Privacy Policy

This Privacy Policy informs you about the nature, scope and purpose of the processing of personal data within our online offering, ZVG Melder.

1. Controller

The controller is Pascal Szorath, Albulastrasse 50, 8048 Zurich, Switzerland, email: kontakt@zvg-melder.de. For data protection matters you can also reach us at datenschutz@zvg-melder.de.

This website operates under the business designation "ZVG Melder". Full provider details are in our Legal Notice.

2. Data processed and purposes

We process master data (e.g. names, email addresses), contact data, content data (the saved searches and watches you create), usage data, metadata (e.g. IP addresses, timestamps), payment data, questions to the assistant and the answers to them, log data (e.g. error messages, retrievals of documents) and data from compulsory-auction proceedings (e.g. location of the property, case number, details from expert reports). Purposes: providing the online offering; performing contractual services and customer support; sending email notifications about relevant compulsory-auction dates; security measures; reach measurement; answering your questions to the assistant; fixing errors; publishing officially announced compulsory auctions.

3. Legal bases (GDPR)

Consent (Art. 6(1)(a)); performance of a contract and pre-contractual requests (Art. 6(1)(b)); legal obligation (Art. 6(1)(c)); legitimate interests (Art. 6(1)(f)).

4. Security measures

We take appropriate technical and organisational measures pursuant to Art. 32 GDPR, including encrypted transmission (TLS/HTTPS), access restrictions and a security-oriented authorisation concept.

No technical system can guarantee complete protection against unauthorised third-party access. Please therefore also protect your email mailbox and any access credentials from third-party access.

5. Deletion of data

Data is deleted as soon as it is no longer required and no statutory retention obligations apply. Your user account and the associated watches remain stored until you delete the account in the account settings or ask us to delete it. Notification logs are retained for a maximum of 90 days. We delete the origin information from registration six months after it was stored (section "Registration, sign-in and user account").

We store the record of your consents and agreements (time and text version) in your user account for as long as the account exists. For a purchase we additionally note it in the payment transaction at Stripe. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in securing evidence and in accountability under Art. 5(2) GDPR). Invoicing and tax-relevant data are retained for the duration of the statutory commercial and tax retention periods.

6. Hosting and access logs

We are established in Switzerland and operate the servers of ZVG Melder there ourselves. We do not use a hosting provider. The European Commission has recognised an adequate level of data protection for Switzerland (Decision 2000/518/EC of 26 July 2000, confirmed in the Commission's report of 15 January 2024). Access to the offering is recorded in server log files (requested pages, date/time, transferred volume, browser type and version, operating system, referrer URL, requesting IP address). We write our server's logs to files. Once a file is full, we delete it 30 days later. Legal basis: Art. 6(1)(f).

Error and stability monitoring: to detect and fix technical errors we use Sentry (via its EU region). When an error occurs, technical event data is transmitted (e.g. error type, affected page, browser type and operating system, possibly the IP address); personal content is removed by a filter before transmission as far as possible. Legal basis: Art. 6(1)(f).

User-initiated error reports: via the "Report a problem" feature you can voluntarily send us a report. This transmits your description and – if you add them – a screenshot and contact details (name, email address). Processing takes place via Sentry (EU region) for the purpose of fixing the error. Legal basis: Art. 6(1)(a) (consent); you may omit this information and withdraw any consent given at any time with effect for the future.

7. Recipients

For individual tasks we use the following service providers.

8. Registration, sign-in and user account

You can sign in with email address and password, with a login link or code by email, with a passkey, or with an existing account at Google or Microsoft. If you choose to sign in through one of these providers, we receive from it your name, your email address and, where applicable, your profile picture; the provider learns that you are signing in to ZVG Melder. You can additionally set up two-step sign-in.

For each sign-in we store IP address, browser and time, so that you can see and end your active sessions in the account settings and so that we can detect misuse. Legal bases are Art. 6(1)(b) and (f) GDPR.

Origin at registration. If you register with an email address and password, or set up an email notification without signing in, we store once in your user account which origin parameters the link you came to us through contained (utm_source, utm_medium, utm_campaign, utm_content, utm_term), and the name of the website you came from, without its path and without search terms. Such origin parameters are carried mostly by links that we have promoted. We use this only to measure through which channels users find ZVG Melder. We use neither cookies nor your browser's storage for this, and we do not pass the information on. When you sign in through Google or Microsoft, with a login link or with a code, we store no origin. We delete the information six months after it was stored, at the latest with your account. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is the evaluation of our advertising.

