Privacy policy

This is a translation. Only the German version is legally binding.

Platform “POWER DUCK Augmented Vital@Work Navigator” & services of WIN-WIN FOR WORK GmbH

This privacy policy informs you transparently about how WIN-WIN FOR WORK GmbH (hereinafter “we” or “us”) processes personal data. Our data processing complies with the Swiss Federal Act on Data Protection (revFADP), the EU General Data Protection Regulation (GDPR) and the transparency obligations of the EU Artificial Intelligence Regulation (EU AI Act).

Table of contents

  1. Doctrinal separation of roles: controller vs. processor
    A.WIN-WIN FOR WORK as controller
    B.WIN-WIN FOR WORK as processor
  2. Responsible body in Switzerland and representatives in the EU
  3. Categories of personal data processed
    A. General business data
    B. Specific application data in the SaaS platform
  4. System guardrails and strict processing rules
  5. Use of AI and legal assurances
    5.1 Intended purpose and delimitation
    5.2 Mandatory legal assurances
    5.3 Transparency regarding residual risks in AI evaluations
  6. Absolute AI decoupling for quantitative surveys
  7. Data disclosure and technology partners
    A. Technical system infrastructure (SaaS modules)
    B. AI model providers
    1. Global infrastructures (security monitoring and temporary storage)
    2. Local infrastructure in Switzerland (hosted by Infomaniak in Switzerland)
    C. General commercial & administrative service providers
    D. Third-country transfers and legal bases
  8. Website services, cookies and social media
  9. International data transfer and data security
  10. Your rights and their exercise free of charge
  11. Applicable law

1. Doctrinal separation of roles: controller vs. processor

A. WIN-WIN FOR WORK as controller

We are the controller for data processing operations in which we ourselves determine the purposes and means. This essentially concerns:

      • visits to our websites (winwinforwork.org, weEmpower.ch, mypowerduck.com, powerduck.ai, powerduck-app.ai).
      • registration for our community, newsletter or use of the blog.
      • the performance of contracts for in-person trainings, consulting, online shop orders and commercial processes.
      • the administrative management of cooperations with independent, certified partners and resellers.

B. WIN-WIN FOR WORK as processor

In operating our SaaS applications “POWER DUCK Augmented Vital@Work Navigator” and “Human to Human Hub” for our B2B corporate customers, WIN-WIN FOR WORK acts as a processor bound by instructions.

Exception to processing on behalf:
When processing telemetry and usage data to ensure system stability and for product improvement, we are an independent controller.
      • Customer’s data sovereignty: The respective B2B customer is the sole controller, holds full data sovereignty and decides autonomously on the purposes of processing and on user accounts. We process personal content data strictly in accordance with instructions on the basis of a data processing agreement (DPA).
      • Platform operation as a purely process-oriented tool: The system is operated exclusively as a process-oriented tool for structuring, organising and accompanying projects, transformation and change processes. It serves to document milestones, to plan resources and to provide aggregated progress measurements at department level. It anchors the “Vital@Work” model as a sustainable standard for organisational development.
      • Clear allocation of obligations: The B2B customer bears sole responsibility for all content data, knowledge modules and instructions entered into the H2H Hub. It ensures that, contractually, the system is not used to monitor employees or for the automated allocation of tasks. We provide the technical infrastructure and carry out exclusively automated format and structure optimisations of the data flows, without performing any content analyses.

2. Responsible body in Switzerland and representatives in the EU

The following bodies are responsible for data protection matters:

Controller in Switzerland:

      • WIN-WIN FOR WORK GmbH, Gisibachstrasse 13, 6405 Immensee, Switzerland
      • E-mail: Datenschutz@winwinforwork.org
      • Managing Director: Christian Czupalla


Representative in the EU:

      • LEXR Germany Rechtsanwalts GmbH, Gormannstr. 14, 10119 Berlin
      • EU contact person for data protection
      • E-mail: contact@lexr.com

3. Categories of personal data processed

A. General business data

      • Master data: Name, contact details, position, information on the business relationship.
      • Contract and billing data: Payment details, billing data.
      • Partner and consultant data: Certification status, billing and commission data of resellers.
      • Communication data: Content from e-mails, contact forms or chats.

