Data protection
Privacy policy
This policy describes the data Avidia uses, its purposes, the service providers involved and how to exercise your rights.
Last updated:
1. Data controller
Avidia Sàrl [to be confirmed], [address], Switzerland, is responsible for processing data collected through avidia.ch. For any questions about your data: privacy@avidia.ch.
2. Data we collect
- Account : email address, name, phone number (optional) and Google identifier if you choose that sign-in method.
- Listings : information about the listed business or premises, including figures, photos and approximate location.
- Information pack requests : message, phone number, acceptance of the confidentiality undertaking and the listing concerned.
- Valuation : type of business, location, revenue figures, rent and lease, and contact details.
- Favourites and alerts : saved listings and search criteria.
- A private log links your account to key actions, periods of activity and moderation interventions. It supports customer service and security and is accessible only to administrators. Passwords, tokens and form contents are not copied into this log.
- Technical data : security and abuse-prevention information, server logs and audience statistics according to your choice.
- After your consent, every visible opening or reload counts, including on the same day and regardless of your role. We retain the listing, date, time and pseudonymous hashes specific to that page view. Raw browser and profile identifiers, raw IP addresses and raw User-Agent strings are not retained in these measurements. No fingerprinting is used. Historical measurements remain unchanged.
- Abuse prevention temporarily uses an IP-address hash in memory to limit request rates. Technical server logs are handled separately from these measurements and are not described as anonymous.
3. Purposes and legal bases
We process your data to:
- provide the service, including accounts, publication, introductions and alerts: performance of the contract;
- respond to your valuation and information pack requests: performance of the contract and legitimate interest;
- ensure the platform’s security and prevent abuse: legitimate interest;
- measure views pseudonymously and produce listing interest reports: only with your consent to audience measurement;
- comply with our legal obligations, including accounting and requests from authorities.
We never sell your data or carry out profiling for advertising purposes.
Newsletters are optional. Your email address, chosen category (buyer, seller or general user), language and consent determine which guides you receive. Creating an account or accepting the terms does not subscribe you to the newsletter.
You can change your preferences in your profile or unsubscribe free of charge from any email, without logging in. Avidia records the date and version of your consent, preference changes and delivery statuses to respect your choices and prevent duplicate messages. These newsletters contain no email-open tracking pixels.
Delivery is handled by Resend. Preferences and consent history remain linked to your account and are deleted with your profile, subject to applicable legal obligations. Campaigns retain their editorial content without including your email address in that content.
5. Processors and transfers
| Provider | Role | Location |
|---|---|---|
| Supabase Inc. | Database, authentication and photo storage | European Union (Frankfurt) |
| [Hébergeur VPS] | Application hosting | [Suisse / UE] |
| Resend Inc. | Service emails and newsletters sent with consent | United States (standard contractual clauses) |
| Plausible Insights OÜ | Anonymous audience measurement (if enabled) | European Union |
| Google LLC | “Continue with Google” sign-in (if used) | United States (Swiss-U.S. Data Privacy Framework) |
Any transfer outside Switzerland is based on an adequacy decision by the Federal Council or appropriate safeguards within the meaning of Article 16 FADP.
6. Retention periods
- Accounts and listings: for as long as the account is active, then for 12 months after deletion.
- Information pack requests and valuation enquiries: 36 months after the last contact.
- Technical logs: 90 days.
- Detailed view records remain associated with the listing to produce its interest reports and are deleted with the listing when its deletion is permitted. Reports already frozen are retained with the dossier follow-up history and applicable records.
- Accounting records: 10 years (Article 958f CO).
7. Your rights
Under Articles 25 et seq. FADP, you have the right to access, rectify, erase, receive or transfer your data, and the right to object to processing. You may withdraw your consent at any time.
To exercise these rights: privacy@avidia.ch. We respond within 30 days. You may also contact the Federal Data Protection and Information Commissioner (FDPIC).
Necessary cookies support sign-in, security, language and remembering your preferences. They remain active so the website can work.
The avidia_audience_consent cookie stores your choice, its date and the policy version for 180 days. When it expires or the policy version changes significantly, you will be asked to choose again.
After consent, the avidia_visit cookie contains a temporary random browser pseudonym. Its lifetime is renewed for 48 hours on an eligible view. Each visible opening or reload may count, even on the same day. This value is not stored directly in the database.
These two cookies are limited to the Avidia site and are not used for advertising or cross-site tracking. If no choice has been made or consent is refused, no detailed view is recorded, whether you are signed in or not.
You can change or withdraw your consent below or through “Manage cookies” in the footer. Rejecting removes the audience identifier and blocks new detailed measurements; it does not retroactively delete existing statistics or reports.
Avidia applies the same rule to all visitors in Switzerland and the European Union: audience measurement remains off until you give your consent.
No audience measurement preference saved.
If Plausible is configured, it is only loaded after the same audience measurement consent and works without its own cookie. The choice may also be stored in the browser’s local storage. The installable app (PWA) keeps a technical cache of pages viewed on your device.
9. Security
TLS encryption, row-level security (RLS) in the database, rate limiting on public forms and approximate listing locations; the exact address is only disclosed after acceptance of a confidentiality undertaking.
10. Changes
This policy may be updated; the date at the top of the page is authoritative. Users with an account will be notified by email of any substantial change.