Data protection policy

Last updated: 26 October 2026

Translation: in case of any discrepancy, the French version prevails. Version française

This policy explains which personal data we process on libre-passage.com (the website and the online search form) and in our app, why, to whom we pass it on, how long we keep it and what your rights are. It has been drawn up in accordance with the Federal Act on Data Protection (FADP) and its Ordinance (DPO) and, for people residing in the European Union, in particular in France, with the General Data Protection Regulation (GDPR).

1. Controller
2. Data we process
3. Purposes and legal bases
4. AHV number, ID document and signature
5. Search started but not completed
6. Recipients of your data
7. Disclosure abroad
8. Retention period
9. Security
10. Cookies and audience measurement
11. Your rights
12. Minors
13. Changes

1. Controller

For any questions about your data or to exercise your rights, please write to us at this address.

2. Data we process

On the website and in the search form

• Estimation questionnaire: your answers (employment status, country of residence, number of employers in Switzerland, years worked, searches already carried out, goal) and the resulting estimate. As long as you do not leave your contact details, these answers remain anonymous.
• Call-back request (‘Get support’): first name, surname, telephone number (confirmed by an SMS code) and, if you provide it, your e-mail address.
• Free cross-border commuter guide (guide.libre-passage.com): first name, e-mail address and country of residence, and the ad you came from. If you then ask to be called back: your telephone number (not confirmed by SMS), passed on to the adviser together with this information. We only contact you if you ask us to.
• Online search: first name, surname, date of birth, sex, e-mail, telephone number, address and country of residence, AHV number, marital status and its date, a photo of your ID document (front and back) and the signature you draw for the power of attorney.
• Proof of your consent: the exact text you accepted, the date and time, your IP address and your browser type.
• Consolidation of your assets: your answers to the investor profile questions.

In the app

• Identity and contact details, as above.
• Tracking of your file: chosen investment strategy and any changes to it, appointments with an adviser, messages exchanged, withdrawal requests.
• Supporting documents that you send us, for example for a capital withdrawal request (ID document, property purchase deed, certificate of departure from Switzerland).

Data we obtain from third parties

• The result of the Central Office 2nd Pillar’s search (list of the institutions where you hold assets).
• Account statements and information sent by pension and vested benefits institutions: balances, opening dates, account numbers, status of transfers.

Technical data

• IP address, device and browser type, date and time of access, server technical logs.
• Anonymous count of the steps of the form (see section 10).

We do not intentionally collect any sensitive data within the meaning of art. 5 let. c FADP or art. 9 GDPR (health, religion, political opinions, etc.). If a document you send us contains such data, it is processed solely for the purpose for which you sent it.

3. Purposes and legal bases

• Performing your mandate: searching for your assets with the Central Office 2nd Pillar and the institutions concerned, obtaining statements, opening your vested benefits account if you request it, preparing and monitoring transfers, processing your withdrawal requests. Basis: performance of the contract (art. 31 para. 2 let. a FADP; art. 6(1)(b) GDPR).
• Calling you back when you ask us to, or when you have started a search without completing it (see section 5). Basis: your request and our interest in helping you complete a process you have started (art. 6(1)(b) and (f) GDPR).
• Providing the app: tracking the search, displaying your assets, changing strategy, booking appointments, notifications. Basis: performance of the contract.
• Improving the website and ensuring its security: anonymous statistics, abuse prevention (limiting the number of submissions). Basis: our legitimate interest (art. 6(1)(f) GDPR).
• Audience measurement and advertising: only with your consent (see section 10). Basis: your consent (art. 6(1)(a) GDPR).
• Direct marketing: only with your express consent (see section 6). Basis: your consent.
• Complying with our legal obligations, in particular regarding the retention of documents. Basis: legal obligation (art. 6(1)(c) GDPR).

You may withdraw your consent at any time, without affecting processing already carried out.

4. AHV number, ID document and signature

Your AHV number is the identifier used by the Central Office 2nd Pillar and by pension institutions. We use it solely to identify you to them, within the scope of the mandate you entrust to us. The Central Office 2nd Pillar also requires a signed power of attorney and a copy of your ID document.

These three items are only sent with your completed search, at the moment you submit it. They are encrypted (AES-256) as soon as our form receives them, are never stored in your browser and are never passed on for commercial purposes.

5. Search started but not completed

As soon as you have completed the ‘Contact details’ step of the search form, we receive your first name, surname, sex, e-mail, telephone number, your answers to the questionnaire and, at the next step, your address, as well as the last step completed. You are informed of this at that step of the form.

If you do not complete your search, an adviser may contact you once to help you. This data is deleted 30 days after your last activity if the search is not submitted. You can object to this at any time by writing to us: we will delete it without delay.

6. Recipients of your data

To perform your mandate

• The Central Office 2nd Pillar (BVG/LPP Guarantee Fund), which receives your search request, your power of attorney and your ID document.
• The pension institutions, vested benefits foundations and banks that hold your assets or to which you request a transfer.
• If you choose to consolidate your assets: Ampia, our partner platform for opening vested benefits accounts, and the chosen vested benefits foundation, which receive the data needed to open the account and your answers to the investor profile. Ampia then sends you the link to confirm your identity directly.
• The authorities, where required by law.