B. Specific application data in the SaaS platform

      • Account data: E-mail address, name, encrypted password.
      • Consultant profiles: Name/initials, short profile, location (city/country), contact links.
      • Project data: Project name, descriptions, target states, milestones, assigned project teams.
      • Authorisations: Release status of documents, access authorisations.
      • Deletion due to inactivity: For the purpose of data minimisation, inactive accounts, including all profile data and project documents, are automatically deleted after 6 months of inactivity.
      • Employee data: The data processing is legally based on its necessity for the performance of the employment relationship or on the legitimate interests of the employer.

4. System guardrails and strict processing rules

In order to comply with data protection and employment law, the “POWER DUCK Augmented Vital@Work Navigator” processes data by applying mandatory technological guardrails:

Data category Purpose of processing Technical protective measure / guardrail
General text inputs Navigation and methodological orientation in the transformation process. The system responds exclusively to text inputs. No collection of behavioural metadata.
Text inputs on emotions/perspectives Identification of structural blockages in the organisation as a whole. Best possible pseudonymisation in line with the current stage of development of the solution. Name, e-mail and role are separated on the system side before AI processing. Management is provided only with generalised, cross-departmental process feedback. Drawing conclusions about individuals is minimised by these integrated prompt and content filters (which are implemented as strict instructions and system prompts at application level). These filters do not alter the data by physical masking (which means that the processing quality and precise inference of the Navigator are fully preserved), but consistently exclude performance evaluations at application level.
Biometric data ARE NOT COLLECTED The system is completely “blind” to biometric data and has no sensors whatsoever for facial expressions or voice analysis, in order to comply with the prohibition of emotion recognition in the workplace.
Personal performance data / KPIs ARE NOT COLLECTED System prompts and instructions integrated on the system side proactively block any attempt to query individual performance profiles, behavioural assessments or personal KPIs.
Express prohibition of misuse for other purposes:
The platform is, technically and conceptually, expressly not intended for recording, monitoring or evaluating employee behaviour. If a user improperly feeds the system with behavioural data, they depart from the purpose technically and contractually intended by the provider.

5. Use of AI and legal assurances

The Navigator serves as a purely assistive orientation tool for digitalising the Vital@Work model. The artificial intelligence exclusively supports the human user.

5.1 Intended purpose and delimitation

      • Purely an assistance tool: The system supports process navigation and gives impersonal recommendations for action. It has no decision-making authority of its own and does not allocate tasks algorithmically.
      • No behavioural assessment: The system is technically incapable of assessing, monitoring or predicting the performance, motivation or psychological state of individual, identifiable employees.

5.2 Mandatory legal assurances

      • Absolute exclusion of profiling: No profiling within the meaning of Art. 22 GDPR or the revFADP takes place. Individual characteristics for predicting work performance or behaviour are categorically not assessed.
      • No automated individual decisions: The strict “human-in-the-loop” principle applies. The AI acts in a purely preparatory capacity. Every decision under employment law or of an organisational nature is taken exclusively by the human user.
      • Compliance with Swiss employment law: Through integrated filters, data-minimising aggregation and the irreversible pseudonymisation of feedback, the protection of personality and the prohibition of behavioural monitoring systems are guaranteed on the system side. Since the system prompts and instructions on the system side block impermissible performance queries, it is ensured contractually and technically that no performance or behavioural assessments can be obtained through the use of the Navigator.
      • Integrated prompt and content filters (input & output via system prompts and instructions): Before text inputs are passed on by the system to the generative language models (input level) and before the generated responses are delivered (output level), the platform applies dynamic prompt and content filters integrated into the software, which are implemented as strict, system-side instructions and system prompts (system instructions) directly at application level. These system-side system prompts and instructions expressly do not serve the physical, distorting masking (redaction) of entered text data, which means that the semantic processing quality, the substantive context and the precise functioning of the Navigator are fully preserved for the user. Instead, these instruction filters at application level ensure that users cannot obtain, query or generate any performance evaluations, behavioural assessments or personal KPI analyses of employees through the use of the Navigator. They function as native guardrails embedded directly in the processing logic to enforce the prohibition on processing performance data (purpose limitation). This avoids the emergence of external security and latency risks (e.g. due to unreliable third-party proxies), while the full processing quality required to ensure the functioning of the Navigator remains unimpaired.

5.3 Transparency regarding residual risks in AI evaluations

We transparently point out that even with optimally functioning prompt and content filters, an inherent residual risk remains. Generative language models could theoretically draw conclusions about individuals from the remaining pure text context. Through this disclosure of risk, responsibility for the output and its lawful use is shifted back to the B2B customer. The customer acts as controller under data protection law and must always critically review the generated results as part of its duty of care (“human-in-the-loop”).

6. Absolute AI decoupling for quantitative surveys

In order to eliminate any data protection risks with regard to surveys and progress measurements, the following strict system architecture applies:

      • Complete technical decoupling: Optional online surveys for monitoring progress are conducted exclusively via the external platform 2ASK (orbiz Software GmbH, Konstanz, Germany). There is no data or API connection whatsoever between the surveys and the AI systems or language models of the platform.
      • No performance or behavioural KPIs: No personal data, free texts or metadata are collected via the survey tool. The questions are based exclusively on standardised, quantitative multiple-choice questions on procedural framework conditions.
      • Anonymity at team level: Results are evaluated exclusively in anonymised, mathematically aggregated form at the level of large organisational units. It is technically impossible to attribute responses to specific persons or to their individual performance.
      • Secure server location: All survey data are hosted and processed on dedicated servers of orbiz Software GmbH in Germany.

7. Data disclosure and technology partners

The processing of content data via application programming interfaces (APIs) always takes place while guaranteeing full freedom of choice for our customers and in accordance with the principle of data minimisation. In order to offer you the greatest possible customer benefit, maximum flexibility and uncompromising security, our system architecture is based on your being able to choose independently, for your various assistants, between global APIs and closed models operated in Switzerland. We ensure that functionality, system security and your administrative benefit are always applied, and continuously optimised, in accordance with the current requirements and technical possibilities of the respective technology contractual partners. Permanent model training by the respective contractual partners on the content data you enter is consistently excluded by contract.

A. Technical system infrastructure (SaaS modules)

      • Operation of Power Duck applications: AI now AG, Switzerland
      • Infrastructure & cloud hosting: Microsoft Ireland Operations Limited (data residency: Switzerland / Geneva/Zurich). Own Azure resources in the controller’s tenant for encrypted system storage.
      • Database service: MongoDB, Inc. (data residency: Switzerland). Cloud database service on Azure infrastructure for storing Powerduck data.
      • Front-end hosting: Netlify, Inc. (data residency: EU).
      • Identity management & SSO: Okta, Inc. / Auth0 (data residency: EU).
      • System notifications (e-mail): Twilio Inc. / SendGrid (data residency: EU).
      • Stability monitoring & system optimisation: Sentry (data residency: EU) and PostHog (data residency: EU, configured for purely technical and operational purposes).

B. AI model providers

When creating the customer-specific configuration (individualisation) and operating the various digital assistants on the platform, the client (customer) always has the free and unrestricted choice of the application programming interfaces (APIs) and infrastructures via which data processing for the respective assistant is to take place. The options available are:

      • Global infrastructures (involving global contractual partners where the technical processing takes place in the USA or the EU) or
      • Local Swiss infrastructures with a closed, self-contained model (hosted on Swiss servers at Infomaniak in Geneva), where all data processing (inference) and temporary execution take place exclusively and without exception physically in Switzerland and no data flow out to third-party providers.

This flexible architecture fully guarantees the digital sovereignty and autonomy of the customer. For the individual assistants, the client can decide independently which model is to be actively used, can change or have adjusted the model configurations for its assistants at any time during operation on its own initiative, and can respond flexibly to changed internal compliance requirements. The platform provider does not prescribe any particular model for the assistants.

1. Global infrastructures (security monitoring and temporary storage)

Summary statement on the security monitoring of the US-based contractual partners: In order to ensure the security, stability and integrity of the services provided, the technical infrastructure of the US-based contractual partners provides by default for automated, temporary security and abuse monitoring (abuse or safety monitoring). This runs in the background and serves exclusively to detect and prevent unauthorised system access, abuse or serious policy violations. It is expressly agreed and contractually guaranteed that the transmitted content data (prompts and completions) will under no circumstances be used for training AI models or for product improvement by the providers.

Not all of the US-based contractual partners have an approved special agreement on zero data retention (Zero Data Retention – ZDR) or modified security monitoring (Modified Abuse Monitoring) in place; the transmitted content data are temporarily cached on the protected infrastructures of the respective contractual partners for the purpose of abuse detection and ensuring system security. This security review is carried out in accordance with the relevant requirements of the respective operator. After this review window has expired, these data are automatically and permanently deleted in the back end, unless there is a specific, well-founded suspicion of system abuse or a security incident. In the event of a well-founded suspicion of abuse or of security incidents, this period may be extended for the duration of the investigation and the preservation of evidence.

Anthropic Ireland, Limited

      • Place of processing: USA (inference is performed on servers of Anthropic, PBC in the USA).
      • Setup: Claude API under the Commercial Terms of Service and DPA.
      • Exclusion of model training: No model training on customer data. It is contractually guaranteed that no API traffic is used at any time for training Claude models.
      • Customer’s freedom of choice: During operation, the customer always has a free choice and can decide independently to use this model, to change the configuration or to switch to a closed model in Switzerland.

Microsoft Azure AI Foundry

      • Place of processing (inference): Switzerland / CH. Inference takes place exclusively via regional deployments (Switzerland North) or Data Zone deployments (Data Zone Standard), whereby the physical retention of data in Switzerland is contractually assured.
      • Setup: Own Azure resources in the controller’s tenant (no dedicated PTU capacities on shared infrastructure).
      • Exclusion of model training: No model training on customer data; no disclosure to OpenAI.
      • Customer’s freedom of choice: During operation, the customer always has a free choice and can decide independently to use this closed Swiss model or to switch flexibly to another model.

OpenAI Ireland Limited

      • Place of processing: USA (technical inference on servers of OpenAI OpCo, LLC in the USA).
      • Setup: API platform under the OpenAI Business Terms with an integrated Data Processing Addendum (DPA).
      • Exclusion of model training: Completely excluded by contract. Customer data (prompts and completions) via the API will under no circumstances be used for training OpenAI models.
      • Customer’s freedom of choice: During operation, the customer always has a free choice and can decide independently to use this model, to change the configuration or to switch to a closed model in Switzerland.

Google AI Studio

      • Place of processing: USA / EU (on global Google servers).
      • Setup: Gemini Developer API in the Paid Tier (with active billing) under the Gemini API Additional Terms.
      • Exclusion of model training: Completely excluded by contract. In the chargeable Paid Tier (with billing activated), any model training and manual review by human reviewers are excluded.
      • Customer’s freedom of choice: During operation, the customer always has a free choice and can decide independently to use this model, to change the configuration or to switch to a closed model in Switzerland.

Perplexity AI, Inc.

      • Place of processing: USA (inference takes place on servers of Perplexity AI, Inc. in the USA).
      • Setup: Chat Completions API. When real-time research is used, the queries entered or the search terms derived from them are transmitted to Perplexity’s search and index infrastructure and to the model providers used.
      • Exclusion of model training: Completely excluded by contract. A strict zero data retention policy (ZDR) applies to API content; the content data are not used for training models.
      • Customer’s freedom of choice: During operation, the customer always has a free choice and can decide independently to use this model, to change the configuration or to switch to a closed model in Switzerland.

2. Local infrastructure in Switzerland (hosted by Infomaniak in Switzerland)

Infomaniak Network SA

      • Setup & contractual framework: Cloud hosting and operation of the models on physical infrastructure operated entirely in Switzerland (Geneva/Zurich, Rue Eugène-Marziano 25, 1227 Acacias) in accordance with the Personal Data Processing Agreement (DPA) concluded between the parties, governed by Swiss law and with data processing taking place exclusively in Switzerland.
      • Data residency & place of processing (inference): Switzerland / CH. The content data are processed and stored exclusively on the Swiss infrastructure. Any transfer or disclosure of the data to countries outside Switzerland or the EU/EEA is strictly prohibited by contract pursuant to Art. 13.1 of the Infomaniak DPA without the prior written consent of the customer (data controller).
      • Contractual & technical exclusion of model training: Any use of the entered or generated data (prompts and completions) for training the open-source models (Apertus, Qwen, Kimi, Mistral, Gemma) or for any other purposes outside the provision of the agreed services is excluded contractually and technically pursuant to Art. 2.1.2 and 2.1.3 of the Infomaniak DPA.
      • Absolute protection against data outflow to third-party LLM providers: Since the open-source models (Apertus, Qwen, Kimi, Mistral, Gemma) are executed in a fully encapsulated and isolated manner within our Swiss tenant on the servers of Infomaniak, there is technically at no time any API, data or network connection to the original model developers (such as Alibaba Group for Qwen or Moonshot AI for Kimi) or to any other external AI platforms. An outflow of customer data to foreign third-party providers is thereby rendered technically impossible; full data sovereignty remains in Switzerland without exception.
      • Customer’s freedom of choice: During operation, the customer always has a free choice and can decide independently to use this closed Swiss model or to switch flexibly to another model.

