Privacy Policy

This Policy describes how Event8 Sagl, having its registered office at Via del Bosco 1a, 6500 Bellinzona, Switzerland, registered with the Commercial Register of the Canton of Ticino (UID: CHE-104.857.520), trading under the brand "Funpromotion" and the domain name funpromotion.app (hereinafter "Funpromotion" or the "Company"), processes the personal data of the users of the mobile application and of the web platform Funpromotion App (the "Platform").

This Policy forms an integral part of the Terms and Conditions – Users and of the Terms and Conditions – Partners, to which reference is made for the rules governing the contractual relationship. The processing takes place in compliance with the Swiss Federal Act on Data Protection (FADP) and, where applicable, with Regulation (EU) 2016/679 (GDPR).

Go directly to one of the sections:

1. Data controller and contacts
2. Data we collect
3. Purposes and legal bases
4. Geolocation
5. Push notifications and communications
6. Data visible to partner venues
7. Providers and recipients of the data
8. Transfers abroad
9. Cookies and similar technologies
10. Data retention
11. Account deletion
12. Security
13. Minimum age
14. Your rights
15. Amendments to the policy

 

1. Data controller and contacts

   1. The data controller is Event8 Sagl, Via del Bosco 1a, 6500 Bellinzona, Switzerland (UID: CHE-104.857.520).

   2. For any request relating to personal data, including the exercise of the rights referred to in art. 14, you may write to [email protected], whether as a User or as a partner venue.

 

2. Data we collect

   1. Registration data. E-mail address (mandatory, it identifies the account), password (stored exclusively in encrypted form, never in clear text), first and last name, date of birth (mandatory, it serves to verify the age requirement referred to in art. 13). Optional: profile photograph, gender, address, public name and preferred language. For those who register as the manager of a venue, the telephone number is mandatory.

   2. Platform usage data. Venues, events, campaigns and offers that you save among your favourites or that you "like"; venues that you follow; offers that you activate and coupons that you redeem; rewards awarded and redeemed; the opening of and interaction with the notifications received; views and clicks on promotional banners. Each of these records is associated with your account and with a date.

   3. Visits to venues (QR code scanning). When the staff of a venue scans the QR code of your card, we record the visit: your account, the venue, any relevant campaign, the date and the time, and the identity of the operator who carried out the scan. This data feeds the count of the visits valid for the awarding of rewards.

   4. Technical data. For the requests made from your account we record a technical log containing the address of the request and the information transmitted by your device or browser (for example device type, application and language set), used for security and diagnostic purposes.

   5. Partner venue data. For Partners we process business data (name, address, contact details, opening hours, description, photographs), the data of the contact persons who access the reserved area and the data necessary for invoicing the fees.

 

3. Purposes and legal bases

   1. To provide the service (creation and management of the account, authentication, favourites, likes, offers, coupons, rewards, visits): the processing is necessary for the performance of the contract constituted by the acceptance of the Terms and Conditions.

   2. To personalise the content by displaying relevant venues, events and offers, including on the basis of location when you share it: performance of the contract and our legitimate interest in making the service useful.

   3. To send push notifications and newsletters relating to offers, events, campaigns and news: on the basis of your consent, which you give by authorising notifications at the first launch of the application and which you may withdraw at any time as indicated in art. 5.

   4. To verify the age requirement referred to in art. 13: compliance with an obligation and legitimate interest in preventing the registration of persons who may not use the service.

   5. To ensure the security and integrity of the Platform (prevention of abuse, unauthorised access, fictitious likes or accounts, diagnostics of malfunctions): our legitimate interest.

   6. To comply with legal obligations, in particular accounting and tax obligations for the payments of the Partners: compliance with legal obligations.

   7. We do not carry out automated profiling with legal effects on individuals, nor the sale or transfer of personal data to third parties for the latter's own marketing purposes.

 

4. Geolocation

   1. If you authorise access to your location, we use it to show you nearby venues, events and offers and to send you notifications relevant to the area in which you are located.

   2. We retain only the most recent location, which is overwritten at each update: we do not build a history of your movements.

   3. You may withdraw the authorisation at any time from your device settings. The other functions of the Platform remain usable; only those based on location cease to work.

 

5. Push notifications and communications

   1. In order to send you push notifications we record a device identifier provided by the messaging service of Google (Firebase Cloud Messaging), together with the brand and model of the device.

   2. You may deactivate push notifications at any time from the settings of your device. As at the date this Policy was last updated we send no newsletters or other promotional communications by e-mail; should we start doing so, every such communication will contain a link to unsubscribe.

   3. Excluded from the withdrawal are service communications necessary for the technical, contractual or security management of the account (for example verification of the e-mail address, resetting of the password, security alerts).

   4. We do not use SMS or instant messaging applications for sending promotional communications.

 

6. Data visible to partner venues

   1. When you present the QR code of your card at a venue and the staff scans it, the venue views your first name, last name, date of birth, gender and profile photograph, for the purpose of verifying that the offer is used by the legitimate holder.

   2. The venue also receives the information about the visits and the coupons redeemed at its own business.

   3. The venue acts as an independent controller in respect of the data thus acquired and is required, by virtue of the Terms and Conditions – Partners, to use it exclusively to provide the offer or to manage the participation in the event.

