Privacy Policy

1. Data controller

The controller of personal data collected on the Citavivo platform is HTplus. Contact: info [at] citavivo.com

2. Data collected

We collect the following data:

• Identification data: name, email address, password (hashed)
• Expert profile data: biography, specialties, profile photo
• Transaction data: amount, date, Stripe identifier (we do not store credit card data)
• Technical data: IP address, connection logs, browsing data

3. Processing purposes

• User account management and authentication
• Processing bookings and payments
• Sending confirmations, reminders and transactional notifications
• Platform improvement and fraud prevention
• Compliance with our legal and accounting obligations

4. Legal basis

The processing of your data is based on: the performance of a contract (bookings, payments), our legitimate interest (security, service improvement) and compliance with our legal obligations.

5. Retention period

Your data is retained for the duration of your relationship with Citavivo, then archived in accordance with legal obligations (5 years for accounting data). Connection data is retained for 12 months.

6. Sub-processors and data sharing

Your data may be transmitted to the following categories of sub-processors, strictly within the scope of their services:

• Secure payment provider (PCI-DSS certified) — transaction processing
• Hosting provider — data storage, servers in Switzerland
• Real-time messaging service — notifications and WebRTC signalling, servers in the EU
• Error monitoring service — may receive technical data (IP address, anonymised ID) in the event of an application error
• Video relay service — processes your IP address only for the duration of the video session

No data is sold to third parties.

7. International transfers

Some sub-processors are based outside the European Economic Area (including in the United States). These transfers are governed by Standard Contractual Clauses (SCCs) approved by the European Commission, providing a level of protection equivalent to the GDPR. Data is hosted in Switzerland, a country recognised as adequate by the EU.

8. Your rights (GDPR / DPA)

In accordance with the GDPR and the Swiss Federal Act on Data Protection (DPA), you have the following rights:

• Right of access, rectification and erasure
• Right to data portability
• Right to object and restriction of processing

To exercise your rights, contact us at info [at] citavivo.com

In case of dispute, you may contact the Federal Data Protection and Information Commissioner (FDPIC — edoeb.admin.ch)

9. Minors

The platform is reserved for adults (18 years and over). We do not knowingly collect personal data from minors. If you believe a minor has created an account, please contact us so we can delete their data.

10. Cookies

The platform uses only technical cookies necessary for operation (authentication, language preferences). No advertising tracking cookies are used.

11. Changes to this policy

We reserve the right to modify this policy at any time. In the event of a significant change, we will notify you by email or via a visible notification on the platform. The date of the last update is shown at the top of this page.