Privacy Policy
Information on how Gstaad Cricket Club collects, protects, and handles personal data in accordance with the revised Swiss Federal Act on Data Protection.
Swiss Alpine Privacy Commitment
Gstaad Cricket Club (GCC) is committed to protecting the privacy, personality rights, and fundamental freedoms of all attendees, members, and website visitors. We process personal data exclusively in compliance with the revised Swiss Federal Act on Data Protection (nDSG / FADP, SR 235.1) and the Data Protection Ordinance (DPO / VDSG, SR 235.11).
1. Identity of the Data Controller
The data controller responsible for personal data processing on this website and in connection with club operations is:
2. Categories of Personal Data Collected
In accordance with the principle of data minimization (Art. 6 para. 2 nFADP), we collect and process only the data strictly necessary for club sporting operations and safety:
Full name, email address, telephone number, participation category (Individual, Family, Junior with Guardian, Group, VIP Patron), attending party size, emergency contact details, and optional dietary/accessibility notes.
Parent / legal guardian full name, relationship to the child, explicit parental consent for athletic participation, and optional media consents.
Full name, contact coordinates, selected membership tier (Adult, Junior, Family, Social Patron), cricketing background, and applicant notes.
Transient IP address evaluated in-memory for 10-minute sliding rate-limiting (not stored in the database), user-agent string, timestamp, and requested resource for DDoS mitigation and server stability.
3. Disclosed Service Providers & Technical Processors
To operate the website, secure attendee registrations, and communicate with members, Gstaad Cricket Club engages specialized external service providers acting as processors under Art. 9 nFADP:
- Provider Identity: Supabase Inc., 970 Folsom Street, San Francisco, CA 94107, USA.
- Personal Data Transferred: Event attendee registration records (name, email, phone, party size, notes, emergency contact, guardian details), membership inquiry submissions, and administrative audit trails.
- Processing Purpose: Structured relational database persistence, attendee capacity counting, member management, and security audit logging.
- Storage & Processing Location: Managed AWS cloud infrastructure located in Frankfurt, Germany (Region eu-central-1).
- Retention Period: Festival registration data is retained through the event completion and post-event administrative review, after which it is archived or deleted. Active membership records are retained for the duration of membership plus statutory Swiss accounting retention periods (Art. 958f CO / OR).
- Cross-Border Transfer: Data is hosted in Germany (EU). Germany is recognized as an adequate jurisdiction under Annex 1 of the Swiss Data Protection Ordinance (DPO / VDSG).
- Safeguards & Security Measures: PostgreSQL Row Level Security (RLS) policies isolating administrative access, AES-256 encryption at rest, TLS 1.3 encryption in transit, and EU Standard Contractual Clauses (SCCs).
- Provider Identity: Web3Forms (Operated by Liram Media).
- Personal Data Transferred: Contact message fields (sender name, email address, optional phone number, inquiry subject, message text, and submission timestamp).
- Processing Purpose: Form submission routing and spam-filtered email delivery relay dispatching inquiries to the official club inbox (
info@gstaadcricketclub.ch). - Storage & Processing Location: Cloud infrastructure situated in the European Union and the United States.
- Retention Period: Web3Forms processes form content ephemerally for instant SMTP delivery. Delivery logs are retained temporarily for troubleshooting (maximum 30 days) and then permanently purged. Data is not used for profiling or marketing.
- Cross-Border Transfer: Transmission outside Switzerland is safeguarded by strict HTTPS TLS 1.3 transit encryption and Standard Contractual Clauses (SCCs).
- Safeguards: End-to-end TLS 1.3 transit encryption, spam filtering, and zero long-term retention.
- Provider Identity: Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA.
- Personal Data Transferred: HTTP request metadata, transient IP address, browser user-agent, requested page URLs.
- Processing Purpose: Static asset delivery, Next.js serverless execution, and DDoS mitigation.
- Storage & Processing Location: Edge server locations with European compute routing (Frankfurt / Zurich / London).
- Retention Period: Technical server access logs are retained for up to 30 days strictly for operational reliability and security diagnostics.
- Cross-Border Transfer: Covered by Swiss-US Data Privacy Framework certification and Standard Contractual Clauses (SCCs).
- Safeguards: TLS 1.3 encryption, automatic DDoS defense, and SOC 2 Type II compliance.
- Personal Data Transferred: Sender and recipient email addresses, participant name, event confirmation text.
- Processing Purpose: Direct transactional confirmation email dispatch to attendees and administrative notification alerts to club officers.
- Retention Period: Mail server queues retain delivery records for up to 90 days for operational reliability.
- Safeguards: Encrypted mail transmission via TLS 1.3 / STARTTLS (Port 465 SSL).
4. Technical Privacy Verification & Security Controls
In accordance with the principle of truth in privacy disclosures, we state the exact technical verification of our architecture:
5. Protection of Minors (< 18) & Parental Consent
The safety and privacy of young participants is paramount to Gstaad Cricket Club:
- Mandatory Guardian Consent: Any registration involving a person under 18 years of age requires the provision of the parent or legal guardian's name and explicit confirmation of consent for athletic participation.
- Unbundled Consent Options: Consents for child participation, emergency medical information, and media publication are presented as distinct, unbundled choices.
- Optional Photography Consent: Consent for photography, filming, and publication on the website or social media is entirely optional. Withholding photography consent does not restrict a child's participation in cricket sessions or festival activities in any manner.
6. Permissions Notice: Donors, Sponsors, Photographs & Federation Branding
Prior Permission Required: Donor names, corporate sponsor logos, club photographs, and Cricket Switzerland federation branding are published on this website exclusively with prior explicit permission and consent from the respective individuals, partner entities, and governing bodies.
Any individual or sponsor wishing to update, modify, or revoke permission regarding published names, logos, or photographic likenesses may do so at any time by contacting info@gstaadcricketclub.ch.
7. Data Retention & Erasure Schedules
Personal data is retained only for the duration necessary to achieve the stated purpose:
- Festival Reservations: Retained until the conclusion of the Gstaad Cricket Festival 2026 and subsequent administrative wrap-up, after which they are archived or deleted.
- Membership Records: Retained for the duration of the member's active affiliation with GCC, plus statutory retention periods required by Swiss accounting law (Art. 958f CO / OR, 10 years).
- General Inquiries: Deleted within 12 months of resolution unless ongoing correspondence requires continuation.
8. Your Rights under Swiss Law (Art. 25–32 nDSG)
Under the Swiss Federal Act on Data Protection, you hold comprehensive rights regarding your personal data:
To exercise any of these rights, email our committee at info@gstaadcricketclub.ch. Requests are fulfilled free of charge within 30 days.
9. Swiss Supervisory Authority
If you believe our processing of your personal data violates Swiss privacy legislation, you have the right to lodge a complaint with the competent Swiss supervisory authority: