List an Asset

Privacy Policy

Contents

Version 3.0, effective 27 September 2026. Governed by the Swiss Federal Act on Data Protection (FADP) and, where applicable, the EU General Data Protection Regulation (GDPR).

This Privacy Policy explains which personal data LuxuryBroker.com processes, why, for how long, and which rights you have. It applies together with our Terms of Service.

1. Controller and contact

Alexander Baum, trading as LuxuryBroker.com, c/o RA Matutis, Rheinstrasse 71, CH-7012 Felsberg, Switzerland. Email: [email protected]

1.1 EU representative (Art. 27 GDPR)

Kanzlei Matutis, Berliner Strasse 57, D-14467 Potsdam, Germany. Email: [email protected], website: https://dsgvo-vertreter.eu / https://matutis.de

2. Legal framework

LuxuryBroker.com is operated from Switzerland. Processing is governed by the Swiss FADP. Where our services are directed at or used by persons in the European Economic Area, the GDPR also applies.

3. Whose data we process

  • Members and their representatives: brokers, dealerships and advisory firms with an account, and the individuals acting for them.
  • Applicants for accreditation.
  • Visitors and buyers who browse the Platform, save favourites, send an enquiry or use the Off-Market Desk.
  • Third parties named in listing materials provided by Members.

4. What we process and why

4.1 Cookies and local storage

We use no tracking cookies, pixels, fingerprinting or web analytics tools, and therefore show no cookie banner. We only use storage that is necessary for the service:

  • a session cookie to keep you signed in and to protect forms against misuse (deleted when the browser is closed);
  • if you choose "stay signed in", a sign-in cookie for up to 30 days;
  • if you choose "trust this browser", a cookie for 30 days so that no sign-in code is needed on that browser;
  • your chosen display currency, stored locally in your browser only;
  • if you choose to load maps only after a click, a cookie named lb_maps that remembers this choice for one year. An overview of every cookie we use, including those for the location search and referrals, and the map setting are under Privacy settings.
  • security cookies set by Cloudflare to protect the Platform against attacks.

Legal basis: legitimate interest in a functioning and secure service (Art. 31(1) FADP; Art. 6(1)(f) GDPR) and, for sign-in, performance of a contract (Art. 6(1)(b) GDPR).

4.2 Hosting and server logs

All application data, images and fonts are hosted in Switzerland. We do not load fonts or scripts for tracking from third parties. When you access the website, the server records the IP address, date and time, requested URL, referrer, browser, operating system and HTTP status. We use these logs only for operation, diagnostics and defence against attacks, and never for marketing or profiling. Legal basis: legitimate interest (Art. 31(1) FADP; Art. 6(1)(f) GDPR).

4.3 Accounts and accreditation

Name, position, business contact details, evidence of commercial activity (for example a commercial register extract or broker licence), identity of authorised representatives, and your password, which we store only in hashed form. Purpose: verification, account management and platform integrity. Legal basis: contract and pre-contractual measures (Art. 31(2)(a) FADP; Art. 6(1)(b) GDPR) and legitimate interest in a verified member network.

Broker verification. When a company registers as a broker, we ask for the company name, website, link to its entry in the commercial register, location, business phone number, asset classes, and the name and position of the contact person; documents are optional. To verify the company we check that the email address belongs to a business domain, that the website can be reached and whether its domain matches the email address. We review each application before the account can publish listings and inform you of our decision by email. Documents you upload are kept outside the public website and deleted 90 days after our decision; the application details are kept as long as the account exists. Legal basis: performance of the contract and our legitimate interest in admitting only genuine businesses.

4.4 Sign-in security

  • Sign-in code: after the password, a six-digit code is sent to your email address. It is stored only in encrypted form in your session and expires after 10 minutes.
  • Sign-in log: for each sign-in we store the IP address, browser, operating system, time of sign-in and last activity. You can see these entries in your account and sign out any device. When your account is used on a new device, we inform you by email.
  • Trusted browsers: a hashed token, the browser, IP address and last use.

Purpose: protecting your account against misuse. Legal basis: legitimate interest in account security and performance of the contract.

4.5 Sanctions screening

Company name, directors and, where applicable, beneficial owners, compared against official sanctions lists. Purpose: compliance with Swiss (SECO) and international sanctions. Legal basis: legal obligation and legitimate interest.

