Privacy Policy

1. Controller

The controller responsible for the processing of personal data on this Platform is china-cars.ch, Im Sunnebuck 23, 8306 Brüttisellen, Switzerland (the "Operator"). Contact: details in the Legal Notice.

This Privacy Policy informs you about the processing of personal data in accordance with the revised Swiss Federal Act on Data Protection (nFADP) and its implementing ordinance (DPO).

2. Principles

Personal data is processed in accordance with the principles of lawfulness, transparency, purpose limitation, proportionality, and data security.

3. Hosting and server logs

The Platform is hosted on Microsoft Azure (Azure Static Web Apps, Azure Functions, Azure Cosmos DB). When you access the Platform, Azure records technical access data (IP address, user agent, timestamp, requested resource). This data is generally retained for up to 30 days and is used for security and troubleshooting purposes.

The data is generally processed in data centers in the EU. Where data is transferred to third countries (in particular the United States), this is done on the basis of standard contractual clauses or applicable adequacy decisions.

4. Local storage in the browser (localStorage)

The wishlist and the theme preference (light/dark) are stored exclusively in your browser (localStorage) and are not transmitted to the Operator.

5. Comments

When you publish a comment, your display name, the comment text, and a hashed IP address (SHA-256) are processed. The hashed IP address is used solely for rate limiting and does not allow you to be identified.

Comments are publicly visible and stored in a database (Azure Cosmos DB). They remain published until deletion is requested.

6. Ratings and sign-in

Star ratings can only be submitted by signed-in users. Sign-in uses the built-in authentication of Azure Static Web Apps with one of the offered providers: Google or Microsoft (Entra ID). The providers transmit a user identifier and, where applicable, the display name to the Operator.

The Operator stores the hashed user identifier, the provider, the display name, the submitted rating, and timestamps. Only one rating per user and vehicle is counted; re-rating overwrites the previous one.

After sign-in, Azure Static Web Apps sets a session cookie that is technically required for authentication.

7. Partner link click tracking

When you click on partner or dealer links (e.g. AutoScout24 or official importers), anonymous event data is stored (partner, placement, page, destination, timestamp). No IP addresses and no personal data are collected.

8. Instagram feed

The homepage displays public posts from the Operator's Instagram channel. The posts are synchronized via the Meta Graph API; when images are loaded, your IP address is transmitted to Meta Platforms (United States).

9. Translation of comments

Users can have comments machine-translated. The comment text is transmitted to the translation service (Microsoft Translator or DeepL) for this purpose but is not permanently stored.

10. Cookies

The Platform does not use tracking cookies. After sign-in, Azure Static Web Apps sets a session cookie that is technically required for authentication.

11. Disclosure to third parties and third countries

Recipients of personal data include: Microsoft (Azure hosting, Cosmos DB, Entra sign-in, translation), Google (sign-in), Meta (Instagram feed), and DeepL (translation).

Transfers to third countries only take place where permitted, in particular on the basis of standard contractual clauses or adequacy decisions.

12. Retention period

Comments and ratings are stored until their deletion is requested. Server logs are generally deleted after 30 days.

13. Rights of the data subject

Every person has the right to access, rectification, deletion, restriction of processing, data portability, and to object to the processing of their data, to the extent permitted by law.

Please direct requests to the Operator (contact: Legal Notice). You also have the right to lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC).

14. Data security

The Platform is served exclusively over encrypted connections (TLS/SSL). Access to stored data is limited to the Operator.

15. Changes to this Privacy Policy

The Operator may adjust this Privacy Policy at any time. The version published at any given time is authoritative.