9. Auction notifications

The core function of ZVG Melder is sending email notifications when a compulsory auction you watch (e.g. by case number or local court) changes — for example a newly scheduled, postponed or cancelled auction date. We process your email address and the watches you create. You can stop delivery at any time by deactivating a watch or using the unsubscribe link in any notification email. Legal bases: Art. 6(1)(a) and (b).

We send all emails through the service provider Resend; for this it processes your email address and the content of the respective email. The links in our emails carry a suffix that names the kind of email, for example "notification". If you follow such a link, our reach measurement recognises which kind of email the visit comes from. The suffix contains no information about you, your account or your watch. Our emails do not load content from third-party servers.

You receive notifications for every property you watch and for every saved search, until you end the watch or the saved search. When you unlock a property or save a note on it, we create a watch for that property. For notes you can switch this automatic watch off in the settings.

10. Questions to the assistant

When you ask the assistant a question about a property, we store the question, the answer and the time in your user account. To answer it, we transmit the question together with excerpts from the property's documents to the service providers named above. We do not transmit your name or your email address in the process. Please do not include personal data of other people in your questions. We store questions and answers until you delete your user account. You can hide individual questions in your account. The legal basis is Art. 6(1)(b) GDPR.

11. Contact and enquiry management

When you contact us (e.g. via the contact form or email), we process the information provided to the extent necessary to answer the enquiry. Legal bases: Art. 6(1)(b) and (f).

12. Payments

Payments are handled by Stripe Payments Europe, Limited (Ireland). When you place an order, we transmit to Stripe your email address, the number of your user account and the information which product you are buying. We also note there when, during the order process, you agreed to the terms and conditions and to the information on withdrawal. You enter payment data and billing address at Stripe yourself; Stripe also calculates the value-added tax from them. Stripe processes part of this data under its own responsibility, for example to prevent fraud. We do not receive complete card data. For each purchase we store amount, discount, tax amount, currency, product and Stripe's transaction numbers. Legal bases are Art. 6(1)(b) and (c) GDPR.

13. Web analytics

We measure the use of our pages with the program Umami, which we operate ourselves. For this your browser calls the address analytics.processflow.dev; behind it is a server that we operate in Switzerland. Umami sets no cookies and stores nothing in your browser. With each page view it records which page you view and which page you come from, plus browser, operating system, screen size and the country the request comes from. From the IP address and browser details it calculates a value with which page views from the same browser within one calendar month can be matched to each other; it groups page views without a break of more than 30 minutes into one visit. It does not store the IP address itself. We do not link this data to your user account. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in recognising which content is used. You can object to the processing (section "Your rights").

14. Geodata

To locate auction properties we process the address details contained in the official announcements. Conversion into geographic coordinates ("geocoding") is performed by a self-hosted service based on OpenStreetMap data; no personal data is transferred to third parties in this step.

The interactive map on the property pages is provided via Google Maps (provider: Google Ireland Limited, "Google"). The map is not loaded automatically: initially only a placeholder with a consent notice is shown; an embedded map is loaded only once you actively click the "Activate map" button, or when a valid consent is already stored for your signed-in account. Only then is your IP address transmitted to Google; a transfer to third countries (e.g. the USA) may occur, safeguarded by appropriate safeguards (standard contractual clauses).

Activation stores a value for Google Maps consent in your browser's local storage (localStorage, key zvgm.maps.consent.v1) and a cache of resolved geo-coordinates (key prefix zvgm.geo.). For signed-in users, we additionally store the consent with version and timestamp in the account settings so it applies across devices and can be demonstrated. As long as you have not activated the map and no consent is stored in your account, no access to Google takes place, and we store neither a consent for Google Maps nor coordinates in your browser. Google's privacy notices additionally apply. The legal basis is your consent (Art. 6(1)(a) GDPR) in conjunction with § 25(1) TDDDG; you can withdraw this consent at any time with effect for the future directly on the map ("Disable Google Maps") or in the account settings. Users who are not signed in can withdraw it directly on the map or delete the browser's local storage. See also our Cookie Policy.

The same consent covers the photo of the court building on the local court pages where we show no photo of our own. That photo is provided via Google Maps and loaded in your browser only after you click "Load photo from Google Maps" or when the consent has already been given. Only then is your IP address transmitted to Google. We do not store the photo. Legal basis and withdrawal are the same as for the map.

15. Embedded videos (YouTube)

Some of our guides embed videos from our YouTube channel. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). The video is not loaded automatically: initially we only show a preview image served by us, with a notice below it on what a click loads. Before that click, your browser makes no connection to YouTube or Google.

