Privacy Policy

Last updated: 3 July 2026

Draft — pending legal review

This text is a draft and must be reviewed by a qualified lawyer before go-live. Placeholders in [[brackets]] must be completed.

This privacy policy explains how personal data is processed when you use immobilien-expat.ch(the "Website"), including our free mortgage-affordability and Lex Koller eligibility calculator (the "Calculator"). It is written to address both the Swiss Federal Act on Data Protection (revised FADP / revDSG, "nDSG") and, where applicable, the EU General Data Protection Regulation ("GDPR"), because our audience includes international expats.

1. Controller

The controller responsible for data processing on this Website is:

digital opua GmbH
Registered address: Rossblattenstrasse 4, 6318 Walchwil, Switzerland
UID: CHE-435.289.702
Contact for data protection matters: welcome@digital-nalu.ch

⚑ Note for legal review: assess whether an EU/Swiss representative under Art. 27 GDPR / Art. 14 nDSG must be appointed and named here.

2. What data we process and why

a) Calculator inputs (anonymous use). When you use the Calculator, you enter: your residency permit type, purchase purpose, canton, gross annual income, available equity, and optionally a target property price. These inputs are processed to produce an indicative, non-binding estimate. You can use the Calculator without providing your name or any contact details.

b) Contact and lead data (only if you request advisor contact). Only if you actively choose "have an advisor contact me" do you provide your name, email address, an optional phone number, and your consent selection(s). This data is processed to contact you and, where you have consented, to connect you with a suitable partner (see Section 7).

c) UTM parameters. If you reach the Website via a campaign link, we may process UTM parameters contained in the URL (e.g. source, medium, campaign) to understand which campaign led to your visit.

d) Server and hosting log data. When you access the Website, our hosting provider automatically processes standard technical log data, which includes your IP address, for the purpose of operating, securing and troubleshooting the Website.

3. Legal basis (nDSG and GDPR)

Under the nDSG, we process personal data in accordance with the principles of lawfulness, good faith, proportionality and purpose limitation. Where we rely on your consent (in particular for contacting you and for sharing your data with partners), that consent is the basis for the processing.

Where the GDPR applies to you (e.g. because you are in the EU/EEA), the legal basis for processing your contact and lead data and for sharing it with partners is your consent (Art. 6(1)(a) GDPR).

⚑ Note for legal review: confirm the legal basis for log data — e.g. Art. 6(1)(f) GDPR legitimate interest under GDPR, and the corresponding justification under nDSG.

4. The Calculator: no automated decision-making with legal effect

The Calculator provides an indicative, non-binding orientation only. It does not make an automated decision that produces legal effects concerning you or similarly significantly affects you within the meaning of Art. 22 GDPR or Art. 21 nDSG. The results are not a lending decision, an eligibility determination, or advice, and any actual assessment depends on the competent authorities, lenders and qualified advisers.

5. Optional contact and consent

Providing contact data is entirely optional and only occurs if you choose to be contacted by an advisor. On the contact form, you can give consent via two separate options:

consent to share your details with a mortgage financing partner; and/or
consent to share your details with a real-estate partner.

These consents are independent — you may give one, both, or neither. If you do not tick a given consent, your data will not be shared with that partner category.

6. Double opt-in

After you submit the contact form, we send a confirmation email to the address you provided. Your data is only used for the purposes described above and only shared with partners after you click the confirmation link in that email (double opt-in). If you do not confirm, we do not act on your request.

⚑ Note for legal review: confirm handling and retention of unconfirmed submissions.

7. Sharing with partners (consent-gated, per type)

We share your contact and lead data with third-party partners only after you have completed the double opt-in and only with the specific partner category or categories you consented to:

a mortgage financing partner (mortgage broker / financing category), if you consented; and/or
a real-estate partner (real-estate category), if you consented.

We describe partners by category here. A current list of partners is available on request or as set out at [[PARTNER LIST]]. Where partners act as independent controllers of your data after receiving it, their own privacy policies apply to their subsequent processing.

⚑ Note for legal review: clarify controller vs. processor relationship with each partner category and reflect it here.

8. Processors and international transfers

We use the following service providers to operate the Website and provide our service. They process personal data on our behalf as processors:

Neon — database hosting (Neon Postgres), hosted in the EU (Frankfurt, aws-eu-central-1).
Vercel — website hosting, region fra1 (EU).
Resend — sending transactional email (e.g. the double opt-in confirmation email).

Hosting of our database and website takes place within the EU. Depending on the provider's corporate structure and sub-processors, personal data may be accessed from or transferred to countries outside Switzerland/the EEA. Where such transfers occur, we rely on appropriate safeguards (such as European Commission / Swiss FDPIC standard contractual clauses and, where relevant, adequacy decisions).

⚑ Note for legal review: verify each provider's transfer mechanism and list sub-processors; complete the safeguards actually relied upon.

9. Cookies and analytics

We currently use only essential technical processing required to operate the Website. We do not use tracking or advertising cookies, and we do not use web analytics services.

⚑ Note for legal review: confirm that only strictly necessary cookies/technologies are set and adjust this section if this changes.

10. Retention

We keep personal data only for as long as necessary for the purposes described in this policy, or until you withdraw your consent, whichever is earlier, unless a longer retention period is required or permitted by law. Specific retention periods: [[RETENTION PERIOD]].

11. Your rights

Subject to the conditions and limitations of applicable law, you have the right to:

information / access to the personal data we process about you;
rectification of inaccurate data;
erasure of your data;
restriction of processing;
objection to processing;
data portability; and
withdrawal of consent at any time, with effect for the future. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

To exercise these rights, please contact us at welcome@digital-nalu.ch. We may need to verify your identity before responding.

12. Supervisory authorities

If you believe that the processing of your personal data infringes applicable law, you have the right to lodge a complaint with a competent supervisory authority:

in Switzerland, the Federal Data Protection and Information Commissioner (FDPIC / EDÖB); and
if you are in the EU/EEA, your local data protection authority.

13. Contact

For any questions about this privacy policy or about how we process your personal data, please contact:

digital opua GmbH
Rossblattenstrasse 4, 6318 Walchwil, Switzerland
welcome@digital-nalu.ch

14. Changes to this policy

We may update this privacy policy from time to time to reflect changes to our service or to legal requirements. The current version published on this Website applies. Please refer to the "Last updated" date above.