Privacy

Translation for convenience. The German version is legally binding.

This privacy policy explains which personal data we process in connection with our activities, including our website tension-festival.ch. In particular, it explains what we process personal data for, how and where. It also explains the rights of the people whose data we process.

For individual or additional activities, further privacy policies and other legal documents such as general terms and conditions, terms of use or conditions of participation may apply.

We are subject to Swiss data protection law and, where applicable, to foreign data protection law, in particular that of the European Union (EU) with the General Data Protection Regulation (GDPR). The European Commission recognises (opens in a new tab) that Swiss data protection law ensures an adequate level of protection.

1. Contact addresses

Responsible for the processing of personal data:

We point it out where, in individual cases, others are responsible for the processing of personal data.

Data protection officer / adviser

The following person is our data protection officer or adviser and the point of contact for data subjects and authorities for enquiries about data protection:

2. Terms and legal bases

2.1 Terms

Personal data is any information relating to an identified or identifiable natural person. A data subject is a person about whom we process personal data.

Processing covers any handling of personal data, irrespective of the means and procedures used, for example querying, comparing, adapting, archiving, storing, reading, disclosing, procuring, recording, collecting, deleting, organising, saving, altering, disseminating, linking, destroying and using personal data.

The European Economic Area (EEA) comprises the member states of the European Union (opens in a new tab) (EU) plus the Principality of Liechtenstein, Iceland and Norway. The General Data Protection Regulation (GDPR) refers to the processing of personal data as processing of personal data relating to data subjects.

2.2 Legal bases

We process personal data in accordance with Swiss data protection law, in particular the Federal Act on Data Protection (opens in a new tab) (FADP) and the Data Protection Ordinance (opens in a new tab) (DPO).

Where and to the extent that the General Data Protection Regulation (GDPR) applies, we process personal data on at least one of the following legal bases:

• Art. 6(1)(b) GDPR (opens in a new tab) for processing that is necessary to perform a contract with the data subject or to take pre-contractual steps.
• Art. 6(1)(f) GDPR for processing that is necessary to protect our legitimate interests or those of third parties, unless the fundamental freedoms, rights and interests of the data subject prevail. Legitimate interests are in particular our interest in carrying out our activities in a lasting, user-friendly, secure and reliable way and in communicating about them, ensuring information security, protection against misuse, enforcing our own legal claims and complying with Swiss law.
• Art. 6(1)(c) GDPR for processing that is necessary to comply with a legal obligation to which we are subject under any applicable law of member states of the European Economic Area (EEA).
• Art. 6(1)(e) GDPR for processing that is necessary to perform a task carried out in the public interest.
• Art. 6(1)(a) GDPR for processing personal data with the consent of the data subject.
• Art. 6(1)(d) GDPR for processing that is necessary to protect the vital interests of the data subject or of another natural person.

3. Nature, scope and purpose

We process the personal data that is necessary to carry out our activities in a lasting, user-friendly, secure and reliable way. Such data can fall into the categories of inventory and contact data, browser and device data, content data, metadata and usage data, location data, sales data, and contract and payment data.

We process personal data for as long as is necessary for the relevant purpose or purposes or as required by law. Personal data that no longer needs to be processed is anonymised or deleted.

We may have personal data processed by third parties. We may process personal data jointly with third parties or transfer it to third parties. Such third parties are in particular specialised providers whose services we use. We ensure data protection with such third parties as well.

As a rule we process personal data only with the consent of the data subject. Where and to the extent that processing is permitted for other legal reasons, we may refrain from obtaining consent. For example, we may process personal data without consent to perform a contract, to comply with legal obligations or to protect overriding interests.

Within this framework we process in particular the information a data subject voluntarily sends us when getting in touch, for example by post, email, instant messaging, contact form, social media or telephone, or when registering for a user account. We may store such information in an address book or with comparable tools. If we receive data about other people, the people sending it are obliged to ensure data protection towards those people and to make sure the data is correct.

We also process personal data that we receive from third parties, obtain from publicly accessible sources or collect in the course of our activities, where and to the extent that such processing is permitted by law.

4. Data security

We take suitable technical and organisational measures to ensure data security appropriate to the risk. With our measures we ensure in particular the confidentiality, availability, traceability and integrity of the personal data we process.