4.6 Listings, price history and statistics

Photographs, videos, floor plans, specifications and brochures uploaded by Members or sent to us for formatting are published on the Platform. Members are independent controllers for any personal data of third parties contained in them. Price changes of listings are recorded and reductions are shown publicly on the listing. For each listing we count views and enquiries per day. These statistics are aggregated counts only: we do not store IP addresses or build visitor profiles for them, and visits by the listing owner and by search engine bots are not counted.

4.7 Enquiries to Members

When you send an enquiry through a listing or a broker profile, we process your name, email address, phone number (optional), your message, a preferred viewing date (optional), the listing concerned and your IP address. Some Members ask for additional details to prepare an enquiry, such as whether you enquire as a private buyer, family office, company or adviser, your company, phone number, country of residence, budget range, financing, time frame and whether you are prepared to provide proof of funds or sign a confidentiality agreement on request. The form shows which details the Member requires. We never ask for identity documents or bank statements through the Platform; any such verification takes place directly between you and the Member.

  • Delivery: the enquiry is stored in the Member's inbox on the Platform and, depending on the Member's settings, sent to the Member by email through our Swiss mail infrastructure (Novatrend). The Member then becomes an independent controller for all further communication.
  • Spam protection: to keep automated messages out, we check a hidden form field and the time needed to fill in the form, and limit the number of messages per IP address. For this purpose the IP address is stored for 24 hours. If enabled, Cloudflare Turnstile (Cloudflare Inc.) additionally checks whether the request comes from a person. Senders of abusive messages can be blocked by email address, domain or IP address.
  • Transfer abroad: depending on where the Member is located, your enquiry may be transmitted to recipients outside Switzerland or the EEA. This is necessary to carry out the pre-contractual measure you requested (Art. 17(1)(b) FADP; Art. 49(1)(b) GDPR).
  • No selling of data: we do not sell, rent or trade your contact details or enquiries.

Legal basis: pre-contractual measures at your request (Art. 31(2)(a) FADP; Art. 6(1)(b) GDPR) and legitimate interest in protection against abuse (Art. 6(1)(f) GDPR).

Confidential listing documents. Brokers can share documents about a listing (for example a detailed brochure or floor plans) with an individual buyer in a conversation. The buyer opens them only while signed in to their own account. We store which documents were shared, when, and each time a buyer opens them (date and IP address), so that the broker can see whether the documents were viewed. Brokers can revoke access at any time; access ends when the conversation or the listing is deleted. Legal basis: performance of the contract and our legitimate interest in protecting confidential information.

Account security and fraud prevention. To protect members from fraud we assess accounts and listings using data we already process: sign-ins (date, IP address, country, browser and a random device identifier; see "Security cookie" below), the time taken to fill in the sign-up form, the email domain (including publicly available domain registration data and mail server records), phone numbers used by several accounts, failed sign-in attempts, reports and the results of our listing checks. When files are uploaded we read technical information contained in the file (for example a marker that an image was generated by AI or edited with a specific program); the file itself is not changed by this check. Our team may also have listing photos and texts checked by an AI service (Anthropic) to detect copied or misleading content; no contact details are sent. None of this leads to an automatic decision: a member of our team reviews the account and, where needed, asks for corrections. If you set up an authenticator app, we store the secret key in encrypted form and the recovery codes only as a hash. Encrypted copies of our database backups are kept with a storage provider outside our server for up to three months. Legal basis: our legitimate interest in protecting members and the platform from fraud and misuse.

Security cookie. When you sign in, we set a cookie named lb_dev that contains a random identifier and nothing else. It lets us recognise when the same browser is used for several accounts, which is a common sign of fraud networks. It is not used for advertising, analytics or tracking across websites. The cookie expires after 180 days; we store only a one-way hash of it together with the sign-in, and delete it with the sign-in record after 180 days at the latest. You can delete the cookie in your browser at any time (it is set again at your next sign-in), and you can object to this processing by writing to us. Legal basis: our legitimate interest in protecting members and the platform from fraud.

Conversations between members. Signed-in buyers can send messages to verified brokers, and brokers to each other. We store the messages, attachments, the listing concerned and their dates, and the settings of each participant (read, archived, pinned, deleted, blocked members). We inform the recipient by email according to their settings. As the operator of the Platform, we can access conversations, for example to provide support, to handle reports and suspected abuse and to keep the Platform secure; every such access is logged. Members can block other members and report conversations to us. Conversations, including attachments, are deleted 12 months after the last message, or earlier when both participants have deleted them. A participant who has archived a conversation keeps their copy until they delete it or close their account, at the latest 10 years after the last message. Legal basis: performance of the contract and our legitimate interest in a safe platform.

