Privacy Policy
1. Introduction
Casae (“we”, “us”, or “our”) is a property-management company that provides core property-management services to property owners and their authorised representatives. These services are supported by digital systems and operational tools that enable efficient communication, coordination, and service delivery.
In the course of providing property-management services, Casae processes personal data relating to tenants, property owners, service providers, and other individuals involved in property-management operations.
This Privacy Policy explains how and why Casae processes personal data, how such data is protected, and what rights individuals have in relation to their personal data. It is provided in accordance with the Swiss Federal Act on Data Protection (FADP) and the EU General Data Protection Regulation (GDPR).
This Privacy Policy applies to personal data processed by Casae in connection with:
Property owners and their authorised representatives who use Casae’s services.
Tenants of properties managed by Casae.
Service providers and vendors involved in property-management operations.
Visitors to Casae’s website and users of Casae’s digital tools.
This Privacy Policy is an informational notice. It does not form part of any contract and does not require acceptance in order to apply.
2. Casae’s Role in Data Processing
Casae processes personal data in different roles depending on the context and purpose of the processing. In some cases, Casae acts as a data processor on behalf of property owners. In other cases, Casae acts as an independent data controller.
Casae as data processor (tenant-related data)
For most personal data relating to tenants and their tenancy, Casae acts as a data processor on behalf of the relevant property owner. In this context, the property owner determines the purposes and means of processing personal data relating to the tenancy, and Casae processes such data solely to carry out property-management activities on the owner’s behalf and in accordance with the owner’s instructions and applicable law.
Tenant-related processing typically includes handling communications, maintenance requests, and routine operational coordination required to manage a property. Where Casae acts as a processor, the property owner remains the primary data controller and is responsible for providing privacy information to tenants and for handling data-subject rights requests. Casae assists property owners in fulfilling these obligations where required.
Casae as independent data controller
Casae acts as an independent data controller for personal data processed for its own business and operational purposes. This includes, in particular:
Managing relationships and communications with property owners and their representatives.
Operating, securing, and improving Casae’s digital platforms and services.
Managing vendor and service-provider relationships.
Processing website usage data and service analytics.
Ensuring compliance with legal, accounting, and regulatory obligations.
In these cases, Casae determines the purposes and means of processing and is directly responsible for compliance with applicable data-protection law.
Use of third-party service providers
Casae uses selected third-party service providers to support certain processing activities, including AI-assisted messaging and automation tools. These providers act as data processors on Casae’s behalf and are contractually bound to process personal data only in accordance with Casae’s instructions and applicable data-protection law.
3. Categories of Personal Data We Process
Casae processes personal data that is necessary to deliver property-management services and to operate its business. The categories of personal data processed depend on the individual’s role and interaction with Casae.
Property owners and owner representatives
Casae may process:
Identification and contact information (such as name, email address, and telephone number).
Professional or business information (such as role, organisation, and properties managed).
Account and service-related information (such as service configuration and support communications).
Billing and contractual information relevant to the provision of services.
Tenants
Casae may process:
Identification and contact information necessary for communication.
Tenancy-related information (such as the address of the rented property and contextual information relevant to managing the tenancy).
Communications submitted in the course of property-management operations (such as maintenance requests or service-related inquiries).
Limited contextual information required to understand and resolve operational issues.
Casae processes tenant personal data primarily on behalf of property owners and does not use such data for purposes unrelated to the management of the tenancy.
Service providers and vendors
Casae may process:
Identification and contact information of individual contacts or representatives.
Information related to services provided, scheduling, and operational coordination.
Billing and payment-related information where relevant.
Website visitors and users of digital tools
Casae may process:
Technical and usage information (such as IP address, device information, and usage logs).
Information collected via cookies or similar technologies.
Information submitted through contact forms or similar channels.
Casae does not intentionally process special categories of personal data through its standard property-management operations or messaging tools.
4. Purposes of Processing Personal Data
Casae processes personal data only where necessary for defined and legitimate purposes related to property management and the operation of its services.
These purposes include:
Delivering property-management services, including handling tenant communications and maintenance requests.
Managing relationships and communications with property owners and their representatives.
Coordinating services with vendors and service providers.
Operating, securing, and improving Casae’s digital systems and tools.
Managing contractual, billing, accounting, and record-keeping obligations.
Complying with applicable legal and regulatory requirements.
Personal data may also be used in a limited and proportionate manner to monitor service performance and improve operational processes. Personal data is not used for unrelated product development, advertising, or commercial profiling purposes.
5. Legal Bases for Processing Personal Data
Casae processes personal data only where a valid legal basis exists under applicable data-protection law.
Performance of a contract
Processing is carried out where necessary to perform a contract with property owners or to enable the performance of tenancy-related obligations on behalf of property owners.
Legitimate interests
Processing may be carried out where necessary for Casae’s legitimate interests, including operating and improving services, ensuring security, and managing operations, provided these interests are not overridden by individuals’ rights and freedoms.
