Privacy Policy

This Policy describes how Event8 Sagl, having its registered office at Via del Bosco 1a, 6500 Bellinzona, Switzerland, registered with the Commercial Register of the Canton of Ticino (UID: CHE-104.857.520), trading under the brand "Funpromotion" and the domain name funpromotion.app (hereinafter "Funpromotion" or the "Company"), processes the personal data of the users of the mobile application and of the web platform Funpromotion App (the "Platform").

This Policy forms an integral part of the Terms and Conditions – Users and of the Terms and Conditions – Partners, to which reference is made for the rules governing the contractual relationship. The processing takes place in compliance with the Swiss Federal Act on Data Protection (FADP) and, where applicable, with Regulation (EU) 2016/679 (GDPR).

Go directly to one of the sections:

1. Data controller and contacts
2. Data we collect
3. Purposes and legal bases
4. Geolocation
5. Push notifications and communications
6. Data visible to partner venues
7. Providers and recipients of the data
8. Transfers abroad
9. Cookies and similar technologies
10. Data retention
11. Account deletion
12. Security
13. Minimum age
14. Your rights
15. Amendments to the policy

 

1. Data controller and contacts

   1. The data controller is Event8 Sagl, Via del Bosco 1a, 6500 Bellinzona, Switzerland (UID: CHE-104.857.520).

   2. For any request relating to personal data, including the exercise of the rights referred to in art. 14, you may write to [email protected], whether as a User or as a partner venue.

 

2. Data we collect

   1. Registration data. E-mail address (mandatory, it identifies the account), password (stored exclusively in encrypted form, never in clear text), first and last name, date of birth (mandatory, it serves to verify the age requirement referred to in art. 13). Optional: profile photograph, gender, address, public name and preferred language. For those who register as the manager of a venue, the telephone number is mandatory.

   2. Platform usage data. Venues, events, campaigns and offers that you save among your favourites or that you "like"; venues that you follow; offers that you activate and coupons that you redeem; rewards awarded and redeemed; the opening of and interaction with the notifications received; views and clicks on promotional banners. Each of these records is associated with your account and with a date.

   3. Visit within a campaign. When you take part in a campaign from the application, using the button for taking part in a campaign, and confirm, we record your visit: your account, the venue, the campaign, the date and the time, the dishes you indicate that you ate and any votes ("I liked it") that you give to those dishes. No venue operator is involved and we do not verify that you are actually at the venue: the visit is your own declaration and, once confirmed, it cannot be changed. If the venue still uses a version of the manager application that has not been updated, the staff may record the visit by scanning the QR code of your card (Check-in): in that case we save the visit without any dishes eaten, together with the identity of the operator who carried out the scan, and this is the only case in which an operator is involved. This data feeds the count of visits and votes used for the awarding of rewards.

   4. Technical data. For the requests made from your account we record a technical log containing the address of the request and the information transmitted by your device or browser (for example device type, application and language set), used for security and diagnostic purposes. The iOS and Android applications also contain the Meta SDK, which sends directly to Meta, without passing through our servers, the events described in art. 7.7 (including the installation and every opening of the app) together with technical data about the device and the app, including: a random identifier that the SDK generates for the installation of the app, the device model, the operating system and its version, the version and build number of the app, the language and time zone settings, the screen size, the number of processor cores, the name of the mobile carrier and the IP address, from which Meta can infer an approximate location. On Android they also include the available storage space, the store from which the app was installed and the Google Play install referrer; only if the Facebook app is installed on the device, also the attribution identifier that the Facebook app makes available; if you open the app from a link to one of our ads, also an identifier of the click on the ad. Neither the data of your account (name, e-mail, telephone, date of birth, account identifier) nor your precise location is sent, and the collection of the device's advertising identifiers (Apple IDFA, Google Advertising ID) is disabled (art. 7.7).

   5. Partner venue data. For Partners we process business data (name, address, contact details, opening hours, description, photographs), the data of the contact persons who access the reserved area and the data necessary for invoicing the fees.