 

7. Providers and recipients of the data

   We make use of the following providers, which process the data on our behalf or as independent controllers within the limits of their respective services:

   1. Google / Firebase (Google Ireland Limited and Google LLC) – authentication through a Google account, sending of push notifications, address lookup and display of maps. When you register or sign in with Google, we receive from the service your e-mail address, your name and, if your profile makes them available, your gender and date of birth.

   2. Apple (Apple Inc.) – sign-in through "Sign in with Apple". We receive an identifier, the e-mail address (possibly in an anonymised form chosen by you) and the name.

   3. Resend – sending of service e-mails and communications.

   4. Stripe and Wallee/PostFinance – management of the Partners' payments. Card data is processed directly by the payment provider; we retain solely the transaction references and the last four digits of the card together with its expiry date.

   5. Google reCAPTCHA – used exclusively on the forms of the website in order to distinguish people from automated systems. The service receives your IP address and information about the interaction with the form.

   6. Cloudflare – distribution and protection of the website; it processes the technical connection data (IP address, browser type).

   7. We do not use third-party tools for the statistical analysis of user behaviour: the Platform does not integrate Google Analytics, Google Tag Manager, Meta Pixel or similar systems of tracking or behavioural advertising.

   8. The infrastructure that hosts the database, the internal search engines and the uploaded files is managed directly by Funpromotion on dedicated servers.

 

8. Transfers abroad

   1. Some of the providers indicated in art. 7 are established or use infrastructure outside Switzerland, in particular in the European Union and in the United States.

   2. In such cases the transfer takes place on the basis of the safeguards provided for by the applicable legislation (adequacy decisions or standard contractual clauses) and is limited to the data necessary for the provision of the individual service.

 

9. Cookies and similar technologies

   1. The website uses a single technical cookie, which stores the language you have chosen so as not to ask you for it at every visit, and a local preference that remembers the dismissal of the notice prompting the installation of the application.

   2. We do not use profiling, statistical or advertising cookies. On the pages that contain a contact form, the reCAPTCHA service referred to in art. 7.5 is loaded, which installs a technical security cookie of its own.

   3. The mobile application stores locally on the device the information necessary to keep you authenticated and the data of your profile, in order to allow you to use the application without re-entering your credentials at every launch.

 

10. Data retention

    1. The account data and the data connected to the use of the Platform are retained for the whole duration of the relationship, that is until the deletion of the account in accordance with art. 11.

    2. The data necessary for compliance with accounting and tax obligations is retained for the periods provided for by law, including after the termination of the relationship.

    3. The technical logs referred to in art. 2.4 and the data relating to visits, notifications and banners are currently retained without a predetermined automatic deletion period. We are defining specific retention periods; in the meantime you may request their deletion by writing to the addresses indicated in art. 1.

 

11. Account deletion

    1. You may delete your account at any time from the settings of the application or by writing to [email protected].

    2. Deletion entails the removal of the profile and the definitive loss of favourites, likes, unused coupons and unredeemed rewards.

    3. For the sake of transparency we point out that some data is not removed automatically upon the deletion of the profile: the identifying data recorded at the time of a payment (retained for accounting obligations), certain activity records that are anonymised rather than deleted, the data received on the occasion of sign-in through "Sign in with Apple" and the identity held with the Google/Firebase authentication service. You may expressly request their deletion by writing to the addresses indicated in art. 1 and we will proceed within the limits of legal obligations.

    4. If a reward has been awarded to you to be collected at a venue, the deletion may require a preliminary check on our part: in that case we will contact you.

 

12. Security

    1. We adopt technical and organisational measures appropriate to protect the data from unauthorised access, loss or disclosure: encrypted connections, passwords stored exclusively in encrypted form and access to the data limited to the personnel that needs it.

    2. No system is, however, absolutely secure. We invite you to safeguard your credentials and to report to us promptly any unauthorised use of your account.

 

13. Minimum age

    1. The Platform is reserved for those who have reached the age of 13. The date of birth is requested upon registration precisely in order to verify this requirement.

    2. If we become aware of an account created by a person of a younger age, we proceed to close it and to delete the related data. Parents or guardians who believe that a minor has registered may write to [email protected].

 

14. Your rights

    1. You have the right to access your data and to obtain a copy of it, to request its rectification if inaccurate, its deletion, the restriction of the processing, and to object to the processing based on our legitimate interest.

    2. Where the processing is based on consent (push notifications, newsletter, geolocation), you may withdraw it at any time, without this affecting the lawfulness of the previous processing.

    3. You may request the portability of the data you have provided to us, in a structured and readable format.

    4. To exercise these rights write to [email protected]. We will reply without undue delay and in any case within the periods provided for by the applicable legislation.

    5. If you believe that the processing of your data infringes the legislation, you may contact the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, Switzerland. If you are located in the European Union, you may contact the supervisory authority of your country of residence.

 

15. Amendments to the policy

    1. We may update this Policy in order to adapt it to changes in the service or in the legislation. The date of the last update is indicated at the beginning of the document.

    2. Material amendments will be communicated to you with reasonable advance notice through the Platform or by e-mail.

Event8 Sagl – Funpromotion App
Via del Bosco 1a, 6500 Bellinzona, Switzerland
UID: CHE-104.857.520 – Commercial Register of the Canton of Ticino
[email protected]