隐私政策

The controller of personal data processed via the Ocio Platform is:

Apsara Software GmbH

Mailing address: Hohlstrasse 210, 8004 Zürich, Switzerland

Email: [email protected]

Phone: +41 78 704 2572

(the "Operator", "we", "us", "our").

We act as data controller under the Swiss Federal Act on Data Protection ("FADP", revFADP in force since 1 September 2023) and, where the EU General Data Protection Regulation ("GDPR") applies, under GDPR Article 4(7).

EU representative. As of the Effective Date we have not appointed an EU representative under GDPR Art. 27 because our current processing does not target EU-based data subjects at meaningful scale. We will appoint a representative when this changes.

Supervisory authorities. You may lodge a complaint with the Swiss Federal Data Protection and Information Commissioner ("FDPIC") at edoeb.admin.ch, or, if you are in the EU/EEA, with the data-protection authority of your habitual residence or place of work.

2.1 This policy applies to personal data processed by the Operator in operating the Ocio Platform — including the customer-facing Apps, the operator administration interfaces, the backend services, and related communications. It covers end-user online access: every natural person who uses the Ocio Platform through an App, including persons who do so as a Tenant's owner, administrator, teacher, or other staff.

2.1a If you act for a Tenant. For a person who uses the Ocio Platform on behalf of a Tenant, this policy governs the processing connected with their individual online access, while the separate, individually agreed Business Contract between the Operator and the Tenant governs the processing connected with the business relationship — including any data-processing arrangements under which the Operator processes the Tenant's customer data on the Tenant's documented instructions. For those persons, the entire scope of the applicable privacy terms is the combination of this policy and that Business Contract; concerning the business relationship, the Business Contract prevails.

2.2 This policy does not apply to:

(a) personal data that a Tenant processes independently of the Ocio Platform — for example, on-premises CCTV, door-access logs, paper sign-up sheets, in-house marketing lists, separate customer-relationship systems. The Tenant is a separate, independent controller for those activities and publishes its own privacy notice;

(b) third-party websites or services that you reach by following a link from the Ocio Platform; or

(c) personal data processed by Stripe, by your OAuth identity provider (where you sign in via Google/Apple/etc.), or by other third parties acting in their own controller capacity. Their privacy notices apply to their own processing.

When you sign up on any App, the Ocio Platform creates a single, portable Ocio Account that works across every App. You are identified externally by a stable Profile Name (e.g. user_ab12cd34); your internal account identifier is never exposed to other Users, Tenants, or third parties. You can update your Profile Name within the limits the Ocio Platform allows.

This means: if you sign up on one App today and visit another App tomorrow, the same Ocio Account works on both — but each Tenant only sees what the Ocio Platform exposes, never your raw account ID.

We collect only the data we need to operate the Ocio Platform. Categories below are non-exhaustive; specific fields evolve with product features.

4.1 Account data

• Required at sign-up: email address and password, or an OAuth identity (where supported by the relevant App).
• Optional: display name, first / last name, profile picture, Profile Name, locale.
• Account state: account creation date, last login, language preference, notification preferences.

We do not collect at sign-up: date of birth, gender, nationality, identity-document data, biometric data, sexual-orientation data, health data, religious data, political opinions. A Tenant may request such data for a specific activity (e.g. age verification for an alcohol-licensed venue) — when it does, that data flows under the Tenant's privacy notice, not this one, unless we explicitly store it on the Tenant's behalf.

4.2 Booking data

When you place a Booking on a Tenant's site, we record:

• the Catalog item booked (Facility, Instructor, Class) and the slot times;
• the Order state (submitted, confirmed, cancelled, superseded);
• the linked Stripe payment intent ID (no card data — see § 4.5);
• any

We share personal data only as described below.

6.1 Service providers (processors) acting on our instructions

7.1 Primary hosting in Germany (EU/EEA). The Ocio Platform's primary servers are located in Germany. Switzerland and the EU/EEA mutually recognise each other as providing an adequate level of data protection, so transfers between them require no additional safeguard.

7.2 Possible future relocation within the EU/EEA. We may relocate the hosting environment to another country within the EU/EEA without further notice, provided the level of protection is not reduced. We will not relocate hosting outside the EU/EEA without updating this policy and, where applicable, putting Article 46 GDPR safeguards in place.

7.3 Limited transfers outside the EEA. Stripe and Google may process certain telemetry outside the EEA under their own GDPR SCCs. Aside from this, we do not currently transfer personal data outside Switzerland or the EU/EEA.

We keep personal data only for as long as we need it.

You have the following rights, subject to the conditions and exceptions of applicable law:

• Access — request a copy of the personal data we hold about you.
• Rectification — have inaccurate data corrected.
• Erasure ("right to be forgotten") — have your data deleted, subject to retention obligations in § 8.
• Restriction — restrict processing in certain situations.
• Portability — receive your data in a structured, commonly used, machine-readable format and transmit it to another controller.
• Object — object to processing based on legitimate interests, including profiling for marketing.
• Withdraw consent — at any time, with effect for the future only, where processing is based on consent.
• No automated individual decisions with legal/similarly significant effects — see § 5.
• Lodge a complaint with the FDPIC (Switzerland) or your local EU/EEA data-protection authority.

To exercise any of these rights, contact us at the address in § 13. We may need to verify your identity before responding. We aim to respond within 30 days (extendable per GDPR Art. 12(3)).

10.1 We apply technical and organisational measures appropriate to the risk, including:

• HTTPS/TLS in transit;
• password hashing using Supabase Auth (bcrypt / Argon2);
• row-level security (RLS) isolating each Tenant's data in the database;
• a least-privilege role-based permission model for Tenant staff (16-bit permission bitset, e.g. MANAGE_ORDERS, MANAGE_CATALOG, MANAGE_PRICING);
• SHA-256 hashing of Access Tokens for venue verification, with a short-lived plaintext copy retained only for legitimate display and scanning purposes;
• backup rotation;
• access logging and monitoring of administrator actions;
• vulnerability management and security updates.

10.2 No system can be guaranteed perfectly secure. We will notify you of personal-data breaches affecting your data when required by law (GDPR Art. 34, FADP Art. 24).

11.1 The Ocio Platform is intended for Users 18 years or older. We do not knowingly collect personal data of children under 18 without parental or guardian consent.

11.2 Where a Tenant offers activities for minors and supports parent/guardian-mediated registration, the parent or guardian assumes responsibility under the Ocio End-User Terms and Conditions. The Operator processes the minor's data on behalf of the parent / guardian and the Tenant.

11.3 Reports of suspected child-safety violations (CSAM, grooming, sextortion, trafficking, sexualisation of minors) are handled per § 16 of the Ocio End-User Terms and Conditions and reported to the appropriate authorities, including clickandstop.ch in Switzerland and, where applicable, the National Center for Missing and Exploited Children (NCMEC).

We may amend this Privacy Policy as our processing changes or as the law evolves. Material changes will be notified by email and/or in-App at least 30 days before they take effect, except where a shorter notice period is required by law.

To exercise your rights or ask any question about this policy:

Apsara Software GmbH

Mailing address: Hohlstrasse 210, 8004 Zürich, Switzerland

Email: [email protected]

Phone: +41 78 704 2572