Privacy policy

1. Controller and contact

The controller responsible for processing personal data on this website and in connection with our services is:

For any questions about data protection, or to exercise your rights, please write to contact@prontamano.ch or send a letter to the address above.

Our services are aimed at clients in Switzerland, and we process data of people living in the EU/EEA only occasionally. We have therefore not appointed a representative in the EU (Art. 27 para. 2 GDPR); please contact us directly.

2. Scope of this policy

This policy explains how we collect and process personal data when you visit our website, request a quote, contact us or use our services. It is based on the Swiss Federal Act on Data Protection (nFADP) and its Ordinance (DPO).

Where the EU General Data Protection Regulation (GDPR) applies to our processing in an individual case, this policy also provides the information required by the GDPR.

"Personal data" means any information relating to an identified or identifiable person. "Processing" means any handling of such data, e.g. collecting, storing, using, disclosing or deleting it.

3. Personal data we process

Quote requests

When you use our quote form, we process:

• your name and contact details (e-mail address, phone number, preferred way of contact and language);
• the service address and, for moves, the destination address, including floor, lift and access details;
• the type of property and your preferred date and time;
• details about the requested services (e.g. size of the home, items, volumes, special items) and your message;
• photos you choose to upload. We automatically remove embedded metadata (EXIF, e.g. the GPS location; only a colour profile, which contains no personal data, may be kept) and keep the photos in private storage that is not publicly accessible;
• optionally, how you heard about us;
• the time at which you accepted this privacy policy.

Contact form

When you write to us through the contact form, we process your name, e-mail address, phone number (optional), the topic and your message, the language of the website and the time at which you accepted this privacy policy.

Notification and confirmation e-mails

When a quote request or a contact message arrives, our team is informed by an internal e-mail that contains no personal data: for a quote request, only its reference, the service requested, the town with its postcode and the time it arrived; for a contact message, only its number and the time it arrived. Your details stay in our administration system, where the retention periods of section 8 apply.

We send a confirmation of receipt to the e-mail address you entered. It does not repeat your contact details or anything you wrote in your own words; for a quote request, it summarises the service and the options you chose, with the postcode instead of the full addresses.

E-mail, phone and messaging

When you contact us by e-mail, phone or WhatsApp, we process the content of the communication and the related contact details. WhatsApp is a third-party service with its own terms and privacy policy: its provider only receives your data if you choose to contact us that way (see section 6). If you prefer, please contact us by phone or e-mail instead.

Contract data

When you book a service, we process the data needed to plan, perform and invoice it, e.g. the agreed services, dates, correspondence, invoices and payments.

Reviews

If you give us a review of our work and agree to its publication, we show it on our website (on the home page and the pages of our services) with the name you agreed to (usually your first name and the initial of your surname), your town, the service we provided, your text, your rating and the date of the review (month and year). We ask for your consent before we publish a review, and publish it only on that basis (Art. 6(1)(a) GDPR). A published review can be read by anyone who visits our website. You can withdraw your consent at any time, e.g. by e-mail: we then remove the review from our website and delete it.

Technical data

When you visit our website, the server records technical data in log files (IP address, date and time, requested page, browser and operating system, referring page). We use these logs only to keep the website secure and stable, and delete them after 30 days.

To protect our forms against abuse, we temporarily count how often they are sent from each IP address (for IPv6, from each /64 network) and how many confirmations of receipt are sent to each e-mail address. The address is only kept as a keyed hash: a pseudonym that cannot be traced back to the address without a secret key, which we store separately. The hash is held in a short-lived cache for at most one hour (24 hours for an e-mail address) and is never saved together with your request.

4. Purposes

We process personal data only for the following purposes:

• answering your requests and preparing quotes;
• communicating with you before, during and after a job;
• publishing your review on our website, with your consent;
• coordinating certified partners, with your agreement;
• operating and securing our website and preventing abuse of our forms;
• measuring, in aggregated form, how our website is used, if you have accepted Google Analytics (see section 12);
• complying with legal obligations, e.g. accounting and tax rules;
• establishing, exercising or defending legal claims.

We do not send newsletters or advertising, and we do not use your data for any other purpose without informing you first.

5. Legal basis

We process personal data in line with the principles of the nFADP (lawfulness, good faith, proportionality, purpose limitation, transparency and accuracy). Where the GDPR applies, we rely on the following legal bases:

• Art. 6(1)(b) GDPR — to prepare quotes and to perform a contract with you;
• Art. 6(1)(c) GDPR — to comply with legal obligations, e.g. retention of accounting records;
• Art. 6(1)(f) GDPR — for our legitimate interests in a secure website, in preventing abuse, in efficient communication and in defending legal claims;
• Art. 6(1)(a) GDPR — your consent, where we ask for it. You can withdraw your consent at any time with effect for the future.

6. Recipients and processors

We only disclose personal data where this is necessary for the purposes above, namely to:

• our hosting provider, which operates the servers of our website and database;
• our e-mail provider;
• our backup storage provider, which keeps encrypted backup copies of our database and uploaded files;
• the providers of the optional tools listed in our cookie policy, only if you have allowed them (see section 12);
• IT, accounting and fiduciary service providers, where needed for their tasks;
• certified partners (e.g. electricians, plumbers or cleaning companies), only with your agreement and only the data they need for the job;
• visitors to our website, who can read a review you have allowed us to publish (see section 3);
• authorities and courts, where we are legally obliged to do so or where it is necessary to protect our rights.

