Privacy Policy

The German version is legally binding. This translation is provided for easier understanding.

Version 1 · published on 11.10.2026

Version of 12 October 2026

This policy shows which personal data we process on heimatli.ch, for what purpose, who sees it and how long we keep it. It is based on the Swiss Federal Act on Data Protection (FADP). Where the EU General Data Protection Regulation (GDPR) also applies in a particular case, for example to people in Liechtenstein, we comply with it as well.

1. Controller and contact

The controller is Puya Purhemmati, Technikumstrasse 31, 9470 Buchs SG, Switzerland, email: [email protected]. HeimatliCH is currently run by an individual.

Please also send all questions and requests about data protection to this address.

2. Which data we process

Account and sign-in

• First and last name, email address, password (we only store an irreversible hash, never the password itself), chosen account type (buyer or seller), language of the site, time of registration and of the last sign-in.
• The mobile number you give us for confirmation. During the pilot phase we confirm it personally by calling you. We do not send text messages and do not use an SMS provider. If we later introduce confirmation by SMS code, we will adapt this policy beforehand and inform you.
• Your consent to the terms and to the privacy policy, with version, time and a pseudonymised identifier of your IP address (see below).
• Whether you agreed to receive news by email.

Sellers, in addition

• Shop name, description, postcode and town, result and note of our review.
• Payment details (account holder, IBAN, TWINT number). We store them encrypted.
• Listings with texts, prices, quantities and photos. When photos are uploaded, we remove additional data such as the place where the photo was taken (EXIF).
• The note on our review is not public. We neither ask for nor store copies of ID documents.

Orders and messages

• Goods ordered, quantity, price, handover method, shipping costs, for postal delivery the name and delivery address (stored encrypted), a note from the buyer, times and course of the order with the people involved.
• Messages between buyer and seller about an order, reports of problems and of messages, and ratings with stars and comment.
• Notes you send us and our replies.

Technical data and security

• When you open the site, the web server processes your IP address, date, time, the page requested and device details so that the site can be delivered. The host (section 4) keeps technical access logs according to its own rules.
• In our security log we record important events: registration, sign-ins, password change, order steps, reviews by us, reports. We store the IP address there, and for limiting failed attempts, only as an irreversible identifier (hash) generated with a secret key. We cannot work out an IP address from it, but we can tell whether many attempts come from the same address.
• A session cookie (see section 7).
• For administration: second factor for administrators (the secrets are stored encrypted).

We do not ask for copies of ID documents or credit data. We do not process particularly sensitive personal data unless you write it into a text yourself. Please do not do so.

3. What we use the data for

We process personal data only lawfully, in good faith and proportionately, only for purposes that are recognisable to you, and we keep it accurate and secure (Art. 6 and 8 FADP). Where the GDPR also applies, we name the legal basis alongside the purposes.

• Providing the account and the platform, sign-in and confirmation of email and mobile number (contract; GDPR Art. 6(1)(b)).
• Reviewing and approving sellers (contract and legitimate interest in a trustworthy marketplace).
• Handling orders: showing the other party the contact details and, for postal delivery, the delivery address, sending notifications by email, examining disputes (contract).
• Preventing fraud, phishing and abuse, limiting failed attempts, ensuring the security of the platform, asserting and defending legal claims (legitimate interests; GDPR Art. 6(1)(f)).
• Meeting legal obligations, for example providing information to authorities (GDPR Art. 6(1)(c)).
• News about the platform by email, if you agreed when registering (consent; GDPR Art. 6(1)(a)). You can withdraw consent at any time by writing to us.

We do not make automated individual decisions with legal effect for you. The platform automatically checks messages and texts for links, contact details and similar content. The only consequence is that such a text is not sent. You can change it and send it again. We currently do not use artificial intelligence. If we did so in future, we would inform you beforehand and adapt this policy.

Gift advisor, seller assistant, photo studio and help

• The gift advisor uses your details about the person receiving the gift (for example name or relationship, interests, budget) only if you consent beforehand, and only to work out suitable suggestions from the listings on HeimatliCH. We do not store these details and do not build a profile of the recipient. Please do not enter sensitive details (for example about health or religion).
• The seller assistant creates a draft text from your own details and shows prices of comparable listings on HeimatliCH (lowest, average and highest price). You always set the price yourself.
• The photo studio processes an uploaded photo with ordinary image editing (cropping, brightening, sharpening) and returns the result to you. The photo is not stored in the process; we only store it when you upload it for a listing.
• The help on the site answers questions using fixed rules on our server. The entries are not stored.
• These functions work without artificial intelligence and without external services.