 

3. Purposes and legal bases

   1. To provide the service (creation and management of the account, authentication, favourites, likes, offers, coupons, rewards, visits and votes): the processing is necessary for the performance of the contract constituted by the acceptance of the Terms and Conditions.

   2. To personalise the content by displaying relevant venues, events and offers, including on the basis of location when you share it: performance of the contract and our legitimate interest in making the service useful.

   3. To send push notifications and newsletters relating to offers, events, campaigns and news: on the basis of your consent, which you give by authorising notifications at the first launch of the application and which you may withdraw at any time as indicated in art. 5.

   4. To verify the age requirement referred to in art. 13: compliance with an obligation and legitimate interest in preventing the registration of persons who may not use the service.

   5. To ensure the security and integrity of the Platform (prevention of abuse, unauthorised access, fictitious likes or accounts, diagnostics of malfunctions): our legitimate interest.

   6. To comply with legal obligations, in particular accounting and tax obligations for the payments of the Partners: compliance with legal obligations.

   7. To measure the effectiveness of our advertising campaigns on Meta's services, only in the iOS and Android applications (art. 7.7): our legitimate interest in knowing how many installations and openings of the app result from our ads. The aggregated measurement is active by default, without any request for consent, and you may object to it at any time by switching it off in the application (art. 14.1). On iOS, the tracking described in art. 7.7 takes place only with your consent, given in Apple's system window.

   8. We do not carry out automated profiling with legal effects on individuals or behavioural profiling, and we do not sell or transfer personal data to third parties for the latter's own marketing purposes. The exception is the data that the Meta SDK sends to Meta (art. 7.7), which Meta also processes for its own purposes, as an independent controller.

 

4. Geolocation

   1. If you authorise access to your location, we use it to show you nearby venues, events and offers and to send you notifications relevant to the area in which you are located.

   2. We retain only the most recent location, which is overwritten at each update: we do not build a history of your movements.

   3. You may withdraw the authorisation at any time from your device settings. The other functions of the Platform remain usable; only those based on location cease to work.

 

5. Push notifications and communications

   1. In order to send you push notifications we record a device identifier provided by the messaging service of Google (Firebase Cloud Messaging), together with the brand and model of the device.

   2. You may deactivate push notifications at any time from the settings of your device. As at the date this Policy was last updated we send no newsletters or other promotional communications by e-mail; should we start doing so, every such communication will contain a link to unsubscribe.

   3. Excluded from the withdrawal are service communications necessary for the technical, contractual or security management of the account (for example verification of the e-mail address, resetting of the password, security alerts).

   4. We do not use SMS or instant messaging applications for sending promotional communications.

 

6. Data visible to partner venues

   1. When you present the QR code of your card at a venue and the staff scans it, the venue views your first name, last name, date of birth, gender and profile photograph, for the purpose of verifying that the offer is used by the legitimate holder. The QR code of your card is used for offers and is no longer needed to take part in a campaign, which you record yourself from the application (art. 2.3); the exception is the Check-in, which versions of the manager application that have not been updated still allow.

   2. The venue also receives the information about the visits registered at its own business (for example the total number, the number of different customers and the votes received by the dishes) and about the coupons redeemed.

   3. The venue acts as an independent controller in respect of the data thus acquired and is required, by virtue of the Terms and Conditions – Partners, to use it exclusively to provide the offer or to manage the participation in the event.

 

7. Providers and recipients of the data

   We make use of the following providers, which process the data on our behalf or as independent controllers within the limits of their respective services:

   1. Google / Firebase (Google Ireland Limited and Google LLC) – authentication through a Google account, sending of push notifications, address lookup and display of maps. When you register or sign in with Google, we receive from the service your e-mail address, your name and, if your profile makes them available, your gender and date of birth.

   2. Apple (Apple Inc.) – sign-in through "Sign in with Apple". We receive an identifier, the e-mail address (possibly in an anonymised form chosen by you) and the name.

