Privacy policy.

1. Controller and roles

The controller within the meaning of the revFADP for the operation of the directory platform is:

Bontem von Vogt, Seidenstrasse 21, 8853 Lachen, Switzerland.
Email: levin@bontem.ch.

Bontem operates the directory and the public profile and event pages. The respective club is responsible for the contents of an entry (description, contact details, location, events). As soon as a person registers for an event through us or submits a membership enquiry, we forward their information to the club concerned. From that point on, the club is itself responsible for the further processing of this data (e.g. confirmation, running the event, admission as a member); Bontem merely acts as an intermediary in this respect.

2. What data we process

Depending on use, we process in particular the following categories of data:

• Club and entry data (onboarding): Club name, category, year of foundation, approximate membership size, address of the registered office, description, and a club email address for managing the entry (management link).
• Public club profile: Information that the club releases for publication, such as description, logo, public contact address, public phone number, event address, location coordinates (map), links and contact persons.
• Login-free event registration: Name, email and phone number of the registering person, optional remarks, and, if desired, information about accompanying persons (name, email, phone).
• Membership and trial enquiries: Name, email and phone number of the enquiring person, for a membership enquiry additionally, on a voluntary basis, year of birth and home address, as well as a free-text note about their motivation.
• Allergies and catering information: Collected only if the club requests it for an event. Such information may be sensitive health data (see section 4).
• Contact and report data: Information that you voluntarily provide to us with a contact or report request (e.g. reporting an entry).
• Logo uploads: A logo uploaded by the club (image file) as part of the public profile.
• Technical data: IP address and timestamp, used exclusively to ensure operation, to prevent abuse and to limit the request rate (rate limits) on public forms.

3. Where the club data comes from

The information in the directory comes from the club itself. The club lists itself, all information comes from it, and it decides what of it becomes public.

4. Allergies as sensitive data

Information about allergies or intolerances may be health data and therefore sensitive personal data within the meaning of Art. 5 lit. c revFADP. We collect it exclusively where the club needs it to run a specific event, and only to the extent necessary for that purpose (data minimisation).

Before submitting a registration containing such information, you confirm, by way of a separate, explicit consent, that this information may be processed and passed on to the club for the purpose of running the event. Providing it is voluntary; without an allergy entry this consent does not apply. You may withdraw a consent you have given at any time with effect for the future.

5. Information from and about minors

Many clubs in the directory address children and young people. Registrations and membership enquiries for a minor should therefore be completed by a person with parental responsibility or made with their agreement. This applies in particular where information about allergies or catering is collected (section 4): only someone who can appreciate the implications of that decision can consent to the processing of sensitive data.

We do not technically verify the age of the registering person, and we could not verify it reliably. If we learn that information about a child was submitted without the agreement of those with parental responsibility, we delete it. Parents and guardians can request information or arrange deletion at any time at levin@bontem.ch.

6. Purposes of processing

• Providing the public club directory and the event overview.
• Receiving and forwarding login-free registrations to the organising club.
• Receiving and forwarding membership and trial enquiries to the club concerned.
• Allowing the club to manage the entry via a magic link (without an account).
• Sending the related emails (confirmation of receipt, management link).
• Ensuring security, stability and the prevention of abuse.

7. Legal basis

Depending on the case, the processing is based on the legitimate interest in operating a functional and secure directory, on fulfilling the request you have initiated (e.g. forwarding your registration), or on your consent. For allergy and health data we obtain explicit consent (see section 4). A consent may be withdrawn at any time with effect for the future.

8. Publicly visible data

The information in the club profile released for publication is publicly accessible and machine-readable through the directory. This concerns in particular the public contact address, the public phone number, the event address, the location coordinates and the named contact persons. The internal club email used to manage the entry is not shown publicly. Information from an event registration or a membership enquiry is not made public, but only forwarded to the club concerned.

