Privacy Policy
October 29th, 2026
1. Who is responsible
Leez Sàrl, Rue des Prés de la Scie 7, 1920 Martigny, Switzerland ("Leez", "we"), is responsible for the processing described here. It concerns the website leez.ch and its platform (the "Service"). For any question about your data: hello@leez.ch.
We apply the Swiss Federal Act on Data Protection (FADP). Where the European Union's General Data Protection Regulation (GDPR) applies, for example if you use the Service from the European Union, you also have the rights it provides.
2. The data we process
Your account. Name, email address, profile picture, language, phone number and its verification, role (seller, buyer, expert), interests and search criteria (sectors, cantons, budget, type of takeover), address, and your answer to "How did you hear about Leez?". Sign-in is handled by Clerk: Leez does not know your password.
Your listings. Information about the business and its figures, including its real name, which we do not publish, the documents uploaded and the contact details of its contact persons.
Identity verification. Stripe Identity checks your identity document and the items its process requires, then sends us the result and the verification report. If the process asks you for a selfie, Stripe compares your face with the photo on the document (biometric data), for this verification only. You can also upload documents yourself: identity card, passport, debt enforcement register extract. Your phone number is verified with a code sent by text message.
Non-disclosure agreements. The signed text, the date, the time, the IP address and the phone number used for signing, the PDF copy of the agreement and the comments exchanged with the seller.
Tracking the steps. The stages, dates and amounts you enter (letter of intent, due diligence, signing, transfer, price) and your notes.
Payments. Your Stripe customer ID, and the amounts, dates and purpose of payments and subscriptions. Card data stays with Stripe.
Valuation. The business figures you enter (revenue, EBITDA, cash, debt…), your contact details, the result and where your visit came from. When you create a listing, these answers, your role on the listing (owner, trusted delegate, fiduciary or adviser) and the asking price form its draft, which you find again in the same browser for 30 days, even before you have an account.
Messages and account management. Messages from the contact form, requests sent to experts, your feedback from the application (with the page concerned) and the emails you exchange with our team. Our team keeps a follow-up record for each account and each valuation request: contact details, exchanges, call notes and tasks.
Use of the Service. The pages and listings viewed, searches, favourites, clicks on documents, contacts and links in blog articles, the days you sign in, and a log of key actions (sign-up, agreement request, publication…) that contains no free text. It also records the language of the page and the type of device (phone, tablet or computer); without an account, it carries your browser's random identifier (section 6) and, if you create an account, the actions of the previous 30 days are linked to it: this shows us at which step our journeys lose their visitors. When you are signed in, the listings you view are linked to your account. Without an account, we count the listings you open each day, using a random identifier kept in your browser (section 6) or, failing that, a fingerprint of your IP address recalculated every day, which does not allow us to follow you from one day to the next. Views of listings, expert profiles and agenda pages, and clicks on their links, count once per visitor and per day: for this we keep a fingerprint recalculated every day from your account, this identifier or, failing that, your IP address and browser, which does not allow us to follow you from one day to the next. If you then create an account, the listings opened with this identifier in the previous 30 days are linked to it: you find them in your account, they prefill your search criteria, and they are kept with your account.
Where your visit came from. The website you came from, the landing page, campaign parameters (utm) and ad click identifiers (gclid, for example), for your first and your last visit. Your browser keeps them until you sign up or request a valuation; we then record them with your account or your request. It also keeps the blog articles you read (which ones, when, and whether you read them to the end); we record them with your account when you sign up.
Emails. The emails we send you, their delivery and, where applicable, whether they were opened and which links were clicked.
Thursday e-mail. If you sign up for the Thursday e-mail without an account: your email address, the language you chose, the page where you signed up, the date of your request and, when you confirm through the link we send you, the date and IP address of that confirmation, which prove your consent. Against abusive sign-ups, we count the sign-ups made from the same connection with a fingerprint of the IP address recalculated every day.
Submitted events. If you submit an event to our agenda: the event's details, which we publish after review, your name, your email address, the language of the page, the date of your agreement to publication and, if you tick the box, your request for the monthly report on your events. Against abusive submissions, we count the events submitted from the same connection using a fingerprint of the IP address recalculated every day.