Access to our online presence, in particular our website, uses transport encryption (SSL / TLS, in particular the Hypertext Transfer Protocol Secure, HTTPS). Most browsers mark transport encryption with a small padlock in the address bar.

Our digital communication is subject, like all digital communication, to mass surveillance without cause or suspicion and to other surveillance by security authorities in Switzerland, the rest of Europe, the United States of America (USA) and other countries. We cannot directly influence the corresponding processing of personal data by intelligence services, police forces and other security authorities.

5. Personal data abroad

As a rule we process personal data in Switzerland. Our website, the forms, the lounge booking and ticket sales run with providers in Switzerland (Green, cyon, Ticketmaster Switzerland).

Personal data reaches recipients abroad in the following cases:

Switzerland recognises an adequate level of data protection for the European Economic Area (EEA) and the United Kingdom (list of countries of the Federal Council (opens in a new tab)). For the USA this applies only to companies certified under the Swiss-U.S. Data Privacy Framework; for Australia and Singapore it does not apply.

Where a recipient is based in a country without adequate data protection, the transfer relies on your explicit consent (in the cookie notice or when signing up for the newsletter) and, where available, on standard data protection clauses or other suitable safeguards of the provider. In these countries authorities may be able to access data without you having the same rights as in Switzerland. We are happy to tell data subjects about any safeguards on request.

6. Rights of data subjects

6.1 Data protection claims

We grant data subjects all claims under the applicable data protection law. Data subjects have the following rights in particular:

• Information: Data subjects can ask whether we process personal data about them and, if so, which data. They also receive the information needed to assert their data protection claims and to ensure transparency. This includes the personal data processed as such, but also the purpose of processing, the retention period, any disclosure or export of data to other countries and the origin of the data.
• Correction and restriction: Data subjects can have incorrect personal data corrected, incomplete data completed and the processing of their data restricted.
• Deletion and objection: Data subjects can have personal data deleted («right to be forgotten») and object to the processing of their data with effect for the future.
• Data release and portability: Data subjects can request the release of personal data or the transfer of their data to another controller.

We may postpone, restrict or refuse the exercise of data subjects’ rights to the extent permitted by law. We may point out any conditions that must be met to exercise data protection claims. For example, we may refuse information in whole or in part with reference to business secrets or the protection of other people. We may also refuse the deletion of personal data in whole or in part with reference to statutory retention obligations.

In exceptional cases we may charge costs for the exercise of rights. We inform data subjects of any costs in advance.

We are obliged to take appropriate measures to identify data subjects who request information or assert other rights. Data subjects are obliged to cooperate.

6.2 Legal protection

Data subjects have the right to enforce their data protection claims in court or to lodge a report or complaint with a competent data protection supervisory authority.

The supervisory authority for reports by data subjects against private controllers and federal bodies in Switzerland is the Federal Data Protection and Information Commissioner (opens in a new tab) (FDPIC).

Possible supervisory authorities for complaints by data subjects, where and to the extent that the General Data Protection Regulation (GDPR) applies, are organised as members of the European Data Protection Board (opens in a new tab) (EDPB). In some member states of the European Economic Area (EEA) the supervisory authorities have a federal structure, in particular in Germany (opens in a new tab).

7. Use of the website

7.1 Cookies

We may use cookies. Cookies, both our own (first-party cookies) and those of third parties whose services we use (third-party cookies), are data stored in the browser. Such stored data does not have to be limited to traditional cookies in text form.

Cookies can be stored in the browser temporarily as «session cookies» or for a certain period as so-called permanent cookies. Session cookies are deleted automatically when the browser is closed. Permanent cookies have a fixed storage period. Cookies make it possible in particular to recognise a browser on the next visit to our website and thus, for example, to measure the reach of our website. Permanent cookies can also be used for online marketing.

Cookies can be deactivated or deleted in whole or in part in the browser settings at any time. Without cookies our website may no longer be available in full. We actively ask for explicit consent to the use of cookies, at least where and to the extent required.

We only use cookies and comparable technologies for statistics and advertising once you have consented in the cookie notice. You can change or withdraw your choice at any time via «Cookies» in the footer of the website.

We store your choice in the cookie notice in your browser together with a randomly generated consent ID. To be able to prove consent, we additionally log this ID, date and time, the categories chosen, the version of the notice, the page visited, the browser and the shortened IP address on our server at cyon in Switzerland. We keep the log for three years. After twelve months, or when the services used change, we ask again.

