Legal notice & privacy

1. Controller

steuermacher.ch is a brand of FINWIWO AG. The controller responsible for the processing of personal data collected via this website is FINWIWO AG, Oberstrasse 153, 9000 St. Gallen, Switzerland.

For questions about data protection, you can reach us at info@finwiwo.ch or by phone on +41 71 552 30 00.

2. Legal basis and scope

We process personal data in accordance with the Swiss Federal Act on Data Protection (FADP) and, where applicable in the individual case, the EU General Data Protection Regulation (GDPR). This statement applies to the website steuermacher.ch and to the requests submitted through it.

Personal data means all information relating to an identified or identifiable person. We process such data on the basis of your consent, in preparation for and performance of a contract, to comply with legal obligations or on the basis of legitimate interests in the secure operation of the website.

3. What data we process

We collect only the data required to answer your request and to prepare your tax return.

• Details from the request form: first and last name, email address, telephone number, postcode and town, canton, date of birth and your details about your tax situation.
• Your consent to the privacy policy, including the version and the time of consent.
• Details from voluntary contact by email or telephone.
• Technical data generated when the website is accessed (see the chapter on technical provision).
• Details from the checklist if you record a tax return: your personal and tax details and the receipts you upload.
• Details about your customer account and the payment: the email address used to sign in as well as the amount, time, payment method and reference of the payment – but not your card or payment details.
• Your decision on statistics and marketing including the time it was made; it is stored only locally in your browser.

4. Purposes of processing

We use your details to answer your request, to assign a specialist to you, to determine the fixed price and – if you engage us – to prepare and file your tax return.

We also process data to ensure the operation and security of the website and to comply with statutory retention and documentation obligations. No automated decision-making with legal effects for you takes place.

5. Request form

The request form transmits your entries to our server over a TLS-secured connection and stores them there in a protected database. The database is not publicly accessible from outside; access takes place exclusively on the server side and is restricted to the persons entrusted with your case.

After submission, you receive a confirmation of receipt by email. At the same time, your request is transferred to our internal customer management system, which FINWIWO AG operates itself, and reported internally so that a specialist can contact you promptly. Both serve solely to process your request.

The form deliberately does not accept document files. You submit your tax documents only after your specialist has contacted you personally and agreed the secure channel for this with you. Please do not send us any documents unencrypted by ordinary email.

By submitting the form, you confirm that you have taken note of this privacy policy. The version you agreed to is stored together with your request.

With your request we also record how you reached our website – campaign parameters from the address, the referring website and the first page you opened. This lets us judge which advertising works. These details come from your browser, are kept only until the browser tab is closed and are stored with your request when you submit it.

6. Technical provision and log data

When the website is accessed, the hosting infrastructure used processes technical connection data of the kind generated when operating a website – such as the IP address, time of the request, address accessed and details of the browser and operating system.

This data serves to deliver the pages, to analyse errors and to prevent misuse. It is not evaluated for advertising purposes and is not linked to personal profiles.

7. Hosting, database and processors

We use technical service providers to operate the website and the database. They process personal data on our behalf, in accordance with our instructions and exclusively for the purposes described here.

Specifically, this concerns the hosting and delivery service for the website, the database service in which the requests from the form are stored, and the sending service for the confirmation and notification emails. Corresponding data processing agreements are in place with these service providers.

Specifically, these are Lovable (Lovable Labs Inc.) for hosting and delivering the website and for sending our confirmation emails, and Supabase (Supabase Inc.) for the database, the customer account sign-in and the encrypted storage of the receipts uploaded in the checklist. The data centres of these providers may be located in the European Union or the United States – see the chapter “Processing abroad”.

8. Recipients of your data

We do not sell personal data and do not pass it on for third-party advertising purposes. Data is disclosed only for a specific purpose and only to the following recipients:

• The internal staff entrusted with your case and the specialist engaged to prepare your tax return.
• Our internal customer management system, which FINWIWO AG operates itself and into which your request is transferred for processing.
• Technical processors for hosting, database and email dispatch, who do not pursue any purposes of their own.
• Trustindex (Trustindex.io) as the provider of the review display; no form data is transmitted in the process, only the technical connection data generated when the widget is loaded.
• The competent cantonal tax office, insofar as you engage us to file your tax return and have approved it.
• Stripe as the payment service provider, insofar as you pay the fixed price online; only the details required for the payment are transmitted, not your tax data.
• Google and Meta, insofar as you have allowed statistics or marketing respectively – to the extent described in the corresponding chapters.
• Authorities and courts, insofar as we are legally obliged to provide information.

9. Processing abroad

Processing generally takes place in Switzerland or in the European Economic Area. If a technical service provider we use processes data in another country, we ensure a level of protection equivalent to Swiss law by means of appropriate contractual guarantees.

Data reaches the United States in particular through Stripe (payment), through Google and Meta (only with your consent to statistics or marketing) and possibly through our technical providers for hosting and database. Where a provider is not certified under the Swiss-U.S. Data Privacy Framework, we base the transfer on the standard contractual clauses recognised by the FDPIC.

10. Data security

The website is delivered exclusively over TLS-encrypted connections; this also applies to the transmission of the request form. Access to the stored requests is restricted to authorised persons and secured by access rules at database level.

We take appropriate technical and organisational measures to protect your data. However, no one can guarantee absolute security for transmission over the internet; therefore, please do not send us sensitive documents via unsecured channels.

11. Cookies, local storage and consent

On your first visit, a notice at the bottom of the page asks whether, beyond the technically necessary functions, we may also use statistics and marketing. Until you have decided, none of that happens: no analytics or advertising service is loaded and no corresponding cookie is set.

