Privacy Policy

We are pleased that you are visiting our website and are interested in our services. The protection of your personal data is a central concern for us. In this privacy policy, we inform you transparently about which data we collect, for what purposes we use it, and what rights you have.

This privacy policy has been prepared in accordance with the revised Swiss Federal Act on Data Protection (revFADP). To the extent that persons from the EU/EEA area visit our website, we also take into account the requirements of the EU General Data Protection Regulation (GDPR).

The controller responsible for data processing within the meaning of the revFADP is:

Fotichaschte Events GmbH
Hagenholzstrasse 102
8050 Zurich, Switzerland

Phone: +41 44 578 09 37
Email: info@fotichaschte.ch
Website: fotichaschte.ch

This privacy policy applies to data processing by Fotichaschte Events GmbH on the website fotichaschte.ch as well as on associated subdomains.

The primary legal basis is the Swiss revFADP. Since our website may also be accessed by persons from the EU/EEA area, we also take the GDPR into account. Where consent is required, we obtain it before processing the data. Otherwise, we base data processing on the following legal bases:

• Art. 6 para. 1 lit. a GDPR (consent
• Art. 6 para. 1 lit. b GDPR (performance of a contract)
• Art. 6 para. 1 lit. c GDPR (legal obligation)
• Art. 6 para. 1 lit. f GDPR (legitimate interest)
• Art. 31 revFADP (overriding interests)

Personal data: All information relating to an identified or identifiable natural person (under the GDPR: “personal data”).

Processing: Any operation in connection with personal data, in particular collection, storage, use, transmission, and deletion.

Controller: The natural or legal person who determines the purposes and means of data processing.

Processor: A person or entity that processes personal data on behalf of the controller.

Cookies: Small text files that are stored in the user’s browser and enable recognition as well as analysis of user behavior.

Whenever our website is accessed, our hosting provider automatically collects information that your browser transmits to our server. These so-called server log files include:

• Anonymized IP address of the accessing device
• Date and time of access
• Name and URL of the retrieved file
• Amount of data transferred
• Notification of successful retrieval
• Browser type, browser version, and operating system
• Referrer URL (previously visited page)

These data are evaluated exclusively to ensure the trouble-free operation of the website and to improve our offering. Storage takes place for security reasons for a maximum of 14 days. The legal basis is our legitimate interest pursuant to Art. 6 para. 1 lit. f GDPR and Art. 31 para. 2 lit. a revFADP.

For security reasons and to protect the transmission of confidential content, this website uses SSL or TLS encryption. You can recognize an encrypted connection by the fact that the browser’s address line changes from “http://” to “https://” and by the lock symbol in your browser bar.

Our website is operated on servers of our hosting provider. In the course of hosting, personal data (e.g. IP addresses, contact inquiries, order data) are processed. A data processing agreement exists with the provider pursuant to Art. 9 revFADP and Art. 28 GDPR.

In addition, content components (e.g. emoji icons) are loaded from WordPress.com (Automattic Inc., 60 29th Street #343, San Francisco, CA 94110, USA). In this context, data may be transferred to the USA. The transfer is based on the Swiss-US Data Privacy Framework as well as EU Standard Contractual Clauses.

Our website uses cookies and comparable technologies (e.g. LocalStorage, web beacons, pixel tags). Cookies are small text files that are stored on your device and can be assigned to your browser.

We distinguish between:

• Necessary cookies: These are technically required for the operation of the website (e.g. language setting via WPML, shopping cart in WooCommerce, session management).
• Statistics cookies: These collect anonymized data for analyzing user behavior (e.g. Google Analytics 4).
• Marketing cookies: These are used to make content and advertising more relevant.

To manage your consents, we use the WordPress plugin Reply42 Cookie Consent, which we operate ourselves. The plugin was developed by our web agency Reply42 and runs exclusively on our own servers. The consent tool itself does not transmit your data to third parties (in particular, no transfer to third countries takes place).

When you first access the website, a cookie banner is displayed, in which you are informed about the cookie categories used and can specifically grant or refuse your consent. The “Accept” and “Reject” buttons are designed equivalently (FDPIC-compliant, no so-called “dark patterns”). Your selection is stored in a technically necessary cookie named “r42cc_consent” on your device (storage period: 30 days).