Cookies in use

We or the embedded services set the following cookies and comparable storage. We maintain the list by hand; the information from the respective providers is authoritative.

For cookies used for performance and reach measurement or for advertising, a general objection («opt-out») is possible for many services via AdChoices (opens in a new tab) (Digital Advertising Alliance of Canada), the Network Advertising Initiative (opens in a new tab) (NAI), YourAdChoices (opens in a new tab) (Digital Advertising Alliance) or Your Online Choices (opens in a new tab) (European Interactive Digital Advertising Alliance, EDAA).

7.2 Server log files

For each access to our website we may record the following information, provided it is transmitted by your browser to our server infrastructure or can be determined by our web server: date and time including time zone, IP address (opens in a new tab), access status (HTTP status code), operating system including user interface and version, browser including language and version, the individual page of our website that was accessed including the amount of data transferred, and the page last viewed in the same browser window (referrer).

We store such information, which may also constitute personal data, in server log files. The information is necessary to provide our website in a lasting, user-friendly and reliable way and to ensure data security, and thus in particular the protection of personal data, including by third parties or with the help of third parties.

7.3 Tracking pixels

We may use tracking pixels on our website. Tracking pixels are also called web beacons. Tracking pixels, including those of third parties whose services we use, are small, usually invisible images that are retrieved automatically when you visit our website. Tracking pixels can record the same information as server log files.

8. Tickets and lounge booking

8.1 Tickets

We sell tickets through Ticketmaster’s ticketing platform. Our website links there; Ticketmaster processes the information provided when buying tickets under its own terms.

• Ticketmaster: (opens in a new tab) ticketing platform; provider: Ticketmaster Schweiz AG (Switzerland); data protection information: privacy policy (opens in a new tab).

8.2 Lounge booking

When you book a lounge, we process your name, email address and telephone number and the booking details to handle the booking, issue the invoice and communicate about the booking. We do not use this information for anything else. We keep invoices and payment records for ten years because Article 958f of the Swiss Code of Obligations (CO) requires it.

8.3 Contact form, Cashless Return and volunteers

When you write to us via the contact form, we process your name, email address, your message and, if you wish, your request to receive the newsletter, in order to answer your enquiry.

To refund remaining credit on cashless cards, we process the card number, a photo of the card, first and last name, address, email address and IBAN. We use this information exclusively to check and transfer the credit. We do not send the IBAN by email. We delete the photo and bank details as soon as they are no longer needed for the refund and any statutory retention obligations.

When you sign up as a volunteer, we process your name, date of birth, town, email address, telephone number, the days you chose and voluntary information on driving licences, experience and previous assignments, in order to plan the assignments and contact you. We need the date of birth because volunteers must be at least 18 years old. The sign-up is sent by email to the people who plan the assignments.

All three forms transmit the information in encrypted form to our server at cyon in Switzerland, where it is stored. You receive a confirmation by email.

9. Notifications and messages

We send notifications and messages by email and via other communication channels such as instant messaging or SMS.

9.1 Performance and reach measurement

Notifications and messages may contain web links or tracking pixels that record whether an individual message was opened and which web links were clicked. Such web links and tracking pixels can also record the use of notifications and messages on a personal basis. We need this statistical recording of use for performance and reach measurement in order to send notifications and messages effectively and in a user-friendly, lasting, secure and reliable way, based on the needs and reading habits of the recipients.

9.2 Consent and objection

As a rule you must expressly consent to the use of your email address and your other contact addresses, unless the use is permitted for other legal reasons. For any consent we use the «double opt-in» procedure where possible, meaning you receive an email with a web link that you have to click to confirm, so that unauthorised third parties cannot misuse it. We may log such consents including IP address, date and time for reasons of proof and security.

As a rule you can object at any time to receiving notifications and messages such as newsletters. With such an objection you can at the same time object to the statistical recording of use for performance and reach measurement. This does not apply to necessary notifications and messages in connection with our activities.

9.3 Service providers for notifications and messages

We send notifications and messages with the help of specialised service providers.

We store sign-ups via the newsletter form on our website (email address, voluntarily first and last name and mobile number) on our server at cyon in Switzerland and pass them on to Audience Republic so that we can send you the messages you asked for.

