Translation. In case of any discrepancy, the French version prevails. This translation will be reviewed by a native English speaker before publication.
This policy explains what personal data NIVOZA processes, why, with whom and for how long, and what your rights are. It follows the Federal Act on Data Protection (FADP, in force since 1 September 2023) and its ordinance (DPO). It applies to the website www.nivoza.ch and to the NIVOZA mobile apps.
In brief
- Your data is hosted in Switzerland.
- Place search and the map come from swisstopo, a federal office. When a map is shown, your browser connects to it directly and gives it your IP address (see "Third-party services").
- We sell no data, show no advertising and use no audience measurement or tracking tools.
- We share no data with other businesses for advertising, not even with other companies of the same owner.
- We use only technical cookies (sign-in, language, choice of agency).
- A request or application goes to the agency or owner of the listing, and to no one else.
- NIVOZA neither asks for nor keeps any application documents (payslip, debt-collection register extract, ID).
- Only one photo per published listing is public, the main photo, without metadata; all other photos stay private.
- A Radar alert keeps your criteria in your account until you delete it. Agencies never see them, and every alert e-mail can be stopped in one click.
- Retention periods are given in figures in the table below.
- You can download your data and delete your account yourself, from your space.
Controller
The controller is Benjamin Hagenbuch, operator of NIVOZA, Chemin du Bois-Gentil 23, 1018 Lausanne, Switzerland. Once it is entered in the commercial register, Summit & Co. Sàrl, the company he plans to found, will become the controller; we will inform you on this page and by e-mail if you have an account.
For any question about your data: contact@nivoza.ch, subject "Data protection", or by post to the address above.
The data we process
| Who | What data |
|---|---|
| Every visitor | IP address and browser type in the server's technical logs; chosen language; text typed in a place or address field (see "Third-party services"); pages viewed, counted without personal data (see "Page counter") |
| Home seeker with an account | name, e-mail, phone if you give it, language, password (only in irreversibly encrypted form), two-factor authentication settings, favourites, saved searches, requests and messages, sign-in log (date, IP address, device), accepted version of the terms |
| Viewing request, message or application | name, e-mail, phone if you give it, message, proposed times; for an application: household size, income bracket (never an exact amount), desired move-in date, the listing's Radar score; date of your consent and IP address (against abuse) |
| Radar alert (with an account) | alert name, criteria (rent or buy, locality or canton, budget, rooms, area, feature, lifestyle), threshold, frequency, language, pause; for each listing flagged: score, score details, dates, read or not (see "Radar alerts") |
| Agency, owner and their users | company name, UID, address, e-mail, phone, website, logo; for each user: name, e-mail, role, sign-in log; listings, photos, replies to requests; chosen plan, invoices, payments |
| Payments | billing name and address, amount, date, means of payment (card type or TWINT, never the full number), status; card data is entered at Stripe and we do not receive it |
| Support and reports | your message, your e-mail, the listing concerned, our replies; for a report: the reason, the decision taken and its date |
| Outreach to agencies | for the agencies we contact: company name, address, published business e-mail and phone, canton, size, public source, contact status |
The Radar and the True Budget calculate their results without storing them, except in two cases: an application keeps the listing's Radar score, and a Radar alert keeps your criteria and its scores. The Comparator and the favourites of a visitor without an account stay in their browser.
Why we process it
- to run NIVOZA: accounts, search, favourites, tools;
- to pass your requests on to the agency or owner and their replies on to you;
- to tell you when a new listing reaches the threshold of your Radar alert;
- to check listings and accounts before publication, and to handle reports (moderation);
- to protect accounts and the website: sign-in, two-factor authentication, attempt limits, prevention of abuse and scams;
- to bill agencies' paid plans and keep the accounts;
- to answer questions and complaints;
- to introduce NIVOZA to agencies by business e-mail, with the option to refuse at any time;
- to meet our legal obligations (retention of accounting records, replies to authorities).
We process your data because it is necessary for the contract with you, because the law requires it, because you have consented (for example to a newsletter, which we only send with your agreement) or because we have a legitimate interest (security, outreach to businesses). We do not use your data for another purpose without informing you first.
What we do not do
- We neither sell nor rent any data.
- No advertising, no ad network, no social media pixel.
- No audience measurement tool (no Google Analytics or anything similar).
- No sharing of data with other businesses for their own use, not even in coded form (for example a "hashed" e-mail address) and not even with other companies of the same owner.
- No commercial profile and no decision about you taken solely by a machine.
- No training of an artificial intelligence model with your data, your messages or the listing photos.
- No collection of application documents.
The Radar and the sorting of applications
The Radar calculates a score out of 100 that measures how well a listing matches the criteria you give. For an application, the agency sees this score and, with the Pro plan, can sort its applications by it. The score decides nothing: the agency or owner decides, and no automated individual decision within the meaning of art. 21 FADP is taken. The weights of the criteria are explained on the Radar page. The score uses neither your nationality, nor your origin, nor your religion, nor your health.
Radar alerts
A Radar alert tells you when a real listing that has just been published reaches the threshold you chose, from 50 to 100%. It is free. It requires an account with a confirmed e-mail address, and you can create 10 at most.
