The entity responsible for processing is Elron Club AG, Tribschenstrasse 62a, 6005 Luzern, Switzerland. Questions about data protection, exercising your rights or the processing of your data can be sent to service@elron.club at any time.

No separate data protection officer has been appointed. Privacy requests are handled by management.

We process only data we need to respond to your inquiry, enter into or perform a rental contract, or operate the website securely:

• Inquiry forms: first and last name, email address, phone number, desired move-in date, stay duration, voluntary message.
• Request workspace (contract preparation): date of birth, nationality, residence permit, employment status, employer details, income evidence, identity documents, credit consent and the supporting documents you upload.
• Access and verification data: email confirmation tokens and technical records of the authentication flow.
• Usage data: IP address, timestamp, referrer, user agent, requested pages. Captured in server logs for operational security.
• Cookies and analytics: strictly necessary cookies (e.g. to store your consent choice) and — only with your consent — Google Analytics 4 in pseudonymised form.

Processing is based on the revised Swiss Federal Act on Data Protection (revFADP) and, where applicable, the EU General Data Protection Regulation (GDPR):

• Pre-contractual measures and performance of rental contracts (Art. 31(2)(a) revFADP; Art. 6(1)(b) GDPR).
• Compliance with legal obligations (tax, accounting, tenancy law) (Art. 31(1) revFADP; Art. 6(1)(c) GDPR).
• Legitimate interests in operational security, abuse prevention and product improvement (Art. 31(1) revFADP; Art. 6(1)(f) GDPR).
• Consent for optional analytics, cookies and newsletters, which you can withdraw at any time (Art. 31(1) revFADP; Art. 6(1)(a) GDPR).

Personal data is retained only as long as necessary for the purposes listed above or as required by statutory retention periods:

• Non-binding inquiries without a contract: 12 months from last contact.
• Rental contracts and contract-related documents: 10 years from end of contract (Art. 958f of the Swiss Code of Obligations).
• Email correspondence: 3 years from last exchange.
• Web server logs: 90 days.
• Google Analytics data (pseudonymised): 14 months.

We only disclose personal data where necessary to provide our services, to comply with a legal obligation, or where you have consented. We rely on the following processors in particular:

Google Cloud EMEA Limited

Cloud hosting in the europe-west6 region (Zurich, Switzerland). Application data and databases are stored exclusively in Switzerland.

Swisscom (Schweiz) AG

Qualified electronic signature for rental contracts (Swisscom Sign). Processing in Switzerland.

Google Ireland Limited / Google LLC

Google Analytics 4, only after consent. Irish entity with sub-processing by the US parent; transfer based on Standard Contractual Clauses and the Swiss-US Data Privacy Framework.

Core operations, databases and document storage remain in Switzerland. International transfer only occurs if you enable analytics cookies; in that case pseudonymised usage data is sent to Google Ireland Limited, which may rely on sub-processing by Google LLC (USA). The transfer is based on the European Commission's Standard Contractual Clauses, the Swiss-US Data Privacy Framework and additional technical measures (IP anonymisation, aggregated reporting).

We use strictly necessary cookies (for example to store your consent choice) and — only with your active consent — privacy-friendly measurement via Google Analytics 4 (Consent Mode v2, IP anonymisation, no advertising features). You can withdraw your consent at any time via the "Privacy settings" link in the footer.

You have the right to request information about personal data we process concerning you. Depending on applicable law, you also have in particular the following rights:

• Rectification of inaccurate data.
• Erasure, to the extent no statutory retention obligations apply.
• Restriction of processing and objection to specific processing activities.
• Portability of data in a commonly used electronic format.
• Withdrawal of consent, with effect for the future.
• Lodging a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC) or the competent EU supervisory authority.

To exercise your rights or for any questions, an informal message to service@elron.club is sufficient. We may request reasonable proof of identity.

We take appropriate technical and organisational measures to protect your data, including encrypted transmission (TLS), role-based access controls, regular backups and an infrastructure for application and contract data operated exclusively in Switzerland.

We may update this privacy policy when legal requirements, our processes or the processors we rely on change. The version published on our website at the time of access applies. The last-updated date is shown at the top of this page.