1. Data Controller
Valtura Advisory OÜ
Registration No. 17367851, Tartu District Court Registry
Ahtri tn 12, Harju County, 15551 Tallinn, Estonia
Managing Director: Wolfgang Staufer
Email: info@smartlandlord.ch
Contact Privacy Policy: datenschutz@smartlandlord.ch
2. Legal Basis for Data Processing
The processing of personal data is carried out in accordance with the Swiss Data Protection Act (DSG, revised version effective September 2023). Where users from the EU/EEA are concerned, we also rely on the EU General Data Protection Regulation (GDPR). Depending on the purpose of the data processing, we rely on the following legal bases:
- Consent of the data subject (Art. 6(1)(a) GDPR / Art. 31 DSG)
- Processing for the purpose of performing a contract (Art. 6(1)(b) of the GDPR)
- Processing to comply with legal obligations (Art. 6(1)(c) of the GDPR)
- Processing to protect legitimate interests (Art. 6(1)(f) GDPR / Art. 31 DSG)
3. Collection and Storage of Personal Data
3.1 When visiting our website
- IP address of the accessing computer
- Date and time of access
- Name and URL of the retrieved file
- Website from which the access is made (referrer URL)
- Browser used and, if applicable, the operating system
Mandatory provision: This data is collected automatically and is technically necessary to display the website. Without this data, the website cannot be loaded.
3.2 During registration and use
- Name and email address
- Password you chose (stored in encrypted form)
- Platform usage data
- Uploaded documents and entered property information
- Communicating with our support team
Mandatory Information: You must provide your name, email address, and password to register. Without this information, you will not be able to use our service. Providing additional property information is optional and is used to access the platform’s features.
4. Use of Third-Party Services
Announcement in the United States
For services that transfer data to the United States, we rely on: - the EU-US Data Privacy Framework (for EU/EEA users) - the Swiss-US Data Privacy Framework (for Swiss users, recognized by the Swiss Federal Council since September 2024) - Standard contractual clauses pursuant to Art. 16(2)(d) DSG and Art. 46 GDPR The certification of the respective providers under the Swiss-US Data Privacy Framework can be verified at https://www.dataprivacyframework.gov.
4.1 Payment Service Providers
Stripe (Payments)
- Purpose: Processing payments Data processed: Payment details, email address, billing address Legal basis: Art. 6(1)(b) of the GDPR (performance of a contract)
- Provider: Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Dublin, Ireland
- Data Transfer to the U.S.: Stripe is certified under the EU-U.S. Data Privacy Framework
- Privacy Policy: https://stripe.com/de/privacy
- Data Processing: We have a data processing agreement with Stripe in accordance with Article 28 of the GDPR
4.2 Hosting Providers
Strato (Web Hosting)
- Purpose: Website and database hosting
- Location: Germany
- Data processed: All website data
- Legal basis: Article 6(1)(f) of the GDPR (legitimate interests)
- Legitimate interest: Our legitimate interest lies in the secure, reliable, and professional operation of our website.
- Data Processing: We have a data processing agreement with Strato in accordance with Article 28 of the GDPR.
Microsoft Azure (Database)
- Purpose: Database hosting
- Location: West Central Germany Region (Frankfurt, Germany)
- Data processed: user data, real estate data
- Legal basis: Article 6(1)(f) of the GDPR (legitimate interests)
- Legitimate interest: Our legitimate interest lies in maintaining a secure and scalable database infrastructure.
- Data Processing: We have a data processing agreement with Microsoft Azure in accordance with Article 28 of the GDPR.
