Logo

ReptElion

Legal

Privacy policy

Privacy policy

Last updated: 20 October 2026

1. Overview

This privacy policy explains which personal data ReptElion (reptelion.com) processes, for what purposes, for how long, who receives it and what rights you have. It applies to all visitors and users, whichever country they use the platform from.

It focuses on Switzerland and the EU: it is designed to meet the Swiss Federal Act on Data Protection (FADP) and the EU General Data Protection Regulation (GDPR). If the law of your country of residence gives you further rights, those apply in addition.

In short: we do not sell data, show no advertising and use no analytics or tracking services.

2. Controller and contact

Elion Qerimi
Grenzstraße 1
2558 Aegerten
Switzerland

Email: info@reptelion.com
Phone: +41 78 352 20 06

You can reach us at this address for all questions and requests about data protection.

3. What data we process

3.1 When you visit the website

  • Technical data on every request: IP address, date and time, requested address, browser and operating system, previously visited page. These arise in our host’s server logs.
  • Application error logs (technical error messages).
  • Reports from your browser about blocked content (Content Security Policy): only the page concerned without parameters and the blocked address.
  • Proof of your consent to the terms of use on your first visit: time, versions of the documents, IP address, browser identifier and a random identifier stored as a cookie.
  • Your language setting.

3.2 User account

  • On registration: email address and password (stored only as a hash, never in plain text).
  • For listings, additionally: first and last name, username and phone number.
  • Optional: display name, profile picture, salutation, company, address (street, postcode, town, region, country), website, links to social media profiles (Facebook, Instagram, TikTok, YouTube) and preferred language.
  • Account status: confirmation of email address and phone number, seller status, times of registration and consents, and important account events (e.g. email confirmed, seller account activated).
  • Sessions: IP address, browser and last activity of your logins. You can see them in the settings under “Active sessions”.
  • Sign-in with Google (optional): Google gives us your name, your email address and a Google account identifier. We never receive your Google password.

3.3 Listings

  • Content: title, description, price, category, species, details about the animal or accessory (e.g. age, sex, health, origin, condition) and images.
  • Location: postcode, town, country and, if you enter them, street and location details. From postcode and country we determine approximate coordinates for the radius search.
  • Documents: uploaded permits or CITES documents. They are not public and are only accessible to authorised persons.
  • Bulk upload: the uploaded file and a processing log (imported rows, errors).
  • Attempts to list a species from CITES Appendix I are recorded with a snapshot of the details in order to prevent abuse.

3.4 Inquiries about listings

  • Name, email address, optionally phone number, your message and, for animals, your confirmation regarding husbandry.
  • The inquiry is sent by email to the seller and you receive a copy. The seller replies to you directly and is responsible for handling your data from then on. ReptElion does not store the content of the inquiry in its database.

3.5 Ratings, reports and corrections

  • Ratings: positive or negative, optionally with a comment, plus author and time.
  • Reports about listings or profiles: reason, description and reporting person (for guests, the email address provided).
  • Correction notes on species information: what is wrong, the correct information and the source.

3.6 Moderation and security

  • Warnings and bans with their reasons, and a block list of email addresses and phone numbers of banned accounts so that bans cannot be circumvented.
  • A log of moderation actions: what, when, by whom, why, state before and after.
  • Short-lived counters to limit requests (e.g. login attempts), partly based on the IP address.

3.7 Account deletion, payments and emails

  • Account deletion: your deletion request with confirmation status and times.
  • Payments: all features are currently free of charge and we collect no payment data. If paid services are offered in the future, payment will be handled by the payment provider Payrexx. We will then only receive the amount, status, time and reference, never card or account details.
  • Emails: we only send emails that are necessary for using the platform (e.g. email confirmation, password reset, inquiries, account deletion). No newsletters, no advertising.

4. Purposes and legal bases

  • Contract (Art. 6(1)(b) GDPR): providing the platform and your account, publishing your listings, forwarding inquiries, necessary emails.
  • Legitimate interests (Art. 6(1)(f) GDPR): security, preventing abuse and fraud, moderation, enforcing the Terms, proof of consents, error analysis and the automatic translation of content for a multilingual audience.
  • Consent (Art. 6(1)(a) GDPR): optional details you choose to publish (e.g. email address or phone number on your profile) and sign-in with Google. You can withdraw it at any time in the settings.
  • Legal obligations (Art. 6(1)(c) GDPR): retention obligations and requests from authorities.

The Swiss FADP does not require a legal basis for every processing activity. We nevertheless follow the same principles: lawful, in good faith, proportionate and only for the purposes stated.

