Privacy Policy

Handling your data with the utmost care is important to us. It’s especially important to know: We never sell your personal data. We always process your personal data in accordance with the Swiss Data Protection Act

Apply for a mortgage conveniently online

This text applies mutatis mutandis to women and to a plural number of people.

This Privacy Policy explains how GTF Gesellschaft für technologiebasierte Finanzdienstleistungen AG, Lintheschergasse 13, 8001 Zurich (hereinafter “we,” “us,” “our,” “GTF” or “HYPOTHEKE.ch”), which operates the website www.hypotheke.ch and the subdomains and applications provided under this domain, handles your data when you use our websites and applications (including the Mortgage application; hereinafter “online offerings”) as well as in the context of a collaboration or the placement of an order (hereinafter collectively referred to as “service offerings”). This notice explains how we handle your data, for what purposes we collect and process it, to whom we may disclose it, and what rights you have with respect to us regarding the use of your data.
We will also inform you separately about certain data processing activities (e.g., in specific privacy notices, consent forms, contracts, or notices). “Personal data” refers to all information relating to an identified or identifiable natural person or, where protected by the DSG, a legal entity. This may include, for example, your first and last name, mailing address, email address, date of birth, phone number, and data regarding your use of our online services. In this Privacy Policy, we use the term “Data” interchangeably with “Personal Data” or “Personal Information.”

In this Privacy Policy, the term “processing of data” refers to any handling of data (e.g., the collection, transmission, use, organization, as well as the storage, sorting, and deletion of data). Whenever the term “Applications” is used in this Privacy Policy, it always refers to the application available at https://, hereinafter referred to as “hereinafter Mortgage Application”.

By accessing www.hypotheke.ch, using our online offerings and services, or submitting data or documents to HYPOTHEKE.ch—whether online or offline—you agree to this Privacy Policy and, in particular, to the processing of your data as described herein.

If you transmit data from other natural or legal persons—such as third parties, third-party companies, authorized representatives, or jointly and severally liable parties (hereinafter “Third Parties”) to HYPOTHEKE.ch, you confirm that you have previously informed the relevant individuals of the processing by referring them to this Privacy Policy, that you are authorized to do so, and that you guarantee the accuracy of the data and that these other individuals also consent to this Privacy Policy.

Please note that third-party websites accessible through our services provide information about their data processing practices in their own privacy policies. We apply no liability or responsibility to these third parties’ compliance with data protection regulations and recommend that you consult the privacy policies of these third-party websites.

1. Sources of personal data

In connection with our business activities and our business relationships with customers or potential customers (“hereinafter referred to as ‘customers’”) and with natural or legal persons associated with the customer, as well as when our services are used, we process personal data that we receive as follows:

  • Documents provided or uploaded by the data subject (e.g., employees, customers, prospective customers, applicants)—for example, via an input form—such as tax returns, pay stubs, or application materials, as well as information submitted through online contact forms, by phone, or during a consultation. This also includes information about third parties;
  • From individuals associated with the data subject (e.g., family members, employers, advisors, authorized representatives, attorneys, or representatives of heirs);
  • From service providers (e.g., credit bureaus, credit rating agencies, or address providers; card issuers; banks; insurance companies; fraud prevention agencies; real estate appraisers; Pension funds; or Pension and investment foundations;
  • From public registers (e.g., commercial registers, the Swiss Commercial Gazette);
  • From government agencies (e.g., criminal records, debt collection registers, land registries);
  • From publicly accessible sources (the Internet, the press, or social media);
  • From cooperation or mortgage lenders or other contractual partners

Affiliated legal entities or individuals include, in particular, family members, any authorized representative, business partner, member of a company’s governing body or employee, partner, signatory, beneficial owner, controlling shareholder, payee of a payment transaction, or any other legal entity or individual who has a relationship with the customer that is relevant to the business relationship between the customer and Mortgage.ch.

