Privacy policy

The German version is legally binding.

1. What this is about

This policy describes which personal data the website vorbau.ch (‘Vorbau’) processes, for what purpose, for how long and to whom it is disclosed. It applies to the website, the accounts, the email alerts, the firm profiles and to personal data that Vorbau takes over from official publications.

In brief:

• No tracking, no analytics or advertising cookies, no social media plug-ins.
• Vorbau sets no cookies when you merely browse. After you sign in, there is a technically necessary session cookie.
• For an account and alerts, only your email address is needed.
• Payments are handled by Stripe; Vorbau never sees card details.
• Vorbau shows information from official publications. Vorbau does not display the names of private individuals. Anyone affected will find their rights in section 10.

2. Controller

We have not appointed a data protection advisor (Art. 10 FADP).

Vorbau is aimed at persons in Switzerland and Liechtenstein and does not monitor behaviour (no tracking). In our assessment, the EU General Data Protection Regulation (GDPR) therefore does not apply; the fact that the servers are located in Germany does not change this.

3. Overview

4. Visiting the website

4.1 Hosting and server logs

The website runs on servers of Hetzner Online GmbH, Industriestrasse 25, 91710 Gunzenhausen, Germany, in data centres in Germany. Hetzner processes the data as a processor on our behalf (Art. 9 FADP).

With every request, the server automatically stores the IP address, date and time, the address requested, the status code, the amount of data transferred, the referrer and the browser identifier. We need this data to operate the website securely and reliably, to fend off attacks and to find errors (overriding interest, Art. 31(1) FADP). The logs are deleted after 14 days at most. If the system detects suspicious access, such as many failed attempts, it temporarily blocks the IP address.

4.2 Cookies and local storage

• Without signing in: no cookies.
• After signing in: a session cookie nr_session. It contains a random value, keeps you signed in, is only transmitted via HTTPS, cannot be read by JavaScript and expires after 30 days. It is deleted when you sign out. On the server we only store a check value (hash) of this value.
• Your browser’s local storage: the selected colour scheme (vorbau.theme), the selected map view (nr.base) and whether your areas are shown on the map (vorbau.mine). This information stays on your device and is not transmitted to us.

We do not set analytics, tracking or advertising cookies.

4.3 Fonts from Google

When you open the pages, your browser loads fonts from servers of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (Google Fonts). In the process, Google receives your IP address, browser information and the address of the page requested. Google may transfer this data to the USA; Google LLC is certified under the Swiss-U.S. Data Privacy Framework. We use the fonts so that the website is displayed consistently. Google’s privacy notice: policies.google.com/privacy.

4.4 Maps, aerial images, place search and location

When you open the map, your browser loads map tiles, vector maps, map fonts and aerial images directly from servers of the Federal Office of Topography swisstopo (wmts.geo.admin.ch, vectortiles.geo.admin.ch). For the place search, your search term is transmitted to api3.geo.admin.ch. In the process, swisstopo receives your IP address and browser information and processes them in accordance with its own terms (geo.admin.ch).

If you use the location button on the map, your browser asks for permission. The location is only used in the browser to move the map there; we do not store it.

5. Account and sign-in

You need an account for the Pro and Business plans, for firm profiles and to manage alerts. Sign-in works without a password: we send you a six-digit code and a sign-in link by email. The account is created on your first successful sign-in. The justification is the contract with you.

We store:

• your email address and the time it was confirmed,
• the plan, the payment option (monthly subscription or annual pass), the end of the paid term and the customer and subscription number at Stripe,
• the time the account was opened,
• sign-in codes and sign-in links only as a check value (hash), never in plain text; the code is valid for 10 minutes, and the entries are deleted after one day,
• to protect against misuse (at most 5 code emails per address and 20 per IP address per hour), a check value of your IP address, likewise for one day at most.

