PRIVACY

Privacy policy

Version 3.1 · 20 August 2026

This website itself sets no cookies and runs no analytics or third-party trackers. Nothing on ecx.ag tracks you, and there is no consent banner because there is nothing to consent to. The policy below covers all our services, including the ECX platform, where an account and a transaction do require personal data.

1. About us

This privacy policy explains how we process and protect your personal data when you use this website or our services provided via https://ecx.ag (together, the "Services").

The Services are operated by European Car Xchange AG, Sonneggstrasse 88, 8006 Zurich, Switzerland (the "Company", "we", "our", or "us"). The Company is the controller for the data processing described below.

Unless otherwise defined here, the terms used have the meaning given to them in the Swiss Federal Act on Data Protection (FADP) or the EU General Data Protection Regulation (GDPR).

2. Vehicle data

We process vehicle data for the purpose of listing a vehicle, running the auction, and for matters connected to the purchase or sale of vehicles on our platform. This includes the vehicle identification number, the registration number and photographs of the vehicle.

Where such data can be linked to an identifiable person, we treat it as personal data and process it on the legal bases set out in section 5.

3. Personal data we collect

We may collect or receive personal data for purposes connected with our business operations when you use our Services, namely:

Contact details, for example name, address, telephone number and date of birth
Professional details, for example title and role
Financial information relevant to a transaction, for example payment and settlement details and creditworthiness checks on business counterparties
Usage and analytics information on the platform, for example identifiers and interaction data
Unique user IDs
Location data, where you provide it or it is needed to arrange collection of a vehicle

There is no obligation to provide your personal data. However, our Services cannot be provided if you do not provide the data strictly necessary to perform the contract between you and us.

4. How we collect personal data

Directly

Through this website and electronic communication
When you use our Services
When you correspond with us by electronic means
When you create a user account on the platform
When you browse, complete a form or make an enquiry
When you sign up to receive our newsletter or other material

Indirectly

Through public sources
From third parties
From external service providers, see section 7

5. Legal basis and purposes

Our legal basis for collecting and using personal data depends on the data concerned and the purpose for which we collect it.

Contract — to perform our contractual obligations or take steps linked to a contract with you:

To provide and protect our platform and Services
To administer, manage and develop our business and Services

Consent — where you have given it freely:

To provide you with information about auctions you take part in
To send you news, offers, newsletters and general information about our goods and services

Legitimate interests — where we have assessed the processing as fair and reasonable and as not overriding your interests or fundamental rights:

To develop new services
To maintain and improve our Services, and to detect, prevent and address security threats

Compliance with legal obligations — to meet regulatory and public interest obligations:

To notify you about changes to our Services and to this policy
To comply with applicable law and regulation
To establish, exercise or defend legal claims

6. Data retention

We keep personal data for as long as it is needed for the purposes for which it was collected, and in line with legal and regulatory requirements or contractual arrangements. After that we delete it or fully anonymise it. In practice that means:

Enquiry and contact data: for as long as we are in contact with you about your enquiry, and for a reasonable period afterwards
Contract and transaction data: for the duration of the contract and for ten years afterwards, as Swiss bookkeeping law requires
Accounting records and supporting documents: ten years, in line with Art. 958f of the Swiss Code of Obligations
Marketing data: until you unsubscribe or withdraw your consent, after which we keep only what is needed to honour that request
Backups: on a rolling schedule, overwritten or deleted in the ordinary backup cycle
Data we are required to keep by law, or must retain to establish, exercise or defend legal claims: until that obligation or period ends

7. Data recipients

We engage third-party companies ("Service Providers") to facilitate the operation of our Services, to help analyse how they are used, or to perform necessary services such as payment processing and IT. These third parties have access to your personal data only to the extent necessary to perform those tasks.

Third parties who provide IT and software services
Professional advisers, such as accountants and lawyers
Third parties engaged in the course of your matter, such as counsel, banks and other payment providers, KYC and AML service providers, and postal or courier providers
Other group entities involved in your matter

8. Data transfers

We and our Service Providers may transfer your personal data to, and process it in, the EU and EEA and the United States.

