Privacy Policy
This privacy policy explains how we collect, use and protect personal data when you visit our website, contact us, subscribe to our newsletter, or use our real-estate services (sale, holiday rental, long-term rental, valuation, consulting and property management) in and around Zermatt.
It is written to meet the Swiss Federal Act on Data Protection (FADP / nDSG) and, where the GDPR applies to our processing — including where its territorial scope is triggered by our activities involving individuals in the EEA or the UK — the GDPR as well.
1. Who is responsible
Depending on the service you use, one or more of the following companies act as controller (and, where they jointly decide purposes and means, as joint controllers):
-
Anton Lochmatter AG
Bahnhofplatz 2, Postfach 231, 3920 Zermatt, Switzerland
UID: CHE-115.793.516
Phone: +41 27 967 20 01 · Email: info@alag.swiss -
ZERMATTHOMES Immobilien Lochmatter AG
Bahnhofplatz 2, 3920 Zermatt, Switzerland
UID: CHE-114.001.532 -
Anton Lochmatter Verwaltungs AG
Bahnhofplatz 2, 3920 Zermatt, Switzerland
UID: CHE-371.505.798
In this policy, “we”, “us” and “the Group” mean these companies. For most website and brokerage contacts the primary controller is Anton Lochmatter AG. Property-management files may be processed by Anton Lochmatter Verwaltungs AG. Holiday-rental operations may involve ZERMATTHOMES Immobilien Lochmatter AG.
We have not appointed a data protection officer. Privacy requests: info@alag.swiss.
2. What data we process
Website use
When you open our pages we process technical data: IP address, date and time, requested URL, referrer, browser and device information, and approximate location derived from the IP. Server logs are used for security, fault diagnosis and to deliver the site.
Enquiries and client relationship
If you write to us, call us, use a contact or viewing form, or instruct us as buyer, seller, landlord, tenant, guest or owner, we process identity and contact data (name, salutation, address, email, phone), language, the content of the enquiry, property preferences (type, budget, rooms, location, first/second home), viewing appointments, contract and identification data required for a transaction, and correspondence. When you submit a form we also record technical data from that request: IP address, browser and device (user agent), date and time, the page or listing from which the form was sent, and similar transmission data. We use that technical data to run the form, prevent spam and abuse, assign the enquiry to the right object, and secure our systems — not to profile you for advertising.
Newsletter
If you subscribe, we process salutation, name, email and the interest you select (sale / holiday rental / long-term rental), plus technical confirmation data from the double opt-in (IP, time). You can unsubscribe at any time via the link in each email or by writing to us.
Client and enquiry files
We store leads, clients, listings and correspondence in a cloud-based customer-management system operated by specialist processors acting on our instructions. Data stored there can include master data, communication history, listings of interest, documents you send us, and internal notes needed to advise you. The processors and, where relevant, their hosting locations may include countries outside Switzerland, in particular the EEA and the United States.
Cookies and similar technologies
We use cookies and similar storage. Strictly necessary cookies (session, security, cookie-consent choice, load balancing) run without a banner choice. We also use certain third-party services, such as Google Maps and Matterport, to provide property-related functions and content. When these services are loaded, they may receive technical information such as your IP address. Analytics and other non-essential tracking technologies are handled according to your cookie settings. You can change or withdraw your choice at any time via the cookie settings.
3. Purposes, Swiss justification and GDPR legal bases
Swiss data-protection law does not use the GDPR’s closed list of “legal bases”. Under the FADP, processing is permitted if it complies with the statutory principles (in particular lawfulness, good faith, proportionality and purpose limitation) and does not unlawfully infringe personality rights. Where a processing would otherwise infringe personality rights, Swiss law requires a justification: consent, a legal provision, or an overriding private or public interest. The first column below is that Swiss explanation. The second column applies only where the GDPR applies to the relevant processing, including where its territorial scope is triggered by our activities involving individuals in the EEA or the UK.
| Purpose | Switzerland (FADP) | GDPR (where it applies) |
|---|---|---|
| Operate, secure and improve the website | Overriding private interest, subject to the FADP principles of proportionality, purpose limitation and transparency | Art. 6(1)(f) |
| Answer enquiries; prepare and perform brokerage, rental, management or valuation mandates | Processing connected with the contractual relationship and steps requested before entering into it; otherwise overriding private interest | Art. 6(1)(b); alternatively Art. 6(1)(f) |
| Identify parties, anti-money-laundering and bookkeeping duties | Legal obligation | Art. 6(1)(c) |
| Newsletter and comparable marketing | Consent (withdrawable at any time) | Art. 6(1)(a) |
| Audience measurement (GA4) and other non-essential cookies | Consent | Art. 6(1)(a) |
| Show a property’s location on an embedded map | Processing to provide property-related information; overriding private interest, subject to the FADP principles | Art. 6(1)(f) |
| Show an embedded 3D / VR tour of a property | Processing to provide property-related information; overriding private interest, subject to the FADP principles | Art. 6(1)(f) |
| Defend legal claims; building and owner communication | Overriding private interest | Art. 6(1)(f) |
4. Cookies, analytics and embeds
Consent banner
A consent management platform on the site records your choice (accept / reject / granular categories). Analytics and other non-essential tracking technologies are activated according to your cookie settings. Maps and Matterport are property-information services and load with the relevant page; they are not used by us for audience measurement, advertising or marketing profiles.