In particular we use:

• Audience Republic: (opens in a new tab) platform for newsletters, sign-up pages and fan communication; providers: Audience Republic Pty Ltd (Australia) / Audience Republic, Inc. (USA); data protection information: privacy policy (opens in a new tab).

10. Social media

We are present on social media platforms and other online platforms in order to communicate with interested people and to inform about our activities. In connection with such platforms, personal data may also be processed outside Switzerland and the European Economic Area (EEA).

The general terms and conditions, terms of use, privacy policies and other provisions of the individual operators of such platforms also apply. These provisions inform in particular about the rights of data subjects directly towards the respective platform, which includes for example the right to information.

For our social media presence on Facebook, including the so-called page insights, we are jointly responsible with Meta Platforms Ireland Limited (Ireland), where and to the extent that the General Data Protection Regulation (GDPR) applies. Meta Platforms Ireland Limited is part of the Meta companies (opens in a new tab) (among others in the USA). Page insights show how visitors interact with our Facebook presence. We use page insights to provide our social media presence on Facebook effectively and in a user-friendly way.

Further information on the nature, scope and purpose of data processing, on the rights of data subjects and the contact details of Facebook and of Facebook’s data protection officer can be found in the Facebook privacy policy (opens in a new tab). We have concluded the so-called «Controller Addendum» (opens in a new tab) with Facebook and thereby agreed in particular that Facebook is responsible for ensuring the rights of data subjects. For page insights the corresponding information can be found on the page «Information about Page Insights» (opens in a new tab) including «Information about Page Insights data» (opens in a new tab).

11. Third-party services

We use services from specialised third parties in order to carry out our activities in a lasting, user-friendly, secure and reliable way. With such services we can, among other things, embed functions and content in our website. With such embedding, the services used record the IP addresses (opens in a new tab) of users at least temporarily for technically compelling reasons.

For necessary security-related, statistical and technical purposes, third parties whose services we use may process data in connection with our activities in aggregated, anonymised or pseudonymised form. This is, for example, performance or usage data needed to offer the respective service.

We load fonts from our own server; no data is transferred to third parties for this.

In particular we use:

• Google services: (opens in a new tab) providers: Google LLC (USA) / Google Ireland Limited (Ireland) for users in the European Economic Area (EEA) and Switzerland; general data protection information: «Privacy and security principles» (opens in a new tab), privacy policy (opens in a new tab), «Google is committed to complying with applicable data protection laws» (opens in a new tab), «Privacy guide for Google products» (opens in a new tab), «How we use data from sites or apps that use our services» (opens in a new tab) (information from Google), «Types of cookies and other technologies used by Google» (opens in a new tab), «Personalised advertising» (opens in a new tab) (activation / deactivation / settings).

11.1 Digital infrastructure

We use services from specialised third parties in order to use the digital infrastructure needed for our activities. This includes, for example, hosting and storage services from selected providers.

In particular we use:

• Green: (opens in a new tab) hosting of the website and email; providers: Green Datacenter AG / green.ch AG (both Switzerland); data protection information: privacy policy (opens in a new tab).
• cyon: (opens in a new tab) hosting of the lounge booking, the forms (contact, Cashless Return, volunteers), the newsletter sign-ups and the consent log; provider: cyon GmbH (Switzerland); data protection information: privacy policy (opens in a new tab).

11.2 Digital video content

We use services from specialised third parties to enable the direct playback of digital video content. We embed YouTube videos in privacy-enhanced mode (youtube-nocookie.com).

In particular we use:

• YouTube: (opens in a new tab) video platform; provider: Google; YouTube-specific information: «Privacy and safety centre» (opens in a new tab), «My data in YouTube» (opens in a new tab).

11.3 Advertising

We use the possibility of having targeted advertising for our activities displayed by third parties such as social media platforms and search engines.

With such advertising we want to reach in particular people who are already interested in our activities or who could be interested in them (remarketing and targeting). For this purpose we may transfer corresponding information, possibly also personal information, to third parties that enable such advertising. We can also determine whether our advertising is successful, that is, in particular whether it leads to visits to our website (conversion tracking).

Third parties with whom we advertise and where you are logged in as a user may be able to assign the use of our website to your profile there.