To prove consent pursuant to Art. 7 para. 1 GDPR and Art. 6 para. 6 revFADP, the plugin logs your selection in a database on our server. The following data are stored:

• a randomly generated consent ID (UUID)
• your IP address in hashed form (SHA-256 with site-specific salt — the original IP address cannot be restored from this)
• browser identifier (user agent)
• the selected cookie categories
• the language of the banner display
• the URL of the page on which consent was given
• type of action (accept, reject, individual selection, withdrawal)
• timestamp

As long as you have not yet made a selection, all non-essential cookies and third-party scripts (e.g. Google Analytics, Google Maps, YouTube, reCAPTCHA, Convertful) are automatically blocked by the plugin. For Google services, Google Consent Mode v2 is additionally implemented so that only those signals corresponding to your consent are transmitted to Google.

You can withdraw or adjust your consent at any time via the “Cookie Settings” link in the footer of our website. The legal basis for processing the consent logs is Art. 6 para. 1 lit. c GDPR (legal obligation to demonstrate consent) as well as our legitimate interest in compliance documentation pursuant to Art. 6 para. 1 lit. f GDPR and Art. 31 para. 2 revFADP.

8.1 Contact form (Contact Form 7)

If you send us inquiries via the contact form on our website, your details from the inquiry form, including the contact details you provide there (name, email address, telephone number, message), will be stored by us for the purpose of processing the inquiry and in case of follow-up questions.

We do not disclose these data without your consent. Processing is carried out on the basis of Art. 6 para. 1 lit. b GDPR (pre-contractual measures) and Art. 6 para. 1 lit. f GDPR (legitimate interest in responding to your inquiry). We use the WordPress plugin Contact Form 7 for input. The data are processed exclusively on our servers.

8.2 Email and telephone contact

When you contact us by email or telephone, your details are stored for the purpose of processing the inquiry and in case follow-up questions arise.

8.3 WhatsApp Business

We offer you the option of contacting us via WhatsApp Business. The provider is WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, a subsidiary of Meta Platforms, Inc. (1601 Willow Road, Menlo Park, California 94025, USA).

When using WhatsApp, personal data (telephone number, profile picture, message content, timestamps) are transmitted to WhatsApp/Meta. Transfer to the USA may occur. This transfer is based on the EU-US Data Privacy Framework as well as the Swiss-US Data Privacy Framework.

We point out that we have no influence on data processing by WhatsApp/Meta. Further information can be found in WhatsApp’s privacy policy: www.whatsapp.com/legal/privacy-policy

We use the WordPress plugin WooCommerce (Automattic Inc.) to process bookings and orders. In this context, the following data are processed:

• First and last name
• Billing and delivery address
• Email address and telephone number
• Order number and order details
• Payment data

These data are processed for the performance of a contract pursuant to Art. 6 para. 1 lit. b GDPR and Art. 31 para. 2 lit. a revFADP. Tax-relevant order data and invoice documents are stored for the duration of contract processing as well as to comply with statutory retention obligations (10 years pursuant to the Swiss Code of Obligations, Art. 958f CO). Non-tax-relevant order data are deleted after completion of the transaction.

10.1 Google Tag Manager

We use Google Tag Manager provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Tag Manager is a solution that allows us to manage website tags via an interface. The tool itself is a cookie-less domain. It does not collect any personal data; however, Tag Manager enables the triggering of other tags, which may themselves collect data.

10.2 Google Analytics 4

We use Google Analytics 4 provided by Google Ireland Limited to analyze the use of our website. Google Analytics uses cookies and comparable technologies to analyze your usage behavior. The following data are processed:

• Anonymized IP address
• Device and browser information
• Visited pages, duration of stay, click behavior
• Approximate location (country/city)

The IP address is anonymized before storage. Processing takes place only with your consent pursuant to Art. 6 para. 1 lit. a GDPR and Art. 6 para. 3 revFADP. A transfer to the USA cannot be excluded and is based on the EU-US or Swiss-US Data Privacy Framework. Further information: policies.google.com/privacy.

10.3 Convertful

We use the conversion optimization tool Convertful to display pop-ups, forms, and personalized content on our website. For this purpose, Convertful processes anonymized usage data (visit behavior, clicks, duration of stay). Processing takes place only with your consent pursuant to Art. 6 para. 1 lit. a GDPR. Further information: convertful.com/privacy

11.1 Google Maps

We use Google Maps (Google Ireland Limited) to display interactive maps and location information. When using Google Maps, data (including IP address and location data) are transmitted to Google and may be processed in the USA. The legal basis is your consent pursuant to Art. 6 para. 1 lit. a GDPR. Further information: policies.google.com/privacy.

11.2 Google reCAPTCHA

To protect our forms against spam and automated misuse, we use Google reCAPTCHA v2 (Google Ireland Limited). reCAPTCHA checks, based on various characteristics (e.g. IP address, mouse movements, duration of stay), whether the input is made by a human or by an automated program. Processing is carried out on the basis of our legitimate interest pursuant to Art. 6 para. 1 lit. f GDPR. Further information: policies.google.com/privacy.

