How we handle your data

1. Controller

The controller for data processing on this website and the contact for privacy matters is:

sct event GmbH
André Kofmehl-Giorgetti
Mainaustrasse 15
8008 Zürich
Switzerland

Phone +41 44 422 00 06
info@singingchristmastree.ch

2. Legal basis

We process personal data in accordance with the Swiss Federal Act on Data Protection (FADP). Where the GDPR applies, we rely, depending on the case, on your consent (Art. 6(1)(a) GDPR), on the performance of a contract or pre-contractual measures (Art. 6(1)(b) GDPR) or on our legitimate interest in a secure, reliable and user-friendly website (Art. 6(1)(f) GDPR).

3. Hosting with Vercel

This website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA, and delivered through its global content delivery network. On every visit, your browser automatically transmits data to Vercel's servers: IP address, date and time, page requested, previously visited page (referrer), browser type and version, operating system, status code and the amount of data transferred.

Vercel needs this data to deliver the website, fend off attacks and fix outages. We use it for error analysis and secure operation. Log data is deleted after a short time. Vercel is certified under the EU-US Data Privacy Framework; in addition, the EU standard contractual clauses apply, which the Swiss Federal Data Protection and Information Commissioner also recognises. We have concluded a data processing addendum with Vercel.

Programme data (the choirs' performance times) is stored in Vercel Blob. It contains no personal data of visitors.

Vercel privacy policy: https://vercel.com/legal/privacy-policy

4. Cookies and local storage

The public pages of this website do not use cookies of their own. Your browser only remembers, for the duration of your visit (session storage), whether you have already seen the sound notice. This information never leaves your device.

The protected administration area for the programme sets a session cookie that is only relevant to sct event GmbH staff.

Google Analytics and Google reCAPTCHA set their own cookies or read device information (see sections 5 and 8). You can delete or block cookies in your browser settings; some functions of the website may then be unavailable.

5. Google Analytics

We use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics sets cookies and evaluates how visitors use our website: pages viewed, time spent, approximate location based on the truncated IP address, device used and where the visit came from. Google Analytics 4 does not store IP addresses.

We use these reports to understand which content is in demand and to improve the website. The reports contain no information that would allow us to identify individual persons. User data is deleted automatically after 14 months.

Google may transfer data to the USA. Google LLC is certified under the EU-US Data Privacy Framework; in addition, the EU standard contractual clauses apply. We have accepted Google's data processing terms.

You can prevent collection by Google Analytics by installing the opt-out browser add-on: https://tools.google.com/dlpage/gaoptout. Google privacy policy: https://policies.google.com/privacy

6. Choir registration and contact

If you use the form on the «Choir registration» page, we process the details you provide there: surname, first name, e-mail address, phone number (optional) and your message. We need this data to answer your enquiry, plan your choir's performance and stay in touch with you.

The form is protected against abuse: a hidden field filters automated submissions, and we limit the number of requests per IP address and e-mail address. For this purpose we keep the IP address in memory for no longer than 15 minutes.

Your message is delivered to us as an e-mail. For sending, we use Resend Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA, as a processor. Resend transmits the e-mail and stores it briefly on servers in the USA for delivery logs; the transfer is based on the EU standard contractual clauses. Resend privacy policy: https://resend.com/legal/privacy-policy

We keep enquiries for as long as we need them to look after your choir and plan the season, at most until the end of the season after next. After that we delete them, unless a statutory retention obligation applies.

If you contact us directly by e-mail or phone, we process your details for the same purpose.

7. Newsletter

If you subscribe on the «Newsletter» page, we process your e-mail address, your first name (optional) and the language in which you subscribed. We write to you two or three times a year about the programme, the choirs and the new season.

Your subscription only becomes active once you click the link in our confirmation e-mail (double opt-in). As proof, we store the time of subscription and of confirmation. Unconfirmed subscriptions are deleted after 30 days. Customers who gave us their e-mail address with a purchase, a booking or an enquiry also receive the newsletter; they can object at any time.

Our newsletters contain an invisible tracking pixel, and links pass briefly through our mailing service's server. This shows us whether an e-mail was delivered and opened and which links were clicked. We use this information to improve the newsletter and do not evaluate it for other purposes. If you do not want this, keep images switched off in your e-mail program or unsubscribe.