Apertus

      • Place of processing (inference): Switzerland / CH. Specialised model for structural analyses, executed on Infomaniak’s data-protection-compliant cloud infrastructure.
      • Storage location (security monitoring): No storage. Execution takes place exclusively transiently in the working memory (RAM) of the Swiss servers; no logging of prompt content takes place.
      • Customer’s freedom of choice: The customer always has the free choice to select or change this model during ongoing operation.

Qwen

      • Place of processing (inference): Switzerland / CH. Open-source language model for text analysis, operated in the isolated Swiss environment.
      • Storage location (security monitoring): No storage. Volatile RAM processing; no logging and no data outflow.
      • Customer’s freedom of choice: The customer always has the free choice to select or change this model during ongoing operation.

Kimi

      • Place of processing (inference): Switzerland / CH. Language model for contextual analysis of large documents, operated in isolation at Infomaniak.
      • Storage location (security monitoring): No storage. Volatile RAM processing; no logging and no data outflow.
      • Customer’s freedom of choice: The customer always has the free choice to select or change this model during ongoing operation.

Mistral

      • Place of processing (inference): Switzerland / CH. Open-source language model for text analysis and logical structuring, operated in the isolated Swiss environment of Infomaniak.
      • Storage location (security monitoring): No storage. Volatile RAM processing; no logging and no data outflow.
      • Customer’s freedom of choice: The customer always has the free choice to select or change this model during ongoing operation.

Gemma

      • Place of processing (inference): Switzerland / CH. Open-source language model specialised in assistance tasks, operated in the isolated Swiss environment.
      • Storage location (security monitoring): No storage. Volatile RAM processing; no logging and no data outflow.
      • Customer’s freedom of choice: The customer always has the free choice to select or change this model during ongoing operation.

C. General commercial & administrative service providers

      • ERP & accounting software: Bexio AG, Rapperswil, Switzerland.
      • Project and work organisation: monday.com Ltd. (data centres in the EU/USA).
      • Office infrastructure & cloud storage: Google Ireland Limited (Google Workspace, EU) and Microsoft Ireland Operations Limited (Office 365, EU).
      • Payment service providers: Stripe, PayPal or PostFinance process credit card and billing data under their own responsibility under data protection law.

D. Third-country transfers and legal bases

Where processing by the providers mentioned takes place in countries without an adequate level of data protection (in particular the USA), the transfer is safeguarded by the conclusion of the Standard Contractual Clauses (SCC) of the EU Commission (taking into account the Swiss adaptations of the FDPIC) and by additional technical and organisational security measures (such as server-side pseudonymisation, the implementation of integrated prompt and content filters at application level by means of strict system prompts and instructions to prevent performance evaluations while preserving processing quality, and local Swiss fallback routing via Infomaniak). Certain providers are also certified under the Swiss-U.S. and EU-U.S. Data Privacy Framework (DPF).

8. Website services, cookies and social media

To provide, secure and optimise our website and our SaaS platform, we use various cookies, analytics and third-party services:

