1. Controller
The controller within the meaning of art. 5 let. j revFADP is Mehmet Ongan, sole proprietorship operating the Parcellis brand, Rue de Porcena 29, 2035 Corcelles (NE), Switzerland. Contact for any question about personal data or exercising your rights: info@parcellis.ch.
If you act on behalf of a company, please also include that company name in your request.
2. Data processed
Depending on your use of the service, Parcellis may process identification and contact data, account data, login and security data, technical logs, information about analysed parcels and projects, support messages and, in case of an order, billing or payment data.
- account data: name, email, technical identifiers, role, preferences
- project data: address, parcel, EGRID, IDENTDN, technical context and project notes you enter
- login and security data: IP address and user agent (browser, system) recorded at your last successful login, timestamps of failed login attempts and account lockouts — processed for the sole purpose of detecting and blocking unauthorised access (art. 8 revFADP)
- usage data: error logs, product events, flow history, interface preferences
- contractual data: order, billing and support information
3. Purposes
We process this data to provide the service, secure access, generate requested reports and flows, provide support, improve product reliability, fight abuse, comply with legal obligations and manage the contractual relationship.
Depending on the case, Parcellis relies on contract performance, legitimate interest in operating and securing the service, compliance with legal obligations or your consent, especially for optional audience measurement.
4. Recipients, processors and cross-border transfers
Data is accessible only on a strict need-to-know basis. Parcellis relies on the following processors, each bound by a data-processing agreement:
- Infomaniak — application hosting (Switzerland)
- Supabase — database, authentication and storage (European Union / United States)
- Stripe — payment and billing (United States / Ireland)
- OpenAI — document analysis and language-model generation (United States)
- Anthropic — document analysis and language-model generation (United States)
- Google (Tag Manager) — optional audience measurement (United States)
- Hotjar — optional navigation analysis: heatmaps and session recordings (European Union)
- Meta Platforms (Meta Pixel) — optional advertising tracking: measuring our campaign conversions (United States)
- Infomaniak (SMTP server) — sending service and support emails (Switzerland)
- depending on enabled features: fal.ai — simulation image generation (United States); Google Photorealistic 3D Tiles — map visualisation (United States)
5. Origin of the documents and analysis by language models
The site has no upload feature: you do not send us any files. The documents used to produce your report (OEREB/RDPPF extracts, municipal and cantonal zoning plans and regulations, cadastral data) come from official or public sources and are gathered by Parcellis on the administrator side, based on the address or parcel identifier you provide.
These documents, the parcel identifiers and the project context you enter are analysed automatically by language models operated by OpenAI and Anthropic (United States) in order to produce your report. These providers act as processors and do not use your content to train their models.
Some data is thus processed by processors located in the United States. Depending on the provider, these transfers rely on the Swiss-U.S. Data Privacy Framework certification recognised by the Federal Council, or on data-protection contractual clauses ensuring an adequate level of protection within the meaning of art. 16 revFADP. A copy of the safeguards can be requested at info@parcellis.ch.
Where an official document gathered in this way contains personal data (a name appearing on a plan or a decision, for example), that data is processed only to the extent necessary to produce the ordered report.
6. Automated individual decision-making and profiling
Parcellis reports are produced by automated processing combining official data and language models. They are an indicative, non-binding decision aid: they create no entitlement, are neither a permit nor an administrative validation, and decide nothing about you (see the Terms of Use, art. 2).
Parcellis therefore makes no automated individual decision within the meaning of art. 21 revFADP, that is, no decision based exclusively on automated processing that would produce legal effects for you or significantly affect you. No price, no contractual condition and no refusal of service results from an automatically established profile.
The only automated mechanisms that may restrict access are deterministic security measures: temporary account lockout after five failed login attempts, and rate limiting per IP address. They follow fixed rules, are temporary, and can be lifted by human intervention on simple request to info@parcellis.ch.
The Meta Pixel, activated only if you consent to it, allows Meta Platforms to measure the conversions of our campaigns and may involve advertising profiling at that provider. This profiling has no effect on the service you receive from Parcellis, on the content of your report or on its price, and you can disable it at any time through the Manage cookies button.
7. Retention
Data is retained for as long as needed to provide the service, manage the business relationship, support, security and our legal obligations. As an indication:
- account data: for the duration of the account, then deleted or anonymised within 12 months after its closure
- documents and project data: 24 months after delivery of the last report, unless earlier deletion is requested
- billing data: 10 years (statutory accounting retention obligation, art. 958f CO)
- technical logs: 12 months
9. Your rights
Subject to applicable law, you may request access to your data (art. 25 revFADP), rectification, erasure, restriction of certain processing, withdrawal of consent for the future and, where relevant, object to certain uses. You also have the right to obtain the handover or transfer of certain data you provided (art. 28 revFADP).
To exercise your rights, write to info@parcellis.ch describing your request. We reply in principle within 30 days and free of charge, except for manifestly unfounded or excessive requests. If there is doubt, we may ask for reasonable evidence to avoid disclosing data to the wrong person.
10. Security, breaches and complaints
Parcellis implements technical and organisational measures to protect data against unauthorised access, loss, alteration, disclosure or misuse. The following are in place: encryption of all communications in transit (HTTPS enforced, HSTS headers and a content security policy); per-user data isolation at the database level, so that an account can only reach its own records; role-based access control reserving administration functions to authorised accounts; temporary account lockout after repeated failed logins and rate limiting; logging of authentication and administration events as well as of sent emails (metadata only, never the message body); and privileged access executed exclusively on the server side, with no administration secret exposed to the browser.
No measure makes a system impregnable: these provisions reduce the risk, they do not remove it. In case of a data-security breach entailing a high risk to your rights, Parcellis notifies the Federal Data Protection and Information Commissioner (FDPIC) and, where applicable, the data subjects (art. 24 revFADP).
If you believe that our processing does not comply with the applicable framework, please contact us first. If necessary, you may also contact the competent supervisory authority, including the FDPIC in Switzerland.