Deutsch Français Italiano English
Version 1.0 · valid for the platform helferliste.ch and all club subdomains (*.helferliste.ch). This statement explains the processing of personal data under the revised Swiss Federal Act on Data Protection (revFADP, in force since 1 September 2023) and, where applicable, the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”). The application and all data are hosted in Switzerland (Infomaniak).
The controller within the meaning of Art. 5 lit. j revFADP and Art. 4 no. 7 GDPR for processing on the platform side is:
Sandro Egloff
Eichenweg 9
8134 Adliswil
Switzerland
Email: kontakt@helferliste.ch
A data protection officer or a representative in the EU/Switzerland is not required by law and has not been appointed.
Helferliste is a multi-tenant software-as-a-service application. For the processing assigned to an individual club (events, volunteer sign-ups, attendance, member records), that club is an independent controller; in this respect the operator processes the data as a processor (Art. 9 revFADP, Art. 28 GDPR) on behalf of and according to the instructions of the club. For the operation of the platform itself (accounts, security, billing, communication) the operator is the controller. For club-related data subject rights, the club is the primary point of contact.
“Personal data” means any information relating to an identified or identifiable natural person. “Processing” covers any handling of personal data, regardless of the means and procedures applied (collecting, storing, using, disclosing, deleting). The “data subject” is the natural person whose data is processed. The definitions follow Art. 5 revFADP and Art. 4 GDPR.
| Category | Data | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| Volunteer sign-up | First/last name, email, chosen stations and shifts, timestamp, attendance status | Organising and running the assignments, confirmation and reminder emails | Contract / pre-contractual measures or legitimate interest of the club (Art. 6(1)(b)/(f) GDPR; Art. 31 revFADP) | until the event is completed and followed up, then deletion or anonymisation |
| Member list | Name, email, phone (optional) | Recurring assignment and invitation of volunteers by the club | legitimate interest / membership of the club | until deleted by the club |
| Administration accounts | Email, role, hashed password, event assignments | Authentication and permission management (club admin / organising committee / operator) | contract / legitimate interest (security) | until the account is deleted |
| Club and billing data | Club name, contact person, address, billing email, plan/subscription status | Performance of the contract, support and invoicing | contract; statutory retention obligations | 10 years for accounting records (Art. 958f CO), otherwise until the contract ends |
| Contact requests | Name, email, message | Answering and handling the request | legitimate interest / consent | until handled, then usual retention |
| Technical data | Server logs (IP, time, user agent), technically necessary cookies, local browser storage | Operation, stability, IT security, defence against misuse and errors | legitimate interest in secure operation (Art. 6(1)(f) GDPR) | short term, then automatic deletion |
No sensitive personal data (Art. 5 lit. c revFADP) is actively collected. Volunteers are asked not to enter sensitive details in free-text fields.
To provide the service we use carefully selected processors who are contractually bound to confidentiality, technical and organisational measures and to our instructions (data processing agreement under Art. 9 revFADP / Art. 28 GDPR):
| Provider | Purpose | Seat / region |
|---|---|---|
| Infomaniak Network SA | Hosting of the application and database (data centres in Switzerland) | Switzerland |
| Brevo (Sendinblue SAS) | Sending transactional emails (confirmation, reminder, invitation, contact, reports) | France (EU) |
Any further disclosure to third parties takes place only where necessary to perform the contract, where required by law or where consent has been given. Personal data is not sold.
The application and the database are hosted exclusively in Switzerland (Infomaniak, data centres in Switzerland). Personal data therefore remains in principle in Switzerland and is subject to Swiss data protection law. Processing in the EU/EEA takes place solely for sending transactional emails via Brevo (France). Appropriate safeguards exist for this transfer – in particular standard data protection clauses or an adequacy decision; from a Swiss perspective the EEA is regarded as providing an adequate level of protection (Art. 16 f. revFADP, Art. 44 ff. GDPR). A copy of the safeguards can be requested from the controller.
We use only technically necessary cookies: a signed access cookie for the volunteer page and a session cookie for the administration login (HttpOnly, SameSite=Lax, Secure over HTTPS). In addition, the browser’s local storage keeps which entries belong to you and the view you last used – this data stays on your device. No tracking, analytics or advertising cookies are used, so no consent (cookie banner) is required.
Personal data is kept only as long as necessary for the stated purposes or as long as statutory retention obligations exist (e.g. retention of accounting records). Afterwards it is deleted or anonymised. Volunteers can change or delete their entries at any time via the link in the confirmation email.
We take appropriate technical and organisational measures (Art. 8 revFADP, Art. 32 GDPR): transmission exclusively encrypted via TLS/HTTPS; passwords are never stored in plain text but only as a cryptographic hash (scrypt with salt); strict separation of club data by tenant; role-based access control; signed, time-limited access tokens. Absolute security of data transmission over the internet cannot be guaranteed.
Within the scope of applicable law you have in particular the following rights:
An informal message to kontakt@helferliste.ch is sufficient to exercise these rights. To prevent misuse we may request proof of identity. For club-related data, please contact the club concerned first.
Without prejudice to other remedies, you have the right to lodge a complaint with a supervisory authority – in Switzerland with the Federal Data Protection and Information Commissioner (FDPIC), in the EU with the competent supervisory authority of your place of residence.
No decision based solely on automated processing with legal effect (Art. 21 revFADP, Art. 22 GDPR) and no profiling for advertising purposes take place. Personal data is not used for direct marketing.
The application is aimed at clubs and their volunteers. If minors sign up as volunteers, this is the responsibility of the club; where necessary, the consent of the legal guardians must be obtained.
This privacy statement may be adapted to changes in the law or in the functions offered. The version published on this page applies.
This statement exists in several languages. In case of discrepancies, the German version prevails.