Data protection
Privacy policy
Last updated: 3 September 2026
1. Data controller
ON-CO is responsible for the processing described in this policy. Questions or requests concerning personal data may be sent to info@on-co.ch.
2. Scope
This policy applies to the ON-CO website, customer area, contact and Marketplace forms, orders, payments, subscriptions and ON-CO services. It covers data collected from the data subject and data supplied by an authorised representative, shareholder, employer or other contact.
3. Data collected
Depending on the requested service, ON-CO processes identity and contact details, account and login data, information about the business and its founders, shareholders, officers, employees or representatives, registered-office and billing addresses, service choices, communications, consents and order references. Files may also contain identity documents, date of birth, AHV number, salary, tax, accounting, social-insurance, banking or commercial data, official extracts, debt-enforcement information and other necessary documents.
4. Technical data and cookies
Technical systems may record the IP address, device and browser type, date, time, requested pages and events required for security, diagnostics and operation. ON-CO uses only cookies or local storage necessary for sessions, authentication, security and interface preferences. If optional analytics or marketing tools are added, information and, where required, a prior choice will be provided.
5. Purposes and grounds
Data is processed to answer enquiries, create and secure the customer area, save and review files, verify identity and information, prepare documents, coordinate services with relevant professionals and authorities, operate the Marketplace, perform orders, collect payments, administer subscriptions, issue invoices, communicate, prevent fraud, maintain security, comply with the law and defend ON-CO’s rights. Depending on the circumstances, processing is based on preparing or performing a contract, a legal obligation, a legitimate interest or consent where required.
6. Payments
Payments offered on the site are made by bank card through Stripe, with TWINT, Revolut or by bank transfer. ON-CO receives or verifies the information needed to monitor payment, including its status, amount, currency and transaction reference. ON-CO does not receive or store the customer’s complete banking details.
7. Recipients and processors
Access is limited to personnel and contractors who need it. Where necessary, data may be shared with Supabase for authentication, databases and documents, Stripe, TWINT, Revolut and their technical partners for payments, Resend for email, hosting providers, and notaries, banks, insurers, compensation offices, tax authorities, commercial registers, public bodies, auditors, accountants, lawyers, software providers and other partners involved in the service. Data may also be disclosed where required by law, an authority’s decision or the protection of rights. ON-CO does not sell personal data.
8. Marketplace
When a seller submits a file, ON-CO records company information, financial and commercial data, the reason for sale, contact details and requested documents to conduct the pre-assessment and make contact. Data from a real file is shared with a potential buyer or adviser only after the necessary confidentiality checks and measures. Automated results support the review but do not alone produce an individual decision with legal or similarly significant effects.
9. International transfers
Some providers may process data outside Switzerland, including in the European Union or the United States. ON-CO gives preference to countries recognised as providing adequate protection. Otherwise, transfers rely on appropriate safeguards, including recognised standard contractual clauses supplemented where necessary by technical and organisational measures, or on a statutory exception.
10. Retention periods
Data is kept only for as long as necessary. Contracts, orders, invoices and accounting records are generally retained for ten years. Service files are retained during performance and then for applicable statutory and limitation periods. Contact enquiries with no contractual relationship are generally deleted or anonymised within twenty-four months of the last exchange. Unsuccessful Marketplace files are generally deleted or anonymised within twelve months of the decision. Longer retention may apply due to consent, a dispute, an investigation, a legal duty, a temporary backup or a need for evidence.
11. Security and confidentiality
ON-CO applies safeguards appropriate to the sensitivity of the data, including access controls, authentication, encrypted communications, private document storage, security logging and restricted permissions. As no system is entirely risk-free, ON-CO reassesses its measures and handles incidents in accordance with applicable duties.
12. Your rights
Within the limits set by law, you may ask whether data about you is processed, obtain a copy, correct inaccurate data, request deletion or restriction, object to certain processing and receive supplied data in a portable format where that right applies. Proof of identity may be required. Send requests to info@on-co.ch. You may also contact the Swiss Federal Data Protection and Information Commissioner (FDPIC) and, where the GDPR applies, the competent European authority.
13. Updates and language
ON-CO may update this policy when its services, providers or applicable rules change. The update date appears at the top, and material changes will be communicated appropriately. If the language versions differ, the French version prevails.