      • Use of cookies, local storage and telemetry: To ensure operational security, system stability and the error-free provision of our SaaS platform, we use exclusively cookies and local storage technologies that are strictly necessary for technical reasons. Since our SaaS platform consistently refrains from advertising or marketing tracking requiring consent, no cookie banner is active or required. The data processing serves exclusively the technical operation and system optimisation.
      • Cookies: We use small text files to distinguish visitors from one another without identifying them personally.
      • Functional cookies: Necessary for settings, language and login; no consent required.
      • Analytical cookies: Measure reach and optimise content; notice is given via an information banner when the website is accessed.
      • Deactivation: Possible via browser settings; may restrict functionality.
      • Google reCaptcha: Used to distinguish human input from automated access in forms. Processes IP address, website use, length of visit, Google account, mouse movements and image puzzles. The service runs in the background without a separate notice.
      • Google Analytics: Analyses user behaviour in order to improve the website. Collects pages accessed, clicks, approximate location, IP address, technical details and referral source. The IP address is truncated within the EU/EEA via “anonymizeIP”. Data are deleted after 12 months. The service is based on your consent.
      • Google Ads / AdWords: Measures the success of Google advertisements. When an advertisement is clicked, a cookie (valid for 30 days, no personal identification) is set. Records the total number of users referred, for anonymous statistics. Objection by deactivating cookies in the browser or by blocking the domain googleleadservices.com.
      • Google Maps: Embeds maps directly. Google records your page view and, if you are logged in, assigns the data to your Google account. Google uses data for advertising, market research and needs-based design. Objections must be addressed directly to Google.
      • Google Tag Manager: Management interface for website tags. The Tag Manager itself does not process any personal data.
      • WordPress plugins: To provide our online shop and members’ area, we use WordPress plugins from Automattic Inc. (USA) / WooCommerce Inc. (USA/Ireland).
      • Plugins: WooCommerce (shop system), YITH WooCommerce Membership Premium, YITH Event Ticket, WP Jobmanager.
      • Data processed: Name, address, company, billing/delivery address, e-mail, telephone number, role/department, payment information and server log files.
      • Note: Automattic processes data as an independent controller, including for its own marketing purposes, and uses cookies/web beacons. Processing also takes place in the USA, whereby the US providers are certified under the Swiss-US or EU-US Data Privacy Framework or we have concluded Standard Contractual Clauses in order to ensure an adequate level of data protection. Objection and deactivation of cookies in the browser are possible.
      • Social media plugins (share buttons): Enable content to be shared on your profiles. Through their use, personal data are transmitted to the respective operator, which processes them under its own responsibility.
      • Facebook (Facebook Inc., USA): Establishes a direct connection to the server and transmits the IP address and the website visit. Objection by logging out before visiting the website or by browser add-ons.
      • X (X Corp., USA): Links pages visited to your account. Objection by logging out or by adjusting the privacy settings at X.
      • LinkedIn (LinkedIn Corp., USA): Assigns your visit, together with your IP address, to LinkedIn (Recommend button).
      • Xing (Xing AG, Germany): Connection to the server without storage of personal data, IP address or analysis of usage behaviour.
      • YouTube (Google Ireland Ltd.): Embeds YouTube videos; data processing is carried out in accordance with Google’s terms of use and privacy provisions.

9. International data transfer and data security

      • Safeguarding of data transfers: For transfers to third countries, we conclude Standard Contractual Clauses and rely on the Swiss-US or EU-US Data Privacy Framework. In addition, we carry out Transfer Impact Assessments.
      • Data residency: Your platform data are stored permanently exclusively in Switzerland (preferred) or the European Union.
      • Access protection (2FA): Two-factor authentication is activated by default and mandatory for all administrative super-admin accounts of the platform.
      • State-of-the-art encryption: All data transmissions are encrypted. We refrain from statically specifying fixed algorithms in order to ensure agile adaptation to future technological security standards.

10. Your rights and their exercise free of charge

Under the revFADP and the GDPR, you have the right, free of charge, to access, rectification, erasure, restriction, objection and data portability.

Please send your request to Datenschutz@winwinforwork.org. For identity verification, we use exclusively data-minimising procedures: if you submit your request by e-mail, we verify your identity by means of a short, informal confirmation sent to the e-mail address we hold on file. Alternatively, you can submit your request directly and in verified form via your password-protected login area of the platform. We will process your request within the statutory period of 30 days.

      • The competent supervisory authority in Switzerland is: Federal Data Protection and Information Commissioner, Feldeggweg 1, CH-3003 Bern. Website: www.edoeb.admin.ch
      • Right to lodge a complaint in the European Union: If you are located in the European Union or the provisions of the GDPR apply to you, you have, in addition to the right to lodge a complaint in Switzerland, the right to lodge a complaint with a data protection supervisory authority in the EU Member State of your habitual residence, your place of work or the place of the alleged data protection infringement if you consider that the processing of personal data relating to you infringes the GDPR.

11. Applicable law

This policy is governed by Swiss law (excluding the conflict-of-laws rules). For consumers with habitual residence in the EU, the mandatory consumer protection provisions of their home country remain applicable.