Our technical service providers

They process data on our behalf, according to our instructions and under contract:

• LWS (France): hosting of our case management platform and the search form.
• Amazon Web Services, Zurich data centre (Switzerland): storage of documents (powers of attorney, ID documents, statements).
• Infomaniak (Switzerland): sending of e-mails from our platform.
• Resend (United States): sending of the confirmation e-mail for your search.
• Twilio (United States): sending of the verification code by SMS.
• Expo (United States): sending of app notifications.
• Google, Meta and Microsoft: audience measurement and advertising, only with your consent (see section 10).

For commercial purposes

Only if you expressly consent, by means of a separate box that is never ticked in advance, may your data be passed on to commercial partners of Brokerlink Sàrl so that they can contact you with offers. These partners operate in insurance (life, pensions, risk), occupational and private pensions (2nd and 3rd pillars, vested benefits), banking, investment and wealth management, as well as real estate financing and mortgages.

The data passed on is: identity, contact details, date of birth, nationality and the estimated total amount of your assets. Your AHV number, your signature and your supporting documents are never passed on. The current list of partners is available on request. Each partner becomes the controller of the data it receives and processes it in accordance with its own data protection policy.

You can withdraw this consent at any time by writing to us or in the app settings: we will then stop any further transfer and inform the partners concerned. Refusing or withdrawing this consent has no effect on the search for your assets or on their consolidation.

7. Disclosure abroad

Your documents are stored in Switzerland. Our platform is hosted in France, a country that provides an adequate level of protection according to Annex 1 of the DPO.

Some service providers are based in the United States (Resend, Twilio, Expo, and Google, Meta and Microsoft if you accept their cookies). Data is only disclosed to them if they are certified under the Swiss–U.S. and EU–U.S. Data Privacy Framework or, failing that, on the basis of the standard contractual clauses recognised by the Federal Data Protection and Information Commissioner (FDPIC) and by the European Commission.

8. Retention period

• Mandate data and correspondence: for the duration of the relationship, then 10 years to comply with retention obligations (art. 958f CO) and to assert or defend any claims.
• Search started but never submitted: 30 days after your last activity, then deleted.
• Call-back request not followed by a mandate: 12 months after the last contact, then deleted.
• Cross-border commuter guide request: 12 months, then deleted.
• Anonymous statistics on the form steps: 13 months.
• Marketing data: until you withdraw your consent.
• Technical logs: 12 months maximum.

9. Security

We take technical and organisational measures appropriate to the risk (art. 8 FADP, art. 32 GDPR): encryption of communications (HTTPS), encryption of the AHV number, the ID document and the signature as soon as they are received, access limited to those who need it, secure authentication for the app, backups and logging. In the event of a data security breach resulting in a high risk to you, we will inform the FDPIC and, if necessary, the data subjects (art. 24 FADP).

10. Cookies and audience measurement

Always active (necessary for the service)

For as long as the tab is open, the form stores in your browser your progress (without the AHV number, date of birth, ID document or signature) and where your visit came from. The website and the form also remember your choice regarding cookies.

We also count, anonymously, the steps completed in the form in order to improve it: a randomly generated visit number kept for as long as the tab is open, the steps, the source (for example the advertising campaign) and the device type, without IP address or personal data. These statistics are kept for 13 months.

Only with your consent

• Google Analytics (Google Ireland Ltd / Google LLC): audience measurement (pages viewed, source of visits, steps completed in the form). The data is kept for 14 months.
• Microsoft Clarity (Microsoft Ireland Operations Ltd / Microsoft Corporation): audience measurement, with heatmaps and session recordings (clicks, scrolling, mouse movements). What you type in the fields is never recorded and personal information displayed on screen is masked. Recordings are kept for 30 days, statistics for 13 months.
• Google Ads (Google): measuring the effectiveness of our ads.
• Meta Pixel (Meta Platforms Ireland Ltd): measuring the effectiveness of our ads on Facebook and Instagram.

These tools are only loaded if you accept them in the cookie banner. You can change your mind at any time using the ‘Cookie settings’ link at the bottom of the page. No identifying data (name, e-mail, AHV number) is passed on to them.

11. Your rights

• Right of access to your data and to information about its processing (art. 25 FADP, art. 15 GDPR).
• Right to rectification of inaccurate data (art. 32 FADP, art. 16 GDPR).
• Right to erasure and right to object, subject to our legal retention obligations (art. 17 and 21 GDPR).
• Right to restriction of processing (art. 18 GDPR).
• Right to receive or transmit your data in a commonly used electronic format (art. 28 FADP, art. 20 GDPR).
• Right to withdraw your consent at any time.

To exercise these rights, write to us at support@brokerlink.ch. We may ask you to prove your identity. We generally respond within 30 days, free of charge.

You can also contact the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, www.edoeb.admin.ch or, if you reside in the European Union, the data protection authority of your country (in France: the CNIL, www.cnil.fr).

We do not make any automated individual decisions within the meaning of art. 21 FADP or art. 22 GDPR: the estimate displayed at the end of the questionnaire and the investor profile are indications only, and nothing is signed without your consent.

12. Minors

Our services are intended for adults. We do not knowingly process the data of persons under the age of 18.

13. Changes

We may amend this policy, in particular if our services or the law change. The version published on this website is authoritative. In the event of a significant change, we will inform you by e-mail or in the app.