Kadastra privacy policy

Version of 18 October 2026 — replaces the version of 4 October 2026

Translation. This policy has been translated from French. In the event of any discrepancy, the French version is binding.

1. Controller and contact

1.1 The controller of the personal data processed in connection with the Kadastra service (hereinafter “the Service”) is PMAX SA, Chemin des Quiess 12, 1907 Saxon, Switzerland (commercial register: CH-621.3.006.895-2; UID/VAT: CHE-112.203.929), hereinafter “PMAX” or “we”.

1.2 For any question relating to this policy or to the processing of your data, and to exercise your rights (Article 10), you may write to us at info@kadastra.ch or at the postal address above.

1.3 The processing of personal data is governed by the Swiss Federal Act on Data Protection (FADP) and its implementing ordinance, the Data Protection Ordinance (DPO). For persons located in the European Union, the General Data Protection Regulation (GDPR) also applies (Article 15).

1.4 This policy applies to the kadastra.ch website and to the app.kadastra.ch application, for the offer for private individuals (“Home”) as well as for the offer for professionals (“Pro”). The specific features of the Pro offer are described in Article 13.

2. Data you provide to us

When you subscribe to and use the Service, we process:

• your email address, which serves as your sign-in identifier and as the address to which alerts and communications relating to the Service are sent;
• your password, which we never keep in clear text but only in the form of an irreversible cryptographic hash;
• the parcels you register for monitoring: municipality, parcel number, monitoring radius, and any label you freely choose. Their geometry and coordinates are obtained from the federal services (Article 5). We recommend that you do not use a person's name as a label;
• your preferences: display language and notification settings;
• the subscription data: number of parcels subscribed, dates of start, end of the free trial and renewal, payment status and customer identifier assigned by our payment provider (Article 11). The amount paid is not stored in our database: only our payment provider holds it. We never receive or keep your bank card details or your TWINT credentials: they are entered directly on our provider's payment page;
• for the free trial of the Home offer, a non-reversible hash of the email address and of the payment method used for the trial (for a card, derived from the fingerprint calculated by our payment provider; no card number). These hashes do not make it possible to recover the address or the card, nor to link them to an account: they serve only to check that a trial has not already been granted;
• the record of your acceptance of the terms of use (version, date and time);
• the content of the messages you send us (support, Pro offer enquiry, exercise of your rights).

3. Data generated by the use of the Service

In the course of operating the Service, we also process:

• the alerts generated for your parcels (a match between an official notice and a monitored parcel) and their status (read, unread, archived);
• session data: a random identifier that keeps you signed in, of which we only keep a hash;
• single-use links sent by email (choosing or resetting a password, confirming a new address, terminating), of which we only keep a hash;
• the sign-in attempts (email address entered and IP address), used exclusively to protect accounts against intrusion attempts, of which we only keep a hash;
• technical server logs, which may contain an email address or an IP address, used for fault diagnosis and security.

The Service uses no audience measurement tool, no advertising tracker and no tracking pixel. We do not sell your data and do not pass it on to any third party for commercial or advertising purposes. The cookies and similar technologies used are described in our cookie policy.

4. Data from the official notices

4.1 The Service monitors the official notices published on the Swiss Official Gazettes Portal (amtsblattportal.ch, operated by the State Secretariat for Economic Affairs SECO), in particular the building permit applications and public consultations published in the Official Gazette of the Canton of Valais. These notices are prescribed by law and drawn up by the competent authorities. They contain personal data of third parties: the Valais construction act requires, for example, that the applicant's name be stated.

4.2 We do not keep those names. Of each notice, the Service retains only what is necessary for monitoring:

• the title;
• the municipality;
• the publication and deadline dates;
• the references of the parcels cited;
• the geographical position of the project;
• the official text of the appeal instructions;
• the links to the official notice.

As the title is drafted by the authority, it may exceptionally contain a name. We use it for no purpose other than displaying it in the alert, and we mask it upon a simple request from the person concerned sent to info@kadastra.ch.

4.3 The content of the notices is a matter for the authorities that issue them (municipalities, canton, federal authorities) and for the Swiss Official Gazettes Portal, which disseminates them. The link to the official notice leads to that document, which may contain third-party data and remains governed by the authority that issued it. PMAX is responsible only for the processing it carries out itself: collecting the notices, keeping them for a limited time and matching them against the monitored parcels.

4.4 This processing re-uses notices made public by the state for the very purpose for which they are published: to allow interested persons to learn of a project and to exercise their rights within the time allowed. It complies with the principles of the FADP:

• no name is kept;
• no profiling is carried out;
• retention is limited in time (Article 8.3).

It is justified by the overriding interest of our users in being informed of notices liable to concern their parcels (Art. 31 para. 1 FADP). For persons located in the European Union, it rests on our legitimate interest and that of our users (Art. 6(1)(f) GDPR).

