Privacy Policy

The controller responsible for data processing on the Platform is P&M Real Estate SA, Lugano, Switzerland. For any privacy-related request, contact us at immobiliare@pmre.ch.

Access to the Platform is by invitation only. We process:

• Identity and contact data — name, email address, phone number (optional).
• Company data — company name and legal address (used, among other things, to complete non-disclosure agreements).
• Account data — your password, stored only as a cryptographic hash; we cannot read it.
• NDA signature records — when you accept a confidentiality undertaking, we record your typed name, the timestamp, your IP address and browser identifier, and generate a signed PDF copy. These records serve as proof of acceptance.
• Transaction data — documents you download, offers and files you submit, and optional notes.
• Investment profile data — investment criteria and free-text notes you voluntarily submit to receive off-market opportunities.
• Audit logs — security-relevant actions on the Platform (e.g. document downloads, NDA acceptances, offer submissions) together with timestamp, IP address and browser identifier.

• Operating the Platform and managing transactions (performance of a contract or pre-contractual measures): account management, staged data-room access, NDA execution, offer handling, notifications.
• Evidence and legal protection (legitimate interest / legal claims): NDA signature records and audit logs document who accessed which confidential information and when.
• Security (legitimate interest): access control, abuse prevention, log analysis.
• Off-market matching (your request): investment profiles are used solely to contact you about opportunities matching your criteria.

Application data is stored in the European Union (Frankfurt, Germany): our database is hosted by Neon (Postgres) and documents are stored on Vercel Blob storage, both in the eu-central region. The application itself is operated on Vercel's infrastructure.

Some service providers are incorporated in the United States. Where personal data is transferred to countries without an adequate level of data protection, we rely on recognised safeguards, in particular the EU Standard Contractual Clauses and their Swiss addendum.

• Vercel Inc. — application hosting and document storage (data region: Frankfurt, EU).
• Neon Inc. — database hosting (data region: Frankfurt, EU).
• Resend — delivery of transactional emails (invitations, confirmations, notifications).

These providers process data on our behalf and under our instructions. We do not sell personal data and we do not use it for advertising.

The Platform uses strictly necessary cookies only: a session cookie and a security (CSRF) cookie required for secure sign-in. We use no analytics, tracking or marketing cookies. Because these cookies are technically required, they do not require consent; you can delete them in your browser at any time, which will sign you out.

Account and profile data are kept for the duration of your registration. NDA signature records, signed PDF copies, offers and related audit logs are retained after account closure for as long as necessary to establish, exercise or defend legal claims arising from the transactions concerned — generally up to ten years, in line with Swiss limitation periods. Data no longer required is deleted or anonymised.

Subject to applicable law, you have the right to access your personal data, to have it corrected or deleted, to restrict or object to its processing, and to receive it in a portable format. Note that we may retain data where a legal retention ground applies (e.g. NDA evidence). To exercise your rights, write to immobiliare@pmre.ch. You may also lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC) or, where the GDPR applies, with your local supervisory authority.

We may update this Privacy Policy from time to time. The version published on the Platform applies; material changes will be communicated to registered users.