Version 2.4 — Effective August 1, 2026 · Governed strictly by the Swiss Federal Act on Data Protection (FADP).

This Privacy Policy explains what personal data LuxuryBroker.com collects, why we collect it, how it is processed, and what rights you have regarding your data. It applies alongside our Terms of Service.

1. Data Controller and Contact Information

The data controller responsible for processing your personal data under this policy is:

Alexander Baum, trading as LuxuryBroker.com

c/o RA Matutis, Rheinstrasse 71

CH-7012 Felsberg, Switzerland

• General Enquiries: [email protected]

• Security & Data Protection Enquiries: [email protected]

• Website: www.luxurybroker.com

2. Applicable Legal Frameworks

LuxuryBroker.com is established and operated strictly out of Switzerland. Our data processing activities are primarily governed by the Swiss Federal Act on Data Protection (FADP / nDSG).

Where we make our B2B platform accessible to users located within the European Economic Area (EEA), processing also complies with applicable provisions of the EU General Data Protection Regulation (GDPR).

3. Categories of Individuals Concerned

We process personal data relating to:

• Members & Authorized Representatives: Licensed brokers, dealerships, corporate advisory firms, and the individuals acting on their behalf who maintain an active account.

• Applicants: Individuals and firms submitting documentation for accreditation.

• Visitors: Individuals browsing the public pages of the Platform or submitting asset enquiries.

• Third Parties Named in Materials: Individuals whose names or details appear in listing documentation (e.g., property owners or representatives named in brochures or title records provided by a Member).

4. What We Process, Purposes, and Legal Basis

4.1 Accreditation and Account Administration

• Data Collected: Name, business position, corporate contact details, company register extract, broker licence evidence, identity of authorized representatives, and hashed login credentials.

• Purpose: To verify accreditation eligibility, establish and maintain B2B accounts, and enforce platform standards.

• Legal Basis: Performance of a contract / pre-contractual measures (Art. 31(2)(a) Swiss FADP; Art. 6(1)(b) EU GDPR) and legitimate interest in maintaining a verified member ecosystem.

4.2 Sanctions and Compliance Screening

• Data Collected: Company name, names of corporate directors, and ultimate beneficial owners (UBOs) where applicable, cross-referenced against public sanctions databases.

• Purpose: To verify that published listings do not violate Swiss (SECO) or applicable international trade embargos.

• Legal Basis: Compliance with legal obligations under Swiss sanctions law and legitimate interest in avoiding unlawful trade activity.

4.3 Listing Media and Concierge Materials

• Data Collected: Photographs, video, floor plans, technical specifications, and brochures provided by Members to generate listings.

• Purpose: To engineer, format, publish, and host asset listings on the Platform.

• Direct Publishing & Roles: Members act as controllers for any third-party personal data contained within the raw materials they submit. The Operator processes these materials on behalf of the Member to format and publish the listing directly live. Members retain 24/7 dashboard access to edit, modify, or unpublish listings.

4.4 Asset Inquiries

• Data Collected: Sender name, email address, phone number, message content, and targeted asset reference.

• Purpose: To route buyer enquiries directly to the listing Member.

• Direct Lead Routing: Enquiries are passed directly to the listing Member. The Member becomes an independent controller for the data upon receipt. The Operator does not monetize, sell, or rent enquiry data to third parties.

4.5 System Logging and Account Security

• Data Collected: IP addresses, request metadata, browser types, security event logs, and automated malware scanning logs.

• Purpose: To maintain server infrastructure security, prevent cyber attacks, and block unauthorized platform scraping.

• Legal Basis: Legitimate interest in platform security (Art. 31(1) Swiss FADP; Art. 6(1)(f) EU GDPR).

4.6 Business B2B Outreach

• Data Collected: Business contact details (company name, professional role, business email, business telephone) sourced from public business registers, corporate websites, or professional directories.

• Purpose: Direct business-to-business (B2B) outreach to introduce our infrastructure to qualified luxury brokers and dealers.

• Right to Object: Recipients may object to direct B2B marketing at any time by emailing [email protected]. Upon receipt of an objection, marketing communications cease immediately.

4.7 Analytics and Advertising

• Data Collected: Anonymized page view statistics, interaction events, and referrer metadata.

• Consent Requirement: Non-essential analytics and tracking scripts are deployed strictly on an opt-in basis via our cookie consent banner.

5. Third-Party Service Providers and Processors

We engage trusted service providers to operate our infrastructure. All providers are bound by data processing agreements in compliance with Swiss FADP standards:

Provider	Purpose	Location
Swiss Hosting Provider (Novatrend)	Dedicated application & database hosting	Switzerland
Cloudflare	DNS acceleration, WAF, and DDoS mitigation	USA / Global Edge Network
Stripe	Payment gateway processing	USA / Ireland
Google (Analytics / Search Console)	Anonymized web performance measurement	USA / Ireland

6. International Data Transfers

Primary application data and databases reside on secure servers located physically in Switzerland.

Where network traffic or support infrastructure routes data through global edge services (such as Cloudflare CDN or Stripe payment gateways), international transfers outside Switzerland or the EEA are conducted on the basis of official Standard Contractual Clauses (SCCs) adjusted for Swiss law, or recognized Data Privacy Framework certifications.

7. Data Retention Periods

• Server & Security Logs: 90 days.

• Member Account & Verification Records: Retained for the duration of active Membership, and up to 10 years following account closure pursuant to statutory record-keeping obligations under Art. 958f of the Swiss Code of Obligations (CO).

• Unpublished Listing Media: Deleted within 90 days of account termination.

• General Enquiries: 12 months, unless required longer for legal dispute resolution.

• Marketing Opt-Out Records: Retained indefinitely on a suppression list to honor objection requests.

8. Your Data Protection Rights

Under the Swiss FADP (and EU GDPR where applicable), you have the right to:

• Access: Request confirmation and copies of personal data held about you.

• Rectification: Request correction of inaccurate or incomplete data.

• Erasure: Request deletion of personal data no longer required for statutory or contractual purposes.

• Restriction & Objection: Object to processing based on legitimate interests or request restriction of processing.

• Withdraw Consent: Withdraw consent for optional processing (e.g., analytics cookies) at any time.

To exercise any of these rights, contact our security team at [email protected] or [email protected].

Supervisory Authority:

In Switzerland, the competent supervisory authority is the Federal Data Protection and Information Commissioner (FDPIC / EDÖB) in Bern (https://www.edoeb.admin.ch).

9. Security Safeguards

We enforce rigorous technical and organizational measures to protect personal data:

• All data transmissions are encrypted via modern Transport Layer Security (TLS/SSL).

• Account authentication is protected by mandatory multi-factor authentication (2FA).

• Server environments are continuously monitored by Web Application Firewalls (WAF) and automated malware scanning engines.

10. Automated Decision-Making and AI Use

We do not perform automated decision-making or profiling that produces legal effects concerning individuals.

Use of AI Tools: Text descriptions prepared via our Concierge Service may be formatted with the assistance of generative AI tools. All Concierge listings undergo human review prior to live publication, and Members retain full 24/7 dashboard authority to edit or unpublish content.

11. Changes to This Policy

We update this Privacy Policy when technical or legal requirements change. The current version is always accessible at https://www.luxurybroker.com/post/privacy.

Last Updated: August 1, 2026

Operator: Alexander Baum, Felsberg, Switzerland

Contact: [email protected]