Access to enquiries and reports. As the operator of the Platform, we can also access enquiries sent to Members through the contact form, for example to provide support, to handle reports of spam or fraud and to keep the Platform secure; every such access is logged. Members can report enquiries and conversations to us as spam, a fraud attempt, harassment or for another reason; we store the report, its category and note, and the date, and use them to review the case and to protect other Members.

4.8 Favourites, price alerts and search alerts

If you save a listing as a favourite, we store this in your account. If the price of that listing is reduced, we inform you by email. You can stop these emails by removing the listing from your favourites. Legal basis: performance of the service you requested.

Search alerts. Without an account, you can ask to be informed by email about new listings that match a search (category, location, price range, search term). We store your email address, the search criteria and the dates of sign-up, confirmation and sending. An alert only starts after you confirm it via the link in our first email (double opt-in). We send at most one email per day and only when there are new matching listings. Members see only how many alerts match their listings, never who set them. Every email contains a link to stop the alert or manage all your alerts. Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.

Reports about listings. You can report a listing that seems incorrect, outdated, misleading or unlawful. We store the listing, the reason, your description, your email address if you choose to give it, and a pseudonymised value derived from your IP address to prevent repeated or abusive reports; this value is deleted when the report is closed. For corrections (incorrect information, sold, duplicate) we forward the reason and your description to the listing member, never your name or email address. Reports of suspected fraud or unlawful content are reviewed by us only. If you gave an email address, we inform you of the outcome. Legal basis: our legitimate interest in accurate and lawful listings and our obligations as a hosting service.

Feedback. Signed-in members can send us feedback from their account (what they like, problems, missing features). We store the type, the title, your messages and our replies with their dates, linked to your account, and inform you by email when we reply or when a suggestion is planned or done. Legal basis: our legitimate interest in improving the platform. Feedback is deleted 24 months after the last change once it is closed, or together with your account.

Off-Market requests. Signed-in members can describe what they are looking for (category, countries, budget range, key criteria and a text). Verified brokers whose listings match see the request without your name or contact details and can answer it. You see their answers in your account and decide whom you write to; only then does the broker see your name and the message you send. We store the request, the answers and their dates, linked to your account. Requests end after 90 days unless you extend them and are deleted 12 months after they ended, or together with your account. Legal basis: performance of our service at your request.

Support requests. Signed-in members can send support requests from their account, and we may send members messages through their account, for example about their listings, invoices or membership. We store the subject, the topic, the messages exchanged, any files you attach (PDF or images; images are saved without their metadata) and their dates, linked to your account, and inform you by email when we reply. Legal basis: performance of the contract and our legitimate interest in answering your questions.

4.9 Off-Market Desk

Name, contact details and the parameters of the asset sought or offered, as provided by you by email or WhatsApp. Your request is forwarded to Members active in the relevant category and market, with the parameters only unless you ask us to disclose your identity. Recipients may be located outside Switzerland or the EEA where the asset or Member is based there (Art. 17(1)(b) FADP; Art. 49(1)(b) GDPR). Legal basis: pre-contractual measures at your request.

4.10 WhatsApp

If you contact us by WhatsApp Business, communications are processed through Meta Platforms Ireland Ltd. Content is end-to-end encrypted; metadata may be processed in the United States. WhatsApp is optional; email is always available.

4.11 Plans, invoices and payments

Company, contact person, billing address, plan, invoice amounts, payment references and payment status. Payments by bank transfer are processed by our bank. Online payments by card, Apple Pay or Google Pay are processed by Stripe Payments Europe Ltd. (Ireland) / Stripe Inc. (USA). We do not store card data. Promo codes and referrals you use are stored with your account. Legal basis: performance of the contract and legal retention obligations.

4.12 Service emails

We send emails that are part of the service: sign-in codes and security notices, invoices, renewal notices and payment reminders, notifications of new enquiries and reminders about unread enquiries, requests to confirm that a listing is still available, price alerts for your favourites, and a monthly performance report for Members. You can switch off the monthly report in your account. Security and contractual emails cannot be switched off while you have an account.

