Privacy

2. Data we process

• Account and profile: name, email, phone, language, account type, address/profile details and authentication data.
• OFFER/WANTED listings: title, description, category, price/budget, availability, images, city, canton, private address used for location verification and technical map coordinates.
• User interactions: requests, bookings, chat, reviews, favourites and other platform events.
• Contracts and signing: documents, versions, OTP signatures, timestamps, document hashes and technical audit-trail data.
• Payments: for transactions between users, ShareSpace may record amounts and declarative confirmations, but it does not collect or transfer the money. For ShareSpace subscriptions, it processes amount, currency, status and technical provider identifiers; full card numbers are not stored.
• Handover, return and disputes: reports, terminations, refunds, deposits, disputes and related documentation.
• Support: the contact form processes name, email, category, subject and message. IP and user-agent are stored only as HMAC hashes.
• Technical and security: sessions, logs, login attempts, security events, browser, operating system and technical identifiers used to prevent abuse.

1. Controller and privacy contact

The controller is the ShareSpace operator. For privacy-related requests, please use the dedicated contact form.

3. Why we use data

We process data to manage accounts, listings, matching, bookings, chat, contracts, signature evidence, information about direct payments between users and ShareSpace subscription payments, notifications, support, fraud and abuse prevention, service security and legal, tax and accounting obligations.

4. Internal analytics

ShareSpace uses internal statistics for visits, pages, source, language, device, browser and approximate session duration. The IP address is hashed. Bots/scanners are separated from real visits. Approximate geolocation through ipwho.is occurs only if that feature is enabled in analytics settings.

5. Maps and geocoding

Maps use Leaflet with OpenStreetMap data. When an address is verified, ShareSpace sends the address string needed for geocoding to Nominatim/OpenStreetMap and restricts the search to Switzerland. Requests to external services may also transmit ordinary connection metadata.

6. Providers and recipients

Service providers needed for operation may process data, such as hosting, email and technical infrastructure. Payments between users are made directly between the parties; ShareSpace does not operate payouts or escrow. ShareSpace subscription payments may be processed by SumUp or the provider identified at checkout under its own terms. OpenStreetMap/Nominatim is used for maps/geocoding. ipwho.is may be used only when external analytics geolocation is enabled. Data may also be disclosed to authorities or entitled parties when required by law or necessary to protect rights and security.

7. Processing abroad

Some technical providers may process data outside Switzerland. Where this occurs, applicable requirements of the Swiss FADP must be met. The published notice must remain consistent with the providers and countries actually used.

8. Retention

We keep data for as long as needed for the purposes described, then delete, anonymise or restrict it unless legal/accounting duties or documented security, evidence or dispute needs require longer retention. Certain Swiss accounting records may need to be retained for up to ten years.

9. Your rights

Subject to the Swiss Federal Act on Data Protection, you may ask whether we process data about you, request information and a copy, correct inaccurate data and, where applicable, request deletion, restriction, delivery/portability or withdraw consent.

10. Security

ShareSpace applies data protection by design and by default, minimisation and risk-appropriate technical and organisational measures, including password hashing, CSRF protection, access controls, private file storage, audit logging and session protection. Where processing may create a high risk, the need for a data-protection impact assessment under the Swiss FADP is evaluated. Security breaches are assessed and, where they are likely to create a high risk, notified to the FDPIC; affected persons are informed when necessary for their protection.

11. Matching and automated systems

Algorithms may assist matching, statistics, security and moderation. Automated signals are not treated as conclusive proof. Where law grants rights concerning certain automated individual decisions, those rights must be respected.

12. Cookies and technical technologies

ShareSpace uses technical cookies/sessions required for login, security, language and site operation. Any additional analytics or tracking tools must be described and managed consistently with the configuration actually in use.

13. Changes

This notice may be updated when features, providers or legal requirements change. The published version/date should be updated when material changes are introduced.