We do not sell your data. We do not use it for third-party advertising.

4. Who receives your data

• The other party to an order. After the seller confirms, buyer and seller see the other’s name, telephone number and email address; for postal delivery the seller sees the delivery address and the buyer sees the seller’s payment details. Only the other party sees your messages about an order, and the team if a problem is reported.
• The shop name, postcode, town and listings of an approved seller are publicly visible.
• Hosting: Infomaniak Network SA, Geneva, Switzerland. The database, the photos and the sending of emails are located there. Infomaniak processes the data on our behalf and may not use it for its own purposes.
• Sending SMS: during the pilot phase we do not use an SMS provider. If we introduce one later, we will name it here with its country of establishment before it receives any data.
• Authorities, courts or other bodies, where we are legally obliged to or where it is necessary to assert or defend legal claims.
• Disclosure abroad: we do not pass personal data to service providers abroad. If a buyer or seller is based in the Principality of Liechtenstein, the other party sends data there or receives it from there. According to the Federal Council’s assessment, Liechtenstein ensures adequate data protection (Art. 16(1) FADP). If we use providers outside Switzerland in future, we will name the country and the safeguards here before they receive any data (Art. 19 FADP).
• We do not pass data to advertising networks, analytics services or social networks. No third-party content is loaded on our pages (no fonts, no maps, no tracking).

5. How long we keep data

• Account data: until you have the account closed. We then remove name, email address, mobile number, payment details, photos and listings and block the account.
• Order data (goods, quantity, price, status, times) and proof of your consents: up to ten years after completion, so that we can clarify disputes and defend legal claims. After your account is closed, this data appears without your name.
• Delivery address and note of an order and the messages about it: 24 months after completion or cancellation. If a problem was reported, we keep the messages concerned as long as the order data.
• Security log: 24 months.
• Confirmation links and codes: 30 days after expiry. Counters for failed attempts: a few days.
• Technical access logs at the host: according to its rules.
• If there are statutory retention obligations, we keep data for as long as the law requires.

6. Your rights

Under the FADP and, where applicable, the GDPR, you have the right to

• access to your personal data stored by us,
• correction of incorrect data,
• erasure or restriction of processing,
• receive or transfer your data in a common format,
• object to processing and withdraw consent.

Write to [email protected] for this. Access is free of charge (Art. 25 FADP). To protect your data we verify your identity, for example by replying to the email address stored with us. We usually respond within 30 days. You can have your account closed this way as soon as no order is open any more.

Restrictions are possible where we have to keep data for legal reasons or where rights of third parties are affected.

You can also complain to the supervisory authority: in Switzerland to the Federal Data Protection and Information Commissioner (FDPIC), in Liechtenstein to the Data Protection Authority of the Principality of Liechtenstein (Datenschutzstelle).

7. Cookies

We use a single cookie that is necessary for operation: the session cookie. It keeps you signed in and protects forms against forgery. It contains no personal details but a random number, and is deleted when you close the browser. A session ends after 12 hours at the latest. There are no advertising or analytics cookies. So you do not have to confirm a cookie banner. We only send you messages related to your account and your orders, and news only with your consent (Art. 3(1)(o) UCA). You can unsubscribe from each such email.

8. Security

We protect your data with technical and organisational measures. These include encrypted transmission (HTTPS), passwords only as a hash, encrypted storage of payment details, delivery addresses and second-factor secrets, restricted access rights, the second-factor requirement for administrators and a security log. There is no complete security on the internet. Choose a long password used only here.

In the event of a data security breach that is likely to result in a high risk to your personality or fundamental rights, we notify the FDPIC and inform you if this is necessary for your protection (Art. 24 FADP).

9. Children

The platform is intended only for people aged 18 or over. We do not knowingly collect data from minors.

10. Changes

We may change this policy, for example when we use a new provider or extend the platform. The version currently in force is published on heimatli.ch. In the case of material changes we inform you and ask for your confirmation at your next sign-in.

The German version is authoritative. Translations are provided for better understanding.