2. Types of data processed by HYPOTHEKE.ch

Which of your personal data we process depends largely on the purpose and context in which we process the data. The data may also relate to third parties. We process various categories of data about you. The most important ones are as follows:

  • Master data (e.g., name information, nationality, date of birth, address, phone number, email address, contact information, personal details (e.g., education, professional information, type of employment, professional status, job description, education, occupation, career prospects, career goals, continuing education, interests, hobbies, social or political involvement, financial circumstances, family circumstances, any signing authorizations);
  • Financial data (e.g., type and amount of your income, earnings and interest, revenue, information about your assets and their source, financial goals, all types of liabilities, Loans, Leasing information, type and amount of Mortgages and Interest rates as well as maturity dates, securities and other financial instruments, investments, Debt enforcement, risk profile, and scoring, rating, and creditworthiness data in connection with mortgage underwriting and mortgage brokerage);
  • Real estate data (e.g., intended use, location data and address, floor plan, property type, Purchase price, sale price, market value, appraised value, rental income, rental expenses, lot size, living area, Cubature, number of rooms, parking options, condition, amenities, year of construction, renovations, and other data related to the review and processing of a mortgage brokerage / financing);
  • Pension data (e.g., information on Pension funds, pension accounts, planned retirement age, AHV contributions and projected AHV pensions, information on life and retirement insurance as well as term life insurance);
  • Tax data (e.g., all relevant information and documents, including, in particular, details regarding religious affiliation, tax residency, or U.S. status);
  • Account data (e.g., payment transaction data, account numbers, types of accounts);
  • Documentation data or data from your interactions with third parties (e.g., consultation or meeting minutes, case notes);
  • Behavioral and interaction data, as well as data regarding your preferences, needs, and interests (e.g., information about your preferred communication channels and times, information about your use of our services or those of mortgage lenders or third parties, websites, and applications);
  • Public data that can be obtained about you (e.g., land registry and commercial registry data, data from (social) media and the press);
  • Identification and authentication data (e.g., ID information, certifications, data from any video identification process, and login credentials);
  • Communication data (e.g., data related to you in written, telephone, or electronic communications, including, in particular, data that you disclose or transmit to us via online contact forms, online services (in particular the Mortgage.ch application), in connection with our range of services, in the login area, or through other online input forms);
  • Technical data that can be associated with you (e.g., data collected when you access our online services—that is, data transmitted to us by your browser or device [e.g., smartphone or tablet] and automatically entered by us directly or indirectly [e.g., IP address, information about these devices such as type, brand, screen information, storage, and their settings [e.g., language, keyboard], cookies, used and unused features, time and duration of access, date, names of files accessed and content viewed, requested domain, web browser, referring websites and location data, client ID, and version of installed software). For more information on the use of cookies, see Section 9: “What online tracking and online analytics techniques do we use?”

3. Purpose of Processing Your Data

HYPOTHEKE.ch always processes your personal data for a specific purpose. The following purposes may apply:

