Nachhaltigkeit trifft Stil

Privacy Policy

1. Controller

CREATIO Development AG
Seeweg 29
8807 Freienbach
Switzerland

Data protection enquiries: datenschutz@creatio.ch
Phone: +41 41 562 06 43

CREATIO Development AG is the controller for the collection and processing of personal data in the context of this website (Art. 5 lit. j revDSG and Art. 4 No. 7 GDPR respectively).

2. Basis

This privacy policy explains the nature, scope and purpose of the processing of personal data on the www.creatio.ch website and its subdomains. The applicable legal bases are the Swiss Federal Act on Data Protection (revDSG) and the EU General Data Protection Regulation (GDPR) for visitors from the EU/EEA.

Personal data is any information relating to an identified or identifiable natural person (name, email address, phone number, IP address, usage behaviour, etc.).

3. Categories of personal data processed

Depending on your use of www.creatio.ch, the following categories of personal data are processed:

  • Master and contact data: first and last name, email address, phone number.
  • Property data: address and information about the property you offer to CREATIO for acquisition.
  • Communication content: free-text messages from the contact form and any subsequent email or telephone conversations.
  • Application data: CV, references, covering letter and interview notes, if you apply to us (see section 8).
  • Technical data: IP address, user agent (browser, operating system, device type), timestamp, referrer URL, URLs accessed.
  • Usage data: pseudonymous information about session, dwell time, click path (only with your consent to analytics cookies).
  • CRM metadata: timing and channel of the first contact, attribution to marketing campaigns (only with your consent to marketing cookies).

We only process the personal data required for the respective purpose (principle of proportionality, Art. 6 para. 2 revDSG).

4. Data collected when visiting the website

When our website is accessed, our hosting provider (Cloudflare, see section 10) logs the following information:

  • IP address of the accessing device (only for the duration of the session, anonymised thereafter)
  • date and time of access
  • URL accessed
  • volume of data transferred
  • user agent (browser, operating system)
  • referrer (referring website)

Purpose: provision and delivery of the website, DDoS protection, technical error diagnosis.
Legal basis: overriding legitimate interest (Art. 31 para. 2 lit. c revDSG and Art. 6 para. 1 lit. f GDPR) in the secure operation of the website.
Retention period: maximum {{30 days}} in server logs, then automatic deletion.

5. Contact form ("purchase offer")

If you use the multi-step form on the homepage to request a purchase offer for your property, we collect the following data:

  • property address
  • first name, last name
  • email address
  • phone number
  • optional free-text message

Purpose: processing your enquiry, preparation of a non-binding purchase offer, response by phone or in writing.
Legal basis: initiation of a contract at the request of the data subject (Art. 31 para. 2 lit. a revDSG and Art. 6 para. 1 lit. b GDPR).
Retention period: {{up to 24 months}} after last contact or until conclusion or final failure of a transaction. Information that leads to the conclusion of a contract is stored in accordance with commercial and tax retention obligations (typically 10 years, Art. 958f CO).

Your form data is transmitted via HubSpot (see section 10).

6. Cookies and similar technologies

We use the following categories of cookies:

  • Strictly necessary cookies — for the correct operation of the website (e.g. cookie-consent storage, Cloudflare security tokens). These cannot be deselected.
  • Analytics cookies — for pseudonymous usage statistics (Google Analytics 4, see section 10). Activated only with your consent via the cookie banner.
  • Marketing cookies — for CRM attribution via HubSpot and for retargeting audiences on LinkedIn, Meta and Google Ads (see section 10). Activated only with your consent via the cookie banner.

You can adjust or withdraw your cookie consent at any time via the "Cookie settings" link in the footer or directly in your browser (delete existing cookies and block new cookies for www.creatio.ch).

7. Newsletter

We send our newsletter via HubSpot. Subscription takes place via the website. You may unsubscribe at any time via the link in the footer of the newsletter emails.

8. Job applications

If you apply for an advertised position or send us a speculative application, we process the data you submit to us in doing so.

