At Pawbook, protecting your personal data is a priority. This policy explains what data we collect, why, how we use it and what rights you have. It has been drawn up in accordance with the Federal Act on Data Protection (FADP) of 25 September 2020, in force since 1 September 2023.
1. Controller
You can contact us at any time with any question about your personal data.
2. Data we collect
a) Pet owners (clients)
- •First name and surname
- •Email address
- •Telephone number (optional)
- •Postal address (for invoicing where applicable)
- •Password (hashed — never visible, not even to us)
- •Information about your pet: name, breed, size, age, allergies, behaviour
- •Your booking history
- •Reviews left on salons
b) Professionals
- •Salon name and company name
- •Business email address
- •Telephone number
- •Postal address of the salon
- •Description and photos of the salon
- •Services offered and prices
- •Opening hours
- •Payment data (handled by Stripe — never stored directly by Pawbook)
- •Subscription history
c) Technical data (all users)
- •IP address (for security)
- •Browser type and operating system
- •Pages visited
- •Essential cookies (session, authentication)
3. Why we collect this data
- Enabling account creation and secure authentication
- Facilitating contact between pet owners and professionals
- Managing bookings and the availability calendar
- Processing subscription payments (professionals) via Stripe
- Sending appointment confirmations by email, appointment reminders by SMS and health record reminders by email
- Improving the quality and features of the service
- Complying with our legal obligations (accounting, tax)
- Ensuring the security of the platform and preventing fraud
Invitation from a professional: a professional who adds you to their client list with your email address can ask Pawbook to send you a one-time invitation to create your account (or to link your existing account), with one reminder at most a week later. For this, Pawbook uses the name, contact details and email address entered by that professional; the invitation contains no health data. The link is valid for 30 days; if you do nothing, nothing happens. To stop receiving invitations from any professional, click “Stop receiving invitations” at the bottom of the email: your address is then kept on a refusal list, only so that we no longer write to you.
4. Legal basis for processing
In accordance with Article 31 FADP, we process your data on the following bases:
5. Data retention period
| Type of data | Period |
|---|---|
| Active user account | For as long as the account is active |
| Deleted account | Client: erased immediately. Professional: erased after 7 days, on hold if invoices have been issued |
| Account never confirmed | Deleted after 48 hours |
| Sign-up request from a professional (private form) | Until the account is deleted, photos and logo included |
| Bookings | 5 years (evidence in the event of a dispute) |
| Invoices and accounting data | 10 years (Swiss legal obligation) |
| Technical logs (IP, etc.) | 12 months maximum |
| Session cookies | Up to 400 days, deleted when you sign out |
Account deletion: When you delete your account, we erase your account, your profile, your pets and their health record, your reviews and your favourites. The professionals you booked with keep, for their own client file, your appointments (name, contact details, pet's name), the reports of their sessions (with the pet's name and species), their invoices, their address book, the photos of the appointments and the record of the messages sent on their behalf. Upcoming appointments are kept and pending requests are cancelled. The professional must keep their invoices for 10 years (Art. 958f CO). Your address stays on their unsubscribe lists, so that they no longer write to you. For this data, please contact the professional directly. If you delete a pet, its health record is erased; the professionals keep the reports of their sessions.
