Privacy Policy

If you have any questions or concerns, please feel free to contact us!

Contact us

Last updated: 16 August 2026

1. Controller

GenossenSchaffen GmbH
Bergstrasse 12
8044 Zurich
Email: info@genossenschaffen.ch

2. Purpose and scope

This privacy policy applies to the use of the website www.genossenschaffen.ch, the registration and management of a subscription for apartment notifications, the sending of notifications by email and – if selected – by WhatsApp, the verification of eligibility for the KulturLegi discount, as well as to billing via Chargebee/Stripe.

3. Personal data processed

The following categories of personal data may be processed:

  • Master data: name, email address, and where applicable phone number
  • Subscription data and preferences: chosen subscription, desired number of rooms or filters, notification status
  • Billing and payment data: billing address, subscription status, payment status; payment processing via Chargebee (EU Data Center) with a connected Stripe account
  • Communication data: contents of enquiries to us
  • Usage data/technical data: IP address, date/time of the request, browser, device, pages visited, referral information (e.g. from immomailing)
  • Cookie/tracking data in accordance with the Cookiebot embedded on the site
  • KulturLegi data: issuing office, KulturLegi number and date of birth (only if you use the KulturLegi discount)

4. Purposes of data processing

Processing takes place for the following purposes:

  • Provision and operation of the website
  • Conclusion and fulfilment of the subscription (sending matching apartment listings by email or WhatsApp)
  • Management of the customer account
  • Billing and payment processing
  • Verification of eligibility for the KulturLegi discount and ensuring that each card has only one active discount
  • Ensuring security and stability
  • Compliance with legal obligations

The legal bases are in particular the necessity for the performance of the contract, our legitimate interests in secure operation, and statutory retention obligations.

5. Cookies and Cookiebot

Cookiebot is used on the website. Via the Cookiebot script embedded at the bottom of the page, you can at any time see which cookies are set and give, change or withdraw your consent for non-essential cookies.

The following are used

  • technically necessary cookies,
  • analytics/statistics cookies (e.g. PostHog EU, Google Analytics, where enabled),
  • as well as cookies from embedded third-party providers (e.g. Mapbox, YouTube/Embed.ly)

. The current list is available from Cookiebot.

6. Recipients and processors

We use the following categories of service providers:

  • Amazon Web Services (AWS), EU region (in particular Ireland and Frankfurt): hosting of the application, sending of emails (Amazon SES) as well as sending of WhatsApp notifications via our AWS environment
  • Chargebee (EU Data Center): management of subscriptions and invoices
  • Stripe (connected via Chargebee): processing of card or payment information as our payment service provider. Stripe acts on our behalf; no separate Stripe account is opened for you.
  • Cookiebot: consent management
  • PostHog (EU): usage analytics
  • Google (Analytics/Ads, where enabled)
  • Mapbox: display of apartment maps
  • Embedded media providers (YouTube/Embed.ly)
  • Immomailing referral: storage of a referral context if the visit comes from immomailing
  • Meta Platforms Ireland Ltd. (Ireland) / Meta Platforms, Inc. (USA): server-side conversion measurement (Meta Conversions API) to measure the performance of our advertising. We transmit only a pseudonymised (SHA-256 hashed) email address and the order value; Meta receives no email address in clear text.
  • Sentry (Functional Software, Inc., USA): error and event logging to ensure technical operation and for troubleshooting. Technical data and, in individual cases, personal data (e.g. email address, phone number, IP address) may be processed in error reports; these are deleted automatically after a short time (typically within around 30 days).
  • KulturLegi/Caritas: verification of card validity and eligibility for the discount

These service providers process data only in accordance with our instructions and only insofar as this is necessary for the provision of the respective service.

  • Postmark (ActiveCampaign, LLC): sending of emails (in particular to Microsoft/Outlook recipients). Postmark processes the email addresses and the content of the notifications on our behalf.

7. Disclosure of data abroad

The main storage takes place in the EU (AWS Frankfurt and Ireland, Chargebee EU) and – for the KulturLegi discount – in Switzerland (AWS Zurich). Disclosure to other countries, in particular the USA, takes place in connection with the use of Postmark (email delivery), Stripe (payment processing), Meta (conversion measurement) and Sentry (error logging). In these cases we rely on the Swiss adequacy decision (e.g. Swiss-U.S. Data Privacy Framework) or on standard contractual clauses recognised by Switzerland.

8. Retention period

Personal data is retained only for as long as necessary for the purposes stated above.

  • Account and notification data (in particular personal profile data for the subscription stored in Chargebee) is automatically deleted or anonymised 14 days after the end of the subscription.
  • Billing and accounting records (e.g. invoices, payment receipts) are retained independently of this for up to 10 years in accordance with Swiss law.
  • Logs and technical backups are stored only for as long as necessary for security and traceability.
  • A released KulturLegi card identifier is deleted automatically after approximately 30 days.

9. Communication

We send

  • contract-related emails (notifications about apartment listings, account/payment notices),
  • service-related information (e.g. changes to the service).

10. Security

We take appropriate technical and organisational measures to protect the data (access restrictions, encryption, logging). Complete protection against all risks cannot be guaranteed.

11. Rights of data subjects

Under the Swiss Data Protection Act (DSG), data subjects have in particular the rights to information (Art. 25), rectification, erasure/anonymisation, data portability (Art. 28) and withdrawal of consent given.

12. Data breaches

In the event of a data breach likely to result in a high risk, we report the incident to the FDPIC and – where necessary – to the data subjects (Art. 24 DSG; Art. 15 VDSG).

13. Changes

We may amend this privacy policy if our services or the legal requirements change. The version published on the website at any given time applies.

14. KulturLegi discount

When you use the KulturLegi discount, we ask KulturLegi/Caritas to confirm that you are eligible. To perform this check, we send your card’s issuing office and number together with your date of birth over an encrypted connection. We keep only the result: valid or invalid. We do not retain any other information returned by KulturLegi.

We do not store the card number or your date of birth in plain text. Instead, we use a secret key to create a pseudonymous identifier from the issuing office and card number. The original card number cannot be recovered from this identifier. We store the identifier in AWS in the Zurich region together with the technical references needed to manage the reservation, discount code and associated subscription. This ensures that each card can be linked to only one active discount.

Temporary reservations expire after a short period. We retain the card identifier for as long as the discounted subscription remains active. When the subscription ends, we release the record and delete it automatically after approximately 30 days. Chargebee and Stripe process payment and subscription data as described above.