In particular we use:

• Facebook advertising (Facebook Ads): (opens in a new tab) social media advertising; providers: Meta Platforms Ireland Limited (Ireland) and other Meta companies (opens in a new tab) (among others in the USA); data protection information: remarketing and targeting in particular with the Facebook pixel and custom audiences including lookalike audiences, privacy policy (opens in a new tab), «Ad preferences» (opens in a new tab) (login as a user required).
• Google Ads: (opens in a new tab) search engine advertising; provider: Google; Google Ads-specific information: advertising based among other things on search queries, with various domain names, in particular doubleclick.net, googleadservices.com and googlesyndication.com, being used for Google Ads, «Advertising» (Google) (opens in a new tab), «Why am I seeing a particular ad?» (opens in a new tab).
• Instagram Ads: (opens in a new tab) social media advertising; providers: Meta Platforms Ireland Limited (Ireland) and other Meta companies (opens in a new tab) (among others in the USA); data protection information: remarketing and targeting in particular with the Facebook pixel and custom audiences including lookalike audiences, privacy policy (Instagram) (opens in a new tab), privacy policy (Facebook) (opens in a new tab), «Ad preferences» (Instagram) (opens in a new tab) (login as a user required), «Ad preferences» (Facebook) (opens in a new tab) (login as a user required).
• Pinterest Ads: (opens in a new tab) social media advertising; providers: Pinterest Inc. (USA) / Pinterest Europe Ltd. (Ireland) for users in the European Economic Area (EEA); data protection information: remarketing and targeting in particular with the Pinterest tag, «Privacy, safety and legal» (opens in a new tab), privacy policy (opens in a new tab), «Personalisation and data» (opens in a new tab), «Personalised ads on Pinterest» (opens in a new tab), cookie policy (opens in a new tab).
• Audience Republic: (opens in a new tab) marketing platform for events with a pixel to measure campaigns and ticket purchases; providers: Audience Republic Pty Ltd (Australia) / Audience Republic, Inc. (USA); data protection information: privacy policy (opens in a new tab).
• TikTok Ads: (opens in a new tab) social media advertising; providers: TikTok Information Technologies UK Limited (United Kingdom) and TikTok Technology Limited (Ireland) for users in the European Economic Area (EEA), the United Kingdom and Switzerland / TikTok Inc. (USA) for users in the USA / TikTok Pte. Ltd. (Singapore) for users in the rest of the world; data protection information: remarketing and targeting in particular with the TikTok pixel (opens in a new tab), privacy policy (opens in a new tab), cookie policy (opens in a new tab), «Privacy policy and cookie policy for TikTok for Business» (opens in a new tab).

We only load the advertising pixels after your consent to «Marketing» in the cookie notice.

12. Performance and reach measurement

We try to find out how our online offering is used. In this context we may, for example, measure the success and reach of our activities and the effect of third-party links to our website. Based on the results we can in particular fix errors, strengthen popular content or improve our online offering.

For performance and reach measurement, the IP addresses of individual users are stored in most cases. In this case IP addresses are generally shortened («IP masking») in order to follow the principle of data minimisation through the corresponding pseudonymisation.

Cookies may be used and user profiles created for performance and reach measurement. Any user profiles created include, for example, the individual pages visited or content viewed on our website, information on the size of the screen or browser window and the, at least approximate, location. As a rule any user profiles are created exclusively in pseudonymised form and are not used to identify individual users. Individual third-party services with which users are logged in may be able to assign the use of our online offering to the user account or profile with the respective service.

We only load these services after your consent to «Statistics» in the cookie notice.

In particular we use:

• Google Analytics: (opens in a new tab) performance and reach measurement; provider: Google; Google Analytics-specific information: measurement also across different browsers and devices (cross-device tracking) and with pseudonymised IP addresses, which are only exceptionally transferred in full to Google in the USA, «Privacy» (opens in a new tab), «Browser add-on to deactivate Google Analytics» (opens in a new tab).
• Google Tag Manager: (opens in a new tab) integration and management of other services for performance and reach measurement and of further services from Google and third parties; provider: Google; Google Tag Manager-specific information: «Data collected with Google Tag Manager» (opens in a new tab); further data protection information can be found with the individual services that are integrated and managed.

13. Final provisions

We created this privacy policy with the privacy policy generator (opens in a new tab) from Datenschutzpartner (opens in a new tab) and adapted it for this website.

We may adapt and supplement this privacy policy at any time. We will inform about such adaptations and supplements in a suitable form, in particular by publishing the current privacy policy on our website.

Last updated: October 2026