9. Processors and third-party services

We use carefully selected service providers that process data on our behalf and according to our instructions:

• Resend (Resend, Inc., USA): Sending transactional emails (confirmation of receipt, management link, forwarding of registrations, waiting list confirmation).
• Google Cloud (Google Cloud EMEA Limited, Ireland): Hosting of the application, the database and uploaded files. The servers are located in the europe-west1 region (Belgium), so the data stays in the EU.
• Sentry (Functional Software, Inc., USA): Monitoring of technical errors and loading performance. Sentry runs on every page view and receives the IP address, the address visited, the browser and the time. Access tokens contained in management portal addresses are removed before transmission.
• Google Fonts (Google Ireland Limited, Ireland): The fonts of this website are loaded from fonts.googleapis.com and fonts.gstatic.com on every visit. In doing so, your IP address reaches Google.
• unpkg (Cloudflare, Inc., USA): On pages with a map, the Leaflet map library is loaded from unpkg.com. In doing so, your IP address reaches the operator of that delivery network.
• OpenStreetMap and Nominatim (OpenStreetMap Foundation, United Kingdom): To display the location map, address data and map tiles are retrieved client-side (in the browser). In doing so, your IP address may reach the map provider.

These services are necessary for the operation and presentation of the site and therefore run independently of your decision about analytics. None of them serves advertising, and we do not build a usage profile from them. Analytics is the only service that requires consent; it is covered separately in section 11.

Where required, data processing agreements are in place with these service providers. Data thereby reaches Ireland, Belgium, the United Kingdom and the USA. For the USA we rely on the adequacy decision for the EU-US Data Privacy Framework or on standard contractual clauses.

10. Cookies and local storage

We only set what the site needs in order to work, plus analytics, which you have to agree to explicitly below. There are no advertising cookies, no profiling and no sharing with ad networks.

Without your consent nothing is measured: the analytics script is not even loaded. That does not mean the site loads nothing external without consent. Fonts, the map library and error monitoring are technically necessary and run regardless of your decision. Which providers those are, and what they see in the process, is set out in full in section 9.

Some of the following are not cookies in the strict sense but entries in your browser local storage. They never reach our servers and stay on your device. For completeness they are listed here as well:

The first three are required for operation and cannot be switched off; without them sign-in and language selection do not work. You can delete everything at any time in your browser settings, where you can also restrict storage in general. Either may mean you have to sign in again or lose a form you had started.

11. Analytics (Google Analytics)

We want to know which pages people find and where they drop off, so we can improve the club directory. For this we use Google Analytics 4 by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Analytics runs ONLY with your explicit consent. Before that, no Google script is loaded and no data point is collected. If you decline or do not decide, nothing happens. Your decision is stored locally in your browser and you can change it below at any time.

After consent, Google Analytics collects among other things the pages visited, time on page, approximate location, device and browser, and the referring page. The IP address is processed in truncated form. Management portal addresses contain an access token; it is removed before every transmission and reaches neither Google nor the error monitoring described in section 9.

Google may process data in the USA. This is based on the adequacy decision for the EU-US Data Privacy Framework and a data processing agreement with Google. The legal basis is your consent, which you can withdraw at any time with effect for the future.

12. Waiting list for the app

On the page about the upcoming club app you can put yourself on a waiting list. For this we process the following:

• Data categories: Name, email address, optionally the club name, the chosen language, and the time and version of the consent.
• Purpose: Confirmation of the sign-up by double opt-in and notification when the app launches. We do not use the address for anything else.
• Legal basis: Your consent, which you can withdraw at any time with effect for the future.
• Recipients: Resend (Resend, Inc., USA) for sending the confirmation and the launch email; Google Cloud (region europe-west1, Belgium, see section 9) for storage.
• Retention: Until withdrawal, at the latest six months after the launch notification. After that we delete the entry.
• Withdrawal: Via the unsubscribe link in every email or by email to levin@bontem.ch. We then delete the entry.

13. Retention

We retain personal data only for as long as it is necessary for the stated purposes or as required by statutory retention periods. Technical logs (e.g. for abuse prevention) are deleted after a short time. After being forwarded to the club, registration and enquiry data is processed by it in accordance with its own requirements.

14. Your rights and deletion

Within the scope of applicable law, you have the right to information, rectification, deletion, restriction and release of your data, as well as the right to object to processing or to withdraw a consent.

If you registered for an event or submitted a membership enquiry without an account, your information was forwarded to the club concerned. For changing or deleting this data, the respective club is the primary point of contact; please use the public contact address shown in the club profile. In addition, for platform-related matters you can contact Bontem at any time (see section 15), and we will forward your request or delete the data still held by us.

A directory entry the club created itself is managed by the club via the management link, where it can amend it or have it deleted at any time.

You can also contact the Swiss Federal Data Protection and Information Commissioner (FDPIC).

15. Contact

For questions about data protection, you can reach us at levin@bontem.ch or in writing at Bontem von Vogt, Seidenstrasse 21, 8853 Lachen.