Technically necessary are the functions without which the website cannot work – signing in to the customer account, the saved progress of the checklist, the security of the forms, your choice of language and your decision here itself. They are not used for recognition for advertising purposes and therefore cannot be switched off.

«Statistics» means measuring which pages are opened how often and where a visit ends. «Marketing» means attributing which advert led to an enquiry. The services behind them are described in the two following chapters.

Your decision is stored, together with the time it was made, exclusively locally in your browser; it is not stored on our servers. You can change or withdraw it at any time via the «Change consent» link in the footer of every page. A withdrawal takes effect for the future. If a service is added, we ask again.

Specifically, the following data is stored in your browser:

• Consent (“steuermacher.einwilligung”, local storage): your decision on statistics and marketing including the time – until you withdraw it or we ask again because of a new service.
• Customer account sign-in (Supabase session, local storage): keeps you signed in – until you sign out.
• Campaign origin (“steuermacher.herkunft”, session storage): which link or advert brought you to us – until the browser tab is closed.
• Google Tag Manager / Google Analytics (“_ga”, “_ga_*”; only with statistics consent): recognising the browser for reach measurement – up to 24 months.
• Meta pixel (“_fbp”, “_fbc”; only with marketing consent): attributing a request to an advert – 90 days.
• Your language choice is not stored; it is part of the page address.

12. Review display (Trustindex)

To display verified Google reviews, we use the service Trustindex (Trustindex.io). For this purpose, a Trustindex widget is loaded on the reviews page and above the footer of our pages.

When a page with this widget is accessed, a connection to cdn.trustindex.io is established. Technical browser and connection data may be transmitted to the provider in the process, such as the IP address, time of access, address accessed and details of the browser and operating system. This transmission is technically necessary to deliver the content.

The sole purpose of the integration is to display the verified reviews available on Google. We do not transmit any details from the request form to Trustindex. The provider's own privacy provisions apply to processing by the provider itself.

The widget is only loaded once you have allowed statistics or marketing, or release it yourself on the respective page with “Show reviews”. Until then no connection to Trustindex is established.

13. Google Tag Manager and consent mode

For measurement we use Google Tag Manager, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Tag Manager is not an analytics tool itself, but the switchboard through which the measurement services used are loaded and supplied with events.

It is only loaded after you have allowed «Statistics» or «Marketing». Before your decision, Google's consent mode (Consent Mode v2) is set to «denied» for advertising and analytics storage; if you change your choice, the mode is updated immediately.

When it is loaded and when events are reported, technical connection data is transmitted to Google, such as the IP address, time, address accessed and details of the browser and device. What is reported is the page path, the scroll depth reached, the time spent, clicks on links and buttons and the start and submission of the request form. The query part of the address is deliberately omitted so that no identifier – such as the number of a tax case – is included.

On the internal pages – checklist, customer account, collection and administration areas – nothing is loaded and nothing is reported, regardless of your decision.

14. Meta pixel and Conversions API

If you have allowed «Marketing», we additionally load the Meta pixel of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland. It reports the opening of a page, clicks on our telephone number or email address and the successful submission of the request form. Without this consent the pixel is not loaded and nothing is sent.

When the form is submitted, we also report the same event from our server via Meta's Conversions API, because the route through the browser is frequently interrupted by ad blockers and device settings. Both reports carry the same event number so that Meta recognises them as a single event and does not count them twice.

For attribution we transmit email address, telephone number, first and last name, postcode, town and country exclusively as an SHA-256 hash value; these details do not leave our server in plain text. The IP address, browser identification and Meta's two cookies are transmitted unencrypted – this is what the interface requires. Details about your tax situation, your date of birth and your documents are not transmitted.

The purpose is to measure the effect of our advertising; the basis is your consent. Meta processes the data as an independent controller under its own provisions, including in the United States.

15. Checklist, customer account and payment

If you record a tax return via the checklist, you enter the personal and tax details required for it there and can upload receipts. The progress is saved so that you can interrupt the entry and continue later. A customer account can only be created from a checklist that is already under way; you sign in via a link sent to your email address, there is no password.

You pay the fixed price via the payment service provider Stripe (Stripe Payments Europe Ltd., Dublin, Ireland, and Stripe, Inc., United States). For this you are directed to a payment page operated by Stripe. You enter your card and payment details there; they do not reach our servers and are not stored by us.

From Stripe we receive the confirmation of the payment with the amount, the time, the payment method used and a reference number. That is enough to assign the payment to your order, issue the invoice and comply with statutory retention obligations. We do not transmit any tax data to Stripe.

16. Retention and deletion

We retain personal data for as long as is necessary for the purposes described or as required by statutory retention obligations. After that, the data is deleted or anonymised.

Requests that do not lead to an engagement are retained only for as long as is necessary to respond to them and to keep a record. You may request the deletion of your request at any time, unless a legal obligation prevents this.

You also have the right to lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern.

17. Your rights

Within the scope of the applicable law, you have in particular the following rights vis-à-vis us:

• Access to the data processed about you.
• Rectification of inaccurate data and deletion of data that is no longer required.
• Withdrawal of consent given, with effect for the future.
• Objection to certain processing operations as well as the release or transfer of your data, where provided for by law.

18. Changes and contact

We may amend this privacy policy if the processing or the technical means used change. The version published on this website at the time is authoritative.

For access requests, rectifications, deletions or other data protection matters, write to info@finwiwo.ch or call us on +41 71 552 30 00. Version as of: September 2026.