4.13 Currency display and Cloudflare

Our security and delivery provider Cloudflare records aggregated request data (country, browser, requested resource, status) for security and performance purposes. To preselect a display currency, we use the country derived by Cloudflare from your IP address for the current request only and do not store it. Exchange rates are retrieved by our server from ExchangeRate-API; no personal data is transmitted.

4.14 Search engine notification

When listings are published or changed, we notify search engines through the IndexNow protocol. Only the public URL of the listing is transmitted.

4.15 Administration log

Actions carried out in the administration area (for example confirming payments or blocking senders) are logged with the administrator, time and IP address to ensure traceability and security.

4.16 B2B outreach

We may contact brokers and dealerships using business contact details from public registers, company websites or professional directories to introduce the Platform. You can object at any time by writing to [email protected].

5. Social media links and sharing

We link to our profiles on WhatsApp, YouTube, Instagram and TikTok, and listings offer simple share links for Facebook, X, WhatsApp, Telegram and email. We do not embed social media plugins, pixels or feeds. Data is transmitted to these services only if you actively click on a link.

6. Service providers

  • Novatrend Services GmbH, Switzerland: web hosting, databases and email infrastructure in Swiss data centres, as processor under a data processing agreement.
  • Cloudflare Inc., USA / global network: DNS, web application firewall, DDoS protection and, if enabled, Turnstile spam protection.
  • Stripe, Ireland / USA: online payments of invoices by card, Apple Pay and Google Pay.
  • Anthropic PBC, USA: AI processing of exposés and web pages that members submit to have a listing pre-filled (optional feature). Only the submitted content is transmitted; members are asked not to include personal data of sellers.
  • OpenStreetMap Foundation, UK, delivered via Fastly Inc., USA: map tiles on listing pages. Your IP address is processed to deliver the map; no tracking cookies are set.

7. Transfers abroad

Application data and databases are stored in Switzerland. Where providers such as Cloudflare, Fastly or Stripe process data outside Switzerland or the EEA, this is based on adequacy decisions of the Swiss Federal Council and the European Commission, the EU-US and Swiss-US Data Privacy Framework, or standard contractual clauses adapted for Swiss law.

8. Retention periods

  • Server and security logs: up to 90 days.
  • IP addresses for spam protection: 24 hours.
  • Sign-in log: up to 180 days after the last activity of a sign-in; trusted browsers: 30 days.
  • Enquiries in Member inboxes: until deleted by the Member, at the latest 12 months after receipt; enquiries the Member has archived are kept until the Member deletes them or closes the account, at the latest 10 years after receipt (retention period for business correspondence).
  • Off-Market requests: up to 12 months, unless longer retention is required to perform a contract or defend legal claims.
  • Administration log: 2 years.
  • Accounts: for the duration of the membership. On deletion of an account, personal data is deleted or anonymised; unpublished listing media is deleted within 90 days.
  • Invoices and accounting records: 10 years (Art. 958f Swiss Code of Obligations).
  • Search alerts: unconfirmed requests 7 days; after you stop an alert, 30 days.
  • Registrations that were never confirmed: 30 days.
  • IP address of the sender of an enquiry: 90 days.
  • Reports about listings: 12 months after the report is closed.
  • Support requests: 12 months after the request is closed.
  • Objections to marketing: kept on a suppression list so that the objection can be respected.

9. Your rights

You have the right to access, rectification, erasure, restriction of processing, objection and data portability, subject to legal retention obligations. Members can download their data and delete their account themselves under Account > Privacy settings, where they also choose which emails they receive. For all other requests, write to [email protected].

You can lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, CH-3003 Bern (https://www.edoeb.admin.ch), or with the data protection authority in your EU country of residence.

10. Security

  • TLS encryption for all connections;
  • Cloudflare web application firewall and DDoS protection;
  • server protection by Novatrend (including Imunify360, Monarx malware monitoring and SpamExperts email filtering);
  • passwords stored only as hashes, sign-in codes by email, device overview and sign-out of individual devices;
  • protection of all forms against cross-site request forgery, and rate limits against automated abuse.

11. Automated decisions and AI

We do not make automated decisions or carry out profiling with legal effects for you. Automated spam protection may reject messages; in that case you can contact us by email. Where we format a listing for a Member, texts may be prepared with the help of generative AI tools.

12. Changes

We may update this Privacy Policy. The current version is always available at https://www.luxurybroker.com/post/privacy.