Event alerts. If you ask to be told the date of an event in the agenda: your email address, the language of the page, the event, the date of your request and, when you confirm it through the link we send you, the date and IP address of that confirmation, which prove your consent. Against abusive requests, we count the alerts requested from the same connection using a fingerprint of the IP address recalculated every day.
Technical data. IP address, browser, device and the logs of our hosting providers, used in particular for security.
Data from third parties. The listings we take from other Swiss websites, with their original text and, where applicable, the name and contact details of the intermediary who publishes them. We do not display these contact details: the listing published on Leez is rewritten and links to the original website. We also receive payment confirmations from Stripe, the results of Stripe Identity and, if you sign in with a third-party account offered on the sign-in page, your name, email address and photo.
We ask for no other sensitive data, such as data about your health or your opinions. Do not include such data in your listings or messages.
3. Why we process them
| Purpose | Legal basis (GDPR) |
|---|---|
| Providing the Service: account, listings, non-disclosure agreements, introductions, tracking of steps, payments | Performance of the contract |
| Verifying buyers' identity and phone number before they access reserved information | Performance of the contract; legitimate interest in protecting sellers |
| Sending the Service's emails, alerts, statistics and reminders | Performance of the contract |
| Sending the newsletter and information about our services, or writing to you about your valuation | Legitimate interest; you can object at any time |
| Sending you the Thursday e-mail, if you signed up for it without an account | Consent, which you can withdraw at any time |
| Publishing the events you submit to us, writing to you about them and sending you their monthly report if you asked for it | Consent for publication and the monthly report; performance of your request for the e-mails about it |
| Telling you the date of an event, if you asked for it | Consent, which you can withdraw at any time |
| Following up our exchanges with you and offering you our support | Legitimate interest |
| Measuring audience, understanding how the Service is used and improving it | Legitimate interest |
| Measuring the effectiveness of our advertising campaigns | Legitimate interest |
| Producing aggregated statistics on transactions | Legitimate interest |
| Protecting the Service against abuse (reCAPTCHA, text message limits, the limit on listings viewed without an account, the limit on Thursday e-mail sign-ups, the limit on submitted events and agenda alerts) | Legitimate interest |
| Meeting our legal obligations, in particular for accounting | Legal obligation |
The FADP does not require a legal basis for each processing operation; the right-hand column applies to the GDPR. We do not sell your data.
4. Who receives your data
Other users, to the extent the Service provides:
- the public information of a listing is visible to everyone;
- when you request a non-disclosure agreement, the seller sees your name, your place of residence and the text of the agreement; if the seller accepts it, you see the reserved information and the seller's contact details;
- the dates and amounts of the step tracking are shared by both parties to the agreement;
- a request sent to an expert is forwarded to the expert with your contact details;
- an expert's profile, contact details included, is public.
Our team, according to their tasks, in particular for account management and identity verification.
Our service providers, who process the data on our behalf and according to our instructions:
| Provider | Use | Location |
|---|---|---|
| Vercel | Hosting of the website and of uploaded files, audience measurement (Vercel Analytics, Speed Insights) | United States |
| Neon | Database | European Union (Germany) |
| Clerk | Sign-in and account management | United States |
| Stripe | Payments and identity verification (Stripe Identity) | Ireland, United States |
| Twilio | Sending text message codes | United States |
| Resend | Sending and receiving emails, tracking delivery, opens and clicks | United States |
| Inngest | Automated tasks, such as sending scheduled emails | United States |
| Audience measurement (Google Analytics), advertising (Google Ads), protection against abuse (reCAPTCHA), address entry (Google Maps) | Ireland, United States | |
| PostHog | Measuring how the Service is used | European Union (Germany) |
| Anthropic | Rephrasing, anonymising and translating listings and profiles with artificial intelligence models | United States |
| Slack | Internal notifications for our team | United States |
Authorities, when the law requires it, and any acquirer of Leez or of the Service, who would remain bound by this policy.
5. Transfers abroad
Several providers process data in the European Union or in the United States. Switzerland recognises that the countries of the European Union provide adequate protection. For the United States, we rely on the provider's certification under the Swiss-U.S. Data Privacy Framework or, failing that, on the standard contractual clauses recognised by the Federal Data Protection and Information Commissioner (FDPIC).