- What we keep: the alert's name, your criteria, the threshold, the frequency, the language and the pause status; for each listing flagged, its score, the score details and the dates.
- Why: to compare your criteria with new listings, show you the result in "My alerts" and write to you at the frequency you chose (right away, every day or every week).
- Who sees them: agencies and owners see neither your alerts nor your criteria.
- The e-mails: plain text, with no tracking image; we do not know whether you open them. We count clicks through to a listing, as a total per day, without knowing who clicked. Until the sending of these e-mails is switched on, flagged listings appear only in "My alerts".
- How to stop: every e-mail contains a link that stops the alert in one click, without signing in. This link pauses the alert: you receive nothing more for it, but its criteria stay stored and you can resume it. In "My alerts" you can also change it, pause it or delete it.
- How to erase everything: delete the alert or your account. The criteria, the flagged listings and the notifications are then erased. E-mails already sent stay in your mailbox, and a copy stays in our sending system.
Your alerts are part of your data download ("Download my data" button).
Recipients: agencies and owners
When you send a request, we pass it on to the agency or owner of the listing. From receipt, they process your data under their own responsibility, in accordance with the FADP, and only to answer your request. Our terms require them to delete the data of unsuccessful applicants no later than 3 months after the home has been let. For the use they make of it, contact them directly; we will help you if needed.
We pass no data to other third parties, except to the providers and third-party services described below, or if the law or an authority requires it.
Providers and countries
Our providers process data only on our behalf, under a contract that obliges them to do so (art. 9 FADP). This is the complete list. We update it before adding a new provider.
| Provider | Role | Location of the data |
|---|---|---|
| Infomaniak Network SA, Geneva | hosting of the website and database (Jelastic Cloud), photos and backups | Switzerland |
| Infomaniak Network SA, Geneva | sending and receiving NIVOZA e-mails, including alert e-mails | Switzerland |
| Stripe Payments Europe, Ltd., Dublin | card and TWINT payments by agencies; not active today (no payments during the launch) | Ireland (EU); some data may be processed by Stripe, Inc. in the United States |
| Artificial intelligence provider for photos | none today (decision pending) | — |
The European Union offers adequate protection according to the Federal Council (annex 1 DPO). For the United States, we only transfer data to a company certified under the Swiss-U.S. Data Privacy Framework or with recognised standard contractual clauses. App stores (Apple App Store, Google Play) process download data under their own responsibility.
Third-party services: place search, map, sign-in
These services do not work for us: they process data under their own responsibility, under their own rules.
- Place and address search (swisstopo). When you type in a place or address field, our server sends the typed text to the search service of the Federal Office of Topography swisstopo (
api3.geo.admin.ch). swisstopo receives this text and the address of our server, but neither your IP address, nor your name, nor your account. We keep the text for 10 minutes at most in memory, to answer faster, and we do not store it. If the service does not respond, a local list replaces it. - Map (swisstopo). The map on a listing page and the map view of the search also come from swisstopo. Your browser then connects directly to
vectortiles.geo.admin.ch, without going through us: swisstopo receives your IP address, your browser type, the name of our website and the map area shown. On a listing page, this happens as soon as the page opens, without a click. The map sets no cookie. If your browser blocks this service, a drawn plan appears instead. - Where these two services are. swisstopo is a service of the Swiss Confederation, but not a NIVOZA service. According to what it publishes, its geoportal runs on cloud servers in Ireland and Germany, two countries that offer adequate protection (annex 1 DPO). We do not know how long it keeps this data.
- Sign-in with Google or Apple. This sign-in is not open today. If we open it, it will remain a choice, and this page will say so first. You would then go through Google (Google Ireland Limited, Ireland; Google LLC, United States) or Apple (Apple Distribution International Ltd., Ireland; Apple Inc., United States), which process your sign-in under their own responsibility. We would receive the identifier of your account with them, your e-mail address (with Apple, sometimes a relay address) and your name (with Apple, only at the first sign-in). You could unlink this account in "Security", and the link would be erased with your NIVOZA account.
Payments
Paid plans concern only agencies and owners; home seekers pay nothing. Card or TWINT payment takes place at Stripe, which collects and stores the card data. We receive from Stripe the payment status, the amount, the date, the type of means of payment and an identifier. Stripe also processes some data under its own responsibility, in particular to fight fraud and meet its legal obligations; see Stripe's privacy policy. During the launch phase, no payment is collected.
Photos and artificial intelligence
- Listing photos are stored privately and served through temporary links, except the main photo of a published listing (next point). Their metadata (GPS position, device) is removed on upload.
- The main photo is public. So that a listing published by a verified advertiser can be found and shared, its first photo is published at a fixed address on www.nivoza.ch: a reduced copy (at most 1200 pixels wide), in WebP format, without metadata. The file sent by the advertiser, as it is, is never public, and fictional examples have no public photo. Search engines (for example Google Images), artificial intelligence services and share previews (WhatsApp, social networks) can read and show this photo, under their own responsibility. We ask the robots that train artificial intelligence not to take it (the website's robots.txt file); a robot that does not respect this rule is beyond our control. Before publication, moderation checks that it shows no recognisable person, no readable number plate, no name on a letterbox or doorbell, and no document.
