Privacy policy

This policy explains what personal data we process when you use expat-services.ch, why, on what legal basis, who else receives it, and what rights you have. It follows the Swiss Federal Act on Data Protection (FADP / nDSG) and, where it applies to you, the EU General Data Protection Regulation (GDPR).

1. Who is responsible

Loaded AG is the controller for the processing described here. For any privacy question or request, write to the address above.

2. Summary

• Using the directory is free for expats and needs no account.
• We collect only what we need to run the directory, send your enquiries and manage provider listings.
• We don't sell personal data and don't use advertising or tracking cookies.
• We don't publish reviews or ratings, so there are no reviewer profiles.
• Our database is hosted in Switzerland (Zurich). Some service providers we use are based in the USA; see section 6.

3. What we process and why

3.1 Visiting the website

When you open a page, our hosting provider processes technical data: IP address, date and time, the page requested, the referring page, browser and device type. We need this to deliver the page, keep the site secure and find errors.

Legal basis: our legitimate interest in a secure, working website (Art. 6(1)(f) GDPR). Server logs are kept only briefly, as set by the hosting provider, and are then deleted.

3.2 Visitor statistics

We plan to use Plausible Analytics to count visits. Plausible doesn't use cookies, doesn't build profiles and doesn't store IP addresses; it only gives us aggregated figures such as page views, referring sites and countries. We also count, per listing, how often it was viewed and contacted, without identifying visitors, so providers can see their statistics.

Legal basis: our legitimate interest in understanding how the site is used (Art. 6(1)(f) GDPR).

3.3 Sending an enquiry to a provider

When you use a listing's enquiry form (or an AI assistant sends an enquiry for you with your consent), we process your name, email address, your message, any other details you choose to give, the listing you contacted, the time, and the channel used (website or agent interface).

• We send your enquiry to the provider's enquiry email address and send you a confirmation.
• We run an automatic spam check. Messages that look suspicious are held and checked by a person before they are forwarded or deleted. This check has no legal or similar effect on you.
• Once the provider has received your enquiry, the provider is responsible for how it handles your data.

Legal basis: your request to contact the provider (Art. 6(1)(b) GDPR) and our legitimate interest in protecting the service against spam (Art. 6(1)(f) GDPR). We keep enquiries for 12 months and then anonymise them.

3.4 Provider accounts and listings

If you create a listing or an account for your business, we process your email address, the login codes we send you, the business details and texts you enter, logos and photos, the enquiry email address, the review history of your listing and a log of changes. We review every listing before it goes live. Public listing data (for example business name, address, phone, categories, languages, description) is shown on the site and through our public agent interface (API) for AI assistants. The enquiry email address is never shown or passed on.

Legal basis: our contract with you (Art. 6(1)(b) GDPR). We keep account data while the account exists. If you delete your listing or account, we delete or anonymise the data, except records we must keep by law (see 3.5).

3.5 Premium subscriptions and payments

Premium listings are paid through Stripe. You enter your card or payment details directly with Stripe; we don't see or store full card numbers. We receive and store your Stripe customer ID, subscription status, billing period, invoices and payment status.

Legal basis: our contract with you (Art. 6(1)(b) GDPR) and our legal duty to keep accounting records (Art. 6(1)(c) GDPR). Swiss law requires us to keep accounting records and invoices for 10 years (Art. 958f Code of Obligations).

3.6 Newsletter

If you sign up for our newsletter, we process your email address and, if you choose them, your city and topics. We use double opt-in: we send you one email with a confirmation link and add you only after you click it (and press the confirm button on our page). Until then we send you nothing else.

To be able to prove your consent, we store:

• the exact consent text you agreed to and its version, and the time of sign-up and confirmation;
• the page you signed up on;
• a one-way hash of the IP address used (not the address itself).

The links in our emails contain random codes; we store only one-way hashes of them. We don't track whether you open the newsletter or which links you click.

Sending: Resend sends the newsletter for us (see section 5). Once you confirm, your email address is added to our subscriber list at Resend; before that it stays only in our own database.

Legal basis: your consent (Art. 6(1)(a) GDPR; in Switzerland also Art. 3(1)(o) of the Unfair Competition Act, which requires consent for advertising emails). You can withdraw it at any time, with effect for the future.

Unsubscribing: every newsletter has an unsubscribe link, and mail programs that support it show a one-click "Unsubscribe" button. You can also reply to any newsletter or write to us.

How long: sign-ups that are not confirmed are deleted after 30 days. After you unsubscribe we delete your city and topics and keep only your email address, the consent record and the date you unsubscribed, on a blocklist, so that we don't send you the newsletter again and can show that earlier emails were sent with your consent.

Sponsored content: a newsletter can contain a paid placement. It is always marked "Sponsored" and names the sponsor. We don't pass your data to sponsors.

3.7 Businesses we list from public information

We don't share unclaimed listings with other directories.

3.8 Claims and removal requests

If you claim a listing or ask for its removal, we process your name, email address, your role in the business and any evidence you send (for example an email from the company domain). We use this only to decide the request and keep it as long as needed to document the decision.

Legal basis: Art. 6(1)(b) GDPR (claims) and Art. 6(1)(c) and (f) GDPR (removal requests).

3.9 Emails to us

If you write to us, we use your message and contact details to answer. We keep correspondence as long as needed for the matter.

3.10 anewera.ch

Loaded AG also runs anewera.ch, a directory that AI assistants can read. With the provider's consent (when claiming a listing or signing up), we can publish the listing there as well. The enquiry email address is passed on only so that anewera can deliver enquiries. Without consent, nothing is shared.

4. Cookies and similar technologies

• Browsing the directory sets no cookies.
• If you log in (providers and administrators), we set cookies that are strictly necessary to keep you logged in.
• Stripe sets its own cookies on its payment pages to prevent fraud.
• We use no advertising, retargeting or social-media tracking.

5. Who receives data

We use the following service providers (processors). They process data only on our behalf and under a data processing agreement.

Other recipients:

• The provider you contact receives your enquiry (section 3.3).
• Stripe is also responsible in its own right for some payment processing (for example fraud prevention).
• Authorities, where we are legally required to disclose data.

6. Data outside Switzerland

Some providers are based in, or can access data from, the USA or other countries. Switzerland and the EU recognise each other's data protection as adequate. For the USA, we rely on the Swiss-U.S. and EU-U.S. Data Privacy Frameworks where the provider is certified, and otherwise on the standard contractual clauses recognised by the Swiss Federal Data Protection and Information Commissioner (FDPIC) and the European Commission. You can ask us for a copy of these safeguards.

7. How long we keep data

8. Your rights

You can ask us, free of charge:

• what data we hold about you and where it came from (access);
• to correct wrong data;
• to delete data, or to restrict how we use it;
• to receive data you gave us in a common electronic format (portability);
• to stop processing based on our legitimate interest (objection), including the listing of your business;
• to withdraw a consent you gave, with effect for the future.

Write to hello@expat-services.ch. We may ask you to confirm your identity. You can also complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC, edoeb.admin.ch) or, if you live in the EU/EEA, to the data protection authority where you live or work.

9. Security

We protect data with encrypted connections, access controls on every database table, two-factor authentication for administrators and a record of administrative changes. Only people who need access to do their work have it.

10. Changes

We update this policy when our services or the law change. The current version is always on this page, with its date. We tell providers with an account about important changes by email.