Privacy Policy
Effective 1 June 2026 — Helvint SARL, Geneva, Switzerland
This policy is reviewed when Swiss law changes. Last legal review: May 2026.
1. Data Controller
Helvint SARL is the data controller for all personal data processed through the platform. Helvint SARL is a limited liability company (société à responsabilité limitée) incorporated and registered in the Canton of Geneva, Switzerland, operating under Swiss law.
Contact for data protection matters: privacy@helvint.ch
The Federal Data Protection and Information Commissioner (FDPIC) is the supervisory authority for data protection in Switzerland: fdpic.ch
2. Legal Basis
This policy is governed by:
- The Swiss Federal Act on Data Protection (nFADP / nLPD), in force 1 September 2023, and its implementing Ordinance (OPDo)
- The Swiss Code of Obligations (OR/CO), in particular Art. 253–274g (tenancy law)
- The Ordinance on the Rental and Lease of Residential and Commercial Premises (VMWG/OBLF), as amended 1 October 2025
- Cantonal procedural laws and housing regulations applicable per user's selected canton (see Section 9)
The nFADP applies to all processing of personal data of natural persons in Switzerland, regardless of where Helvint SARL's servers are located. All Helvint data is processed and stored exclusively in Switzerland.
3. Data We Collect
3.1 Account data
Name, email address, password (hashed, never stored in plain text), language preference, selected canton, and user role (Property Manager, Tenant, or Contractor).
3.2 Property and lease data
Property addresses, unit details, lease terms, rent amounts, ancillary cost structures, handover protocols, and maintenance records. This data is entered by you and relates to third parties (tenants, contractors). You are responsible for informing those third parties that their data is processed on Helvint in accordance with this policy and applicable Swiss law.
3.3 Payment and subscription data
Subscription tier, billing cycle, and payment history. Credit card data is processed exclusively by Wallee and is never stored on Helvint infrastructure. Wallee's own privacy policy applies to payment processing.
3.4 Bank transaction data (sensitive personal data)
If you connect your bank account via SIX bLink, Helvint accesses read-only account information (Account Information Services / AIS) to automate rent payment tracking. Bank transaction data constitutes sensitive personal data under Art. 5 let. c nFADP. This access:
- Requires your explicit, informed, and freely given consent via OAuth
- Is strictly limited to AIS (read-only) — Helvint never initiates payments
- Uses SIX bLink infrastructure, operated by SIX Group AG (Swiss entity)
- Tokens are stored encrypted in Swiss-jurisdiction object storage only
- Bank data is never logged, never transferred outside Switzerland, and never shared with third parties for any purpose other than the matching of rent payments within your Helvint account
- You can revoke bank access at any time in your account settings
3.5 Technical and usage data
IP address (anonymised after 7 days), browser type, pages visited, and error logs (retained 7 days, never associated with bank data).
4. How We Use Your Data
We process your data for the following purposes, each with its lawful basis:
| Purpose | Lawful basis |
|---|---|
| Providing the Helvint platform and its features | Performance of contract (Art. 31 nFADP) |
| Bank payment matching via SIX bLink | Explicit consent (Art. 31 nFADP — sensitive data) |
| Sending transactional notifications (maintenance alerts, rent due, lease events) | Legitimate interest / contract performance |
| Improving platform reliability and debugging | Legitimate interest (anonymised technical data) |
| Billing and subscription management | Contract performance / legal obligation |
| Complying with Swiss legal obligations | Legal obligation |
We do not use your data for advertising, profiling, or sale to third parties. Ever.
5. Data Retention
| Data type | Retention period |
|---|---|
| Account data | Duration of account + 5 years post-deletion (OR Art. 962 — accounting records) |
| Lease and property data | Duration of account + 10 years (OR Art. 127 — limitation period for tenancy claims) |
| Bank transaction data | 12 months rolling, then permanently deleted |
| Bank OAuth tokens | Deleted immediately upon revocation or account deletion |
| Authentication event logs | 30 days |
| Application error logs | 7 days |
| Wallee billing records | As required by Swiss VAT law (10 years) |
6. Data Sharing and Sub-Processors
Helvint does not sell your data. We share data only with the following sub-processors, all of whom process data under contractual data processing agreements (DPA):
| Processor | Role | Jurisdiction |
|---|---|---|
| Supabase (self-hosted, Infomaniak infrastructure) | Database and authentication | Switzerland |
| Infomaniak Network SA | VPS hosting, object storage, transactional email | Switzerland (Geneva) |
| SIX bLink (SIX Group AG) | Bank API / AIS | Switzerland |
| Wallee AG | Payment processing | Switzerland — Wallee AG, Zürcherstrasse 146, 8400 Winterthur (FINMA supervised) |
Wallee is a Swiss processor — no cross-border transfer. Payment data FDPIC-recognised transfer mechanism (Standard Contractual Clauses) in accordance with Art. 16 nFADP. No bank data, property data, or tenant personal data is ever transferred to stays within Swiss jurisdiction.
