Privacy Policy

The controller of personal data processed through the Ocio platform is:

Apsara Software GmbH

Limited liability company (GmbH) with its seat in Zürich

Commercial register of the Canton of Zürich, UID CHE-228.016.109

Mailing address: Hohlstrasse 210, 8004 Zürich, Switzerland

Email: [email protected]

("Ocio", "we", "us", "our").

We act as data controller under the Swiss Federal Act on Data Protection ("FADP") and, where the EU General Data Protection Regulation ("GDPR") applies, under Article 4(7) GDPR.

EU representative. We have not appointed an EU representative under Article 27 GDPR because our current processing does not target people in the EU at meaningful scale. We will appoint one when this changes.

Supervisory authorities. You may lodge a complaint with the Swiss Federal Data Protection and Information Commissioner ("FDPIC") at edoeb.admin.ch or, if you are in the EU/EEA, with the data protection authority of your habitual residence or place of work.

2.1 This policy applies to the personal data Ocio processes in operating the Ocio platform: the websites and apps powered by Ocio, the administration tools, the backend services and related communications. It covers every person who uses the Ocio platform, including people who use it as an owner, administrator, teacher or other staff member of an organization.

2.1a If you act for an organization. For a person who uses the Ocio platform on behalf of an organization, this policy governs the processing connected with their own use of the platform. The organization's relationship with Ocio, including any processing Ocio carries out on the organization's instructions, is governed by the Ocio Organization Terms and the organization's purchase contract.

2.2 This policy does not apply to:

(a) how an organization uses the personal data it receives through the Ocio platform, and any processing it carries out outside the platform, for example video surveillance on its premises, paper records or its own marketing lists. For this, the organization is responsible and its own privacy notice applies (see § 6.3);

(b) third-party websites or services that you reach by following a link from the Ocio platform; or

(c) personal data processed by Stripe, by Google when you sign in with Google, or by other third parties acting as controllers in their own right. Their privacy notices apply to that processing.

When you sign up on any website or app powered by Ocio, the Ocio platform creates a single Ocio account that works on all of them. Other users and organizations see you by your profile name (for example user_ab12cd34) and the details you publish; your internal account identifier is never shown to other users, organizations or third parties. You can change your profile name within the limits the platform allows.

If you sign up on one website today and visit another tomorrow, the same Ocio account works on both, but each organization sees only what the Ocio platform shows it (§ 6.3).

We collect only the data we need to operate the Ocio platform. The categories below are not exhaustive; specific fields change as features evolve.

4.1 Account data

• Required at sign-up: email address and password, or a Google sign-in where the website offers it; first and last name; date of birth.
• Optional: profile picture, profile name, language, phone number (used to verify your account by SMS where the website or app offers this).
• How they are used: your first and last name are shown on your public profile (see § 6.4). Your date of birth is used to confirm that you are at least 18 years old and is not shown on your public profile unless you choose to show your age.
• Account state: account creation date, last sign-in, language preference, notification settings.

We do not collect at sign-up: gender, nationality, identity-document data, biometric data, data on sexual orientation, health data, religious or political views. An organization may ask for such data for a specific activity, for example age verification for an event with alcohol; it does so under its own privacy notice, not this one.

4.2 Booking data

When you book or buy something from an organization through the Ocio platform, we record:

• what you booked or bought, with dates, times and places;
• the status of your booking, for example confirmed or cancelled;
• the reference of the payment at our payment provider (no card data, see § 4.5);
• where issued, the QR code for your booking, which we store securely and which stops working when the booked session ends.

We share personal data only as described below.

6.1 Service providers (processors) acting on our instructions

7.1 Primary hosting in Germany. We operate the Ocio platform's database, backend, file storage and backups, and the ocioapp.ai website, ourselves on servers rented from Hetzner in Germany. No production data is stored outside Germany. Switzerland and the EU/EEA recognise each other as providing an adequate level of data protection.

7.2 Transfers outside Switzerland and the EU/EEA. Some of the service providers in § 6.1 process personal data in other countries:

(a) United Kingdom (OpenStreetMap Foundation): recognised by Switzerland and the EU as providing an adequate level of protection;

(b) USA (Cloudflare, Google, Stripe, Twilio, IPinfo, Anthropic, OpenAI): on the basis of the EU-U.S. and Swiss-U.S. Data Privacy Framework where the recipient is certified under it, and otherwise of the European Commission's standard contractual clauses with the amendments required by Swiss law;

(c) Services you choose to use (§ 6.2), such as Telegram, WhatsApp or your calendar provider, may process data in countries without an adequate level of protection. We send data to them only at your request, when you connect or enable the service, which the law permits (Art. 17 FADP, Art. 49 GDPR).

7.3 Relocation. We may move the platform's hosting to another provider or another country within Switzerland or the EU/EEA without further notice, provided the level of protection is not reduced. We will not move it outside Switzerland or the EU/EEA without updating this policy and putting appropriate safeguards in place.

We keep personal data only for as long as we need it.

You have the following rights, subject to the conditions and exceptions of applicable law:

• Access: request a copy of the personal data we hold about you.
• Rectification: have inaccurate data corrected.
• Erasure: have your data deleted, subject to the retention obligations in § 8.
• Restriction: restrict processing in certain situations.
• Portability: receive your data in a structured, commonly used, machine-readable format and transmit it to another controller.
• Objection: object to processing based on legitimate interests, including profiling for marketing.
• Withdrawal of consent: at any time, with effect for the future, where processing is based on consent.
• No automated decisions with legal or similarly significant effects (§ 5).
• Complaint to the FDPIC (Switzerland) or your data protection authority in the EU/EEA.

To exercise any of these rights, contact us at the address in § 13. We may need to verify your identity before responding. We aim to respond within 30 days, which can be extended where the law allows. For an organization's use of your data, contact the organization (§ 6.3.3).

10.1 We apply technical and organisational measures appropriate to the risk, including:

• encrypted transmission (HTTPS/TLS);
• passwords stored only in one-way encrypted form (hashed);
• separation of each organization's data in the database;
• permissions for organizations' staff that give each person only the access their role requires;
• QR codes for bookings stored securely and usable only until the booked session ends;
• regular backups;
• logging and monitoring of administrator actions;
• vulnerability management and security updates.

10.2 No system can be guaranteed perfectly secure. We will inform you of personal data breaches affecting your data where the law requires it (Art. 24 FADP, Art. 34 GDPR).

11.1 The Ocio platform is intended for users aged 18 or older. We do not knowingly collect personal data of persons under 18.

11.2 Reports of suspected child-safety violations (child sexual abuse material, grooming, sextortion, trafficking, sexualisation of minors) are handled as set out in § 8.2 of the Ocio End-User Terms and Conditions and reported to the appropriate authorities, including clickandstop.ch in Switzerland and, where applicable, the National Center for Missing and Exploited Children (NCMEC).

We may amend this Privacy Policy as our processing changes or the law evolves. We will tell you about important changes by email or in the website or app at least 30 days before they take effect, unless the law requires a shorter period.

To exercise your rights or ask any question about this policy:

Apsara Software GmbH

Mailing address: Hohlstrasse 210, 8004 Zürich, Switzerland

Email: [email protected]