   3. Resend – sending of service e-mails and communications.

   4. Stripe and Wallee/PostFinance – management of the Partners' payments. Card data is processed directly by the payment provider; we retain solely the transaction references and the last four digits of the card together with its expiry date.

   5. Google reCAPTCHA – used exclusively on the forms of the website in order to distinguish people from automated systems. The service receives your IP address and information about the interaction with the form.

   6. Cloudflare – distribution and protection of the website; it processes the technical connection data (IP address, browser type).

   7. Meta (Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland) – only in the iOS and Android applications, measurement of the effectiveness of our advertising campaigns on Meta's services (Facebook, Instagram) through the Meta SDK ("Meta App Events"). The SDK sends its own automatic events, namely the installation (first launch), every opening of the app and the end of every session of use, with its duration and any interruptions; it also sends some internal technical events of the SDK (for example about its configuration, on iOS the background refresh setting, on Android the name of the app screen and the time spent on it) and reports of errors or crashes of the SDK itself. Each event is accompanied by technical data such as those indicated in art. 2.4. The application sends no custom events and no data from your account. On iOS, before starting the measurement, the application asks you, through Apple's system window (App Tracking Transparency), whether you allow tracking. If you allow it, Meta may link the data from the application with your activity on the apps and websites of other companies, in order to measure and personalise advertising; if you deny it, the measurement continues in Meta's aggregated form, without tracking. In both cases the application collects neither Apple's IDFA nor Google's Advertising ID. Meta provides us only with aggregated data, that is how many installations and openings of the app come from our ads: we do not receive from Meta any data about individual users and we do not carry out any behavioural profiling. Meta also processes this data as an independent controller, for its own purposes, under its own terms for business tools (Meta Business Tools Terms) and its own privacy policy (www.facebook.com/privacy/policy). You may switch off the measurement at any time, even without an account, as indicated in art. 14.1.

   8. Apart from the Meta SDK described in the previous point, we do not use third-party tools for the statistical analysis of user behaviour or for advertising: the website does not integrate Google Analytics, Google Tag Manager, Meta Pixel or similar systems of tracking or behavioural advertising, and the applications do not integrate any other tools of this kind.

   9. The infrastructure that hosts the database, the internal search engines and the uploaded files is managed directly by Funpromotion on dedicated servers.

 

8. Transfers abroad

   1. Some of the providers indicated in art. 7 are established or use infrastructure outside Switzerland, in particular in the European Union and in the United States. This is the case for the data sent by the Meta SDK (art. 7.7): it is received by Meta Platforms Ireland Limited and may be transferred to Meta Platforms, Inc., in the United States.

   2. In such cases the transfer takes place on the basis of the safeguards provided for by the applicable legislation (adequacy decisions or standard contractual clauses) and is limited to the data necessary for the provision of the individual service.

 

9. Cookies and similar technologies

   1. The website uses a single technical cookie, which stores the language you have chosen so as not to ask you for it at every visit, and a local preference that remembers the dismissal of the notice prompting the installation of the application.

   2. The website does not use profiling, statistical or advertising cookies. On the pages that contain a contact form, the reCAPTCHA service referred to in art. 7.5 is loaded, which installs a technical security cookie of its own.

   3. The mobile application stores locally on the device the information necessary to keep you authenticated and the data of your profile, in order to allow you to use the application without re-entering your credentials at every launch. In the iOS and Android applications, in addition, the Meta SDK stores on the device the random installation identifier referred to in art. 2.4, and the application stores there your choice regarding advertising campaign measurement (art. 14.1).

 

10. Data retention

    1. The account data and the data connected to the use of the Platform are retained for the whole duration of the relationship, that is until the deletion of the account in accordance with art. 11.

    2. The data necessary for compliance with accounting and tax obligations is retained for the periods provided for by law, including after the termination of the relationship.

    3. The technical logs referred to in art. 2.4 and the data relating to visits (including the dishes eaten and the votes), notifications and banners are currently retained without a predetermined automatic deletion period. We are defining specific retention periods; in the meantime you may request their deletion by writing to the addresses indicated in art. 1.