Data collected: first and last name, contact details (email, phone, address), information from your CV, references, diplomas and employment confirmations, your covering letter, and our notes from calls and interviews with you. Any further information — reference checks, for example — is obtained only with your prior consent.

Transmission: applications reach us by email at jobs@creatio.ch. Email is generally transmitted unencrypted; if you wish to protect sensitive information, please agree an alternative channel with us in advance.

Purpose: assessing your suitability for the advertised position, conducting the selection process and communicating with you about it. Your data is not used for any other purpose.

Legal basis: contract initiation at your request (Art. 31 para. 2 lit. a revDSG and Art. 6 para. 1 lit. b GDPR). If you apply from the EU/EEA, we additionally rely on Art. 88 GDPR in conjunction with the applicable national employee data protection law.

Sensitive personal data: we do not ask for information about health, religion, political views or trade union membership. If you provide such information unprompted (for example in a CV), we process it only in so far as it is necessary to assess your application.

Access: only the people involved in the selection process have access to your application documents. They are not disclosed to third parties, except to the IT service providers named in section 10, which provide us with infrastructure as processors (email, document storage, applicant management).

Retention: if your application is unsuccessful, we delete your documents no later than {{6 months}} after the process concludes. This period allows us to respond to any claims arising from the application process, for instance under the Gender Equality Act. If an employment relationship is entered into, the documents are transferred to your personnel file and the retention periods under employment and social insurance law apply.

Talent pool: we retain your documents beyond that period only if you expressly consent. You may withdraw your consent at any time and without giving reasons; we will then delete the documents promptly.

Your rights: the rights set out in section 12 apply — in particular access to the data we process about you, together with rectification and erasure.

9. Disclosure to third parties

We only disclose your data if this is necessary to process your enquiry, if you have expressly consented or if we are legally obliged to do so.

Transfers are made to the following categories of recipients:

  • IT service providers (hosting, CRM, analytics — see section 10)
  • banking and finance partners in the case of a concrete contract initiation
  • notary, land registry and tax authorities in the context of a transaction (only with your knowledge)
  • legal representatives and authorities where required by law

10. Third-party services used

Cloudflare (hosting + CDN)

Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA
Purpose: delivery of the website, DDoS protection, SSL/TLS termination, and provision of embedded videos (Cloudflare Stream) on the careers page.
Data transfer: to the USA. Contractual safeguards through EU standard contractual clauses + Data Processing Addendum.
Privacy policy: https://www.cloudflare.com/privacypolicy/

Google Tag Manager

Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
Purpose: central management of marketing and analytics tags. GTM itself does not collect personal data; it loads tags.
Privacy policy: https://policies.google.com/privacy

Google Analytics 4

Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
Purpose: pseudonymous reach and behaviour analysis (page views, dwell time, traffic sources).
Consent: activated only with your consent in the cookie banner.
Data transfer: to the USA, EU standard contractual clauses + Google DPA. IP anonymisation is enabled.
Privacy policy: https://policies.google.com/privacy

HubSpot (CRM + form platform)

HubSpot Ireland Limited, One Dockland Central, Guild Street, Dublin 1, Ireland
Purpose: receipt of the contact form, contact management, email communication in the context of enquiry processing.
Legal basis: contract initiation (see section 5).
Privacy policy: https://legal.hubspot.com/privacy-policy

Google Fonts

Google Ireland Limited (address see above)
Purpose: delivery of the Montserrat typeface.
Data transfer: your IP address is transmitted to Google when the font file is loaded. We are continuously evaluating a self-hosting variant.

