Privacy policy

⚠ Draft for legal review — Swiss and cantonal. Written against the revised Federal Act on Data Protection (nFADP / nLPD, in force since 1 September 2023) and its ordinance, with the GDPR applied alongside it because a large share of this site’s visitors are in the EU. Not reviewed by a lawyer. Fill in the details in square brackets — the controller’s identification above all — and have it reviewed by Swiss counsel before publishing. See also section 11.

Last updated: [DATE]

1. Who is the controller

• Operator: [REGISTERED BUSINESS NAME]
• UID: [CHE-123.456.789]
• Registered seat: [STREET, NUMBER, POSTCODE, TOWN, SWITZERLAND]
• Email: [CONTACT EMAIL]
• Website: divaescort.ch

[If the operator is established outside Switzerland, or processes on a scale that triggers it, a Swiss representative may be required under the nFADP. Equally, a controller offering services into the EU may need an EU representative under Article 27 GDPR. Both are questions for your adviser; neither is assumed here.]

[A data protection adviser (conseiller à la protection des données) is voluntary for a private controller of this size under the nFADP, but it is worth discussing given the nature of the data handled. If one is appointed, name them here with a contact route.]

2. Which law applies

Swiss law is the primary frame. The operator is established in Switzerland, and the revised Federal Act on Data Protection governs this processing.

The GDPR applies alongside it for visitors in the European Economic Area, because this site is offered to them as well. Where the two differ we apply whichever gives you the stronger protection. The rights in section 7 are written to satisfy both, which is why some are described in terms one law grants more generously than the other.

Switzerland is recognised by the European Commission as providing an adequate level of protection, so data reaching us from the EEA needs no additional transfer mechanism.

3. Our commitment: as little data as possible

This site is built on the proportionality and data-minimisation principles both laws share (art. 6 nFADP; Article 5(1)(c) GDPR). We ask for nothing in order to browse: there are no user accounts, no newsletter, no profiling and no third-party tool watching you. We process personal data only when you decide to write to us, and only what we need in order to reply.

4. What we process, why, and on what basis

Swiss law does not require a “legal basis” in the GDPR sense for ordinary processing by a private person — it requires that the processing be lawful, proportionate, in good faith and recognisable. Where a GDPR basis is also relevant, it is named in brackets for visitors in the EEA.

4.1. Enquiries and booking requests

• Data: the name or alias you choose to give, your email address, and the content of your message, including the quarter or hotel, the date and the kind of occasion.
• Purpose: to answer your enquiry, propose an option and coordinate the service requested.
• Basis: performance of the contract you are asking us to prepare and carry out [Article 6(1)(b) GDPR].
• Retention: for the duration of the relationship and afterwards for the limitation periods that apply to contractual claims. If no booking follows, entries are deleted after 12 months, or sooner if you ask. [Swiss limitation periods are materially longer than the ones this schedule was first written against — ask counsel whether 12 months is right here, and see section 11.]

You may write to us under an alias. We do not verify your identity and we do not need it in order to help you.

4.2. Casting applications

• Data: name, age, an email address, languages, the photographs you attach and the content of your application.
• Purpose: to assess your application and, where appropriate, invite you to meet us in person. Verifying that you are over 18 is an absolute requirement.
• Basis: your explicit consent, and steps taken before entering a contract [Articles 6(1)(a) and 6(1)(b) GDPR; art. 6(6)–(7) nFADP on consent].
• Retention: 6 months if there is no fit, after which the application is deleted along with the photographs. A declined application is deleted after 30 days. If we would like to keep it longer for future rounds, we will ask you separately.
• Your photographs are never published without specific, informed, written consent, which you can withdraw at any time.

4.3. Cookie consent log

• Data: date and time, the categories accepted, browser type and a truncated IP address (the final digits are removed, so it no longer identifies you).
• Purpose: to be able to demonstrate your decision if we are asked to.
• Basis: our own accountability, and compliance with the obligations that apply to us [Articles 5(2) and 6(1)(c) GDPR].
• Retention: 12 months, deleted automatically.