11.3 YouTube

Videos from the YouTube platform (Google Ireland Limited) are embedded on our website. Where possible, we use the enhanced privacy mode (“youtube-nocookie.com”). When a page with an embedded video is accessed, a connection to YouTube servers is established and cookies may be set. The legal basis is your consent pursuant to Art. 6 para. 1 lit. a GDPR. Further information: policies.google.com/privacy.

11.4 WPML (multilingual plugin)

To provide multilingual content (German/English), we use the WordPress plugin WPML. In this context, a technically necessary cookie is set that stores your language selection. No personal data are transmitted to third parties.

11.5 Imagify

To optimize the loading speed of our website, we compress image files using the Imagify service (WP Media SAS, 331 rue Pierre Mauroy, 59000 Lille, France). Compression is carried out server-side; for this purpose, image files are transmitted to an Imagify server. No personal data of website visitors are transmitted. Further information: imagify.io/privacy

11.6 Sucuri Security

To protect against cyberattacks and malware, we use the security service Sucuri (Sucuri Inc., 4035 Westshore Blvd, Tampa, Florida, USA). In this context, IP addresses and access patterns may be processed to detect attacks. The legal basis is our legitimate interest in the security of our website pursuant to Art. 6 para. 1 lit. f GDPR. Further information: sucuri.net/privacy.

11.7 Yoast SEO

For search engine optimization, we use the WordPress plugin Yoast SEO. The plugin does not process personal data of website visitors and does not embed any external resources.

Within the scope of the above-mentioned services (in particular Google services, WhatsApp/Meta, WordPress.com, Sucuri), your personal data may be transferred to the USA or other third countries. We base these transfers on:

• Swiss-US Data Privacy Framework (recognized by the Federal Council since 15 September 2024)
• EU-US Data Privacy Framework (adequacy decision of the EU Commission dated 10 July 2023)
• EU Standard Contractual Clauses (SCC) pursuant to Decision (EU) 2021/914
• Your explicit consent pursuant to Art. 49 para. 1 lit. a GDPR and Art. 17 revFADP

We store personal data only for as long as is necessary for the respective purposes or for as long as statutory retention obligations exist:

• Server log files: max. 14 days
• Contact inquiries: until final processing, max. 24 months
• Order data/WooCommerce (tax-relevant): 10 years (retention obligation pursuant to CO Art. 958f)
• Analytics data (Google Analytics): 14 months
• Consent cookie (r42cc_consent) on your device: 30 days
• Consent logs (consent log in our database, with hashed IP): 12 months

Under the revFADP and GDPR, you have the following rights:

• Right of access (Art. 25 revFADP / Art. 15 GDPR): You may request information about which personal data we process about you.
• Right to rectification (Art. 32 para. 1 revFADP / Art. 16 GDPR): You may request the correction of inaccurate data.
• Right to erasure (Art. 32 para. 2 lit. c revFADP / Art. 17 GDPR): You may request the deletion of your data.
• Right to restriction of processing (Art. 18 GDPR).
• Right to data disclosure and portability (Art. 28 revFADP / Art. 20 GDPR).
• Right to object (Art. 30 revFADP / Art. 21 GDPR): You may object to the processing of your data.
• Withdrawal of consents: You may withdraw consent you have given at any time with effect for the future.
• Right to lodge a complaint with the supervisory authority: In Switzerland, with the Federal Data Protection and Information Commissioner (FDPIC); in the EU, with the respectively competent national data protection authority.

To exercise your rights, please contact us informally at: info@fotichaschte.ch. We will respond to your request as soon as possible, no later than within 30 days.

For Switzerland:

Federal Data Protection and Information Commissioner (FDPIC)
Feldeggweg 1
3003 Bern, Switzerland
www.edoeb.admin.ch

We take appropriate technical and organizational measures (TOMs) to protect your data against accidental or unlawful destruction, loss, alteration, and unauthorized access. These include, among others:

• SSL/TLS encryption of data transmission
• Access restrictions and role-based permissions
• Regular backups and security updates
• Web Application Firewall (Sucuri)

In the event of a data protection breach with a high risk for the affected persons, we will inform the FDPIC and, where applicable, the affected persons in accordance with Art. 24 revFADP.

We reserve the right to amend this privacy policy in order to keep it aligned with current legal requirements or to implement changes to our services, e.g. when introducing new services. The new privacy policy will then apply to your next visit.

Status of this privacy policy: 21 May 2026 · Fotichaschte Events GmbH, Zurich