Privacy notice

The controller for data processing on this platform is Jubai Gehrig, sole proprietorship (contact).

Swiss data protection law applies, in particular the Federal Act on Data Protection (nFADP, in force since 1 September 2023) and the Data Protection Ordinance (DPO). Where individual offers specifically target people in the EU/EEA, we additionally apply the stricter requirements of the EU General Data Protection Regulation (GDPR).

This notice describes the processing actually performed on this platform. It is no substitute for legal advice – the version published here prevails in each case.

Jubai Gehrig, sole proprietorship, Sagenmattstrasse 11, 6344 Meierskappel, Switzerland

Data requests: info@autonio.ch

We have not appointed a data protection adviser within the meaning of Art. 10 nFADP.

• Account data: name, email address, password (hashed), login data, organization membership.
• Listing data: vehicle details, photos, prices, location (town and postal code, never private coordinates), seller identity.
• Usage data: pages visited, search and filter settings, device and browser details, IP address and server logs needed to run the service.
• Communication data: contact and chat messages, reports, support requests.
• Payment data: orders, subscriptions and invoices. Card data is processed by our payment provider Datatrans; we store no complete card numbers.

• Providing the marketplace: search, listings, accounts and saved items.
• Performing contracts: drafts, subscriptions, invoicing.
• Security and abuse prevention: fraud detection, moderation, enforcing the listing rules and GTC.
• Communication: support replies, security messages, newsletters only with consent.

We collect no particularly sensitive personal data within the meaning of Art. 5 let. c nFADP – please do not send us any.

• Hosting and application: Cloudflare (delivery, security, performance) and PlanetScale (database). We sign processor agreements with processors within the meaning of Art. 9 nFADP.
• Payments: Datatrans (payment processing, fraud prevention).
• Email sending: Migadu (Migadu-Mail GmbH, Switzerland; servers in France/EU) for transactional emails such as registration and password reset.
• Authorities: only where required by law.

No disclosure to third parties for their own advertising purposes.

Cloudflare runs a worldwide edge network (US company): technical connection data may therefore also be processed outside Switzerland and the EU/EEA. PlanetScale (US company) hosts our database in the eu-central-1 (Frankfurt, EU) region. Transfers to states without an adequate level of protection rely on appropriate safeguards within the meaning of Art. 16 para. 2 nFADP, in particular standard contractual clauses under the processor agreements. Migadu processes email data in France, i.e. in a state with an adequate level of protection.

• Business and accounting records: ten years per Art. 958f SCO.
• Accounts, listings and moderation data: while the account exists or retention and evidence duties require; [detailed periods to follow].
• Server logs: [period to be completed, e.g. 90 days].

Where the purpose lapses and no duties stand in the way, we delete or anonymize the data.

You have the right of access (Art. 25 nFADP – generally within 30 days), rectification and erasure (Art. 32 nFADP), release and portability of your data (Art. 28 nFADP) and objection to certain processing. Write to info@autonio.ch.

Complaints may be addressed to the Federal Data Protection and Information Commissioner (FDPIC): edoeb.admin.ch.

We protect personal data with state-of-the-art technical and organizational measures (Art. 8 nFADP): encrypted transmission, access controls and regular review. Absolute security does not exist on the Internet – please report anomalies immediately via contact.

We adapt this notice when our offering or the legal situation changes. Material changes are communicated appropriately.

Note: a detailed cookie and tracking overview (technologies used, purposes, retention, opt-outs) will be added once the final setup is fixed. Technically necessary storage is limited to what operating the service requires.