6. Sharing with third parties and processors
We never sell your data. We use the following service providers; those acting as processors are contractually bound to respect the confidentiality and security of your data:
| Service | Country | Purpose | Safeguards |
|---|---|---|---|
| Supabase Pte. Ltd. | United Kingdom (servers in London), Singapore, United States | Database, accounts and files | Adequate country; standard contractual clauses (SCC) |
| Stripe Payments Europe, Limited | Ireland, United States | Payment of professionals' subscriptions | Adequate country; Swiss-U.S. Data Privacy Framework |
| Resend (Plus Five Five, Inc.) | United States (sent from Ireland) | Sending emails | Standard contractual clauses (SCC) |
| Twilio Ireland Limited | Ireland, United States | Sending SMS reminders | Adequate country; Swiss-U.S. Data Privacy Framework |
| Sentry (Functional Software, Inc.) | Germany (servers in Frankfurt), United States | Tracking technical errors, without recording sessions | Adequate country; Swiss-U.S. Data Privacy Framework |
| DeepL SE | Germany, Iceland, Sweden | Machine translation of professionals' texts | Adequate countries |
| Google Ireland Limited | Ireland, United States | Sign-in with Google and map of salons (shown only at your request) | Adequate country; Swiss-U.S. Data Privacy Framework |
| swisstopo (Swiss Confederation) | Switzerland | Search, verification and geolocation of addresses in Switzerland and Liechtenstein | Data in Switzerland |
| Infomaniak Network SA | Switzerland (Geneva) | Website hosting and server functions; email service for the contact address | Data in Switzerland |
Your pet's health record: the professionals you booked with always see its profile (name, breed, allergies, emergency contact) and the notes you leave for them. The full health record (vaccinations, history, treatments, documents and session reports) is shared by default with the vets, animal physiotherapists, animal osteopaths, pet boarding services and dog trainers you booked with; groomers, pet sitters, dog walkers and pet photographers do not see it without your consent. You can enable or withdraw this sharing for each professional, in your pet's health record.
7. Transfers of data abroad
Some of your data is transferred outside Switzerland for the purposes of the service providers listed above.
Countries concerned: United Kingdom, countries of the European Union and the European Economic Area (EEA), United States, Singapore.
The United Kingdom and the countries of the EU and the EEA are recognised by Switzerland as providing an adequate level of protection. For the United States, each transfer is based on the company's certification under the Swiss-U.S. Data Privacy Framework, a certification that can be verified on dataprivacyframework.gov, or, failing that, on standard contractual clauses (SCC) approved by the European Commission and recognised by the Federal Data Protection and Information Commissioner (FDPIC), which guarantee a level of protection equivalent to that required by the FADP. Transfers to Singapore are also based on these clauses.
You can ask us for more information about these safeguards by writing to contact@pawbook.ch.
8. Data security
- Secure HTTPS connection across the entire site
- Hashed passwords — never stored in plain text
- Role-based restricted access to data (strict access control)
- Regular, automated backups
- Monitoring of suspicious access and abnormal activity
- Stripe certified PCI-DSS Level 1 for all payments
9. Your rights
The FADP guarantees you the following rights. They are all free of charge and can be exercised simply by email.
Right of access (Art. 25 FADP)
You can ask us what data we hold about you. We will reply within 30 days.
Right to rectification
You can correct or update your data via your personal area or by contacting us.
Right to erasure (right to be forgotten)
You can request the deletion of your account and your data. We erase your account, your profile, your pets, your reviews and your favourites; the professionals you booked with keep your appointments for their own client records and the reports of their sessions, as well as their invoices, which they must retain to meet legal obligations (see the retention period).
Right to data portability (Art. 28 FADP)
You can obtain your data in a common electronic format (JSON or CSV).
Right to object
You can object to certain processing of your data on legitimate grounds.
Right to withdraw your consent
You can withdraw your consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.
10. How to exercise your rights
12. Data breach
In the event of a breach of the security of your data that poses a high risk to the personality or fundamental rights, we will inform you without undue delay and notify the competent authority (Federal Data Protection and Information Commissioner, FDPIC) in accordance with Article 24 FADP.
This notification will specify the nature of the breach, the data concerned, the likely consequences and the measures taken or planned to remedy it.
13. Supervisory authority
If you believe that your rights are not being respected, you can lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC):
Federal Data Protection and Information Commissioner (FDPIC)
Feldeggweg 1
3003 Bern, Switzerland
Website: www.edoeb.admin.ch
Telephone: +41 58 462 43 95
14. Changes to this policy
We may update this privacy policy to reflect changes in our practices or for legal reasons. The date of the latest update is always shown at the top of this page.
Any significant change will be communicated to you by email or via a notice displayed on the site before it takes effect.
15. Contact
This privacy policy has been drawn up in accordance with the Swiss FADP and constitutes our contractual commitment to you. For any specific legal question, please do not hesitate to contact us.
In case of any discrepancy, the French version prevails.