Compliance with legal obligations
Processing may be required to comply with legal or regulatory obligations, including accounting, tax, and record-keeping requirements.
Consent (where applicable)
Consent is relied upon only in limited cases where it is appropriate, such as for non-essential cookies or optional features. Consent may be withdrawn at any time.
6. Data Sharing and Recipients
Casae shares personal data only where necessary to provide property-management services, operate its business, or comply with legal obligations. Personal data is not sold or shared for unrelated commercial purposes.
Personal data may be shared with:
Property owners, as primary data controllers for tenant-related data.
Service providers and sub-processors supporting Casae’s operations.
AI-assisted messaging and automation providers used to support operational communications.
Service providers and contractors involved in property-management tasks.
Authorities or third parties where required by law or to protect Casae’s legal rights.
7. International Data Transfers
Casae processes personal data primarily in Switzerland. In certain cases, personal data may be transferred to, stored in, or accessed from countries outside Switzerland, including the United States.
Where such transfers occur, Casae implements a combination of contractual, technical, and organisational safeguards to ensure a level of protection essentially equivalent to that required under Swiss and EU data-protection law. These safeguards include:
Standard Contractual Clauses (EU 2021/914).
Binding data-processing agreements with service providers.
Strict data-minimisation and scope limitations.
Encryption of personal data in transit and at rest.
Role-based access controls and least-privilege principles.
Explicit exclusion of sensitive categories of personal data from third-country processing.
Documented risk assessment and mitigation, including a dedicated Data Protection Impact Assessment.
Third-country processing is limited in scope, monitored on an ongoing basis, and treated as temporary where feasible.
8. Data Retention
Casae retains personal data only for as long as necessary to fulfil the purposes for which it was collected and to comply with applicable legal and regulatory obligations.
Retention periods are determined based on the nature of the data, the purpose of processing, and applicable contractual or legal requirements. Where personal data is no longer required, it is securely deleted or irreversibly anonymised.
Where Casae acts as a data processor, retention is governed by the instructions of the relevant property owner and applicable contractual arrangements.
9. Data Subject Rights
Individuals whose personal data is processed by Casae have rights under applicable data-protection law, including the right to access, rectify, delete, restrict, or object to the processing of their personal data, and the right to data portability where applicable.
Requests to exercise these rights may be submitted using the contact details provided below.
Where Casae acts as an independent data controller, Casae will respond to such requests directly within the time limits required by law.
Where Casae acts as a data processor on behalf of a property owner, in particular in relation to tenant personal data, the relevant property owner remains the primary data controller and is responsible for responding to data-subject rights requests. Casae assists property owners in fulfilling these obligations where required.
Casae may take reasonable steps to verify the identity of individuals submitting requests and may refuse or limit requests where permitted by law.
10. AI and Automated Processing
Casae uses limited forms of AI-assisted tools to support property-management operations, in particular to assist with the handling, routing, and preparation of routine operational communications.
Where AI-assisted tools are used, relevant personal data may be processed by third-party service providers acting on Casae’s behalf as data processors. Such processing is carried out under binding data-processing agreements and is subject to contractual, technical, and organisational safeguards in accordance with applicable data-protection law.
AI-assisted tools may be used to categorise requests, assist with drafting responses, or route communications to the appropriate operational team or service provider. These tools support human decision-making and do not operate as systems of record.
Casae does not use automated decision-making, including profiling, that produces legal effects or similarly significant effects on individuals. All actions taken in response to communications remain subject to human review and control.
Personal data processed through AI-assisted tools is limited to what is necessary for operational communications. Sensitive categories of personal data are explicitly excluded, and personal data is not used to train generalised machine-learning models.
11. Security Measures
Casae implements appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or unauthorised access.
These measures include, in particular:
Role-based access controls and least-privilege principles.
Authentication and authorisation mechanisms.
Encryption of personal data in transit and, where appropriate, at rest.
Monitoring and logging of system activity.
Confidentiality obligations for personnel.
Incident-response and breach-management procedures.
Where personal data is processed by third-party service providers, Casae requires such providers to implement comparable security measures through contractual obligations.
12. Cookies and Website Analytics
Casae uses cookies and similar technologies on its website to ensure basic functionality and to understand how the website is used.
Analytics tools may be used to collect aggregated and statistical information about website usage. Casae does not use cookies for targeted advertising or profiling.
Where required by applicable law, Casae obtains consent for non-essential cookies and provides appropriate information and controls.
13. Contact Details and Complaints
Questions, requests, or concerns regarding this Privacy Policy or the processing of personal data by Casae may be directed to:
Email: nicolas@casae.io
Individuals who believe that their personal data has been processed in violation of applicable data-protection law have the right to lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC) or, where applicable, with a competent EU supervisory authority.
14. Changes to This Privacy Policy
Casae may update this Privacy Policy from time to time to reflect changes in its processing activities, legal requirements, or operational practices. The most recent version will always apply.