3.1 Registration and Authentication

When registering, we collect your surname, first name, email address and a password. Alternatively, you may register via "Sign in with Apple" or "Sign in with Google". In this case, we receive the data provided by Apple or Google (ID, name, email address) and store an OAuth token for authentication.

Your email address is confirmed during registration via a verification email. This email is sent via SendGrid (Twilio Inc.).

Legal basis: Performance of contract (Art. 31 para. 2 lit. a FADP / Art. 6 para. 1 lit. b GDPR).

3.2 Profile Data

After registration, you create a profile. The data collected varies depending on your role:

As a buyer, you provide: industries (interests), regions, purchase price range, number of employees, languages, a headline and a personal description.

As a seller, you provide: industry, region, sale price range, company age (as a range), number of employees, turnover, languages, your motivation for selling, a headline and a personal description.

No exact prices are collected; only ranges are used.

Legal basis: Performance of contract (Art. 31 para. 2 lit. a FADP / Art. 6 para. 1 lit. b GDPR).

3.3 Profile Images, Listing Images and Documents

You may upload profile images (e.g. portrait or company logo), listing images and supplementary documents to your listing. This content is stored in Supabase Storage in Switzerland and is visible to users with whom a match or partial match exists (see section 3.4). It is not publicly accessible and not freely searchable.

3.4 Matching and Visibility of Profile Data

Matching between buyers, sellers and advisor mandates is carried out exclusively server-side via database queries. No external AI services are used. No automated profiling within the meaning of the GDPR takes place, i.e. no decisions are made that are based solely on automated processing and produce legal effects.

Your profile data is not publicly accessible and not freely searchable. It is displayed exclusively to registered users for whom the matching algorithm has identified a correspondence (match or partial match). This includes the information referred to in section 3.2 (headline, description, industry, region, price ranges, etc.) as well as listing images and documents (section 3.3).

In the event of a complete match (mutual like), your first name is additionally displayed. Your email address, full surname and contact details are not disclosed to other users.

Visibility of advisor data: Mandates of M&A advisors are created via the separate advisor portal and appear in the matching process within the app. In the event of a match with an advisor mandate, you will see the advisor's first name. The advisor may optionally release further details via their portal (surname, self-description, experience, specialisation, public email address, telephone number, profile image). Whether and which of these details are displayed is determined by the advisor.

3.5 In-App Messages

After a match, users can send each other messages. The messages are stored in Supabase in Switzerland and protected by access control at the database level. Transmission is encrypted (TLS). The message content is not end-to-end encrypted.

In the chat, your first name is visible to the other person. Read receipts: when the other person opens your message, you may be shown that the message has been read (for example by a checkmark). The time the message was read is processed for the respective conversation but is not passed on to any third party outside the conversation. You can deactivate this function in the settings; if it is deactivated, you will likewise not see other users' read receipts. Legal basis: performance of the contract (Art. 31 para. 2 lit. a DSG / Art. 6 para. 1 lit. b GDPR) or legitimate interest in a standard chat function (Art. 31 para. 1 DSG / Art. 6 para. 1 lit. f GDPR).

If you delete your account, the messages you have sent remain visible to the other person. The chat is marked with a note that it has been closed. On request to datenschutz@bizzqui.com, your messages can also be deleted for the other person.

3.6 Push Notifications

For push notifications, we use Firebase Cloud Messaging (FCM) by Google. Firebase is used exclusively for the delivery of push notifications, not for authentication, analytics or crash reporting. You may deactivate push notifications at any time in your device settings.

3.7 Translations

For the translation of profile content (headline, description and, where applicable, motivation for selling), we use the DeepL API. Processing takes place server-side. DeepL processes the transmitted texts in the EU (Germany).

We currently use the DeepL API Free Plan. Under this plan, the transmitted texts may be used by DeepL to improve the translation service. Only the aforementioned profile content is transmitted; no email addresses, names or other directly identifying data.

Legal basis: Legitimate interest in providing the platform in multiple languages (Art. 31 para. 1 FADP / Art. 6 para. 1 lit. f GDPR).

3.8 Transactional Emails

For the delivery of verification emails and notifications, we use SendGrid (Twilio Inc.). Your email address and first name are transmitted to SendGrid. SendGrid processes data in the USA on the basis of Standard Contractual Clauses and the EU-US Data Privacy Framework.

3.9 Reach and advertising performance measurement via Meta (app)

Where you have given your consent, we use services provided by Meta Platforms Ireland Ltd in our app to analyse how the app is used and to measure the effectiveness of our advertising campaigns. For this purpose we use the Facebook SDK, which transmits selected events to Meta, in particular the installation of the app and the first activation of your profile, together with related device and usage data (e.g. device type, operating system version, app version and a resettable advertising identifier).

On iOS devices we additionally request your permission via Apple's mandatory dialog (App Tracking Transparency) before a cross-device advertising identifier is used. If you do not grant this permission, measurement takes place only in a limited, aggregated form via Apple's SKAdNetwork, under which Apple provides anonymised and bundled data without any link to your person.

The recipient of the data is Meta Platforms Ireland Ltd. A transfer to the USA to Meta Platforms Inc. may take place; this is based on Standard Contractual Clauses and the EU-US Data Privacy Framework.

Legal basis: your consent (Art. 31 para. 1 FADP and Art. 6(1)(a) GDPR). You can withdraw your consent at any time with effect for the future in the app settings. Without your consent this measurement does not take place, and the app continues to function unchanged.