Privacy Policy

At PEPIN GmbH ("Pepin"), we take the protection of your personal data very seriously.

Data controller

Data we collect

Through our general contact form we collect the data necessary to respond to your request:

• Name
• Email
• Phone

Besides the form we collect data through other channels, described in detail below: the website audience measurement, the premium calculator if you use it, and WhatsApp messaging if you write to us there. If you request a call from the premium calculator, we keep a record of that operation in an internal log used solely to prevent abuse and automated submissions. We do not store your IP address in that log.

Purpose of processing

We use your data exclusively to:

• Contact you
• Offer you insurance advice
• Follow up on your request
• Let you know when the following year’s premiums are published, if you asked us to
• Publish your review of our service, if you give us one and only with your express consent

We do not sell your data or share it for advertising purposes. We share it with the service providers necessary to handle your request, described below. Publishing your review on our own website, if you give us one and allow us to, is not a disclosure to third parties: we publish it ourselves, on our own pages, and it is described below.

And if you ask us for offers, your data is passed to the insurance companies we request them from: that is what brokering consists of. In certain cases that transfer happens through a broker pool acting as a technical intermediary between the broker and the insurer. Beyond that and the providers described below, we do not share your data with anyone without your consent.

Premium calculator

The premium calculator on this website computes inside your browser: the comparison happens on your device, not on a server of ours, and what you type does not reach us unless you request a call. There are two caveats we would rather state than deny:

• When you pick your municipality, the table of official premiums for your region is downloaded, so the server that serves it sees which region you asked for.
• Your answers travel in the page address (the municipality, the year of birth, the deductible). If you reload, save the page or open a shared link, that address also reaches the technical log of whoever hosts it.

If you submit the form to request a call, we receive:

• Your name
• Your phone number
• Your email (optional)
• The summary of your comparison, exactly as you see it on screen before sending it: the municipality and its canton, the years of birth of the people in your household (and any name you typed for them), the deductible and accident cover selected, the insurance options you ticked with their official premium, the premium you pay today if you entered it, whether you have just arrived in Switzerland or are already insured, the time slot you prefer for the call and the language you were using the page in.

That request is stored in our database, hosted in the European Union, and handled from our internal advisory console. We use it solely to call you and follow up, for the same purposes and with the same rights described above.

The calculator’s internal metrics: to improve it we count its use with pseudonymous — not anonymous — counters: which screens are opened and how often. They use no cookies, do not store your IP address or your browser identifier (User-Agent), and never store what you type. Each visit carries a random identifier generated in the tab itself that disappears when you close it, with no link to your name; the time is stored rounded to the hour. They are still personal data, this policy applies to them, and we do not cross-reference them with your contact details.

Published reviews

If you have been a client, we may ask you for a review of our service through a personal, unique, single-use link that expires. Leaving one is voluntary and changes nothing about your relationship with us if you would rather not. It is only published if you tick the consent box on the form.

Of what you send us, this is what is published on this website — on the reviews page and on the pages where that block appears, such as the home page: the name you choose to sign with (shortened, "María G.", or in full if you expressly allow it), your canton, the text of your review, your rating from 1 to 5 and, if you tell us on the form, the month in which we advised you. Your email, your phone number and any other data in your file are not published. Your review may also be shown translated into the other languages of this website: when that happens, the language you wrote it in is always stated.

You can withdraw your consent at any time, without giving reasons: write to us at info@pepin.swiss and we take it off the site. In our system that removal is final — a withdrawn review cannot be published again — and the date is recorded, as proof that it was acted on.

We keep your review, the proof of your consent (the date and the version of the text you accepted) and the record of the link for as long as the review is published and, after that, for as long as we need to be able to show it was published with your permission. If we decide NOT to publish it, we keep it too: it stays stored internally and is never published. While the decision is still pending, its text may be sent to the translation tool described in the artificial intelligence section; once it has been turned down it is not shared with anyone and is not sent to any provider. A review is not documentation the law requires us to keep: write to us and we delete it, whether we published it or not, and if you ask for your data to be deleted, it is deleted with it.