  • Review, conclusion, and processing of contracts: We process your personal data so that we can provide and offer you our products and services; this includes, in particular, the management and development of the business relationship, as well as services you can use in the public and logged-in areas of our online offerings;
  • Brokerage of products and services from our Mortgage lenders or third parties: We process your personal data so that we can provide you with personalized and pre-screened offers from our Mortgage lenders or third parties—in particular Mortgages—that are as close to being ready for closing as possible;
  • Compliance with applicable laws, internal regulations, and Risk, Legal & Compliance: HYPOTHEKE.ch is subject to internal and legal requirements (e.g., in connection with financial reporting, tax laws, the prevention and detection of criminal offenses, and responding to actual and potential proceedings, requests, or investigations by law enforcement agencies and other government or regulatory authorities);
    In connection with marketing, customer care, and the personalization of our services: We process your personal data for customer care and to tailor our services optimally to your individual needs, as well as for marketing purposes. For example, based on your individual situation (e.g., financial data, personal data, real estate data, interests, and user behavior [particularly in response to inquiries and your use of our online offerings]) send you personalized advertisements, interest rate updates, customized interest rate calculations, optimization suggestions, general tips and advice, and information about our own or third-party products and services (e.g., by mail, directly within our online offerings, via email, or SMS). In addition, we may derive information regarding the statistical probability that you are interested in certain products and services or that you will behave in a certain way.
  • In connection with market research as well as product development and improvement: We process your personal data to improve our products and services and to develop and launch new products and services, based on the collection and analysis of your user behavior (e.g., use of our online offerings)
  • Communication: We process your personal data to communicate with you and third parties and to address your inquiries. When you communicate with us via email or through contact forms on the Internet, you authorize us to respond to you through the same channel. Please note that when using the Internet and email as means of communication, it is possible for third parties to view transmitted data with minimal effort. It therefore cannot be ruled out that the transmitted data may be visible, accessible, and manipulable by third parties. We therefore ask that you do not send us any confidential information via email. To the extent permitted by law, we exclude any liability arising from erroneous transmission, falsification of content, or Internet disruptions
  • Security, Access, and Authorization Controls: We process your personal data to ensure and continuously improve the security and operation of our IT infrastructure. Access controls are implemented in particular for access to IT systems, websites, and applications (e.g., via login or firewalls)
  • Protection of Our Rights: We may process your personal data to assert claims before domestic and foreign authorities (both in and out of court) or to defend ourselves against claims
  • Corporate Transactions: We may process your personal data to review, prepare, and complete a merger, the purchase or sale of our company, or the transfer of assets;
  • Training and Education: We may process your personal data to conduct internal training and to train and educate our employees;
  • Other Purposes: We may process your personal data for other purposes necessary to protect our legitimate interests.

4. What are the rules regarding profiling and automated decision-making?

HYPOTHEKE.ch processes personal data automatically—that is, using computers—in certain cases to assess and evaluate personal characteristics (profiling). This may occur, for example, in the following cases:

  • To inform you about services and products tailored to your needs through advertising (directly on our online platforms, via email, or through other designated communication channels);
  • To determine and classify your creditworthiness and other characteristics relevant to mortgage lenders;
  • To create internal ratings regarding the customer relationship as well as customer profiles
  • To identify fraud and security risks
  • Purpose: To generate statistical analyses
  • To provide optimization suggestions, general tips, and advice (directly in our online services, via email, or through other designated communication channels)
  • In doing so, we may combine various categories of data (Section 2) in such a way that we can better understand you as a person, taking into account your diverse needs, interests, and characteristics. By using our online services, the data subject hereby consents to data processing in this context.

5. Recipients of Personal Data and Disclosure to Third Parties

Personal data is processed only by those individuals within HYPOTHEKE.ch who need it to fulfill legal or contractual obligations. Our online offerings and the services provided through them are regularly delivered through a division of labor. Your personal data is therefore stored and processed not only by us but also by third parties. In doing so, we comply with all applicable legal requirements.

For the purposes described in Section 3, we may disclose your personal data to the following categories of recipients:

  • Service providers (e.g., IT providers, marketing, newsletter, communications, and market research service providers, trust companies, law firms, payment processors, or auditing firms)
  • Cooperation partners, for the purpose of sharing infrastructure or personnel
  • Contract processors and other service providers (e.g., suppliers)
  • Mortgage lender
  • Customers
  • Public entities (e.g., government agencies), provided that a legal or regulatory obligation requires it
  • Internal departments (e.g., Finance, Human Resources)
  • Law enforcement and other authorities and government agencies

Before transmitting your personal data, we conduct a thorough review of the respective data recipient and require them to comply with appropriate data protection standards and to maintain confidentiality regarding your data.
Under certain circumstances, statistical data and insights derived from its analysis may be visible to other registered users or affiliated Mortgage lenders. Such data is made available to other users or Mortgage lenders exclusively in anonymized and/or aggregated form.

With your separate consent, we will disclose personal data to mortgage lenders, who may process this data in accordance with their own terms and conditions and may also use it for other purposes (e.g., marketing purposes). By giving your consent, you also authorize these mortgage lenders to provide us with the relevant information.

The Mortgage application () is hosted by Aspectra, Weberstrasse 4, 8004 Zurich. The hosting service is certified to ISO 27001:2013, PCI DSS-compliant, and audited for compliance with FINMA Guidelines 08/7, 08/21, and 18/3.

