Privacy Policy

The controller is the legal entity identified in the operator details above. This policy applies to the website, customer and company accounts, job intake, verification, credits, messaging, complaints and push notifications.

Swiss data protection law applies primarily. Where the EU General Data Protection Regulation applies to a specific processing activity, its requirements are also taken into account.

Depending on how the service is used, we process in particular:

Data is processed to operate accounts, publish jobs, notify suitable companies, unlock contact data, manage payments and credits, verify companies, deliver messages, prevent misuse and comply with legal obligations.

Where required, processing is based on contract performance, pre-contractual measures, consent, legal obligations or legitimate interests in a secure and functional marketplace.

Public job views are anonymised where intended. Direct contact details and full addresses are not displayed in the public feed.

After a free or paid unlock, no more than five verified companies may access the released job data and media. Telephone and platform chat are provided only according to the contact method chosen by the customer; the email address remains hidden from companies. Sumexia may participate as one of those companies.

Data may be shared as necessary with hosting, email, storage, security, analytics, payment and push providers. When payments are enabled, Stripe processes the offered payment methods, which may include TWINT through Stripe Checkout.

Payment card data should not be stored on Sumexia systems and is processed by the enabled payment provider. Google Places may be used for publicly available business reviews.

Some providers may process data outside Switzerland. Where this occurs, legally required safeguards are used, such as a recognised adequate level of protection or suitable contractual measures.

Data is retained only for as long as needed for its purpose, complaint handling, security evidence or statutory retention duties. Media, company evidence, accounts and transaction records may follow different periods.

Backup data is overwritten or deleted under the applicable backup and deletion policy.

Reasonable technical and organisational measures include access controls, hardened server configuration, encrypted transport, separated secrets, logging and regular backups. No system can guarantee absolute security.

Subject to applicable law, individuals may request access, correction, deletion, restriction, data delivery or object to processing, and may withdraw consent for the future. Statutory retention and third-party rights remain reserved.

Requests must be sent to the privacy contact shown above. Proof of identity may be requested to prevent unauthorised disclosure.

Strictly necessary cookies and local storage may be used for language, login, security and sessions. Non-essential analytics or marketing technologies may only be enabled after any required consent.

Push notifications are sent only after an active device permission and can be disabled at any time in browser or device settings.

This policy may be updated when features, providers or legal requirements change. The current version published on this page applies.