Some Service Providers are located in countries whose level of data protection does not correspond to that of Switzerland or the EU. We safeguard your personal data in line with our contractual obligations and applicable data protection law when transferring it abroad. Safeguards may include transfers to countries recognised as providing adequate protection by the Swiss Federal Council or by a European Commission adequacy decision, and standard contractual clauses, binding corporate rules or equivalent obligations.

Where a transfer to a third country takes place without an adequacy decision or appropriate safeguards, there is a risk that authorities in that country may gain access to the transferred data and that your rights as a data subject may not be enforceable.

9. Data disclosure

We may disclose your personal data where we believe in good faith that it is necessary:

To comply with a legal obligation, including a valid request from a court or public authority
To protect the security of our Services and defend our rights or property
To prevent or investigate possible wrongdoing in connection with us or with a third-party provider
To protect ourselves against legal liability

10. Data security

We take the technical and organisational security measures we consider appropriate to protect stored data against manipulation, loss and unauthorised third-party access, and we adapt them as technology develops.

Our employees and the service providers we engage are required to maintain confidentiality and to comply with applicable data protection law, and are granted access to personal data only where this is necessary for their tasks.

No method of transmission over the internet or of electronic storage is completely secure. While we use commercially reasonable means to protect your personal data, we cannot warrant its absolute security.

11. Your rights

You have the rights set out below. To exercise them, write to the address above or email privacy@ecx.ag. We may ask you to verify your identity before we respond.

Access — to request a copy of your personal data, which we provide in electronic form.
Rectification — to ask us to correct our records where you believe they are incorrect or incomplete.
Withdrawal of consent — to withdraw consent at any time with effect for the future, including opting out of marketing. To stop receiving emails, use the unsubscribe link in the message or write to privacy@ecx.ag.
Erasure — to ask us to delete your personal data where it is no longer necessary for the purposes for which it was collected, or where it was processed unlawfully.
Restriction of processing — to ask us to restrict processing where you believe the data is inaccurate, the processing is unlawful, or we no longer need the data but cannot delete it.
Portability — to ask us to transmit data you provided to us to another controller in a standard format, where we process it on the basis of your consent or to perform a contract.
Objection — where we process your data on the basis of legitimate interests, to object on grounds relating to your particular situation. We will comply unless we have compelling legal grounds that override your interests, or need the data to establish, exercise or defend a legal claim.
Complaint to a supervisory authority — the competent authority in Switzerland is the Federal Data Protection and Information Commissioner. In the EU and EEA you may complain to the supervisory authority of your residence, your place of work or the place of the alleged infringement; a list of authorities is maintained by the EDPB.

12. Social media and links to third-party sites

Our Services contain links to websites and applications that we do not operate. We have no control over their content, privacy policies or practices.

We maintain a presence on LinkedIn to communicate with customers and prospective customers and to provide information about our products and Services. If you have an account on the same network, information and media you have made available there may be visible to us, for example when we view your profile, and the network may allow us to contact you. Once we transfer personal data into our own systems we are responsible for it independently, and we do so to take pre-contractual steps or to perform a contract. For processing carried out by the network under its own responsibility, please refer to its privacy statement.

13. Newsletter

We send newsletters and other notifications by email and through other channels, and may use third parties to deliver them. In principle you must expressly consent to receive them, unless another legal basis permits it.

Newsletters may contain web links or tracking pixels that record whether a message was opened and which links were clicked. We use this statistical record of usage, including reach measurement, to make our newsletters useful and reliable. You can unsubscribe at any time, and thereby object to that collection, by contacting us or by using the link in the footer of each newsletter.

14. Changes to this policy

We may update this policy from time to time and encourage you to review it periodically. Changes take effect when they are posted on this page.

15. Contact

European Car Xchange AG
Sonneggstrasse 88, 8006 Zurich, Switzerland
privacy@ecx.ag