7. Security
Helvint implements the following security measures in accordance with the privacy-by-design and privacy-by-default principles required by Art. 7 nFADP:
- All data transmitted over TLS 1.2 or higher
- Bank OAuth tokens encrypted at rest using AES-256 in Swiss-jurisdiction storage
- Row-Level Security (RLS) enforced on all database tables
- Passwords hashed using bcrypt — never stored in plain text
- No bank data in application logs
- Short log retention (auth events: 30 days; errors: 7 days)
- Access to production systems restricted to authorised personnel only
8. Data Breaches
In the event of a personal data breach that poses a high risk to the rights and freedoms of natural persons, Helvint will notify the FDPIC as soon as possible and, where required, will notify affected users directly by email, in accordance with Art. 24 nFADP.
9. Cantonal Context and Disclaimers
Swiss tenancy law is governed federally by OR Art. 253–274g and the VMWG/OBLF, but cantons retain authority over procedural rules. Helvint's platform includes canton-specific features and alerts. The following is a summary of cantonal specifics that affect how Helvint's data and tools apply to you:
Official Initial Rent Form (Avis initial / Anfangsmietzins)
As of 1 October 2025, the obligation to use the official form for initial rent notification applies in full in the cantons of Basel-Stadt (BS), Fribourg (FR), Geneva (GE), Lucerne (LU), Zug (ZG), and Zurich (ZH). In Vaud (VD) and Neuchâtel (NE), the obligation applies in certain municipalities and districts. In all other cantons, disclosure is required only upon tenant request.
From 1 October 2025, the official form must also include the current reference mortgage rate and national CPI at the time of signing. Helvint's rent index feature displays this information, but you are solely responsible for ensuring your official forms are completed correctly.
Geneva (GE): LDTR
The Loi sur les démolitions, transformations et rénovations de maisons d'habitation (LDTR) imposes rent caps following renovation works. Post-renovation rents are capped at CHF 3,528 per room per year (including ancillary costs, excluding heating costs — the kitchen counts as a room). The entire canton of Geneva is subject to the official form requirement and is subject to a declared housing shortage. Public authorities in Geneva hold a right of pre-emption on property sales.
Zurich (ZH) and Basel-Stadt (BS)
The entire canton of Zurich and Basel-Stadt are subject to the official form requirement. Basel-Stadt has additional cantonal housing protection legislation (WRFG / WRSchV) for existing affordable residential properties. Zurich and Basel-Stadt conciliation authorities (Schlichtungsbehörde) are known to apply tenancy law aggressively in favour of tenants.
Vaud (VD)
The official form obligation applies in municipalities with a declared housing shortage. Vaud grants public authorities a right of pre-emption on property sales in certain areas.
Ticino (TI)
Ticino's cantonal building law ("Lex Airbnb", in force 2022) classifies short-term online rentals of fewer than 4 apartments for more than 90 days per calendar year as commercial use, subject to an authorisation requirement. Managers operating in Ticino who use their properties for short-term rentals must verify their cantonal permit status independently.
Other cantons
In cantons without a declared housing shortage (e.g. Valais, Jura, Appenzell, Glarus, Schaffhausen, Uri, Schwyz, Obwalden, Nidwalden, Graubünden, Thurgau, St. Gallen, Solothurn), the official form for initial rent is not mandatory unless requested by the tenant. Conciliation authorities exist in all cantons and are free for residential tenancy cases.
IMPORTANT DISCLAIMER:
The cantonal information above is provided for general awareness only and is not legal advice. Swiss tenancy law and cantonal regulations change. Helvint does not guarantee the accuracy, completeness, or current applicability of cantonal information displayed on the platform. You are responsible for verifying applicable rules with a qualified Swiss lawyer or your cantonal conciliation authority.
10. Your Rights Under the nFADP
Under Art. 25–27 nFADP, you have the right to:
- Access the personal data we hold about you
- Request correction of inaccurate data
- Request deletion of your data (subject to legal retention obligations)
- Request restriction of processing
- Data portability — receive your data in a structured, machine-readable format
- Object to processing based on legitimate interest
- Withdraw consent at any time (without affecting the lawfulness of prior processing)
To exercise any of these rights, contact privacy@helvint.ch. We will respond within 30 days.
If you believe your data protection rights have been violated, you may lodge a complaint with the FDPIC ( fdpic.ch).
11. Cookies and Tracking
Helvint uses only technically necessary cookies for session authentication. We do not use advertising cookies, cross-site tracking, or third-party analytics cookies. No consent banner is required for technically necessary cookies under the nFADP.
12. Children
Helvint is a B2B professional platform not directed at persons under 18. We do not knowingly collect personal data from minors.
13. Changes to This Policy
We will notify users by email at least 14 days before any material change to this policy. Continued use of the platform after the effective date constitutes acceptance. The current version is always available at helvint.ch/privacy-policy.