- Privacy Policy: https://www.microsoft.com/de-de/trust-center/privacy
4.3 Sending Emails
Strato Email Service
- Provider: Strato AG, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany
- Purpose: Sending transactional emails (registration, password reset, notifications)
- Data processed: Email address, name, email content
- Legal basis: Article 6(1)(b) of the GDPR (performance of a contract) or Article 6(1)(f) of the GDPR (legitimate interests)
- Location: Germany
- Data Processing: We have a data processing agreement with Strato in accordance with Article 28 of the GDPR
Twilio (SMS notifications)
- Provider: Twilio Inc., 101 Spear Street, San Francisco, CA 94105, USA
- Purpose: Sending SMS notifications (e.g., two-factor authentication, important messages)
- Data processed: phone number, SMS content, timestamp
- Legal basis: Article 6(1)(b) of the GDPR (performance of a contract) or Article 6(1)(a) of the GDPR (consent for optional notifications)
- Data Transfer to the U.S.: Twilio is certified under the EU-U.S. Data Privacy Framework and uses standard contractual clauses
- Privacy Policy: https://www.twilio.com/legal/data-protection-addendum
- Data Processing: We have a data processing agreement with Twilio in accordance with Article 28 of the GDPR
4.4 Maps and Geodata
Google Maps API
- Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
- Purpose: To display the addresses you enter on a map
- How it works: When you enter an address, only that address is sent to Google Maps to display the map. Your location is not tracked.
- Data processed: Addresses you have entered
- Legal basis: Article 6(1)(f) of the GDPR (legitimate interests in user-friendly presentation)
- Data transfers to the U.S.: Google is certified under the EU-U.S. Data Privacy Framework.
- Privacy Policy: https://policies.google.com/privacy
Overpass API
- Provider: Overpass API (open-source project, operated by FOSSGIS e.V., Germany, among others)
- Purpose: Retrieval of geographic data (points of interest, infrastructure, environmental features) for location analyses and evaluations
- Data processed: Search queries (addresses/coordinates); these queries are processed on the server side by our platform—your browser does not establish a direct connection to the Overpass API
- Legal basis: Article 6(1)(f) of the GDPR (legitimate interests in a well-founded location analysis)
- Location: Servers in the EU
- Privacy Policy: https://wiki.openstreetmap.org/wiki/Privacy_Policy
4.5 Artificial Intelligence (AI Services)
OpenAI API
- Provider: OpenAI, L.L.C., 3180 18th Street, San Francisco, CA 94110, USA
- Purpose: AI-powered features (e.g., text generation, data analysis)
- Data processed: Text and data you enter and consent to have processed
- Legal basis: Article 6(1)(b) of the GDPR (performance of a contract) or Article 6(1)(f) of the GDPR (legitimate interests)
- Data Transfer to the U.S.: OpenAI Uses Standard Contractual Clauses for Data Transfers
- Privacy Policy: https://openai.com/privacy
- Data Processing: A data processing agreement has been entered into with OpenAI in accordance with Article 28 of the GDPR
- Important note: OpenAI processes your data in accordance with its own privacy policy. We recommend that you do not enter any sensitive personal information into AI-powered features.