4.5 Persons concerned by a notice may object to this processing as far as they are concerned (Article 10.3).

5. Federal map services

5.1 To locate a parcel or an address, the Service transmits your search (municipality name, parcel number or address entered) to the federal geoinformation services (GeoAdmin, Federal Office of Topography swisstopo). This request is made by our server and contains neither your email address nor any account identifier. The parcel data comes from the cantonal official cadastral survey.

5.2 The map displayed in the application is loaded by your browser directly from swisstopo's servers. On that occasion they receive your IP address and the technical information usual to any visit to a website.

5.3 swisstopo is not our processor: it is a provider of public data, which handles these requests under its own terms of use and in its capacity as a federal body.

6. Purposes of the processing

We process the data described above in order to:

6.1 provide the monitoring Service: register your parcels, compare them with the official notices and report matches to you;

6.2 send you the alerts, the summaries and the communications needed to operate the Service;

6.3 manage your account, your subscription, its payment and invoicing, and keep the record of the formation of the contract;

6.4 ensure the security of the Service, in particular prevent unauthorised access and abusive use; check that the free trial is granted only once per person (terms and conditions, Art. 4.4), and prevent it from being obtained more than once;

6.5 ensure the proper functioning, maintenance and improvement of the Service;

6.6 comply with our legal obligations, in particular accounting obligations, and assert or defend our rights.

We do not process your data for any other purpose without informing you beforehand.

6.7 We take no automated individual decisions within the meaning of Article 21 FADP and Article 22 GDPR. Alerts result from an automatic geographical comparison, but they produce no legal effect in respect of you.

7. Communications by email

7.1 The Service sends you each morning, by email, a summary of the new alerts concerning your parcels, if there are any. If no alert has been sent to you during the period, it also sends you, on Fridays, a short message confirming that monitoring is active, at the frequency you choose on the “My account” page: every week, every two weeks, every four weeks, or never.

7.2 You may turn off both of these at any time from the “My account” page or using the unsubscribe link in each email. The alerts then remain available in the application.

7.3 The emails essential to the management of your account and your subscription (choosing a password, confirmation of subscription and payment, renewal notice, change of terms, security) cannot be turned off.

7.4 We send no advertising communications.

8. Retention periods

8.1 Account and subscription

Your account data (email address, password hash, parcels, preferences, alerts) is kept as long as your account exists. When your subscription ends without being renewed, your account is deactivated, then deleted 90 days after the end of the subscription, unless a new subscription is taken out in the meantime.

8.2 Accounting data and record of the contract

• The documents relating to payments and invoicing are kept for ten years, in accordance with the statutory obligations to retain accounting records (Art. 958f of the Code of Obligations), including after your account is deleted.
• The record of your acceptance of the terms of use is kept for the same period, for evidential purposes.

8.3 Official notices

A notice is kept for 90 days from its publication or, if later, until the expiry of the response deadline it states, and for 12 months at most. At the end of that period:

• if it has given rise to no alert, it is deleted;
• if it has given rise to an alert, it is reduced to a trace (title, municipality, dates, links to the official notice) so that your alert history remains readable. That trace is deleted along with the alert, in particular when your account is deleted.

8.4 Technical data

8.5 Backups

Encrypted backup copies of the database are made daily, for security and continuity of the Service. Deleted data may remain in them until the backups rotate, for six months at most, before disappearing definitively. It is extracted from them only in the event of a restore following an incident, or for a restore test carried out in an isolated environment that is destroyed as soon as the check is complete. After a restore following an incident, the deletions that occurred in the meantime are reapplied.

8.6 Free trial

The hashes used for the free trial are kept for 24 months from the trial, including after your account is deleted: otherwise, deleting one's account and signing up again would make it possible to obtain a new trial. They are erased automatically at the end of that period.

9. Deletion of the account

9.1 You may delete your account at any time from the “My account” page of the application.

9.2 Deletion immediately erases your email address, the hash of your password, your parcels, your alerts, your preferences and your sessions. It is final and irreversible. It ends your subscription, with the financial effects provided for in the terms and conditions. The hashes used for the free trial (Article 8) are not erased by the deletion of the account; they are erased at the end of their retention period.

9.3 The following are kept, within the limits of Article 8:

• the accounting documents and the record of the contract (Article 8.2);
• the official notices, which are not your data (Article 8.3);
• the backups until they rotate (Article 8.5).

10. Your rights

10.1 Under the FADP, you have in particular:

• the right of access: to know whether we process data concerning you and to obtain a copy of it. The “My account” page allows you to download all your data at any time;
• the right to have your data handed over or transferred in a common electronic format;
• the right to rectification: your email address, your parcels and their labels can be changed from the application;
• the right to erasure (Article 9);
• the right to object to processing or to request its restriction, in the cases provided for by law.

10.2 For any request that cannot be met from within the application, write to us at info@kadastra.ch. We reply free of charge, within 30 days. We may ask you to prove your identity in order to protect your data against abusive requests. Rights may be restricted in the cases provided for by law, in particular where overriding third-party interests so require; we then tell you the reason.

10.3 Persons named in a notice processed by the Service have the same rights and may contact us at the same address, in particular to have a name appearing in a title masked or to object to the processing. Any request relating to the content of the official notice itself must be addressed to the authority that issued it.

