Privacy

Controller

Quartiero GmbH
Bernstrasse 27b
3122 Kehrsatz
Switzerland

The Swiss Data Protection Act (revDSG) applies. Quartiero GmbH is the controller for the processing. Please direct privacy questions to info@quartiero.ch.

Territorial scope

Quartiero's offering is currently aimed at business customers in Switzerland, and the revDSG applies. Use from the European Union is not excluded. Where the European General Data Protection Regulation (GDPR) applies to a specific processing activity, the data subject rights it provides apply in addition to the rights under the revDSG.

What data we process

When you visit the website and the portals, the server briefly logs technical connection data such as IP address, time, the page requested and the browser type. These access logs serve secure operation and troubleshooting. They are kept in Zurich for 180 days, and K-I-Soft IT&Holding GmbH, which operates the platform for us, analyses them without cookies.

For signing in to the portals (management portal, advertising portal, operator portal) we use Amazon Cognito. This processes the account data of the signed-in person, usually email address and name, so they can sign in and use the respective portal.

When you write to us through the contact form or by email, we process the details you provide (name, email, phone if given, and your message) in order to answer your enquiry.

We only use technically necessary cookies needed for sign-in and the session. There is no tracking and there are no advertising cookies on the website.

Purposes of processing

We process this data to provide and securely operate the website and the portals, to manage sign-ins and accounts, to play out the stairwell content on behalf of the property management, to answer enquiries, to send notices and the newsletter, and to keep the anonymous reach and click measurement for advertising.

Notices and newsletter

Besides the emails about your account, orders and invoices, we send circulars to the customers of the management portal, of two kinds:

  • Notices about your contract and the operation of Quartiero, for example a change to the general terms and conditions or to the data processing agreement. They are part of performing the contract, also go to people who have unsubscribed from the newsletter, and cannot be unsubscribed from.
  • Newsletter with news about Quartiero and similar offerings of Quartiero GmbH. You receive it as a customer on the basis of the existing customer relationship (Art. 3 para. 1 let. o UCA). You can unsubscribe at any time through the link in every issue or with the switch in your profile in the management portal. Unsubscribing applies to the quartiero.ch newsletter; you will continue to receive notices.

For every mailing, we record per recipient the address the email went to and at what time, and note an unsubscription. This makes it possible to show when a notice was sent. We do not measure whether or when you open an email: the emails contain neither tracking pixels nor tracked links. They are sent through Amazon Simple Email Service.

Content in the portals

The property management maintains the stairwell content in the portal, such as notices, house rules or contact details. Where such content contains personal data, for example the name of a caretaker, we process it on behalf of the management. The data processing agreement applies to this.

Data from the screens in the stairwell

The screens count anonymously only. We record whether a movement occurred and whether a click happened, each as a plain count without any link to a person. There is no camera or person recognition, and residents do not sign in.

Measurement uses a motion or presence sensor (infrared or radar) that only detects presence and movement and does not capture or store any images. The anonymous counts serve to measure reach and clicks for advertising.

Weather and departures tile

At the property management's choice, the screen additionally shows the time, local weather and the next public-transit departures within walking distance. For departures we send the device's fixed installation location directly to opentransportdata.swiss, as a search for nearby stops. The MeteoSchweiz local forecasts (data.geo.admin.ch), by contrast, we download as an open, publicly available file and evaluate ourselves; the device's location never reaches MeteoSchweiz. Neither provider receives any information about individuals. The source is shown directly alongside the display.

Advertising

Advertisers and agencies receive only anonymous, aggregated figures, such as the reach and the number of clicks of a campaign. No personal data is passed to advertisers, and there is no advertising targeted at an individual.

Resident app

Anyone using the resident app pairs it with the public building code shown on the screen in the stairwell. No sign-in with personal data is needed for this. The app shows the same anonymous building information that already runs on the screen.

Payment processing

For payment processing we work with wallee AG (Switzerland) as our payment service provider. If you store a card or TWINT as a payment method, the payment details are captured and stored exclusively at wallee (tokenisation). Quartiero stores only a token reference, the name of the payment method and transaction references, and at no time card data. We transmit to wallee the billing and contact details you entered (company, address, email), as far as they are needed for payment processing.

Disclosure to third parties

We do not sell personal data. Disclosure only happens to processors who support us in operating the service and are bound by our instructions: K-I-Soft IT&Holding GmbH (Switzerland) for development, operation and support of the platform and the analysis of the access logs, Amazon Web Services for hosting, database, sign-in (Amazon Cognito), sending email and converting videos, and wallee AG (Switzerland) for payment processing. Beyond that, we disclose data where we are legally required to.

Hosting and storage location

The data is stored exclusively in Switzerland, in Amazon Web Services data centres in Zurich, as are the backups. It is encrypted with the platform's own key, which is also located in Zurich.

In some technical processes data passes encrypted through locations outside Switzerland without being stored there:

  • Access: browsers and screens connect to the nearest access point of the Amazon Web Services worldwide network (Amazon CloudFront), in Europe usually one in the EU. It keeps images, videos and documents in its cache for a limited time so that they load quickly. The technical error logs of the sign-in check at the access point are deleted after 30 days.
  • Real-time connection: screens and portal are connected through a data centre in Frankfurt (Germany), because the service used for this is not offered in Zurich. Status messages, commands and notices of changes pass through it, but no content. Technical connection logs are kept there for 30 days.
  • Converting videos: an uploaded video is converted for the screens in Frankfurt and then stored back in Zurich.

According to the decision of the Swiss Federal Council, Germany and the EU provide data protection equivalent to that of Switzerland.

Amazon Web Services is a US company. Even though the data is kept in Switzerland, access by US authorities under US law, such as the CLOUD Act, cannot be ruled out with absolute certainty. In case data reaches the USA, for example through an access point there, the Amazon Web Services data processing agreement provides for protection under Swiss law, with the EU standard contractual clauses and the Swiss-U.S. Data Privacy Framework. We also address the residual risk with encrypted transmission and storage and the principle of data minimisation.

Data security

We take appropriate technical and organisational measures to protect the data: encryption in transit and with our own key at rest, two-factor sign-in, access limited to authorised persons, separate processing per tenant and continuous backups of the database. No one can guarantee absolute security for transmission over the internet.

Retention

The anonymous raw counts from the screens are given an automatic deletion period (TTL) of 90 days and are removed after they are summarised into anonymous daily totals. Technical device error logs expire automatically after 30 days. Content and accounts in the portals are kept for the duration of the contractual relationship and deleted afterwards. Enquiries via the contact form are kept for as long as needed to handle them. Access logs are deleted after 180 days. We keep the record of notices and newsletters sent, because it shows when a notice was sent. When an account is deleted, we remove the name and email address from it; the time and result of the dispatch remain as evidence.

Your rights

Under revDSG you have the right to access, rectification and erasure, as well as to restriction of processing. Please contact the office named above. If you disagree with our processing, you can lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC).

Changes to this policy

We adjust this privacy policy when our processing or the legal requirements change. The version published on this page applies.

Last updated: October 2026