6. Transfer of Data Abroad

HYPOTHEKE.ch processes personal data in Switzerland; data transfers abroad are only permitted in exceptional cases. Any exceptions are listed below. If personal data is transferred abroad, this is done in compliance with the legally prescribed provisions and only when necessary to fulfill the contract. If service providers abroad are used, we require them to comply with the Data Protection Act.

Exception to the data processing in Switzerland described in Section 6:

  • When newsletters are sent via MailChimp (see Section 10, “Sending Newsletters via the MailChimp Service Provider and the YouTube Video Platform”), data is transferred abroad.
  • When visiting websites that display a video, data may be transferred abroad (see Section 10, “Sending Newsletters via the MailChimp Service Provider and the YouTube Video Platform”)

7. Retention Period for Personal Data

We process personal data for as long as necessary to fulfill the purpose for which the personal data was collected or to fulfill contractual, legal, or other obligations. The retention period is therefore determined by legal and internal regulations. In doing so, we take into account criteria (e.g., the scope and purpose of the stored data) and the need to protect our own interests. Once these purposes have been achieved or no longer apply, and there is no longer a legal obligation to retain the data, we will delete or anonymize your data as part of our standard procedures. Depending on the legal basis, this may take more than ten years.

If you have registered for our online services using a login, your data will be retained for as long as your user account is active. You can delete your user account yourself or instruct us to delete it. Data entered in the HYPOTHEKE app that is not secured with a login will be automatically deleted after 28 hours of inactivity.

You also have the option to store the data entered in the Mortgage app for a longer period without logging in by creating an access link from the Mortgage app. Once such an access link has been created, the data is stored for 90 days from the last activity and then deleted. No personal identification takes place; data assignment is ensured via a reference number in the link. If you do not consent to your data being stored via an access link, please do not generate such a link.

Storing data may be technically necessary because certain data cannot be separated from other data, and we must therefore continue to store it together with that other data (e.g., in the case of backup or document management systems).

8. Protection of Personal Data and Compliance with Data Protection Principles

We process personal data in accordance with the Federal Act on Data Protection (DSG) and the Ordinance on Data Protection (DSV). In doing so, we ensure that the data is processed lawfully, in good faith, and in a proportionate manner. Should it become apparent that data is inaccurate or incomplete, we will correct, delete, or destroy it, unless prohibited by law or regulatory provisions.
Personal data is treated as strictly confidential and protected from access by unauthorized third parties. To this end, we implement appropriate security measures of a legal (e.g., confidentiality agreements), technical (e.g., encryption or logging), and organizational nature (e.g., access restrictions, guidelines for our employees). Individuals who are not subject to a duty of confidentiality generally do not have access to the collected personal data. We also ensure that the recipients of the personal data comply with the applicable data protection regulations.

9. What online tracking and analytics techniques do we use?

We deliberately do not use marketing cookies or third-party cookies. We therefore do not share any information about your use of our online services with third parties.

However, we cannot do without cookies entirely. We also collect data about your behavior in connection with the use of our online services and use cookies for this purpose. Cookies are small text files that are stored in your browser or on your device (e.g., browser, smartphone, or tablet) and are read when you access the online service again until their programmed expiration date. Cookies typically contain an anonymous identifier so that we can recognize returning visitors as such, as well as additional information about visitor behavior or settings within the online service. This allows us to personalize your experience each time you visit and to identify you when you log in. Depending on their purpose, we distinguish between functional cookies, analytics cookies, and marketing cookies.

  • Functional cookies: Certain cookies are necessary for our online services to function.
  • Analytics cookies: We use cookies that enter and analyze data about how our online services are used so that we can improve the content and presentation of our online services and tailor them to users.
  • Marketing cookies: We do not currently use any marketing cookies.

