Privacy Policy

Last updated: 11 August 2026

1. Introduction

This privacy policy explains how Aeria ("Aeria", "we") collects, uses and protects your personal data when you use our website and our platform for booking workspaces with partner hotels (the "platform").

We process your data in accordance with the Swiss Federal Act on Data Protection (FADP) and its ordinance. This policy supplements our cookie policy, which details the use of cookies and similar technologies.

2. Data controller

The controller of your personal data is:

• Aeria Workspaces Sàrl, Chemin du Pont-de-Ville 5a, c/o Recogest Partners SA, 1224 Chêne-Bougeries, Switzerland;

• Contact for any question relating to data protection: info@aeria-workspaces.com.

3. What data we process

Depending on your use of the platform, we process the following categories of data:

• Account data: surname, first name, e-mail address, password (stored in encrypted form), language and account settings.

• Booking data: workspaces and hotels booked, dates and times, history and status of bookings, any subscription plan.

• Payment data: payments are processed by our provider Stripe. We do not store card numbers; we receive limited information (payment status, reference, possibly the last digits of the card).

• Support data: the content of your exchanges with our team via the integrated messaging (Intercom) or by e-mail.

• Technical and browsing data: IP address, device or user identifiers, pages viewed, audience measurement data (Google Analytics), set by means of cookies (see the cookie policy).

• Product usage data: events related to your browsing and interactions (page views, automatically recorded clicks, steps in the booking journey), processed by means of a product analytics tool (PostHog). When you are logged in, these events are linked to your account and your profile may include your e-mail address; a session recording feature may also be active. This processing, which is more detailed and identifiable in nature, is subject to specific information and is only carried out with your consent, which you can withdraw at any time.

• Mapping and telemetry data: when you view the maps (Mapbox), interaction and approximate location data may be collected, including by Mapbox for its own purposes of improving its services; you can object to this.

• Data you provide to us: messages, reviews, or information provided via our forms (for example "Become a partner hotel").

Providing account, booking and payment data is necessary to use the platform and to carry out your booking; without it, we cannot provide the service. Other data (for example your messages or reviews) is optional. The platform is intended for adult users and is not aimed at minors; we do not knowingly collect data concerning persons under the age of 16.

4. Purposes and bases of processing

We process your data for the following purposes, on the bases indicated (performance of the contract, legitimate interest, legal obligation or consent):

5. Cookies and similar technologies

The platform uses cookies and similar technologies for the purposes of operation, audience measurement and support. Their use, the categories concerned and the means to refuse them are described in detail in our cookie policy. Non-essential trackers, in particular audience measurement (Google Analytics) and usage analytics (PostHog), are only activated after you have been informed and given the opportunity to object.

6. Recipients of your data

Your data is accessible to our authorised teams and communicated, only to the extent necessary, to the following categories of recipients:

• Partner hotels: the information necessary to carry out your booking (identity, time slot, workspace booked).

• Payment provider: Stripe, for secure payment processing and fraud prevention.

• Technical sub-processors: hosting (Vercel), audience measurement (Google Analytics, PostHog), support messaging (Intercom), content management (TinaCMS), acting on our instructions.

• Mapping (Mapbox): acts as a provider for displaying the maps and, for its telemetry, may process data for its own purposes.

• Authorities and authorised third parties: where the law requires us to do so or to assert our rights.

Our sub-processors act only on our instructions and are contractually required to ensure an adequate level of protection and to process your data solely for the agreed purposes, in accordance with Article 9 FADP.

We do not sell your personal data.

7. Transfers of data abroad

Some of our providers (in particular Google, Intercom and Mapbox) are established outside Switzerland, in particular in the United States. Where a transfer of data abroad takes place, we ensure that it rests on a valid basis: either a country offering adequate protection recognised by the Federal Council (for certified US companies, the Swiss-U.S. Data Privacy Framework), or standard contractual clauses recognised by the FDPIC, or, failing that, your explicit consent. The list of providers concerned and the applicable safeguards can be obtained on request at info@aeria-workspaces.com.

8. Retention periods

We keep your data only for as long as necessary for the purposes pursued, then for the applicable statutory periods:

• Account data: for the lifetime of your account, then deleted or anonymised after its closure, subject to statutory periods.

• Booking and billing data: retained in accordance with Swiss legal obligations to keep accounting records (in principle ten (10) years).

• Support data: kept for the time necessary to handle your request, then in principle for up to twenty-four (24) months after the last contact.

• Audience measurement data (Google Analytics): a maximum of thirteen (13) months, then deleted or aggregated.

• Product usage data (PostHog): a maximum of twelve (12) months, then deleted or anonymised.

• Mapping telemetry data (Mapbox): associated with an anonymous identifier renewed periodically, retained by Mapbox in accordance with its own policy.

9. Security and data breaches

We implement appropriate technical and organisational measures to protect your data against any unauthorised access, loss, alteration or disclosure, in particular encryption of connections, encrypted storage of passwords and restriction of access to authorised persons. As no system is infallible, however, we cannot guarantee absolute security.

In the event of a data security breach resulting in a high risk to your personality or fundamental rights, we notify the Federal Data Protection and Information Commissioner (FDPIC) as soon as possible and, where necessary for your protection or required by law, we also inform you, in accordance with Article 24 FADP.

10. Your rights

In accordance with the FADP, you have the following rights over your personal data:

• right of access: to know whether we process your data and to obtain a copy of it (Art. 25 FADP);

• right to rectification of inaccurate data;

• right to obtain the erasure or destruction of your data, within the limits provided by law;

• right to object to processing, in particular to the disclosure of your data to third parties, and to request that a specific processing operation cease;

• right to the handover or transmission of your data in a common electronic format (portability, Art. 28 FADP);

• right to withdraw your consent at any time where the processing is based on it, without affecting the lawfulness of processing carried out beforehand.

To exercise these rights, write to us at info@aeria-workspaces.com. Proof of identity may be requested in order to avoid any disclosure to a third party. We respond within the time limits provided by law. These rights may be restricted where the law so provides or where the rights of third parties so require.

11. Automated decisions and profiling

We use audience measurement tools to understand the use of the platform, but we do not make decisions producing legal effects concerning you on the sole basis of automated processing.

12. Complaint to the supervisory authority

If you consider that the processing of your data does not comply, you may contact the Federal Data Protection and Information Commissioner (FDPIC), www.edoeb.admin.ch. Should EU law apply, you could also contact the data protection authority of your country of residence.

13. Amendment of this policy

We may amend this policy to reflect developments in our services or the legal framework. The applicable version is the one published on the platform on the date of your visit. In the event of a substantial change, we will inform you by an appropriate means. This policy is drawn up in French and may be translated; in the event of any discrepancy between the versions, the French version shall prevail.

14. Contact

For any question relating to this policy or your personal data, you can write to us at info@aeria-workspaces.com or at the following address: Aeria Workspaces Sàrl, Chemin du Pont-de-Ville 5a, c/o Recogest Partners SA, 1224 Chêne-Bougeries, Switzerland.