsletter for statistical and marketing purposes. The statistical analyses and evaluations of logged user behavior help us to optimize our Website and further develop it based on user needs.  We also use information to determine which of our company's services are of interest to customers and newsletter subscribers and to contact them for advertising purposes.

The HubSpot Cookies are stored for a maximum period of 12 months and then automatically deleted. If this analytics feature is activated, the data collected with HubSpot (including technical information such as IP address, URL and language of the browser, approximate location, duration of a visit, privacy settings, interactions on the Website) can be linked to the information you provide to us in the forms and evaluated together.  We receive the raw data collected and the statistical reports from HubSpot.
 
We only use these functions of HubSpot and the corresponding Cookies if you have given us your consent to the use of marketing Cookies on the Website or to the evaluation of the use of our newsletter (see the section on newsletters above) and the associated data processing. 

The service is used on the basis of your consent in accordance with Art. 31 sec. 1 FADP and Art. 6 sec. 1 lit. a GDPR. You can freely withdraw your consent at any time with effect for the future, e.g. in the cookie banner on our Website.

3.3 Google Fonts

Our Website uses Google Fonts for the integration of external fonts, a service provided by Google Ireland Ltd (Gordon House, Barrow Street, Dublin 4, Ireland; hereinafter referred to as ‘Google’).

The integration of Google Fonts takes place locally on our own server, so that no direct connection to Google's servers is established when you visit our Website.

Insofar as data processing is carried out, this is done for the purpose of the uniform presentation of fonts and icons. The legal basis is therefore our legitimate interest in the uniform presentation in accordance with Art. 31 sec. 1 FADP and Art. 6 sec. 1 lit. f GDPR.

 

 

4. Wire Messenger and App

4.1 Download of the Wire App

When downloading the App, the operator of the app shop through which the App is made available (for example Apple, Inc. for the App Store and Google LLC for the Google Play Store) collects personal data required for the download. This data may include your name, your email address and your postal code, time of download, the IP address, and the individual device identification number of your end device (so-called IMEI), as well as your payment information, if applicable. This collection and processing of your personal data is, however, basically carried out solely by the respective app shop operator, without participation or influence by Wire. Further details on this data processing are available in the privacy policy of the relevant app shop operator. 

We process the personal data provided by the app shop operator only to the extent necessary for the download and provision of the App. If we process personal data in the course of installation, this is done on the basis of the contract for the download and use of the Wire App that you have concluded, in accordance with Art. 6 sect. 1 lit. b GDPR.

4.2 Messenger Analytics

With your consent, we use the analytics tool "Countly" in Wire cloud to help us fix errors and further optimize the Wire Messenger based on user needs. Countly collects and analyses crash reports and information on certain other events, such as when a particular feature is activated. This gives us statistical information that helps us improve the stability and features of the Messenger.

When Countly is activated, certain information about your use of the Messenger, such as whether and when an error occurs or a certain event occurs (e.g., opening or closing of the App, using of a particular feature), and other technical information (e.g., IP address, app version, device type, operating system) is collected using a pseudonymous ID generated by Countly. The information is transmitted to our (self-hosted) EU servers. Any ID and information stored by Countly are automatically deleted from your device no later than 365. 

We do not use the information transmitted by Countly to identify you. We cannot link this information to your Wire account, since it is only sent to a (self-hosted) server which is separated from the Wire servers hosting the Wire user accounts or the Messenger. We also do not store any IP addresses collected by Countly. We do not share the information with third parties. Countly is self-hosted by Wire on EU servers, so no data collected or analyzed by Countly is shared with the tool provider (Countly Ltd, with its principal place of business located at 9th Floor 107 Cheapside London United Kingdom EC2V 6DN) or any other third party. The data is not transferred to countries outside of the EU or EEA. We only use the collected information to create anonymous statistics and reports about the stability, functionality, and usage patterns related to the Messenger.

We only use Countly in the Messenger with your consent which is obtained through a consent banner integrated in our Messenger. Therefore, the legal basis for the data processing as described above is user consent (Art. 31 sec. 1 FADP or Art. 6 sec. 1 lit. a GDPR). You can withdraw your consent at any time with effect for the future. Please make the appropriate settings via our consent banner.

Subprocessor	Function	Server location
Amazon Web Services (AWS)	Hosting	EU
Hetzner	Hosting	Germany
Google Workplace	E-mail Provider	EU
Box	Signature Management	EU
Zendesk	Customer Support	EU
Countly	Product Analytics	Germany
Stripe	Payment Services	USA
Contract Hero	Contract Management	EU
Salesforce	CRM-Services	Germany
HubSpot	Website Hosting & Marketing Activities, CRM Services	EU