Data protection
Privacy policy
This policy describes the data Avidia uses, its purposes, the service providers involved and how to exercise your rights.
Last updated:
1. Data controller
Avidia Sàrl [to be confirmed], [address], Switzerland, is responsible for processing data collected through avidia.ch. For any questions about your data: privacy@avidia.ch.
2. Data we collect
- Account : email address, name, phone number (optional) and Google identifier if you choose that sign-in method.
- Listings : information about the listed business or premises, including figures, photos and approximate location.
- Information pack requests : message, phone number, acceptance of the confidentiality undertaking and the listing concerned.
- Valuation : type of business, location, revenue figures, rent and lease, and contact details.
- Favourites and alerts : saved listings and search criteria.
- Technical data : IP address for abuse prevention, server logs, and aggregated, anonymous audience statistics.
3. Purposes and legal bases
We process your data to:
- provide the service, including accounts, publication, introductions and alerts — performance of the contract;
- respond to your valuation and information pack requests — performance of the contract and legitimate interest;
- ensure the platform’s security and prevent abuse — legitimate interest;
- measure audience activity anonymously — consent through the banner;
- comply with our legal obligations, including accounting and requests from authorities.
We never sell your data or carry out profiling for advertising purposes.
Newsletters are optional. Your email address, chosen category (buyer, seller or general user), language and consent determine which guides you receive. Creating an account or accepting the terms does not subscribe you to the newsletter.
You can change your preferences in your profile or unsubscribe free of charge from any email, without logging in. Avidia records the date and version of your consent, preference changes and delivery statuses to respect your choices and prevent duplicate messages. These newsletters contain no email-open tracking pixels.
Delivery is handled by Resend. Preferences and consent history remain linked to your account and are deleted with your profile, subject to applicable legal obligations. Campaigns retain their editorial content without including your email address in that content.
5. Processors and transfers
| Provider | Role | Location |
|---|---|---|
| Supabase Inc. | Database, authentication and photo storage | European Union (Frankfurt) |
| [Hébergeur VPS] | Application hosting | [Suisse / UE] |
| Resend Inc. | Service emails and newsletters sent with consent | United States (standard contractual clauses) |
| Plausible Insights OÜ | Anonymous audience measurement (if enabled) | European Union |
| Google LLC | “Continue with Google” sign-in (if used) | United States (Swiss-U.S. Data Privacy Framework) |
Any transfer outside Switzerland is based on an adequacy decision by the Federal Council or appropriate safeguards within the meaning of Article 16 FADP.
6. Retention periods
- Accounts and listings: for as long as the account is active, then for 12 months after deletion.
- Information pack requests and valuation enquiries: 36 months after the last contact.
- Technical logs: 90 days.
- Accounting records: 10 years (Article 958f CO).
7. Your rights
Under Articles 25 et seq. FADP, you have the right to access, rectify, erase, receive or transfer your data, and the right to object to processing. You may withdraw your consent at any time.
To exercise these rights: privacy@avidia.ch. We respond within 30 days. You may also contact the Federal Data Protection and Information Commissioner (FDPIC).
Avidia only uses strictly necessary cookies for the authentication session (Supabase) and language preference. There are no advertising or third-party tracking cookies.
If Plausible audience measurement is enabled, it works without cookies; the choice you make in the banner is stored locally in your browser. The installable application (PWA) keeps a technical cache of visited pages on your device.
9. Security
TLS encryption, row-level security (RLS) in the database, rate limiting on public forms and approximate listing locations; the exact address is only disclosed after acceptance of a confidentiality undertaking.
10. Changes
This policy may be updated; the date at the top of the page is authoritative. Users with an account will be notified by email of any substantial change.