We send the emails via Infomaniak Network SA, Rue Eugène-Marziano 25, 1227 Les Acacias (Geneva), Switzerland, as a processor.

Your account remains in existence until you request its deletion. To do so, write to info@vorbau.ch. We will then delete the account, sessions, alerts and firm profiles; we retain payment receipts in accordance with section 13.

6. Email alerts

You can receive alerts about new or changed construction projects and forced auctions in an area. For this purpose we store:

• your email address (for signed-in users, the account address) and, where applicable, the link to the account,
• the area (circle, rectangle or freely drawn shape),
• the selected filters and an optional name,
• a random key for confirmation and unsubscribing, and the times of creation, confirmation, last sending and unsubscribing.

Without an account, an alert only becomes active once you confirm it via the link in the confirmation email. The justification is your consent. We delete unconfirmed alerts after 7 days. With an account, the alert is part of the contract and is active immediately.

The alerts contain aerial image sections from swisstopo. These images are generated by our server; your email program loads them from vorbau.ch. This generates the server logs described in section 4.1. We do not analyse whether or when you open an email. The preview images are deleted after 120 days.

Every email contains an unsubscribe link; you can end alerts at any time in your account. After you unsubscribe, we delete the alert within 30 days.

7. Payments

Payments are processed by Stripe. Vorbau’s contractual partner is Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland. You enter card or TWINT details directly on Stripe’s payment page; they never reach our servers.

We receive from Stripe your email address, a customer number, where applicable a subscription number, the service purchased, the amount, the time and the payment status. Stripe produces invoices and receipts on our behalf. Via the Stripe customer portal you can change your means of payment and cancel your monthly subscription.

Stripe processes data partly as an independent controller, in particular to combat fraud and to fulfil legal obligations, and may transfer data to Stripe, Inc. in the USA. Stripe, Inc. is certified under the Swiss-U.S. Data Privacy Framework; otherwise Stripe relies on standard data protection clauses. If the payment page offers further payment methods, the privacy terms of the respective provider also apply. Stripe’s privacy notice: stripe.com/ch/privacy.

8. Firm profiles and enquiries

If you create a firm profile, we store the website, the contact address, the telephone number, the description, the services and the regions. You confirm the contact address with a code; we only store the code as a check value and delete it after one day. Once approved, the description, services, regions, website and telephone number are publicly visible and accessible to search engines; we do not display the contact address. The data remains stored until you have the profile deleted.

Anyone who writes via the enquiry form of a firm profile provides their name, email address and message. With your consent, we forward the enquiry once by email to the firm and do not store it. To protect against misuse, we count enquiries using a check value of the IP address and delete this entry after two days. From the time of forwarding, the firm is responsible for your data.

9. Contact

If you write to us by email, we process your address and the content in order to answer your enquiry. The mailbox is hosted by Infomaniak in Switzerland. We delete the correspondence once it has been dealt with and there is no obligation to retain it, at the latest after two years.

10. Data from official publications and registers

This section is addressed to persons named in official publications.

10.1 What data and where it comes from

• Building permit applications from the official gazettes of the cantons of ZH, BE, ZG, BS, BL, AR and TI (via amtsblattportal.ch): developer/building owner and project author (architect), address and plot of the construction project, project description, place of public display, deadlines and links to the public display of plans. We take over the publication as published. We do not display the names of private individuals; instead the entry reads ‘Private individual’. The names of companies, cooperatives, foundations and public bodies are visible to signed-in customers with a Pro or Business plan.
• Forced auctions from the Swiss Official Gazette of Commerce (SOGC) and the cantonal official gazettes: property details such as location, plot, official estimate, date and viewing. We do not store the names of debtors.
• Commercial register (Zefix (Central Business Name Index), open government data of the Confederation via LINDAS): company name, legal form, UID (business identification number), registered address and purpose. For sole proprietorships, the company name contains the name of the owner. Visible to Business.
• Federal Register of Buildings and Dwellings (RBD): no names, only information on buildings and dwellings.