We send the newsletter via Resend (see section 6). Addresses and delivery status are stored in a database by Neon, a Databricks Inc. company, USA, in a data centre in Frankfurt am Main (EU). Privacy policy: https://www.databricks.com/legal/privacynotice

You can unsubscribe at any time using the link at the end of every newsletter or by writing to info@singingchristmastree.ch. After you unsubscribe, we keep your address marked «unsubscribed» so that you reliably receive no further newsletters. On request we delete it entirely.

The subscription form is protected against abuse: by a hidden field, a limit on subscriptions per IP address and e-mail address, and by Google reCAPTCHA (see section 8).

8. Google reCAPTCHA

To protect the choir registration and the newsletter subscription against automated abuse, we use Google reCAPTCHA from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. reCAPTCHA checks in the background whether an input comes from a human. For this, Google evaluates the IP address, time spent, mouse movements, browser and device information and any Google cookies, and transmits this data to Google, possibly to the USA (certification under the EU-US Data Privacy Framework, in addition standard contractual clauses).

reCAPTCHA is only loaded once you start filling in one of these forms.

The check is based on our legitimate interest in preventing spam and abusive requests. Google privacy policy: https://policies.google.com/privacy, terms of service: https://policies.google.com/terms

9. Fondue Chalet reservations (aleno)

You book tables in the Fondue Chalet through the reservation system of aleno AG, Tessinerplatz 7, 8002 Zürich, Switzerland. When you click «Book online», the aleno reservation widget opens in a window on our website. Only then is data transmitted to aleno: your IP address and the details you enter in the widget (name, e-mail address, phone number, date, time, number of guests, remarks and, if a deposit is required, payment details).

aleno processes this data on our behalf so that we can manage your reservation, send you a confirmation and reach you in case of changes. The data is stored in Switzerland and the EU. The basis is the performance of the reservation contract. We keep reservation data until the end of the season and delete it afterwards, unless a retention obligation applies. Any payments are handled by the payment provider integrated by aleno; that provider's privacy policy applies to its processing.

Further information on aleno: https://www.aleno.me/de/impressum

10. Google Maps

On the «Location» page we show our own drawn map; it loads without any connection to third parties. In addition, the address links to Google Maps, a service of Google Ireland Limited. Only when you click this link does your browser connect to Google; your IP address and device information are then transmitted to Google, possibly to the USA. Google may link this data to your Google account if you are signed in. Google privacy policy: https://policies.google.com/privacy

11. Live stream and embedded content

During the season we may broadcast performances as a live stream. The stream is delivered by a third-party video platform. When you play it, your browser connects to that platform, which receives your IP address and may set its own cookies. We state which platform we use on the «Live stream» page; its privacy policy applies.

12. Fonts, images and sound

We serve all fonts, images and audio files from our own servers. No fonts are loaded from Google Fonts or other third parties. The sound on the home page is muted by default and only starts when you switch it on.

13. Social media

We run profiles on Facebook, Instagram and LinkedIn. Our website only contains plain links to them; no platform plugins are embedded, and no data flows to these providers when you visit our website. If you follow a link, the privacy policies of Meta or LinkedIn apply.

14. Disclosure and transfers abroad

We disclose personal data only where necessary for the purpose described: to the service providers named (Vercel, Neon, Google, Resend, aleno), who work on our behalf, or where we are legally obliged to do so. We do not sell data.

Some service providers are based in the USA. Transfers are based on the EU-US Data Privacy Framework, which the Swiss Federal Council has recognised as adequate for Switzerland, or on the EU standard contractual clauses with the adaptations required for Switzerland.

15. Data security

The connection to our website is encrypted throughout (TLS). Only people who need form enquiries and reservation data for their work have access to them. We take technical and organisational measures to protect data against loss, manipulation and unauthorised access.

16. Retention

We keep personal data only for as long as the respective purpose requires or the law prescribes. The periods are stated under the individual services. After that we delete or anonymise the data.

17. Your rights

You have the right to request information about the personal data we process about you. You may ask us to correct inaccurate data, delete data or restrict processing, and you may object to processing. Where the GDPR applies, you also have the right to receive your data in a common format.

You may withdraw consent you have given at any time with effect for the future. An informal e-mail to info@singingchristmastree.ch is sufficient. We handle your request within 30 days. These rights may be subject to statutory restrictions, for example where we must keep data to meet a retention obligation.

You may also lodge a complaint with the competent supervisory authority. In Switzerland this is the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, https://www.edoeb.admin.ch.

18. Changes

We may amend this privacy policy at any time, for example when we use new services or the legal situation changes. The version published on singingchristmastree.ch applies. The date of the last change is shown at the bottom of this page.