10.4 If you consider that the processing of your data does not comply with the law, you may contact the Federal Data Protection and Information Commissioner (FDPIC, www.edoeb.admin.ch). For persons located in the European Union, see Article 15.

11. Hosting, recipients and transfers abroad

11.1 Hosting

The Service and its database are hosted in Switzerland, on a server operated by Infomaniak. Backups are encrypted before being sent and are kept in Switzerland.

11.2 Processors and other recipients

We use the following providers, which process your data only on our behalf and according to our instructions.

Infomaniak Network SA (Geneva, Switzerland): hosting of the server, storage of the encrypted backups and sending of the emails.

Stripe (payment provider): processing of payments for the Home offer.

• Our contracting party is Stripe Payments Europe, Limited, in Ireland, a state recognised by Switzerland as offering an adequate level of protection.
• The data is also processed by Stripe, Inc. in the United States. This transfer rests on Stripe's certification under the Swiss-U.S. Data Privacy Framework, recognised by the Federal Council since 15 September 2024 (and, for persons in the EU, under the EU-U.S. Data Privacy Framework), and, in the alternative, on standard contractual clauses.
• You give your email address on kadastra.ch, before the payment page: we check whether it has already had the free trial (Article 2), without keeping it at that stage, then transmit it to Stripe together with the number of parcels chosen and the display language. Stripe collects the necessary payment and billing data directly from you, then confirms to us the email address used to open your account.
• For a card, we receive from Stripe a technical fingerprint of the payment method (without the card number), of which we keep only a non-reversible hash, for the purposes described above.
• Stripe acts as our processor for the processing of payments, and as an independent controller for its own obligations, in particular fraud prevention and compliance with financial regulation.
• For more information: stripe.com/privacy.

TWINT. If you pay by TWINT, the transaction is additionally handled by TWINT AG (Switzerland), under its own terms, by means of your TWINT app.

Other recipients. We may also disclose data:

• to our advisers (accountant, lawyer), who are bound by professional secrecy;
• to the authorities, where the law obliges us to or where it is necessary to assert or defend our rights;
• to any acquirer of the Service, under the conditions provided for in the terms and conditions.

11.3 Transfers abroad

With the exception of the processing of payments by Stripe described above, your data does not leave Switzerland. Any new transfer would be announced by an update of this policy.

12. Security

We implement appropriate technical and organisational measures to protect your data against unauthorised access, loss or alteration (Art. 8 FADP), in particular:

• the irreversible hashing of passwords, which are never kept in clear text;
• the encryption of communications between your device and the Service (HTTPS);
• the limitation of sign-in attempts;
• server access restricted to a limited number of individually designated persons, by cryptographic key;
• daily encrypted backups, kept off the server.

In the event of a breach of data security likely to result in a high risk to your rights, we notify it to the FDPIC (Art. 24 FADP) and, where this is necessary for your protection or the FDPIC requires it, we inform you. For persons in the EU, Articles 33 and 34 GDPR are complied with.

13. Pro offer

13.1 For Pro accounts, PMAX is the controller of the account data of the professional users (email address, preferences, sessions), under the conditions of this policy.

13.2 The data of the portfolio monitored by a Pro client (parcels, file references, imported files) is processed by PMAX on behalf of that client, in its capacity as processor, in accordance with the appendix “Data processing agreement” of the Kadastra Pro terms and conditions. That appendix sets out in particular its retention period and the list of sub-processors. The persons concerned by this data may exercise their rights with the Pro client; PMAX forwards without delay any request that reaches it directly.

13.3 As Pro clients pay their subscription by invoice, their payment data does not pass through Stripe.

14. Minors

The Service is not intended for persons who are minors. We do not knowingly collect data concerning them.

15. Persons located in the European Union (GDPR)

15.1 Where the GDPR applies, we process your data on the following legal bases:

15.2 You have the rights of access, rectification, erasure, restriction, portability and objection (Articles 15 to 21 GDPR). You may exercise them in accordance with Article 10.

15.3 You may lodge a complaint with the supervisory authority of the member state of your habitual residence, your place of work or the place of the alleged infringement.

15.4 Switzerland benefits from an adequacy decision of the European Commission. Transfers to the United States are described in Article 11.2.

15.5 PMAX has not designated a representative in the European Union within the meaning of Article 27 GDPR. It considers that it meets the conditions of the exception provided for in Article 27(2)(a) GDPR: its processing is occasional and does not include, on a large scale, processing of special categories of data or of personal data relating to criminal convictions and offences. Data subjects may contact us directly at info@kadastra.ch.

16. Changes

We may adapt this policy, in particular where the Service, our providers or the applicable law change. The version in force is published on kadastra.ch, with its date; earlier versions are available on request. Any substantial change is announced to you by email at least 30 days before it enters into force, unless a faster change is required by law.

PMAX SA — Chemin des Quiess 12 — 1907 Saxon — Commercial register: CH-621.3.006.895-2 — UID/VAT: CHE-112.203.929

Contact: info@kadastra.ch