- After removal of the listing, its refusal or the blocking of the advertiser, the address no longer shows the photo. Copies in temporary memory (cache) may remain for up to one hour, and search engines or sharing services may keep a copy for some time, under their own rules; we cannot delete it on their side. If the main photo shows you, your home or your belongings and you do not want this, write to contact@nivoza.ch: we examine your request as a rule within 2 working days; if it is justified, the photo is no longer public, and we show you how to ask search engines to delete it.
- Automatic optimisation (size, light, straightening, colours) takes place on our servers in Switzerland.
- Today, no photo is sent to an artificial intelligence provider. If we choose one outside Switzerland (for example in the United States), this page will say so before the first transfer, with the provider's name, the country and the safeguards. A photo in which a person or a number plate is recognisable will never be sent without blurring.
Mobile app
The app uses the same database as the website, in Switzerland. Your sign-in token is kept in your device's secure storage. The app contains no tracking or advertising tool, does not use the device's advertising identifier and does not read your location.
Cookies and local storage
We use only technical cookies: the sign-in cookie, the language cookie and, in the Agency space, the cookie for the choice of agency. The Comparator and favourites without an account are kept in your browser's local storage. The details and how to refuse them are on the Cookies page.
Page counter
To know which pages are useful, we count the number of views per page and per day. This counter records no IP address, no cookie and no identifier: only the day, the page and a number. Clicks from an alert e-mail are counted in the same way.
Retention periods
| Data | Period |
|---|---|
| Viewing request, message, application | deleted 12 months after it is closed |
| Radar alert (criteria, threshold, frequency) | until you delete it, or with your account; a paused alert stays stored |
| Listings flagged by an alert, and notifications | 90 days, then erased at the next publication of a listing or the next preparation of a digest; sooner if the alert, the account or the listing is deleted |
| Text typed in a place or address field | 10 minutes at most, in memory; never stored |
| Account | until it is deleted; an account inactive for 24 months is deleted, after an e-mail warning 60 days before |
| Sign-in log | 12 months |
| Sessions | 30 days on the website, 90 days in the app, or until sign-out |
| Server technical logs | 30 days |
| Support requests | 24 months after closure |
| Reports and moderation decisions | 24 months after the decision |
| Listings and photos | until the listing is removed; a deleted property takes its photos with it; the main photo is no longer public from removal (search engines may keep a copy for some time) |
| Invoices, payments and accounting records | 10 years (art. 958f CO) |
| Outreach to agencies | up to 24 months after the last contact; an agency that declines is kept only on an opt-out list, so we never write to it again |
| Backups | 30 days, then deleted |
There are only two exceptions: we keep longer what is needed for an ongoing dispute or a security investigation, until it ends; and we may keep overall figures (for example the number of listings per canton) that no longer allow anyone to be identified.
Security
- Hosting in Switzerland, encrypted connection (HTTPS) everywhere.
- Passwords irreversibly encrypted (Argon2), attempt limits and progressive lockout.
- Two-factor authentication offered to all, mandatory for paying agencies and for anyone who administers NIVOZA.
- Access limited to the people who need it for their task, log of administration actions.
- Separation of each agency's data, verified by tests; separation of data by purpose (for example, outreach has no access to seekers' requests).
- Private photos, served through temporary links, except the public main photo of a published listing, without metadata; no keys and no passwords in the code.
- Database backup before every website update. The nightly backup and the monthly restore test are planned, but not yet in place.
In case of a data security breach that poses a high risk to you, we report it to the Federal Data Protection and Information Commissioner (FDPIC) and, if necessary, to you (art. 24 FADP).
Minors
NIVOZA is aimed at adults. An account requires being 18 or the consent of a legal representative. If we learn that a minor has opened an account without this consent, we close the account and delete their data.
Your rights
- Access: know what data we hold about you (art. 25 FADP).
- Portability: receive your data in a common format (art. 28 FADP); from your space, button "Download my data".
- Rectification: have inaccurate data corrected.
- Erasure and objection: have your data erased or object to processing (art. 32 FADP); from your space, button "Delete my account". We keep only what the law obliges us to keep.
- Withdrawal of consent at any time, for the future.
Write to contact@nivoza.ch. We reply free of charge, within 30 days (art. 18 DPO), and may ask you to prove your identity. You can also contact the FDPIC (www.edoeb.admin.ch).
People in the European Union
NIVOZA is aimed at the Swiss market. If the EU General Data Protection Regulation (GDPR) applies to you, you also have the rights it provides, in particular the right to lodge a complaint with the authority of your country. The legal bases are then the performance of the contract, a legal obligation, a legitimate interest or your consent, as stated above.
Changes
We adapt this policy when our processing changes. The version in force and its date are always on this page. A significant change is announced by e-mail to account holders at least 30 days before it takes effect. This policy exists in French, German, Italian and English; in case of any discrepancy, the French version prevails.