Baumatching

1Who is responsible

SAITS GmbH, Baarerstrasse 79, 6300 Zug, Switzerland, runs Baumatching. For people in the EU the GDPR applies, in Switzerland the revised FADP.

2What we store from clients

Your questionnaire answers, postcode and town, optional photos, name, email, phone, role and optionally company or project reference. Plus the time and IP address of your consent as proof.

3What for

To check your request and pass it to at most three matching, verified businesses. Before buying, businesses see your request without name and contact details; we hide phone numbers, email addresses and links in free text. The legal basis is your consent and performing the contract (Art. 6(1)(a) and (b) GDPR).

4What we store from businesses

Company and register data, contact persons, services, service area, documents, purchases, offers and invoices – for verification, matching and billing (Art. 6(1)(b) and (c) GDPR).

5How long

Unconfirmed requests are deleted automatically after 7 days. Confirmed requests are kept as long as your account exists or statutory periods require (invoices 10 years). Sign-in links are valid for 20 minutes, sessions for 30 days.

6Cookies

Only necessary cookies: your language choice (NEXT_LOCALE, 1 year) and, after signing in, a session cookie (30 days). No advertising cookies. For page views we use, when switched on, Plausible: cookieless, no personal data, servers in the EU. Questionnaire answers stay on your device until you send them.

7Service providers

Hosting in the EU, email delivery through a provider based in the EU or covered by standard contractual clauses, optionally Cloudflare Turnstile against spam. The exact list of processors will be added before launch.

8Your rights

Access, rectification, erasure, restriction, portability, objection and withdrawal of consent with effect for the future. You may complain to a supervisory authority.

9Security

Encrypted transfer (HTTPS), sign-in by single-use link, tokens stored only as hashes, files kept outside the public area and served only after a permission check.