Processors act only on our instructions and are contractually bound to protect your data. We never sell or rent personal data. Charities and donation points receive donated items only, never your personal data.

WhatsApp: only if you choose to contact us via WhatsApp, your messages and contact details are also processed by the provider of WhatsApp, WhatsApp Ireland Limited, Dublin, Ireland (Meta group). It acts as an independent controller under its own terms and privacy policy, which we do not control. You can always reach us by phone or e-mail instead.

7. Disclosure abroad

Our hosting, e-mail and backup providers process personal data in the countries stated for them in section 6. As a rule, we only disclose personal data to countries that the Swiss Federal Council recognises as providing adequate data protection (Annex 1 DPO), which include the member states of the EU/EEA.

If data is disclosed to a country without adequate protection, we ensure appropriate safeguards, in particular the EU standard contractual clauses recognised by the Federal Data Protection and Information Commissioner (FDPIC), or rely on a statutory exception, e.g. the performance of a contract with you. You can ask us for a copy of these safeguards.

The providers of the optional tools and the countries in which they process data are listed in our cookie policy.

If you contact us via WhatsApp, its provider may also transfer data to the USA and other countries. It relies on its own safeguards for this (e.g. the Data Privacy Framework or standard contractual clauses), which are described in its privacy policy.

8. Retention periods

We keep personal data only as long as necessary for the purpose for which it was collected or as required by law:

Data is deleted automatically at regular intervals (at least once a month) once its retention period has ended; a quote request is always deleted together with its photos. If we need specific data longer to establish, exercise or defend legal claims, we keep only that data, and only for as long as necessary.

9. Data security

We protect personal data with technical and organisational measures appropriate to the risk, in particular:

• encrypted transmission (HTTPS/TLS) for all pages and forms;
• access to requests limited to authorised staff with personal accounts;
• private, non-public storage for uploaded photos, which only authorised staff can download;
• data minimisation: our forms only ask for what we need, and photo metadata is removed;
• protection of our forms against spam and abuse, without third-party captcha services.

No transmission over the internet is completely secure. Please do not send us particularly sensitive data (e.g. health data) unless it is necessary for the service.

10. Your rights

Under the nFADP and, where applicable, the GDPR, you have the right to:

• information and access — find out whether and which personal data we process about you (Art. 25 nFADP, Art. 15 GDPR);
• data portability — receive the data you gave us in a common electronic format, or have it transferred to another controller (Art. 28 nFADP, Art. 20 GDPR);
• rectification of inaccurate data (Art. 32 nFADP, Art. 16 GDPR);
• deletion of your data, unless we are required to keep it (Art. 32 nFADP, Art. 17 GDPR);
• restriction of processing (Art. 18 GDPR);
• objection to processing based on our legitimate interests (Art. 30 para. 2 lit. b nFADP, Art. 21 GDPR);
• withdrawal of consent at any time, with effect for the future.

These rights may be restricted where the law allows it, e.g. when we must keep data because of statutory retention obligations or to protect overriding interests.

11. Automated decisions and profiling

We do not make automated individual decisions and we do not carry out profiling. Every quote is prepared by a member of our team.

12. Cookies, analytics and third-party content

Our website uses the cookies that are necessary for it to work and to remember your cookie choices. In addition, it offers the optional tools listed in our cookie policy (for example for statistics). They only run, and only set their cookies, after you have allowed their category in the cookie banner or the cookie settings (Art. 6(1)(a) GDPR). You can withdraw your consent there at any time, with effect for the future.

• __Host-csrftoken — Protects our forms (quote request, contact) against cross-site request forgery. It contains a random security token only. Storage period: 1 year.
• __Host-sessionid — Keeps staff members logged in to the administration area and, after you send a quote request, briefly remembers its reference number for the confirmation page. Storage period: 8 hours.
• messages — Shows a one-time confirmation message after a staff member saves a change in the administration area. Storage period: Deleted as soon as the message has been shown.
• pm_consent — Stores your cookie choices (or that you have read the cookie notice) so that we do not ask you again on every page. Storage period: 1 year.
• _ga (Google Analytics, Google Ireland Limited, Ireland, and Google LLC, USA) — Distinguishes visitors by a random number, so that Google Analytics can count them. Storage period: 2 years.
• _ga_CZE6FL4ZWX (Google Analytics, Google Ireland Limited, Ireland, and Google LLC, USA) — Keeps the state of your current visit for Google Analytics. Storage period: 2 years.

Fonts, scripts and images are served from our own server: apart from the optional tools you allow, visiting our website sends no data to third parties. If we add or change an optional tool, we ask for your consent again and update this policy.

Links to social networks and other websites are plain links: data is only transmitted to those providers when you click them, and their privacy policies apply.

13. Minors

Our services are aimed at adults. We do not knowingly collect personal data of children. Minors should only contact us with the consent of their legal representative.

14. Changes to this policy

We may update this policy when our services or the law change. The version published on this page applies. Where appropriate, we inform you of significant changes.

15. Right to lodge a complaint

If you believe that we process your data unlawfully, please contact us first — we will do our best to find a solution.

You also have the right to contact the Swiss data protection supervisory authority:

If you live in the EU/EEA, you may also lodge a complaint with the supervisory authority of your country of residence — in Italy, the Garante per la protezione dei dati personali.

See also our terms of service.