Perplexity AI
- Provider: Perplexity AI, Inc., USA
- Purpose: AI-powered research and data analysis
- Data processed: Search queries and text entered
- Legal basis: Article 6(1)(f) of the GDPR (legitimate interests)
- Data Transfer to the U.S.: Perplexity AI Uses Standard Contractual Clauses
- Privacy Policy: https://www.perplexity.ai/privacy
4.6 PDF Generation
PDFShift
- Provider: PDFShift, France
- Purpose: Creating PDF documents from web content
- Data processed: Content converted to PDF
- Legal basis: Article 6(1)(b) of the GDPR (performance of a contract)
- Location: EU (France)
- Privacy Policy: https://pdfshift.io/privacy
- Data Processing: A data processing agreement in accordance with Article 28 of the GDPR is in place with PDFShift
4.7 Analysis and Marketing
Google Analytics
- Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
- Purpose: To analyze user behavior in order to improve our website
- Data processed: IP address (anonymized), page views, time spent on the site, device information, browser type, approximate location
- Legal basis: Article 6(1)(a) of the GDPR (consent via cookie banner)
- Cookie duration: Up to 2 years; Google is certified under the EU-US Data Privacy Framework
- Privacy Policy: https://policies.google.com/privacy
- Objection: You can prevent Google Analytics from collecting data by: - Opting out via the cookie banner -
- Browser add-on: https://tools.google.com/dlpage/gaoptout
- Data Processing: We have a data processing agreement with Google in accordance with Article 28 of the GDPR
Google Tag Manager
- Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
- Purpose: Management of website tags (technical implementation of analytics and marketing tools)
- Data processed: IP address, browser information
- Legal basis: Article 6(1)(f) of the GDPR (legitimate interests in efficient tag management)
- Note: The Tag Manager itself does not collect any personal data, but it enables the loading of other services (such as Google Analytics), which are listed separately
- Privacy Policy: https://policies.google.com/privacy
LinkedIn Insight Tag
- Provider: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland
- Purpose: Conversion tracking, remarketing, and audience analysis for LinkedIn advertising
- Data processed: IP address, browser information, page views, LinkedIn profile ID (if logged in)
- Legal basis: Article 6(1)(a) of the GDPR (consent via cookie banner)
- Cookie duration: Up to 180 days
- Data Transfer to the U.S.: LinkedIn Uses Standard Contractual Clauses
- Privacy Policy: https://www.linkedin.com/legal/privacy-policy
- Objection: Opt out via the cookie banner or in your LinkedIn settings under "Privacy"
4.8 Cloudflare (Security & CDN)
Cloudflare
- Provider: Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA
- Purpose: - Content Delivery Network (CDN) for faster loading times - DDoS protection and web application firewall - Performance monitoring (Cloudflare Insights)
- Data processed: IP address, browser information, requested URLs, access times
- Legal basis: Article 6(1)(f) of the GDPR (legitimate interests in security and performance)
- Data Transfer to the U.S.: Cloudflare is certified under the EU-U.S. Data Privacy Framework
- Privacy Policy: https://www.cloudflare.com/cloudflare-customer-dpa/
- Data Processing: We have a data processing agreement with Cloudflare in accordance with Article 28 of the GDPR
- Retention period: Log data is deleted after 24 hours
4.9 Content Delivery Networks (CDNs)
Google Fonts
- Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
- Purpose: Provision of web fonts
- Data processed: IP address, browser information
- Legal basis: Article 6(1)(f) of the GDPR (legitimate interests in consistent presentation)
- Data transfers to the U.S.: Google is certified under the EU-U.S. Data Privacy Framework
- Privacy Policy: https://policies.google.com/privacy
External CDNs (cdnjs.cloudflare.com, cdn.jsdelivr.net, unpkg.com)
- Purpose: Rapid deployment of JavaScript libraries and frameworks
- Data processed: IP address when loading resources
- Legal basis: Article 6(1)(f) of the GDPR (legitimate interests in performance and loading times)
- Note: These CDNs deliver only static files (JavaScript, CSS) and do not track users
4.10 Reviews and Trust
Trustpilot
- Provider: Trustpilot A/S, Pilestræde 58, 5th floor, 1112 Copenhagen, Denmark
- Purpose: Displaying customer reviews to build trust
- Data processed: IP address when loading the Trustpilot widget
- Legal basis: Article 6(1)(f) of the GDPR (legitimate interests in transparency and building trust)
- Location: EU (Denmark)
- Privacy Policy: https://legal.trustpilot.com/end-user-privacy-terms
- Note: If you submit a review yourself, Trustpilot’s separate privacy policy applies.
