Privacy policy

1. Controller

GuestLee Sàrl

Route de Glion 74, 1823 Glion (municipality of Montreux), Switzerland

• UID: CHE-191.185.856
• Commercial register of the Canton of Vaud, CH-550.1.168.676-2

Email for data protection questions: [À COMPLÉTER: one address, for example info@guestlee.com]

Phone: [À COMPLÉTER: company number]

Representative in the European Union (Art. 27 GDPR): [À COMPLÉTER or delete after legal advice]

2. Data we collect

a) Online valuation (steps 1 and 2)

• The property address you enter, plus the standardised address, building identifier and geographic coordinates returned by our data provider.
• Property details: type (apartment, house, etc.), living area, number of rooms, bathrooms, floor and construction year (optional).
• The indicative price range calculated.

b) Contact request (step 3)

• First name, last name, email address, phone number.
• Your intended selling timeline and preferred contact method (email, phone, WhatsApp).
• Your choice for the box "I agree to receive GuestLee news and off-market listings by email" (unticked by default).
• The property address and type, a summary of the details entered, the page address and the language used.

c) Newsletter (sign-up window)

• Email address, page address and language.

d) Direct contact

• If you call us, email us or write on WhatsApp: your number, your name and the content of your messages.

e) Technical data

• IP address, browser and device type, pages viewed, date and time, security data (Cloudflare Turnstile bot protection).
• Audience measurement and on-page interaction data (Microsoft Clarity, Lovable statistics) and, if you accept, marketing data (Meta Pixel). See section 9.

We do not ask for any sensitive data. Please do not include any in your messages.

3. Purposes

We use your data to:

1. calculate and display an indicative valuation of your property;
2. answer your request, contact you through the channel you chose and prepare a detailed valuation or a sales mandate;
3. send you our news and off-market listings, only if you agreed (newsletter or tick box);
4. keep the site secure and prevent abuse (bots, mass submissions);
5. understand how the site is used and improve it;
6. measure the effectiveness of our advertising and show you relevant ads on Meta platforms, only with your consent;
7. meet our legal obligations (accounting, tax) and defend our rights.

We do not sell your data.

We make no automated individual decisions within the meaning of Art. 21 FADP or Art. 22 GDPR: the online valuation is indicative and an advisor reviews it.

4. Legal bases

Under Swiss law, we process your data in line with the FADP principles (lawfulness, good faith, proportionality, purpose limitation, accuracy, security).

Where the GDPR applies, we rely on:

• steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR): valuation, answering your request, preparing a mandate;
• your consent (Art. 6(1)(a) GDPR): newsletter and marketing emails, non-essential cookies and trackers (Meta Pixel), and where required audience measurement;
• our legitimate interest (Art. 6(1)(f) GDPR): site security, abuse prevention, improving the site with cookieless audience measurement;
• our legal obligations (Art. 6(1)(c) GDPR): keeping accounting records.

Marketing emails are sent only with your prior consent, as required by Art. 3(1)(o) of the Swiss Federal Act against Unfair Competition (UCA).

You can withdraw your consent at any time through the unsubscribe link in every email or by writing to us. Withdrawal does not affect processing already carried out.

5. Recipients and processors

Your data is available to the GuestLee team handling your request (in particular Vincent Stasolla, Head of Sales).

We use the following providers, who process data on our behalf or, for some, as separate controllers:

We may also disclose data to authorities where the law requires it.

6. Transfers abroad

Some providers are located outside Switzerland. EU countries and the United Kingdom provide an adequate level of protection recognised by the Swiss Federal Council (Annex 1 of the Data Protection Ordinance, DPO).

For the United States, transfers rely on the provider's certification under the Swiss-U.S. Data Privacy Framework (and, for the GDPR, the EU-U.S. Data Privacy Framework) or, failing that, on the European Commission's standard contractual clauses with the Swiss addendum.

[À COMPLÉTER: check the DPF certification of each US provider.]

You can ask us for a copy of the safeguards used.

7. Retention

• Valuation data without a contact request: [À CONFIRMER: for example 12 months].
• Contact requests that do not lead to a mandate: [À CONFIRMER: for example 24 months after the last exchange], then deletion.
• Data linked to a sales mandate: for the term of the mandate, then 10 years for accounting and contractual records (Art. 958f Swiss Code of Obligations).
• Newsletter: until you unsubscribe. We then keep only proof of your consent and its withdrawal.
• Technical data and security logs: [À CONFIRMER: period].
• Cookies: see section 9.

8. Your rights

Within the limits of the law, you can:

• access your data (Art. 25 FADP, Art. 15 GDPR);
• have it corrected (Art. 32 FADP, Art. 16 GDPR);
• ask for erasure or restriction (Art. 17 and 18 GDPR);
• object to processing, in particular direct marketing (Art. 30 FADP, Art. 21 GDPR);
• receive your data in a common format or have it transmitted (Art. 28 FADP, Art. 20 GDPR);
• withdraw your consent at any time.

To exercise your rights, write to [À COMPLÉTER: email address] or to the postal address in section 1. We may ask you to prove your identity. We reply within 30 days.

You can lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC, www.edoeb.admin.ch) or, if you live in the European Union, with the data protection authority of your country.

9. Cookies and similar technologies

On your first visit, a banner lets you accept or refuse non-essential cookies. You can change your choice at any time via the "Manage cookies" link in the site footer.

Necessary (no consent needed)

• __cf_bm (Cloudflare): bot protection, 30 minutes.
• __dpl (Lovable): technical operation and routing of the site, [À COMPLÉTER: duration].
• Cloudflare Turnstile: bot check on the valuation form.
• Browser local storage: gl_lang (chosen language), guestlee_newsletter_popup_v1 (so the newsletter window is not shown again), gl_lead_fired (session, so a request is counted only once).

Audience measurement

• Microsoft Clarity: records clicks, scrolling and movements on the page in pseudonymised form to improve the site. Clarity is set up without cookies and typed fields are masked. [À COMPLÉTER after legal advice: consent or legitimate interest.]
• Lovable statistics: counts visits and page views, without identifying people.

Marketing (with consent)

• Meta Pixel (_fbp, 90 days): measures visits and requests coming from our ads on Facebook and Instagram, and builds advertising audiences. Meta may link this information to your Meta account under its own policy (www.facebook.com/privacy/policy).

Google Tag Manager only loads the other tools and does not set a cookie by itself. Google Fonts are loaded from Google servers, which receive your IP address.

10. Security

The site uses an encrypted connection (HTTPS) and the form is protected against automated submissions. Access to requests is limited to the people who need it. No transmission over the internet is completely secure, however.

11. Contact

For any question about this policy or your data:

GuestLee Sàrl, Route de Glion 74, 1823 Glion, Switzerland [À COMPLÉTER: email] · [À COMPLÉTER: phone]

12. Changes

We may update this policy to reflect changes to the site, our providers or the law. The version published on this page applies.

If we make a significant change, we will show it clearly on the site.