Version 20 September 2026 — operational draft pending final legal review.
1. Controller
INFOAUTO SA, Rue des Saars 131, 2000 Neuchâtel, Switzerland, is the controller for the platform. Privacy requests may be sent to [email protected]. This notice is based on the Swiss Federal Act on Data Protection (FADP) and, where its territorial scope applies, the EU General Data Protection Regulation (GDPR).
2. Data we process
- account data, names, email addresses, telephone numbers, language and authentication records;
- company, register, tax, website, authorisation, beneficial ownership and verification-document data;
- address, canton/state, city, map position, coordinates and selected supplier radius;
- requests, offers, prices, messages, files, catalogues, evaluations, work-order and dispute records;
- membership orders, invoices, payment method, receipt and transaction references; we do not intend to store full payment-card details;
- support, consent, notification and communication preferences;
- security and usage data such as IP address, timestamps, browser/device information, logs and cookie identifiers.
3. Sources
We receive data from you, your organisation and its authorised users; from parties with whom you transact; from public company registers and verification sources; and automatically from your browser, device and platform activity. A person inviting you to a company team must be authorised to provide your business contact details.
4. Purposes and legal grounds
We process data to register and authenticate users; verify firms; publish profiles and catalogues; match location and category; operate requests, offers, messaging, acceptance, work orders and disputes; administer memberships and payments; send transactional notifications; provide support; prevent abuse; keep evidence and audit trails; comply with accounting, tax, sanctions and legal duties; and improve the service. Depending on the situation, processing is necessary for a contract or pre-contractual steps, compliance with law, legitimate interests in a secure and effective marketplace, or consent. Marketing and non-essential analytics rely on consent where required.
5. Visibility and recipients
Public profile and approved catalogue data are visible as indicated on the platform. Eligible suppliers may see an anonymised request; the selected supplier receives requester contact details after acceptance. Authorised users in an organisation may access organisation records according to their roles. Data may also be provided to hosting and infrastructure providers, Cloudflare storage/CDN, ZeptoMail, Google Maps, consent-based Google Analytics, payment providers, professional advisers, security services and competent authorities, only as necessary for their tasks.
6. International transfers
Some recipients may process data outside Switzerland or the European Economic Area. Where required, we rely on an adequacy decision, recognised data-protection framework, contractual safeguards such as standard contractual clauses, or another lawful exception. Users should avoid placing unnecessary personal or sensitive information in free-text fields and files.
7. Retention
Account and profile data are generally kept while the account is active and then for the time required to resolve claims and meet legal duties. Verification files are reviewed periodically and retained only as long as required for verification, defence of claims and compliance. Requests, accepted offers, payments and audit records may be retained for contractual limitation and statutory record-keeping periods; Swiss business and accounting records are generally retained for ten years. Unaccepted or expired operational data may be deleted or anonymised earlier. Security logs are retained for a limited period proportionate to risk.
8. Security
We use role-based access, encrypted transport, authentication controls, private object storage, backups, logging and administrative review. No system is completely secure. Users must protect credentials and must not upload special-category or highly confidential data unless it is necessary and the platform expressly allows it.
9. Your rights
Subject to applicable law, you may request access, correction, deletion, restriction, portability or objection, and may withdraw consent for future processing. We may verify identity and may retain data where a legal duty, overriding interest or legal claim requires it. Complaints may be made to the Swiss Federal Data Protection and Information Commissioner (FDPIC) and, where the GDPR applies, to the competent EU/EEA supervisory authority.
10. Automated decisions, children and updates
HD Online does not intend to make decisions producing legal or similarly significant effects solely by automated means without appropriate notice and safeguards. The service is not intended for persons under 18. We may update this notice when processing or law changes; material changes will be dated and appropriately communicated.