Messaging on WhatsApp

You can write to us on WhatsApp at the PEPIN GmbH number. If it is your first time and we do not have you on record, the first replies come from an automated assistant: it greets you, asks which language you prefer and offers to book a call, receive your documents or put you through to a person; a member of the team takes over whenever it is needed, and whenever you ask for it. We say so in the first message, with a link to this policy. Please do not share medical details on this channel: we do not need them to book your call or open your file, and we would rather health data did not travel this way.

From a WhatsApp conversation we store, in our own database: your phone number, the name shown on your WhatsApp profile, the content of the messages you send us and of the ones we send you, the files you send us and the ones we send you (photos or PDFs of your documents, an offer or your policy, for example), and the time of each message with its delivery status. Files are kept in private storage; if they belong in your file, your broker saves them there and can tell you so. Voice notes (and any audio you send us) are kept with the conversation, like any other file, and transcribed automatically into text so that the team can read them. We always reply from our own console: the company number has no WhatsApp app installed on any phone.

We use that data to reply to you, book your call, ask for, receive or send you the paperwork needed and keep a record of what was discussed in your file. If you write to us without being a client, we create a contact record from your number so that we can help you. We do not use WhatsApp for advertising or campaigns: beyond the conversation you start, we only write to you about specific service matters (a reminder of your appointment, or a document still missing, for example).

If the conversation is not linked to your client record, we delete it in full, with its files, 5 years after the last message. If we link it to your file, we keep it for as long as you are a client and, after that, until you ask us to delete your data — then it goes with it, except for the records the law requires us to keep (see “User rights”). The technical log handed to us by the provider, containing the raw content of each message, is emptied after 30 days. Our backups, which are encrypted and exist only so that we can recover from a failure, keep the messages for up to 7 more days and the files for longer: the file backup is not yet pruned automatically. Internal notifications to the team about your messages travel through our email provider, which appears in the list of providers.

We only call you on WhatsApp if you have given us permission, and you can withdraw it at any time in Pepin’s WhatsApp profile. If you call us or we call you, the call goes through WhatsApp Ireland Limited (Ireland), which carries it on our behalf, as it does with messages, and may process the call data in the United States and in other countries. To keep a record of how we helped you, we store, for each call, the fact that it took place, its date and time, its duration, who at Pepin made or answered it, and whether and when you gave us permission to call you; we keep this with the conversation, for the same periods as its messages, and it is deleted with it. If we note the call in your file, its date and duration stay there.

Call recording. If at the start of a call we tell you it is being recorded and you do not object, we record the audio to prepare an internal summary. Infomaniak (Switzerland), acting as a processor on our behalf, transcribes it and prepares the summary; we ask it to leave out any health data, but some may remain: you can ask us to delete it. In our systems, the audio is deleted when that is done and at the latest after 24 hours; Infomaniak keeps the audio and the text after delivering it to us (the text, for at least 32 hours according to what we have measured) and we have not found a way to delete them sooner. We keep the summary in your file and the transcript (without the health data that is detected), which only Pepin's management can see and which is deleted after 5 years. If you do not want the call recorded, tell us during the call and the recording is discarded without being sent to anyone; if you tell us afterwards, we delete what we hold at once (not Infomaniak's copy).

Service providers

To deliver our service we rely on carefully selected external providers, which process your data on our behalf, only as far as necessary for the service they provide, and under contractual confidentiality and data-protection obligations. These are the functions we use them for and what reaches each one:

