Privacy Policy

This Privacy Policy informs you about the nature, scope and purpose of the processing of personal data within our online offering, ZVG Melder.

1. Controller

Pascal Szorath, Albulastrasse 50, 8048 Zurich, Switzerland. Email: kontakt@zvg-melder.de. This website operates under the business designation "ZVG Melder". Full provider details are in our Legal Notice.

2. Data processed and purposes

We process master data (e.g. names, email addresses), contact data, content data (the searches and watches you create), usage data, metadata (e.g. IP addresses, timestamps) and payment data. Purposes: providing the online offering; performing contractual services and customer support; sending email notifications about relevant compulsory-auction dates; security measures; reach measurement.

3. Legal bases (GDPR)

Consent (Art. 6(1)(a)); performance of a contract and pre-contractual requests (Art. 6(1)(b)); legal obligation (Art. 6(1)(c)); legitimate interests (Art. 6(1)(f)).

4. Security measures

We take appropriate technical and organisational measures pursuant to Art. 32 GDPR, including encrypted transmission (TLS/HTTPS), access restrictions and a security-oriented authorisation concept.

No technical system can guarantee complete protection against unauthorised third-party access. Please therefore also protect your email mailbox and any access credentials from third-party access.

5. Deletion of data

Data is deleted as soon as it is no longer required and no statutory retention obligations apply. Accounts and associated watches are deleted after the user relationship ends. Notification logs are retained for a maximum of 90 days.

Records of consent and contractual declarations (e.g. the separate confirmation regarding the nature of automated content, and confirmations relating to withdrawal) are retained, with the displayed text version and a timestamp, until the limitation periods relevant for potential claims expire (generally three years, §§ 195, 199 BGB), in order to evidence the declaration in the event of a dispute. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in securing evidence and in accountability under Art. 5(2) GDPR). Invoicing and tax-relevant data are retained for the duration of the statutory commercial and tax retention periods.

6. Hosting and access logs

We use a hosting provider to deliver the offering. Server log files (requested pages, date/time, transferred volume, browser type and version, operating system, referrer URL, requesting IP address) are stored for a maximum of 30 days for security reasons. Legal basis: Art. 6(1)(f). Server location: Switzerland. Switzerland is a third country under the GDPR for which the European Commission, by decision of 15 January 2024, has confirmed an adequate level of data protection (Art. 45 GDPR); additional safeguards such as standard contractual clauses are therefore not required for transfers to Switzerland.

Error and stability monitoring: to detect and fix technical errors we use Sentry (via its EU region). When an error occurs, technical event data is transmitted (e.g. error type, affected page, browser type and operating system, possibly the IP address); personal content is removed by a filter before transmission as far as possible. Legal basis: Art. 6(1)(f).

User-initiated error reports: via the "Report a problem" feature you can voluntarily send us a report. This transmits your description and – if you add them – a screenshot and contact details (name, email address). In addition, a technical session recording of the last seconds before the error may be transmitted, in which text, inputs and media content are automatically masked. Processing takes place via Sentry (EU region) for the purpose of fixing the error. Legal basis: Art. 6(1)(a) (consent); you may omit this information and withdraw any consent given at any time with effect for the future.

7. Registration and user account

Users can create an account. Sign-in is passwordless via an email login link ("magic link") or via your chosen credentials. We process your email address and usage-related data. Legal basis: Art. 6(1)(b).

8. Auction notifications

The core function of ZVG Melder is sending email notifications when a compulsory auction you watch (e.g. by case number or local court) changes — for example a newly scheduled, postponed or cancelled auction date. We process your email address and the watches you create. You can stop delivery at any time by deactivating a watch or using the unsubscribe link in any notification email. Legal bases: Art. 6(1)(a) and (b).

For the technical delivery of emails we use the processor Resend (Resend, Inc., USA); your email address is transmitted in the process. Any transfer to the USA is safeguarded by appropriate safeguards (EU standard contractual clauses).

9. Contact and enquiry management

When you contact us (e.g. via the contact form or email), we process the information provided to the extent necessary to answer the enquiry. Legal bases: Art. 6(1)(b) and (f).

10. Payments

For paid plans we use external payment providers. We engage them on the basis of Art. 6(1)(b). Transaction data is collected and processed exclusively by the payment providers; their privacy notices additionally apply.

11. Web analytics

We use the self-hosted, cookieless analytics tool Umami for reach measurement. Umami uses no cookies and builds no personal profiles; the data is processed on our own infrastructure in Switzerland and not transferred to third parties. Collected data (e.g. page viewed, referrer, approximate country-level origin) is evaluated in aggregated form. Legal basis: Art. 6(1)(f).

12. Geodata

To locate auction properties we process the address details contained in the official announcements. Conversion into geographic coordinates ("geocoding") is performed by a self-hosted service based on OpenStreetMap data; no personal data is transferred to third parties in this step.

The interactive map on the property pages is provided via Google Maps (provider: Google Ireland Limited, "Google"). The map is not loaded automatically: initially only a placeholder with a consent notice is shown; an embedded map is loaded only once you actively click the "Activate map" button, or when a valid consent is already stored for your signed-in account. Only then is your IP address transmitted to Google; a transfer to third countries (e.g. the USA) may occur, safeguarded by appropriate safeguards (standard contractual clauses).

Activation stores a value for Google Maps consent in your browser's local storage (localStorage, key zvgm.maps.consent.v1) and a cache of resolved geo-coordinates (key prefix zvgm.geo.). For signed-in users, we additionally store the consent with version and timestamp in the account settings so it applies across devices and can be demonstrated. Before activation, no access to Google and no write access to local storage takes place. Google's privacy notices additionally apply. The legal basis is your consent (Art. 6(1)(a) GDPR) in conjunction with § 25(1) TDDDG; you can withdraw this consent at any time with effect for the future directly on the map ("Disable Google Maps") or in the account settings. Users who are not signed in can withdraw it directly on the map or delete the browser's local storage. See also our Cookie Policy.

13. Your rights

You have the rights to object (Art. 21), to withdraw consent (Art. 7(3)), of access (Art. 15), to rectification (Art. 16), to erasure and restriction (Art. 17, 18), to data portability (Art. 20), and to lodge a complaint with a supervisory authority (Art. 77).

14. Cookies

We use strictly necessary cookies required to operate the offering and your sign-in. See our Cookie Policy. Legal basis: Art. 6(1)(f) and § 25(2) TDDDG.

15. Updates

We update this Privacy Policy whenever changes to our processing make this necessary.