Responsible Party
Responsible for the processing of your personal data in accordance with the Swiss Data Protection Act (DSG) is:
Carvalando
Ersin Kas
Angelgasse 7a
CH-6317 Oberwil b. Zug
E-Mail: datenschutz@carvalando.ch
Purpose of Data Processing
We process your personal data exclusively for the following purposes:
- Provision and operation of the platform carvalando.ch
- Responding to inquiries and contact requests
- Mediation of offers to leasing and car subscription providers
- Improvement of our services (analysis of anonymized usage data)
- Measurement of the performance of our provider partnerships (click tracking)
- Fulfillment of legal obligations
Types of Collected Data
We collect the following categories of personal data:
a) Contact data (when voluntarily provided):
- Name, email address, phone number (when using contact forms/inquiries)
b) Technical data (automatically collected during website visits):
- IP address, browser type, device information, duration of visit, pages accessed
c) Usage data (platform interactions):
- used search filters, viewed offers, favorites, saved searches
d) Anonymized click tracking data: When clicking on "To the provider", a non-traceable hash value of the IP address and browser type is stored. This data is fully anonymized, not linked to personal profiles, and used solely for deduplication and fraud prevention.
e) Newsletter registration: Email address, time of registration and confirmation (double opt-in).
Note: Registration is not mandatory.
Legal Basis for Data Processing
Data processing is carried out in accordance with Art. 6 DSG on the following grounds:
- Legitimate interest (Art. 6 para. 1 lit. f DSG): operation of the platform, ensuring functionality, fraud prevention, anonymized click tracking
- Contract fulfillment (Art. 6 para. 1 lit. b DSG): processing of inquiries/mediations
- Consent (Art. 6 para. 1 lit. a DSG): newsletter registration (double opt-in), optional analysis cookies
- Legal obligation (Art. 6 para. 1 lit. c DSG): accounting, bookkeeping
Retention Period
Personal data will only be stored as long as necessary for the respective purpose:
- Contact inquiries: maximum 12 months after the end of communication
- Lead inquiries (offer requests): maximum 24 months after the last interaction
- Technical log data: 30 days
- Usage data: 12 months (anonymized thereafter)
- Newsletter addresses: until unsubscribed
- Anonymized click data (partner events): 24 months
- Cookie consent records: 3 years (legal proof requirement)
- Legal retention obligations: 10 years (accounting documents)
Data Sharing and Third Parties
Your data will only be shared with third parties in the following cases:
a) Providers (when requesting offers): only the data necessary for the request (name, email, vehicle preferences)
b) Processors (Art. 8a DSG):
- Supabase (EU/USA) — database and authentication. Standard contractual clauses (SCC).
- Vercel Inc. (USA) — hosting. Standard contractual clauses (SCC).
- Resend Inc. (USA) — email dispatch (transactional) (SCC).
- Plausible Analytics (EU) — website statistics (EU provider, no transfer)
c) No sharing for advertising purposes or sale of your data.
Cookies and Tracking
We use session cookies that are necessary for the operation of the platform. These cannot be disabled.
- Analysis cookies (opt-in): With your consent, we use Plausible Analytics – a privacy-friendly analytics tool without personal user profiles, without cross-site tracking, and without data transfer to the USA. Plausible is EU-hosted. You can revoke this consent at any time in the cookie banner.
- Marketing cookies: Currently, no external marketing tools are active.
_ Consent record: Your cookie consent (or rejection) is stored anonymously to fulfill the proof requirement according to DSG/DSGVO.
- You can manage cookies at any time through your browser settings or our cookie banner.
Rights of Affected Persons (Art. 25 et seq. DSG)
You have the following rights:
- Access to stored data
- Correction of incorrect data
- Deletion (unless there are legal retention obligations)
- Restriction of processing
- Data portability (for structured data)
- Objection to processing
Contact: datenschutz@carvalando.ch
Response time: Within 30 days.
Complaint to the FDPIC
You have the right to file a complaint with the Federal Data Protection and Information Commissioner (FDPIC): FDPIC, Feldeggweg 1, 3003 Bern, www.edoeb.admin.ch
International Data Transfer
When using cloud services in the USA, data transfer is carried out in accordance with the standard contractual clauses (SCC) of the EU Commission. The contracts are available upon request.
Changes to this Privacy Policy
We reserve the right to make changes. The current version will be published on the platform. Registered users will be informed of significant changes.
Contact
Data Protection Officer: datenschutz@carvalando.ch
Processing: Within 30 days