Tree-Nation, {{Address}}
Purpose: display of our reforestation balance. The widget loads images and counter scripts from Tree-Nation.
Privacy policy: https://tree-nation.com/legal/privacy

Mapbox (location map in the purchase-offer form and in the project overview)

Mapbox, Inc., 1 Vorhees St, San Francisco, CA 94103, USA
Purpose: interactive map rendering of the address you enter and of CREATIO projects. When the map is loaded, the map material and the mapbox-gl-js script library are loaded from api.mapbox.com and events.mapbox.com into your browser; your IP address is transmitted to Mapbox in the process.
Data transfer: to the USA. Contractual safeguards through EU standard contractual clauses.
Privacy policy: https://www.mapbox.com/legal/privacy

YouTube (video embeds in the blog and on project pages)

Google Ireland Limited (address see above)
Purpose: embedding videos for projects and blog posts. When played, a connection is established with www.youtube.com and googlevideo.com; YouTube sets cookies for reach measurement and transmits your IP address to Google.
Data transfer: to the USA via Google group companies.
Privacy policy: https://policies.google.com/privacy

Vimeo (alternative video embeds)

Vimeo.com, Inc., 555 West 18th Street, New York, NY 10011, USA
Purpose: embedding selected videos where not delivered via YouTube. When played, a connection is established with player.vimeo.com and your IP address is transmitted.
Data transfer: to the USA, EU standard contractual clauses.
Privacy policy: https://vimeo.com/privacy

LinkedIn Insight Tag (retargeting)

LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland
Purpose: building audiences of visitors to our careers page in order to show them open positions on LinkedIn, and measuring whether such ads lead to visits.
Data transfer: Ireland; onward transfer to LinkedIn Corporation (USA) under the EU-U.S. Data Privacy Framework and standard contractual clauses.
Legal basis: your consent (marketing cookies), revocable at any time via "Cookie settings" in the footer.
Objection: LinkedIn retargeting settings

Meta Pixel (retargeting)

Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland
Purpose: building audiences of visitors to our careers page for ads on Facebook and Instagram, and measuring ad performance.
Data transfer: Ireland; onward transfer to Meta Platforms, Inc. (USA) under the EU-U.S. Data Privacy Framework and standard contractual clauses.
Legal basis: your consent (marketing cookies), revocable at any time via "Cookie settings" in the footer.
Objection: in the ad settings of your Facebook or Instagram account.

Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
Purpose: building audiences of visitors to our careers page for ads in the Google advertising network, and measuring ad performance. We use Google Consent Mode: no advertising cookies are set without your consent.
Data transfer: Ireland; onward transfer to Google LLC (USA) under the EU-U.S. Data Privacy Framework and standard contractual clauses.
Legal basis: your consent (marketing cookies), revocable at any time via "Cookie settings" in the footer.
Objection: Google ad settings

11. Automated individual decisions and profiling

CREATIO does not make automated individual decisions within the meaning of Art. 21 revDSG or Art. 22 GDPR that produce legal effects on you or similarly significantly affect you. In particular, no purchase offer is automatically prepared or rejected — every offer undergoes an individual review by our team.

Within our CRM system (HubSpot), technical contact and lead scoring takes place (categorisation, prioritisation of responses). This scoring is purely an internal working aid and does not constitute automated decisions with legal effect.

12. Your rights

Under Swiss data protection law (Art. 25 ff. revDSG) and — if resident in the EU — under GDPR, you have the following rights:

  • Access to the data stored about you
  • Rectification of incorrect data
  • Erasure of your data, provided no statutory retention obligation applies
  • Restriction of processing
  • Data portability (where applicable)
  • Objection to certain processing
  • Withdrawal of consent given, with effect for the future
  • Complaint to the competent data protection authority (in Switzerland: FDPIC, https://www.edoeb.admin.ch; in the EU: national supervisory authority at your place of residence)

To exercise your rights, an informal message to datenschutz@creatio.ch is sufficient.

13. Data security

We take state-of-the-art technical and organisational measures to protect personal data, in particular:

  • exclusively encrypted transmission via TLS 1.2+ (HTTPS with HSTS preload)
  • access protection for CRM and internal systems through multi-factor authentication
  • regular security updates for operating systems, frameworks and dependencies
  • role-based access rights within the company (need-to-know principle)

14. Changes to this privacy policy

We reserve the right to adapt this privacy policy in the event of changes to the legal situation or our services. The version published on this page applies in each case.

Last updated: 02.09.2026