4.4. Age verification

When you confirm that you are over 18, a cookie is stored in your browser with the date of that confirmation. Nothing is recorded on our servers and it is not linked to any person. Basis: our legitimate interest in restricting access to an adult audience [Article 6(1)(f) GDPR].

4.5. Server logs

Our hosting provider keeps access logs (IP address, date, resource requested) for security reasons and to diagnose incidents. Basis: legitimate interest in the security of the system [Article 6(1)(f) GDPR]. Retention: [PROVIDER’S PERIOD, typically 30 days].

5. Sensitive personal data

We do not ask for and do not want any of the categories both laws treat as sensitive — health, sexual life or orientation, religious or political views, ethnic origin, trade-union membership, or data on administrative and criminal proceedings (art. 5(c) nFADP; Article 9 GDPR). Please do not include them in your messages. If any are volunteered regardless, they are deleted as soon as they are noticed.

6. Recipients and where the data goes

We do not pass your data to third parties, we do not sell it, and we do not use it for profiling or automated individual decision-making.

The only parties with access, as processors under a written contract, are the providers strictly needed to run the service: [HOSTING PROVIDER] and [EMAIL PROVIDER]. [State where each one stores the data. If either is outside Switzerland and the EEA, name the country and the safeguard relied on — an adequacy decision of the Federal Council, or standard contractual clauses recognised by the FDPIC. Do not leave this bracket unfilled: a cross-border transfer with no stated safeguard is the most common finding in a data-protection review.]

We would disclose data to anyone else only under a legal obligation, for example in response to an order from a Swiss authority or court.

7. Your rights

You may at any time ask for access, correction, deletion, and the handing over or transfer of your data, and object to processing or ask that it be restricted. Where we rely on your consent, you may withdraw it at any time, and withdrawing it is as easy as giving it. Write to [CONTACT EMAIL].

We reply within one month at the latest. We will not ask you to justify a deletion request and we will not try to talk you out of it.

If you believe we have not handled your request properly, you may contact the Federal Data Protection and Information Commissioner (FDPIC — EDÖB in German, PFPDT in French; Feldeggweg 1, 3003 Bern — edoeb.admin.ch).

If you are in the European Economic Area, you may instead lodge a complaint with the supervisory authority of the country where you live or work.

8. Security and confidentiality

The site is served entirely over an encrypted connection (HTTPS). We apply technical and organisational measures appropriate to the risk, access to enquiries is restricted to the people who have to handle them, and everyone with access is bound by a duty of confidentiality that outlives their relationship with us.

If a breach of data security occurs that is likely to lead to a high risk for you, we will notify the FDPIC as the nFADP requires, and tell you where we are obliged to or where it would help you protect yourself.

No communication over the internet is absolutely secure. If you would rather not put something in writing, leave it out of the form and raise it when we speak.

9. Minors

This site is intended exclusively for adults aged 18 and over, and says so before any content is shown. We do not knowingly process data belonging to minors. If we find that a record belongs to someone under 18, it is deleted immediately.

10. Changes to this policy

Any change is published on this page with its update date. If a change materially affects how we handle your data, we will tell you through the contact route you have given us.

11. Open questions for counsel — remove before publishing

⚠ This section is working notes, not policy. Delete it once each point is resolved.

• Cantonal duties. The Canton of Switzerland regulates this sector through its legislation on prostitution (LProst). Any register, list or notification that framework requires an operator to keep is itself a processing of personal data, and it may sit uneasily beside the deletion schedules above. Ask counsel how the cantonal duties and the data-protection duties interact, and whether anything on this page must change as a result. Nothing here should be read as a statement that those duties do or do not apply — see section 10 of the legal notice.
• Retention. The 12-month, 6-month and 24-month schedules on this site and in the booking diary were set against a different country’s limitation periods. Swiss law differs materially. Confirm each one.
• Cross-border transfers. Confirm where the hosting and email providers actually store data, and complete the bracket in section 6.
• Representative. Confirm whether a Swiss or an EU representative is required (section 1).