• Hosting and IT infrastructure — serve this website and our applications. Their technical logs may contain your IP address and technical connection data.
• Data storage and processing — the database where your request and your advisory file are stored: your name, your contact details and the summary of your comparison.
• General website audience measurement — a system separate from the calculator’s internal metrics described above. It counts which pages are visited and where the visit comes from: the path, the referring site, the country and the device and browser type. It uses no cookies, but derives an identifier that changes every day from your IP address and your browser. We do not cross-reference it with your contact details and it is not used for advertising.
• Email communications — deliver to our inbox the messages you send from the form — your name, email and phone number — and, where applicable, carry documents from your file as attachments, for example the signed advisory protocol.
• Appointment scheduling — if you choose to book a call in the calendar, the calendar provider receives your name, email and booking details.
• Security and anti-bot verification — to tell people apart from automated programs. Your browser connects to it directly: when the page containing a form loads, it receives your IP address and technical browser signals, before you send anything. (In the premium calculator this happens when you open the call form, not when the page loads.) It may store technical data on your device in order to work. It uses no tracking or advertising cookies, and it only runs if the verification is switched on.
• WhatsApp messaging — if you write to us on WhatsApp, WhatsApp Ireland Limited (Ireland) processes your number, your profile name, the content of the messages and the files you send us and we send you on our behalf, in order to deliver them. That company is part of the Meta group and may process that data in the United States and in other countries.
• Voice note transcription — Infomaniak Network SA (Geneva, Switzerland) converts into text, on our behalf and on servers in Switzerland, the voice notes (and any audio) you send us on WhatsApp. It does not use that content to train its models. It keeps the audio and the text after delivering it to us (the text, for at least 32 hours according to what we have measured) and we have not found a way to delete them sooner.
• Artificial intelligence, where applicable — described in the following section.

We do not pass your data to these providers for them to use for advertising or for commercial purposes unrelated to providing their service, and, beyond the insurers and the pool described above, we do not share it with anyone else. If you write to us on WhatsApp, on top of the above your number and your messages are stored in our database, as described under “Messaging on WhatsApp”.

Processing with artificial intelligence

For certain functions we may use artificial intelligence technology providers that analyse the documentation you supply or the text you write to us: for example, to read an insurance policy and propose its data, or to propose a translation of your review into the other languages of this website. In both cases a person always reviews the proposal before it is saved or published. No automated decision is made about you: the proposal is a draft, and your broker decides. That data is not used to train models. WhatsApp voice notes are converted into text automatically by a Swiss provider (see the list of providers); that text is stored as it is, with no automated decisions about you.

An insurance document may contain health data, which Swiss law treats as sensitive personal data. When we use this tool, the document is analysed by our artificial-intelligence provider acting as a processor, with the safeguards described in the international transfers section, and the result is always reviewed by your broker. If you prefer that your documents are read only by a person, tell us and we will do so.

International transfers

Some of these providers process the data in Switzerland or in the European Economic Area. Others are companies established in the United States, so some of your data may be processed there. A service being hosted in the European Union does not mean all processing happens there: some providers, or group entities involved in delivering the service, are established in the United States, so certain data may be accessible or processed there.

Those transfers rely, depending on the provider, on the Swiss–U.S. Data Privacy Framework where the provider is certified under it, or on standard contractual clauses recognised by the Federal Data Protection and Information Commissioner (art. 16 para. 2 let. d of the Federal Act on Data Protection), together with the corresponding technical and organisational measures.

If you want to know which specific provider is involved in a processing operation that concerns you, and which safeguard covers it, write to us and we will tell you. info@pepin.swiss

Data retention

We keep your data for as long as the purpose that generated it requires. If your enquiry does not lead to an advisory relationship, we keep it while we handle your request. If we go on to advise you or broker a policy, certain documents are kept for the periods required by the applicable commercial, tax, contractual or supervisory law — for example the ten years the Code of Obligations sets for accounting records.

Your rights

You can request at any time, among other rights:

• Access to your data
• Rectification
• Deletion
• The handing over or transmission of your data in a common electronic format (art. 28 FADP)
• To object to a specific processing operation

To do so, write to: info@pepin.swiss

These rights have a legal limit: we cannot delete documentation the law requires us to keep, such as the record of the information provided under art. 45 of the Insurance Supervision Act or the contracts we brokered. If you ask for deletion and part of your data falls into that category, we will tell you and will restrict its use to what the law strictly requires.

You may also lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC).

Cookies and storage on your device

This website uses basic cookies necessary for its operation. We do not use advertising or cross-site tracking cookies. The anti-bot security provider and the appointment calendar may store technical data on your device in order to work.