5. What is publicly visible

  • Profile: username or display name, first and last name, profile picture, website and social media links, verification status, trust score and badges, ratings and your listings.
  • Listings: content, images, price, postcode, town and country, and the street if you enter it.
  • Email address and phone number only if you explicitly make them public.

Public content can be accessed worldwide without logging in and may be indexed by search engines. Please do not publish anything that should not be public, and do not put contact details in listing texts.

6. Trust score

The trust score (0–100) is calculated automatically from account age, number of listings, ratings, warnings, confirmed reports and bans. It is for orientation only. Warnings and bans of accounts are always decided by a human; there are no automated individual decisions with legal or similarly significant effects within the meaning of Art. 22 GDPR or Art. 21 FADP.

7. Recipients and service providers

  • Infomaniak Network SA, Geneva, Switzerland: hosting, database and sending of emails. The platform’s data is stored in Switzerland.
  • DeepL SE, Cologne, Germany: automatic translation of listing texts and species descriptions. Only the texts to be translated are transmitted, no account or contact details from your profile.
  • Google (Google Ireland Limited, Ireland, and Google LLC, USA): only if you use “Sign in with Google”.
  • OpenStreetMap Foundation, United Kingdom (“Nominatim” service): receives only postcode and country from our server to determine coordinates, no personal data.
  • Payrexx AG, Thun, Switzerland: only if paid services are offered in the future.
  • Other users: public content; your inquiry goes to the seller.
  • Authorities and courts, if we are legally obliged to disclose data or it is necessary to protect our rights.

We do not sell data and do not pass on data for advertising purposes.

8. Transfers abroad

  • The platform’s data is located in Switzerland. The EU recognises Switzerland as a country with an adequate level of data protection.
  • DeepL (Germany) and the OpenStreetMap Foundation (United Kingdom) are based in countries whose data protection Switzerland and the EU recognise as adequate.
  • When you sign in with Google, data may be transferred to the USA. Google LLC is certified under the EU-U.S. and the Swiss-U.S. Data Privacy Framework; standard contractual clauses apply in addition.
  • If you use ReptElion from outside Switzerland, your data is transferred to and processed in Switzerland.

9. Cookies

We only use technically necessary cookies: no analytics, advertising or tracking cookies and no third-party cookies. That is why we do not ask for cookie consent.

  • Session: keeps you logged in and secures forms; expires after 2 hours of inactivity.
  • Security token (XSRF-TOKEN): protects forms against misuse.
  • Language: remembers your language for 1 year.
  • Proof of consent: a random identifier so that we do not ask you again on every visit.
  • “Remember me”: only if you choose this option when logging in.

When you sign in with Google, Google’s own cookies and privacy terms apply on Google’s pages.

10. Retention and deletion

  • Account and profile data: until you delete your account.
  • Listings, images and ratings: until you delete them or your account.
  • Sessions: until you log out or they expire.
  • Application error logs: 14 days. The host’s server logs: according to the host’s rules.
  • Account deletion: after your confirmation we delete your account immediately, together with profile, listings, images, ratings, reports, sessions and proofs of consent. Entries in the moderation log about measures that concerned your account remain.
  • Ban data of banned accounts (block list with email address and phone number): for as long as necessary to enforce the ban.
  • Payment-related data, if any: for the statutory retention period (Switzerland: 10 years).
  • Backups are deleted when their retention period ends.

11. Your rights

In particular, you have the right to:

  • access your data,
  • have incorrect data rectified,
  • erasure,
  • restriction of processing,
  • receive your data in a common format (data portability),
  • object to processing based on legitimate interests,
  • withdraw consent with effect for the future.

You can do much of this directly in the settings, such as changing your profile or deleting your account. For anything else, write to info@reptelion.com. We usually reply within 30 days and may ask for proof of identity to protect your data.

You can also lodge a complaint with a supervisory authority: in Switzerland with the Federal Data Protection and Information Commissioner (FDPIC), in the EU or EEA with the data protection authority of the country where you live or work (in Germany the authority of your federal state, in Austria the Data Protection Authority in Vienna).

If the law of your country gives you further rights, you can also exercise them via the address above.

12. Minors

ReptElion is intended only for persons who are at least 18 years old and of full age under the law of their place of residence. We do not knowingly process data of minors. If we become aware of it, we delete the account.

13. Security

We protect your data with encrypted transmission (HTTPS), passwords stored only as hashes, access restrictions for administration and moderation, security policies in the browser and regular backups. However, absolute security does not exist on the internet. If a data breach occurs, we inform you and the competent authorities where the law requires this.

14. Changes

We update this privacy policy when the platform or the legal situation changes. We will inform you of material changes on your next visit. The version published here applies.

15. Language versions

This privacy policy is available in German, English, French and Italian. In case of discrepancies, the German version prevails.