Vorbau links building permit applications to the commercial register via the UID or the exact company name. In the firm directory (Business only), the building permit applications that architecture firms have submitted as project author are shown for those firms.

10.2 Purpose and justification

The purpose is a research service: people looking for housing, owners, professionals and companies should be able to find out where construction is taking place and which firms are involved. The authorities published the information so that the public can take note of construction projects. We rely on an overriding private interest (Art. 31(1) FADP) and keep the processing proportionate through the following measures: no display of names of natural persons, company names only behind a sign-in with a paid plan, no indexing of this information by search engines, no debtor data, no search by personal name, a right to object under section 10.3 and a prohibition of advertising and harassment in the terms of use.

10.3 Your rights as a data subject

You may at any time request information as to whether and which data about you appears on Vorbau, have incorrect information corrected and object to the processing. If you object, we will remove the information within 30 days, unless there are exceptionally overriding reasons for continuing to display it; we will inform you of these. Please write to info@vorbau.ch and state the building permit application (municipality, date or publication number) or the firm. Corrections to the official publication itself must be made by the publishing authority.

11. Recipients and processors

• Hetzner Online GmbH, Germany: processor for hosting and database (all data stored on Vorbau).
• Infomaniak Network SA, Switzerland: processor for email sending, mailbox and DNS.
• Stripe Payments Europe, Ltd., Ireland (and Stripe, Inc., USA): payments, partly as an independent controller.
• Google Ireland Ltd., Ireland (and Google LLC, USA): fonts, as an independent controller.
• Federal Office of Topography swisstopo, Switzerland: maps and place search, as an independent controller.
• Firms with a firm profile: enquiries via the enquiry form.
• Vorbau customers: data under section 10 within the scope of their plan, including CSV export.
• Authorities and courts, where we are legally obliged to disclose data to them.

We do not sell personal data or pass it on for third-party advertising.

12. Disclosure abroad

Personal data is disclosed to Germany (Hetzner), Ireland (Stripe, Google) and the USA (Stripe, Inc.; Google LLC). According to the decision of the Federal Council, Germany, Ireland and the USA, the latter for companies certified under the Swiss-U.S. Data Privacy Framework, ensure an adequate level of data protection (Art. 16(1) FADP). Where a recipient is not certified, the disclosure is based on standard data protection clauses (Art. 16(2)(d) FADP).

13. Retention

14. Data security

We take appropriate technical and organisational measures (Art. 8 FADP), including encrypted transmission (HTTPS), storage of codes, links and session keys only as check values, limited sign-in attempts, a database that is not publicly accessible, access for the operator only and regular backups. We report data security breaches likely to result in a high risk to the Federal Data Protection and Information Commissioner (FDPIC) as soon as possible (Art. 24 FADP).

15. Your rights

Under the FADP, you have in particular the right to

• request information as to whether and which personal data we process about you (Art. 25 FADP); we generally reply within 30 days and free of charge,
• request the correction of incorrect data,
• object to the processing and request erasure,
• request the handover of the data you have provided to us yourself in a commonly used electronic format (Art. 28 FADP),
• withdraw your consent at any time with effect for the future; for alerts, this is easiest via the unsubscribe link.

To do so, write to info@vorbau.ch. To ensure we do not disclose data to unauthorised persons, proof that the email address belongs to you may be required. You may also lodge a complaint with the FDPIC, Feldeggweg 1, 3003 Bern, edoeb.admin.ch.

16. No automated individual decisions

We do not make decisions that are based exclusively on automated processing and that have legal effects on you or significantly affect you (Art. 21 FADP). We do not create profiles of your usage behaviour.

17. Changes

We amend this policy when our processing changes. The version published on vorbau.ch applies. In the event of material changes, we will inform account holders by email. The German version is authoritative. Further information on the data sources: Sources and licences.

As of 11 October 2026