Privacy Notice

1. Controller

The controller is Sumexia GmbH, Bärholzstrasse 16, 5610 Wohlen, Schweiz / Switzerland, UID CHE-236.998.154; Commercial Register No. CH-400.4.458.196-2. Contact: info@cone24.com.

2. Data and purposes

We process account, contact, listing, communication, security and transaction data where needed for registration, platform operation, fraud prevention, support, contract handling and legal duties.

3. Legal bases and recipients

Depending on purpose, processing is based on contract performance, legal obligations, legitimate interests or consent. Recipients may include technical and payment providers and competent authorities where necessary.

4. Retention and rights

Data is kept only as long as required by the purpose or legal retention duties. Data subjects may exercise the access, rectification, erasure, restriction, objection and complaint rights available under applicable law.

A deletion request is not accepted while open deals, payments, disputes, payouts, wallet balances or other outstanding obligations remain. Once accepted, the account is locked immediately and removed from public view. To protect against accidental or abusive deletion, we keep the account state from the time of the request under restricted access and fully recoverable for exactly 90 calendar days. Recovery requires the existing credentials, a one-time link sent to the already verified email address and another password confirmation. Recovery ends permanently when the 90th day expires, even if a settlement obligation or legal hold has arisen meanwhile. Account, profile and KYC/identity-verification data that is no longer required, including identity-document and selfie files no longer needed, is then deleted or anonymised. Transaction, accounting and dispute evidence required by law or for settlement is retained separately, under restricted access and only for the relevant purpose until the applicable period expires. Where Swiss accounting law applies, the retention period for relevant business records is generally ten years. A documented legal hold or duty arising later extends only retention of the specific evidence required, never account recovery; data no longer required is not covered by that extension.

5. Analytics and AI

Optional analytics or AI processing is not inferred merely from registration. Where consent is required, it is requested separately and may be withdrawn for the future.

6. International transfers and providers

Data may be processed by carefully selected providers in other countries. Where required, appropriate safeguards, contractual protections and access restrictions are used. Payment, identity and fraud checks may also be governed by the licensed provider’s privacy notice.

7. Rights in the United States and other jurisdictions

Individuals receive the rights granted by their applicable privacy law. Depending on residence, these may include access, correction, deletion, portability, restriction, objection, withdrawal, opt-out and complaint. Requests sent to info@cone24.com are verified and answered within the applicable period. This notice does not claim that a specific U.S. state law applies where its statutory thresholds are not met.

8. Identity verification and biometric data

Identity verification using an identity document, selfie or facial analysis occurs only after a separate, clear notice of provider, purpose, data types and retention period and, where required, separate express consent. Biometric identifiers are not sold or used to profit from trading them. Where the Illinois Biometric Information Privacy Act applies, a public retention and deletion policy applies; the relevant data is deleted once its purpose is satisfied or no later than three years after the last interaction, unless a shorter period or mandatory evidence preservation applies. Without the required consent and deletion workflow, the biometric feature is not offered in the affected jurisdiction.

Country estimate at registration

When a new account is created, CONE24 estimates the country of the internet connection using a locally stored country database. We store the country estimate, capture time, sign-up method and database version with the account for account-security review by authorized superadmins. This record contains no raw IP address and is not updated by later sign-ins. It is kept with account data under the retention rules described in this notice. Visitor IP addresses are not sent to the database provider. VPNs, proxies and database limitations can make the estimate inaccurate; it is not proof of residence or identity. Older accounts may show a separate, clearly marked unconfirmed estimate from existing server logs.

Android push notifications

If you enable notifications in the Android app, CONE24 uses Google Firebase Cloud Messaging (FCM). Google processes the app-installation registration identifier and technical device and delivery information. Processing may take place outside Switzerland, including in the United States.

CONE24 binds the installation to your signed-in account and encrypts the delivery token at rest. Push contains generic alerts; private message text and conversation content are not sent as push content. This feature does not enable Google Analytics.

You can change notification categories in the app and disable notifications in Android settings. Signing out revokes the device binding. Device and network settings can delay or prevent delivery.