Privacy policy

1. Controller

The controller responsible for processing personal data within the meaning of the Swiss Federal Act on Data Protection (FADP) and the EU General Data Protection Regulation (GDPR), where applicable, is:

E-mail: sodales@swisspga.ch
Web: sodales.swisspga.ch

2. Principles of data processing

Swiss PGA Sodales processes personal data in accordance with the following principles:

• Lawfulness: Data are processed only on a legal basis or with consent.
• Purpose limitation: Data are used only for the stated purpose.
• Data minimisation: Only those data that are necessary for the respective purpose are collected.
• Accuracy: Data are kept correct and up to date.
• Security: Data are protected by appropriate technical and organisational measures.
• Transparency: Data subjects are informed about the processing of data.

3. Data collected and purpose

3.1 Upon registration

When taking out a Sodales membership, we collect the following data:

• First name and last name
• E-mail address
• Billing address
• Payment information (processed by Stripe — no card data stored by Swiss PGA Sodales)

Purpose: Conclusion of contract, membership administration, invoicing and communication.

3.2 When using the platform

When using sodales.swisspga.ch, technical data are collected automatically:

• IP address
• Browser and device type
• Pages visited and time spent
• Date and time of access
• Source of access (referrer)

Purpose: Technical operation, security and improvement of the platform.

3.3 Newsletter and communication

With express consent, we use the e-mail address for:

• Weekly Swiss PGA Sodales News
• Information on events and offers
• Information on partner benefits
• Administrative notices concerning membership

Purpose: Member communication and community operations. Delivery is handled via the newsletter service Beehiiv(see section 5).

3.4 Payment processing

Payment processing is handled by the third-party provider Stripe Inc. Payment data are transmitted directly to Stripe and processed there. Swiss PGA Sodales does not store credit card or TWINT data. Stripe’s privacy policy applies: stripe.com/privacy.

4. Legal bases for data processing

The Swiss FADP is primary: as a private controller, Swiss PGA Sodales processes personal data as a rule where permitted and, where required, relies on the grounds for justification under Art. 31 FADP (in particular performance of a contract pursuant to Art. 31 para. 2 lit. a FADP, overriding interest, or consent). The GDPR bases listed below apply only where the GDPR is applicable. Personal data are processed on the following legal bases:

• Performance of a contract: To perform the membership contract (Art. 6(1)(b) GDPR)
• Consent: For newsletters and optional communication (Art. 6(1)(a) GDPR)
• Legitimate interests: For platform operation, security and improvements (Art. 6(1)(f) GDPR)
• Legal obligation: For statutory retention obligations (Art. 6(1)(c) GDPR)

5. Disclosure to third parties

Swiss PGA Sodales discloses personal data only if:

• this is necessary to perform the contract (e.g. Stripe for payments)
• there is a statutory obligation
• the data subject has expressly consented

Current third-party providers:

Disclosure to third parties for marketing purposes without express consent does not take place.

6. Transfers abroad

Some third-party providers are established abroad, in particular in the USA (e.g. Stripe Inc.). Where there is no adequacy decision of the Federal Council for the state concerned, we base disclosure on appropriate safeguards under Art. 16 para. 2 FADP, in particular standard contractual clauses recognised by the FDPIC. Transfers to the USA are based, where the recipient is duly certified, on the Swiss-U.S. Data Privacy Framework (Federal Council adequacy decision); otherwise on standard contractual clauses. On request to sodales@swisspga.ch we will inform you of the specific recipients, the states concerned and the safeguard applied in each case.

7. Retention period

Personal data are stored only for as long as necessary for the respective purpose:

• Membership data: For the duration of membership; accounting-relevant data (in particular invoices and payment receipts) thereafter for 10 years pursuant to Art. 958f CO; other member data are deleted after the end of the contract
• Technical access data: Maximum 12 months
• Newsletter data: Until consent is withdrawn
• Payment data: In accordance with statutory retention periods (10 years)

8. Cookies and tracking

The platform sodales.swisspga.ch uses cookies and similar technologies:

• Necessary cookies: For the technical operation of the platform (login, session management). No consent required.
• Analytics cookies: To improve the platform (e.g. visitor statistics). Only with express consent.
• Marketing cookies: Not currently used.

You can adjust cookie settings at any time via the cookie settings on the platform or manage them in your browser. Further details are set out in the separate cookie and storage notice.

9. Your rights

As a data subject you have the following rights:

• Access: You may at any time request information about the data we hold about you. (Art. 25 FADP)
• Rectification: You have the right to have inaccurate data corrected. (Art. 32 FADP)
• Erasure: You may request erasure of your data unless statutory retention obligations prevent this. (Art. 32 FADP)
• Restriction: You may request restriction of processing. (only where the GDPR applies; Art. 18 GDPR — no exact equivalent in the FADP)
• Data portability: You have the right to receive your data in a commonly used format. (right to data release and transfer, Art. 28 FADP)
• Objection: You may object to processing based on legitimate interests. (only where the GDPR applies; Art. 21 GDPR — under the FADP via asserting a violation of personality rights under Art. 30/32 FADP)
• Withdrawal of consent: Consent given may be withdrawn at any time without stating reasons.

To exercise your rights, contact: sodales@swisspga.ch

You also have the right to lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC): edoeb.admin.ch.

10. Data security

Swiss PGA Sodales takes appropriate technical and organisational measures to protect your data, in particular:

• Encrypted data transmission via SSL/TLS
• Access restrictions on personal data
• Regular review of security measures
• Use of certified payment service providers (Stripe is PCI-DSS certified)

11. Minors

Membership of minors requires the prior consent of the legal representative (see clause 2.1 of the Terms). Data of minors are processed only on that basis. If we become aware that data of a minor were collected without the required consent, those data will be deleted without delay.

12. Changes to this privacy policy

Swiss PGA Sodales reserves the right to amend this privacy policy at any time. The current version is available on the platform at sodales.swisspga.ch/en/privacy. In the event of material changes, registered members will be informed by e-mail.

13. Contact

For questions about data protection or to exercise your rights:

E-mail: sodales@swisspga.ch
Web: sodales.swisspga.ch