Privacy notice

1. Controller and contact details

The controller under the Swiss Federal Act on Data Protection (FADP, SR 235.1) is FVT FuturaVision Technology GmbH, Baarerstrasse 75, 6300 Zug (ZG), UID CHE-275.715.986. Operating office: Via ai Prati, 6930 Bedano (TI).

For any data protection matter, write to info@confedera.ch with the subject line "Data protection".

As FVT is domiciled in Switzerland, no representative under Art. 14 FADP is required. No data protection adviser under Art. 10 FADP has been appointed; requests are handled directly by management.

2. Categories of data collected

Identification and contact data: first and last name, e-mail, phone number, language, declared role (seller, buyer, fiduciary, investor).

Account and authentication data: user ID, encrypted credentials, e-mail verification status, settings and notification preferences.

Company and financial data provided by the advertiser: company name, sector, canton and location, revenue, EBITDA, headcount, year of foundation, asking price, descriptions, images and uploaded documents.

Interaction data: messages to sellers, NDA requests, offers and counter-offers, requests to fiduciaries, credit and valuation questionnaires, expressions of interest in shareholdings.

Contract and billing data: subscription plan, payment status, invoicing documents. Full card details are processed solely by the payment provider and never reach our systems.

Electronic signature data: signature evidence, timestamps, one-time password (OTP) verification results and document audit logs.

Technical and log data: IP address, request date and time, browser and device type, pages viewed, application errors.

We do not request sensitive personal data within the meaning of Art. 5(c) FADP; please do not enter such data in free-text fields or uploaded documents.

3. Data required to create an account

Creating an account requires: e-mail address, password (stored only in encrypted form) or sign-in via an external provider, first and last name, and the role in which you use the platform.

If you sign in with a Google account, we receive your e-mail address, name and account identifier from the provider; we do not receive your password.

Providing this data is voluntary but indispensable: without it we cannot technically create an account or grant access to restricted areas (dashboard, favourites, offers, data room).

Company and fiduciary accounts may require further details (company name, UID, address, contact person) needed to perform the contract and to meet statutory invoicing obligations.

4. Data used to publish listings

The listing is created and completed independently by the advertiser. The data used for publication is what is entered in the form: sector, deal type, canton and location, financial data (revenue, EBITDA, margins, debt where declared), headcount, year of foundation, asking price, strengths, descriptive text, images and attachments.

The advertiser chooses the level of detail: listings can be published anonymously, without company name or exact address, keeping identifying details confidential until an NDA is signed.

Confidential documents uploaded to the data room are not public: they are accessible only to users the advertiser expressly authorises, folder by folder.

Before publication we run formal checks (completeness of mandatory fields, plausibility of values, absence of manifestly unlawful content). We do not verify the substantive accuracy of the declared financial data.

5. Which information becomes public

Visible to anyone, even without an account, and indexable by search engines: listing title and description, sector, canton and stated location, revenue and EBITDA figures or ranges, headcount, year of foundation, asking price, images and listing badges.

For fiduciaries and professional partners the following are public: company name, logo, description of services, cantons served, languages, business contact details and indicative fees published by the partner.

Never public: personal e-mail and phone number, exchanged messages, purchase offers, data room documents, credit and valuation questionnaires, payment data.

Published information may be copied, cached by search engines or shared by third parties: removing a listing from the platform does not guarantee immediate deletion of such external copies.

6. Purposes and legal grounds

Service delivery: account management, publishing and managing listings, search and filters, contact between parties, NDAs, offers, data room, electronic signature, credit comparison and company incorporation journeys (performance of the contract).

Service communications: transactional e-mails on registration, publication, new messages, offer and signature status (performance of the contract).

Security and abuse prevention: detection of unusual access, spam and fraudulent listings, protection of systems (overriding legitimate interest under Art. 31 FADP).

Product improvement and aggregated usage statistics (legitimate interest, or consent for non-essential measurement tools).

Legal obligations: accounting, tax and retention duties, responses to competent authorities.

Marketing and newsletter: only with your prior consent, which can be withdrawn at any time via the unsubscribe link or by writing to info@confedera.ch.

We do not carry out automated individual decisions with legal effect under Art. 21 FADP. The valuation estimator and credit pre-matching produce purely indicative results, always subject to human assessment.

7. Recipients and categories of recipients

Other platform users: when you send a message, an NDA request or an offer, the data needed for contact (name, e-mail, content) is transmitted to the receiving advertiser, who becomes an independent controller for further processing.

Fiduciaries and professional partners: they receive your dossier or request only if you select them and send the request.

Banks and financial intermediaries: they receive the financing dossier only at your express request.

Technical providers acting as processors on our instructions (section 8).

Legal, tax and audit advisers bound by professional secrecy, strictly as needed.

Authorities and courts, where required by law or to establish or defend legal claims.

We do not sell, rent or transfer your personal data to third parties for marketing purposes.