Only when you click the preview image does your browser load YouTube's player in privacy-enhanced mode (youtube-nocookie.com). Data is then transmitted to Google, including your IP address, technical details of your browser, the selected video and the address of our website. YouTube may store and read information in your browser, for example as cookies or in local storage. A transfer to third countries (e.g. the USA) may occur, safeguarded by appropriate safeguards (standard contractual clauses). Google's privacy notices additionally apply.

We do not store your decision. Every opening of the player requires a click of its own. The legal basis is your consent given by the click (Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDDG). You can withdraw it at any time with effect for the future by closing the player, which removes it from the page and ends playback. You can delete what YouTube has stored in your browser in your browser settings. We count that a video was opened in our cookieless reach measurement (Umami).

A link below the preview image leads to the video's page on youtube.com, and YouTube's player contains a link of its own. If you follow one of these links, youtube.com opens; YouTube's terms and privacy notices apply there. See also our Cookie Policy.

16. Data from compulsory-auction proceedings

We publish details of compulsory auctions that courts announce in the official justice portal: type and location of the property, case number, date and market value, plus photos of the property and details from the expert reports. The source is the justice portal of the Federation and the Länder (zvg-portal.de).

We do not include names of debtors, owners or residents in our own details. The courts' expert reports may contain such names. They can be viewed only by users who have a subscription or have unlocked the property. In addition, the address often reveals who owns a property or who lives there.

We show these details so that prospective bidders can find and assess ongoing proceedings. The legal basis is Art. 6(1)(f) GDPR.

Recipients are the visitors to our pages, search engines, the social networks in which we present individual properties, and the technical service providers that analyse the documents automatically (see section "Recipients").

We show the details publicly until the auction date or until the court withdraws the announcement. After that the page is no longer public; the data remains stored with us.

We do not notify owners, debtors and residents individually. Given the number of proceedings, that would involve a disproportionate effort, and we would have to collect additional data about them to do so. We therefore provide the information here (Art. 14(5)(b) GDPR).

If you are the owner, debtor or resident of a property that we show, you can object to the publication at any time (Art. 21 GDPR). Please tell us the grounds relating to your particular situation. You can also request that we erase data or restrict its processing (Art. 17, 18 GDPR). To do so, write to datenschutz@zvg-melder.de. We examine each request individually. We can then name only the town instead of the address, or stop showing the proceedings altogether.

17. Further processing and mandatory information

Notes, calculations and lists. What you create in your account, such as notes, cost and profitability calculations, your own question lists and saved list views, we store until you delete it or delete your account. The legal basis is Art. 6(1)(b) GDPR.

Retrievals of documents. We record when you retrieved which document. This is how we count how many retrievals your plan still allows on a given day, and how we detect misuse. Legal bases are Art. 6(1)(b) and (f) GDPR.

Error log. If an error occurs in your browser or on our server, we store the error message, the address of the page without search parameters, the browser identifier, a random identifier of the browser tab and, if you are signed in, the identifier of your account. We do not store the IP address in the process. We delete the entries after 30 days. The legal basis is Art. 6(1)(f) GDPR. We have a legitimate interest in finding and fixing errors.

Withdrawal and cancellation via the form. Your declaration with name, email address and your details of the contract reaches us as an email and remains stored in our mailbox. You receive a confirmation by email. Legal bases are Art. 6(1)(b) and (c) GDPR.

Mandatory information. For a user account we need an email address, and for a purchase additionally the information the payment provider asks for. Without this information we cannot set up the account or process the purchase. All further information is voluntary.

18. Your rights

You have the rights to object (Art. 21), to withdraw consent (Art. 7(3)), of access (Art. 15), to rectification (Art. 16), to erasure and restriction (Art. 17, 18), to data portability (Art. 20), and to lodge a complaint with a supervisory authority (Art. 77).

You can lodge a complaint with any data protection supervisory authority, in particular with the authority at your place of residence. In Switzerland the Federal Data Protection and Information Commissioner (FDPIC) is competent. We do not take decisions that are made solely by automated means and that legally affect you (Art. 22 GDPR). Where the Swiss Data Protection Act applies, the information in this policy applies accordingly.

19. Cookies

We use strictly necessary cookies required to operate the offering and your sign-in. See our Cookie Policy. Legal basis: Art. 6(1)(f) and § 25(2) TDDDG.

20. Updates

We update this Privacy Policy whenever changes to our processing make this necessary.