Google Analytics 4
If you consent, we use Google Analytics 4 (Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland; parent: Google LLC, USA). GA4 uses cookies or similar identifiers to measure visits, pages, events and approximate geography. We configure IP anonymisation / reduced location granularity where available. Google may process data in the United States. Transfers rely on the EU-US Data Privacy Framework (where the recipient is certified) and/or the European Commission Standard Contractual Clauses, plus Swiss-approved transfer tools under the FADP.
We load Google Tag Manager to manage this measurement. We use Google Consent Mode: analytics and advertising storage stay switched off until you accept in the cookie notice. Until then, Google tags may still receive limited, non-identifying technical data (for example, a cookieless ping with your IP address and the page address), but they do not set analytics or advertising cookies. You can change your choice at any time via “Cookie settings” in the footer.
Google information: policies.google.com/privacy
Google Maps
We use Google Maps on certain pages to display property and office locations. The map loads with the page because displaying the property’s location is part of the website’s property information. When the map loads, Google receives your IP address and other technical information required to provide the service. We do not use Maps for advertising, remarketing or building visitor profiles. Google may process that technical data in the United States (DPF and/or Standard Contractual Clauses). If you do not wish to use the map, you can block third-party content in your browser; the rest of the listing remains usable.
Matterport 3D / VR tours
On some listing pages we offer a Matterport Showcase player (Matterport, Inc., United States) so you can walk through the property in 3D or VR. Where a listing includes a Matterport tour, the player loads with the page. When it loads, Matterport receives technical data needed to deliver the tour (IP address, which Matterport states it truncates for analytics, browser and device information, approximate city/country, and interaction events inside the player). For visitors who are not logged into a Matterport account, Matterport states that Showcase does not set tracking cookies; it may use local storage for player settings (for example measurement units). We do not use the tour for advertising or to build marketing profiles. Matterport may process this data in the United States (DPF and/or Standard Contractual Clauses).
Details: matterport.com/legal/showcase-data-privacy
Fonts, assets and external links
Fonts, scripts and other design assets are hosted by us. We do not load web fonts or marketing pixels from Meta or similar networks. The site may contain ordinary hyperlinks to third-party sites (for example industry associations). Those sites are responsible for their own processing; we only transmit data if you click the link (your browser then requests that page).
5. Recipients and processors
We use specialised providers who process data on our instructions (Art. 9 FADP / Art. 28 GDPR). On the public website we name the services that run in the visitor’s browser. Backend systems are described by category so that internal tools are not advertised here.
| Recipient | Role | Location / transfer |
|---|---|---|
| Cloud customer-management and document processors | Leads, client files, listings, correspondence | Switzerland, EEA and/or USA; DPF and/or SCCs where required |
| Google Ireland / Google LLC | Analytics (with consent); Maps to display property location | EEA and USA; DPF and/or SCCs |
| Matterport, Inc. | Embedded 3D / VR property tours | USA; DPF and/or SCCs |
| Email / newsletter provider | Subscription, sending, unsubscribe handling | As per that provider’s contract |
| Website host and content-management provider | Hosting, backups, security logs | Preferably Switzerland or EEA |
| Consent-management provider | Store and honour cookie choices | As per that provider’s contract |
If you ask us which processor holds your particular file, we will tell you. We do not publish a full sub-processor catalogue on this page because it changes.
We may also disclose data to notaries, land registries, banks, insurers, property managers, tradespeople, co-ownership boards, tax or supervisory authorities, and counterparties, where this is required to perform a mandate or a legal duty.
6. Transfers abroad
Some providers (in particular Google, Matterport and cloud processors for client files or email) process data in the United States or other countries without an equivalent Swiss/EU adequacy decision for every entity. Where that happens we use recognised safeguards: adequacy decisions where they exist, the EU-US Data Privacy Framework for certified US organisations, Standard Contractual Clauses, and the corresponding Swiss transfer mechanisms. A copy of the relevant clauses can be requested from us.
7. How long we keep data
- Server logs: typically 3–12 months, unless needed longer for security incidents.
- Cookie-consent records: for the life of the consent plus a short audit period (often 12–24 months).
- Newsletter: until you unsubscribe, then suppression of the address as needed to honour the opt-out.
- Unsuccessful enquiries: usually up to 24 months after last contact, unless you ask us to delete sooner and no legal hold applies.
- Contracts, accounting records and other documents that are subject to a statutory retention duty (including anti-money-laundering identification where the law requires it): for the applicable statutory period. In Switzerland that is often ten years from the end of the relevant financial year or relationship, but only where a statute actually says so.
- Client and property files that are not covered by a specific statutory duty: for as long as reasonably necessary for the mandate, the ongoing relationship and possible legal claims, and then deleted or anonymised, unless a retention obligation still applies.
8. Your rights
Depending on the applicable law, you may have rights to access your personal data, request correction or deletion, object to certain processing, request restriction of processing, or withdraw consent where processing is based on consent. Withdrawal of consent does not affect processing already carried out. Where the GDPR applies, additional rights may apply, including data portability and specific rights concerning automated decision-making.
Write to info@alag.swiss or to the postal address above. We may need to verify your identity.
You may lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC, edoeb.admin.ch). Where the GDPR applies, you may also contact the supervisory authority in the EEA or the UK that is competent for you.
We do not use solely automated decisions that produce legal or similarly significant effects about you.
9. Security
We use technical and organisational measures appropriate to the risk (access control, encrypted transport (TLS), least-privilege accounts, backups). No online transmission is completely secure; you may also contact us by phone or post.
10. Children
Our website and services are aimed at adults. We do not knowingly collect data from children for marketing.
11. Changes
We will update this policy when the site, tools or law change. The date at the top is the current version. Material changes will be published on this page.