6. Cookies and browser storage
The website uses cookies and your browser's local storage:
- to work: your sign-in session (Clerk), your display settings, your choice on the cookie banner, your favourites while you have no account, the draft of a valuation in progress, where your visit came from (section 2), without an account, a random identifier that counts the listings you open, for the viewing limit, that makes your visits to listings and pages count only once a day (section 2), that brings back for 30 days the draft of a listing started without an account and, if you create an account, links these listings and the actions recorded in our log to it (leez_vid cookie, 30 days) and, when you open a listing from the Thursday e-mail or confirm your subscription to it, the identifier of your subscription or account, without your e-mail address, which lifts that limit for the e-mail's listings (for all listings for 7 days if you have an account) and lets us recognise you (leez_mj cookie, 30 days);
- to measure audience: Google Analytics, PostHog, Vercel Analytics and Speed Insights. If you accept cookies, a random identifier also lets us count the visitors of a listing;
- for advertising: Google Ads, which measures the results of our campaigns and may build audiences.
You can block or delete cookies and local storage in your browser settings, refuse measurement by Google Analytics with Google's opt-out add-on and adjust advertising in your Google settings. Without cookies, some features, such as signing in, do not work.
7. Emails
Our emails are sent through Resend. We record when they are sent and delivered. They contain a tracking image and links that tell us whether they were opened and which links you clicked; links to leez.ch carry campaign parameters (utm). Replies to emails from our team are added to your follow-up record.
You can turn off alerts, statistics and reminders in your account settings or through the link they contain. You can unsubscribe from the newsletter and from information about our services at any time, through the unsubscribe link or by writing to hello@leez.ch.
Without an account, you only receive the Thursday e-mail after confirming your sign-up through the link in the confirmation email. Every Thursday e-mail contains an unsubscribe link that works without logging in.
An agenda alert is only sent to you after you confirm your request, and only once. The monthly report to organisers contains an unsubscribe link that works without logging in.
8. How long we keep data
We keep your data for as long as needed for the purposes described, to prove your commitments and ours, and to meet our legal obligations. In particular:
- listings viewed without an account are deleted after 31 days, except those linked to the account created afterwards, which are kept with it;
- a Thursday e-mail sign-up without an account is deleted 7 days after the confirmation link is sent if you do not confirm it, and 24 months after you unsubscribe; if you create an account with the same address, it is attached to the account and deleted with it;
- an agenda alert is deleted 7 days after the confirmation link is sent if you do not confirm it; your address is erased as soon as the alert is sent, if the event is cancelled, or 12 months after the expected month if its date has still not been announced;
- the action log and the record of automated emails are deleted after 24 months, and the browser's random identifier is removed from the log after 90 days;
- the follow-up record of a person without an account is anonymised after 24 months without activity;
- accounting records and payment data are kept for 10 years, as Swiss law requires;
- non-disclosure agreements and proof of their signature are kept for as long as they may serve as evidence;
- Google Analytics deletes data linked to a visitor after 14 months.
When you delete your account, we close your access, replace your email address with a technical address, archive your listings, anonymise your follow-up record and erase the address, subject and text of the emails exchanged with you. The rest is kept for as long as needed.
9. Security
Connections to the website are encrypted (HTTPS). Access to data is limited by role, and our providers are bound by data processing agreements. Identity documents, listing documents and non-disclosure agreements are stored in a private space: they can only be opened through the application, by authorised people. No system is infallible: report any incident to us at hello@leez.ch.
10. Your rights
You can ask for access to your data, its correction or its erasure, object to processing, in particular to direct marketing, and receive your data in a common format. Where processing is based on your consent, you can withdraw it at any time. If identity verification automatically ends in a refusal, you can ask a member of our team to review your file.
Write to us at hello@leez.ch or through the contact page. We may ask you to prove your identity and generally reply within 30 days. Some data must be kept despite an erasure request, for example for our accounting obligations or as proof of an agreement.
You can contact the Federal Data Protection and Information Commissioner (FDPIC) and, if you live in the European Union, the data protection authority of your country.
11. Minors
The Service is for adults only. We do not knowingly collect data from minors.
12. Changes
We update this policy when our processing changes. The version in force is the one published on this page, with its update date.
13. Contact
Leez Sàrl, Rue des Prés de la Scie 7, 1920 Martigny, Switzerland. Email: hello@leez.ch. Form: contact page.