4.11 Own Infrastructure
Azure Blob Storage
- Provider: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland
- Purpose: Storage of uploaded files and documents
- Data processed: Uploaded documents, images, PDF files
- Legal basis: Article 6(1)(b) of the GDPR (performance of a contract)
- Location: EU (Germany)
- Data Processing: We have a data processing agreement with Microsoft in accordance with Article 28 of the GDPR
- Privacy Policy: https://privacy.microsoft.com/de-de/privacystatement
SmartLandlord CDN (cdn.smartlandlord.de)
- Purpose: Delivery of static content (images, CSS, JavaScript)
- Data processed: IP address when loading resources
- Legal basis: Article 6(1)(f) of the GDPR (legitimate interests in performance)
- Location: Germany/EU
- Operator: SmartLandlord LTD (a separate group company; not a provider as defined in Section 1)
- Data Processing: A data processing agreement has been entered into with SmartLandlord LTD in accordance with Article 28 of the GDPR
5. Cookies and Consent Management
5.1 Technically necessary cookies
These cookies are necessary for the website to function:
- Session cookies for your login
- Security cookies (CSRF protection)
- Cookie Consent Storage
Legal basis: Your consent pursuant to Art. 31(1) of the Swiss Data Protection Act (for Swiss users) and Art. 6(1)(a) of the GDPR (for EU/EEA users), provided via the cookie banner.
Storage duration: Session cookies are deleted at the end of the session; persistent cookies are deleted after 30 days
5.2 Analytics and Marketing Cookies
The following services use cookies that require your consent:
- Google Analytics (see 4.8)
- LinkedIn Insight Tag (see 4.8)
Legal basis: Your consent pursuant to Art. 31(1) of the Swiss Data Protection Act (for Swiss users) and Art. 6(1)(a) of the GDPR (for EU/EEA users), provided via the cookie banner.
You can withdraw your consent at any time via our cookie settings or delete/block cookies in your browser.
5.3 Cookie Management
When you visit our website for the first time, a cookie banner will appear, allowing you to set your preferences. You can change your settings at any time via:
- Cookie settings in the footer of our website
- Browser settings (varies by browser)
Note: Blocking certain cookies may affect the functionality of the website.
Technical security measures
- SSL encryption: All data transmissions are encrypted
- Password Security: All passwords are stored in hashed form
- Access Control: Strict Authorization Policies
- Regular updates: All systems are kept up to date
6. Retention period
- User data: Stored until your account is deleted, and thereafter for
- will be completely deleted after 30 days.
- Payment information: We do not store this information; it is stored only by Stripe.
- Log files: Are automatically deleted after 30 days.
- Support communications: Retained for 2 years after completion.
- Contract-related data: To the extent required by commercial or tax law
- Due to legal retention requirements, we store data for up to 10 years
- (Art. 958 et seq. CO – Swiss Code of Obligations).
7. Your rights as a data subject
- Right of access (Art. 25 DSG / Art. 15 GDPR)
- Right to rectification (Art. 32 DSG / Art. 16 GDPR)
- Right to erasure (Art. 32 DSG / Art. 17 GDPR)
- Right to restriction of processing (Art. 18 GDPR)
- Right to data portability (Art. 20 GDPR)
- Right to object (Art. 21 GDPR)
- Right to withdraw consent (Art. 7(3) GDPR / Art. 31 DSG)
Withdrawal of consent: If the processing is based on your consent
(e.g., Google Analytics, LinkedIn Insight Tag), you can do so at any time
revoke, without affecting the validity of the actions taken up to the time of revocation
editing is involved.
8. Right to file a complaint with the supervisory authority
Right to file a complaint
You have the right to file a complaint with the Federal Data Protection and Information Commissioner (FDPIC) if you believe that the processing of your personal data violates the Swiss Data Protection Act (DSG) or the GDPR.
Federal Data Protection and Information Commissioner (FDPIC)
Competent supervisory authority
1 Feldeggweg, 3003 Bern
Important Notice
Automated individual decision-making (Art. 21 DSG / Art. 22 GDPR)
No individual decision with legal effect is made solely by automated means. The AI-powered analyses, assessments, and recommendations provided by our platform (e.g., ImmoCheck) are for informational purposes only and do not replace the user’s own independent decision or professional advice.