We use the following cookies in our online services:

  • Functional cookie: Name: ncs-S, 32-character alphanumeric code, Purpose: Web Application Firewall (WAF) and Aspectra load balancer for quality assurance, security, and availability; Duration: Session (until the browser is closed)
  • Analytics cookie: Name: hyporef; Purpose: Tracking “First Contact” (referrer, date, landing page) for statistical purposes, expiration: 180 days
  • Functional and analytics cookie: Mortgage-*, purpose: A group of functional application cookies (session ID, encryption, and anonymized logging) for statistical purposes; expiration period: session (until the browser is closed)

If you do not agree to the use of cookies, you can configure your browser so that it generally does not accept cookies, does not accept cookies from us, or notifies you when a cookie is set. You can also delete existing cookies. You can find instructions for doing so in your browser’s menu. Our online services will remain available, but certain features may not be available or may be limited. You can also install a browser plugin that notifies you when and if third parties access your browser.

10. Use of the email service provider “MailChimp” and the video platform “YouTube”

MailChimp
We use MailChimp to send out our newsletter. MailChimp is a service provided by The Rocket Science Group, LLC, 512 Means Street, Suite 404, Atlanta, GA 30318, USA, a subsidiary of Intuit Inc.

The email addresses of our newsletter recipients are stored on MailChimp’s servers in the United States. Together with other non-personal data not provided by us, MailChimp uses this information to send and analyze the newsletters on our behalf. MailChimp may use this data to optimize its own services (e.g., technical optimization of the mailing process, newsletter layout, or for business purposes, such as determining which countries the recipients are from). However, MailChimp does not use the email addresses of our newsletter recipients to contact them directly or to share them with third parties. You can find MailChimp’s privacy policy here: https://www.intuit.com/privacy/statement/

MailChimp is certified under the U.S.-EU/U.S.-Switzerland “Privacy Shield” agreement and is therefore committed to complying with Swiss and EU data protection regulations. Furthermore, we have entered into a “Data Processing Agreement” (https://mailchimp.com/de/legal/data-processing-addendum) with MailChimp. This is a contract in which MailChimp commits to protecting our users’ data, processing it on our behalf in accordance with its privacy policy, and, in particular, not disclosing it to third parties.

YouTube
We use plug-ins from YouTube, a site operated by Google. YouTube is operated by YouTube, LLC, 901 Cherry Ave., San Bruno, CA 94066, USA. When you visit one of our pages that includes a YouTube plug-in, a connection is established to YouTube’s servers. In the process, the YouTube server is informed which of our pages you have visited. If you are logged into your YouTube account, you allow YouTube to associate your browsing activity directly with your personal YouTube profile. You can prevent this by logging out of your YouTube account.

For more information on how user data is handled, please see YouTube’s Privacy Policy at: https://www.google.de/intl/de/policies/privacy.

11. Your Rights

You have the right to access, correct, obtain a copy of, transfer, or delete your personal data, as well as the right to object to its processing, provided that no contractual or legal obligation precludes such actions. Furthermore, the data subject may request that certain data processing be prohibited or restricted, or that the disclosure of certain personal data to third parties be prohibited.

If the processing of your personal data is based on your consent, you may withdraw that consent at any time for future processing.

If we make an automated decision that affects you, you have the right to speak with a human representative and request that they review the decision. We will notify you separately in such a case.

If you wish to exercise your rights with us, please contact us with a signed letter (see Section 11) and include a clearly legible copy of your identification (ID or passport) for identification purposes and to prevent misuse. You may revoke your consent in other ways, provided we make such options available (e.g., deleting your profile).

The rights to erasure and objection are not unrestricted. Depending on the specific case, overriding interests, legal requirements, and restrictions may necessitate further processing. HYPOTHEKE.ch reviews each case individually and will inform you of the outcome.

12. Contact Information for the Data Controller

GTF Gesellschaft für technologiebasierte Finanzdienstleistungen AG, Schweizergasse 6, 8001 Zurich, Phone: 044 552 57 58, info@hypotheke.ch, is responsible for data processing in accordance with this Privacy Policy.

13. Amendment to the Privacy Policy

We reserve the right to change this Privacy Policy at any time. The version published at https://www.hypotheke.ch/datenschutzerklaerungdatenschutz is the currently valid version.

As of August 2023