8. Technical providers (processors)

We use selected providers bound by a data processing agreement requiring confidentiality, appropriate security measures and a ban on using data for their own purposes. The categories are:

Cloud infrastructure, hosting and content delivery network (CDN), with attack protection and traffic filtering.

Managed database, authentication and file storage for accounts, listing content and uploaded documents.

Transactional e-mail delivery (confirmations, notifications, system alerts).

Payment processing and subscription billing through a specialised payment service provider, which processes card data as an independent controller under its own policy.

Electronic signature and timestamping services for NDAs and contracts.

Error monitoring and aggregated audience measurement, including search engine optimisation tooling.

An up-to-date named list of providers and their processing countries is available on request at info@confedera.ch.

9. Transfers abroad

Data is hosted primarily on infrastructure located in Switzerland or the European Economic Area.

Some technical providers may process data in other countries, including the United States, for example for content delivery, e-mail sending, payments or support.

Transfers take place to countries recognised by the Federal Council as providing adequate protection or, failing that, on the basis of the standard contractual clauses recognised by the FDPIC (Art. 16 and 17 FADP), supplemented where necessary by additional technical and organisational measures such as encryption and data minimisation.

You can request a copy of the safeguards in place at info@confedera.ch.

10. Retention

Account data: for the duration of the relationship and up to 12 months after account closure, subject to longer statutory obligations.

Published listings: until removed by the advertiser or until the publication expires; we then keep an administrative copy for as long as needed to handle potential disputes.

Messages, offers and signed documents: up to 10 years, given Swiss limitation periods and the evidentiary value of electronic signatures.

Accounting and invoicing records: 10 years, in accordance with Art. 958f of the Swiss Code of Obligations.

Technical and security logs: normally 3 to 12 months, longer in the event of a security incident.

Newsletter and marketing data: until consent is withdrawn.

Once these periods expire, data is deleted or irreversibly anonymised.

11. Data security

We apply appropriate technical and organisational measures under Art. 8 FADP and the DPO: encryption in transit (TLS/HTTPS), encryption at rest with infrastructure providers, password storage using hashing algorithms.

Role-based access control with row-level security rules, so each user can access only their own data and data explicitly shared with them.

Access to data room documents requires the advertiser's explicit authorisation, with access logging.

Two-step verification via one-time password (OTP) for signature operations.

Regular backups, event logging, security updates and least-privilege access for staff.

In the event of a data security breach likely to result in a high risk to the personality or fundamental rights of data subjects, we notify the FDPIC and, where necessary, the individuals concerned, in accordance with Art. 24 et seq. FADP.

12. Cookies, analytics and tracking technologies

Strictly necessary cookies and local storage: session and authentication, security and abuse prevention, load balancing, storing the detected or selected language. They require no consent as they are essential to the requested service.

Preference cookies and local storage: search filters, saved favourites, comparisons, questionnaire progress, dismissal of informational notices. They are stored on your device and can be deleted from your browser at any time.

Measurement and statistics: we collect aggregated usage statistics to improve the service. We also use Google Search Console, which relies on Google search data and does not set tracking cookies on the site.

We do not use advertising or profiling cookies and do not sell behavioural data to ad networks. No third-party advertising pixels are used for retargeting.

Pages may embed technical third-party content (for example the secure payment form or web fonts), which may receive your IP address in order to display that content.

You can manage or block cookies in your browser settings and delete those already stored; disabling technical cookies may prevent access to restricted areas. If your browser sends a Global Privacy Control or "Do Not Track" signal, our behaviour is unchanged because we do not run advertising tracking.

Further details are set out in our Cookie policy.

13. Your rights

As a data subject you have the right to: information about and access to data concerning you (Art. 25 FADP); rectification of inaccurate data (Art. 32 FADP); erasure or destruction; objection to processing based on legitimate interest; withdrawal of consent at any time, without affecting the lawfulness of prior processing.

You are also entitled to receive or have your data transmitted in a common electronic format (portability, Art. 28 FADP) and to be told the source of data you did not provide yourself.

Where the GDPR applies to your situation, you may also exercise the corresponding rights, including restriction of processing.

To exercise your rights, write to info@confedera.ch. We normally respond within 30 days; to verify your identity we may request additional information, used solely for that purpose. Access is free of charge, except in the statutory cases of manifestly unfounded or excessive requests.

You can delete your account and listings yourself from the dashboard; certain data is retained for the statutory periods set out in section 10.

14. Contact, complaints and updates

Data protection contact: info@confedera.ch — FVT FuturaVision Technology GmbH, Baarerstrasse 75, 6300 Zug (ZG), UID CHE-275.715.986.

You may contact the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, www.edoeb.admin.ch. If you reside in the European Union you may also contact your national supervisory authority.

This policy may be updated to reflect changes to the service or to the law. The version in force is always published on this page with its last-updated date; for substantial changes we inform registered users by e-mail or via an in-platform notice.

This document describes our processing practices and does not constitute legal advice.