    4. The data that the Meta SDK sends to Meta for advertising campaign measurement (art. 7.7) is not retained by us: Meta retains it in accordance with its own privacy policy. Since it is held by Meta and contains no data from your account, the deletion of the account (art. 11) does not affect it.

 

11. Account deletion

    1. You may delete your account at any time from the settings of the application or by writing to [email protected].

    2. Deletion entails the removal of the profile and the definitive loss of favourites, likes, unused coupons and unredeemed rewards, as well as of your visits within campaigns, the dishes you indicated that you ate and the votes you gave.

    3. For the sake of transparency we point out that some data is not removed automatically upon the deletion of the profile: the identifying data recorded at the time of a payment (retained for accounting obligations), certain activity records that are anonymised rather than deleted, the data received on the occasion of sign-in through "Sign in with Apple" and the identity held with the Google/Firebase authentication service. You may expressly request their deletion by writing to the addresses indicated in art. 1 and we will proceed within the limits of legal obligations.

    4. If a reward has been awarded to you to be collected at a venue, the deletion may require a preliminary check on our part: in that case we will contact you.

 

12. Security

    1. We adopt technical and organisational measures appropriate to protect the data from unauthorised access, loss or disclosure: encrypted connections, passwords stored exclusively in encrypted form and access to the data limited to the personnel that needs it.

    2. No system is, however, absolutely secure. We invite you to safeguard your credentials and to report to us promptly any unauthorised use of your account.

 

13. Minimum age

    1. The Platform is reserved for those who have reached the age of 13. The date of birth is requested upon registration precisely in order to verify this requirement.

    2. If we become aware of an account created by a person of a younger age, we proceed to close it and to delete the related data. Parents or guardians who believe that a minor has registered may write to [email protected].

 

14. Your rights

    1. You have the right to access your data and to obtain a copy of it, to request its rectification if inaccurate, its deletion, the restriction of the processing, and to object to the processing based on our legitimate interest. In particular, you may object to advertising campaign measurement (art. 7.7) at any time, even without an account, directly in the application: in the menu, under "Privacy", switch off "Advertising campaign measurement". The choice is stored on the device and applies to that device; it may be lost if you uninstall the application or delete its data: in that case the measurement is active again and has to be switched off again. From the moment you switch it off, the application records no new events; events recorded shortly before may still be sent in the following seconds and, on Android, the SDK sends one technical event recording the change of the setting itself. On iOS the Meta SDK is no longer started from the next opening of the app: in the session in which you switch it off, it may still contact Meta, without sending events, until the app is closed. On Android, at every start of the app, the SDK still downloads the app's configuration from Meta with two or three requests that contain no events and no identifier of you or of the installation, but reveal to Meta the IP address, the operating system version, the language and the SDK version. On iOS you may withdraw your consent to tracking at any time in Settings › Privacy & Security › Tracking; the aggregated measurement, instead, is switched off with the switch in the application.

    2. Where the processing is based on consent (push notifications, newsletter, geolocation, on iOS tracking), you may withdraw it at any time, without this affecting the lawfulness of the previous processing.

    3. You may request the portability of the data you have provided to us, in a structured and readable format.

    4. To exercise these rights write to [email protected]. We will reply without undue delay and in any case within the periods provided for by the applicable legislation.

    5. If you believe that the processing of your data infringes the legislation, you may contact the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, Switzerland. If you are located in the European Union, you may contact the supervisory authority of your country of residence.

 

15. Amendments to the policy

    1. We may update this Policy in order to adapt it to changes in the service or in the legislation. The date of the last update is indicated at the beginning of the document.

    2. Material amendments will be communicated to you with reasonable advance notice through the Platform or by e-mail.

Event8 Sagl – Funpromotion App
Via del Bosco 1a, 6500 Bellinzona, Switzerland
UID: CHE-104.857.520 – Commercial Register of the Canton of Ticino
[email protected]