Data Protection Policy

1. Data Controller

The data controller is:

Association Everybody’s Perfect

Rue Chantepoulet 1

1201 Geneva

Switzerland

Email:

Website: everybodysperfect.ch

If you have any questions about the protection of your data or wish to exercise your rights, you can contact us at the address above.

2. Data We Process

Depending on how you use our services, we may process:

· your contact details, such as your first name, last name and email address;

· information required to purchase, book and manage tickets, passes or multi-entry cards;

· certain demographic or geographical information collected when using the ticketing service, including postcode, city, country, age and gender;

· information relating to transactions and the payment method used, without us having access to your full bank card details;

· information relating to your subscription to our newsletter;

· technical data relating to the use of the website and ticketing service, such as your IP address, language, certain information about your browser or device, pages visited and technical identifiers;

· communications you send to us;

· photographs or videos taken in connection with the festival and its events.

We seek to limit the processing of personal data to what is useful for the purposes described in this policy.

3. Ticketing and Ticketack

Everybody’s Perfect uses Ticketack, a service provided by Net Oxygen Sàrl, for its ticketing service.

Ticketack is used in particular to manage orders, bookings, tickets, Perfect Passes and multi-entry cards, QR codes, access control, payments, and the data required to manage and monitor ticketing activities.

Everybody’s Perfect has administrative access to its ticketing data and may export such data when necessary for its activities.

This data is processed in particular to execute and administer orders and bookings, issue admission tickets and passes, manage access to events, handle possible cancellations or changes, carry out administrative and accounting tasks, and compile statistics on the festival’s activities and attendance.

According to information provided by Net Oxygen, Ticketack’s main infrastructure is hosted in Switzerland.

Retention periods

Our current ticketing configuration provides in particular for:

· abandoned shopping carts to be deleted after 7 days;

· shopping carts awaiting payment to be deleted after 30 days;

· customer accounts to be considered inactive after 1 year;

· data identifying inactive customers to be anonymised after 2 years;

· technical logs to be deleted after 3 years.

After anonymisation, certain information may be retained for statistical purposes, including postcode, city, country, age, gender and language.

4. Statistics and Inclusive Pricing

Everybody’s Perfect uses certain data from its ticketing system to better understand festival attendance, prepare its activity reports and, in particular, meet statistical requirements related to its public funding.

Postcodes are used in particular to analyse the geographical origin of our audience. Age and gender may contribute to general attendance statistics.

Reduced or inclusive rates offered by Everybody’s Perfect are based on self-declaration. Everybody’s Perfect does not require proof of age, student status, unemployment, OASI (AVS) or disability insurance (AI) status, or social circumstances in order to benefit from these rates.

When statistics are communicated in our reports or to public bodies, we use aggregated or anonymised data that does not allow individual audience members to be identified.

5. Payments

Electronic payments are processed by payment service providers integrated into the Ticketack ticketing system, including Pixoo / Net Oxygen and VR Payment.

Available payment methods may include Visa, Mastercard, PostFinance and TWINT.

The information required to process payments is transmitted to the relevant service providers. Everybody’s Perfect does not have access to full bank card details.

Certain transaction information may also be used by Ticketack for technical analysis and to improve its ticketing service, as explained below.

6. Usage Analytics – PostHog

Ticketack uses PostHog as an analytics tool to understand the use of the website and ticketing service and to improve its services. Everybody’s Perfect also has a PostHog integration associated with its Ticketack instance.

According to information provided by Net Oxygen, the data processed includes pages visited, certain website performance indicators, information relating to the purchasing journey and transactions, and a technical identifier used to link actions carried out during the same visit.

When a person is logged in, a Ticketack technical identifier associated with the user or ticket may also be used. According to Net Oxygen, names, email addresses and postal addresses are not transmitted to PostHog in this context.

Session recording (“Session Replay”) and the automatic capture of clicks or forms are disabled. No video recording of browsing activity takes place.

This data is used for usage analysis and service improvement, and not for targeted advertising or marketing profiling.

Data processed using PostHog is currently hosted in the European Union, in Frankfurt, Germany, and retained for 1 year, according to information provided by Net Oxygen.

7. Cookies and Similar Technologies

Our website and the services integrated into it use cookies and similar technologies.

Some are necessary or functional, for example to remember the selected language.

Ticketack/PostHog also uses a technical identifier to perform the usage analytics described above. Under the website’s current configuration, this analytics tool may be loaded without prior consent being requested.

You can delete or restrict cookies through your browser settings. Disabling certain cookies may, however, affect some website functionality.

We may adapt our cookie management mechanisms as our tools or applicable requirements evolve.

8. Newsletter and Mailchimp

Subscription to the Everybody’s Perfect newsletter is optional and separate from the purchase of a ticket. You can subscribe through our website or by selecting the relevant option when placing an order through Ticketack.

Our newsletter is managed using Mailchimp, a service provided by The Rocket Science Group LLC, an Intuit company.

When you choose to subscribe, the data required to send the newsletter, including your email address, is transmitted to Mailchimp.

You can unsubscribe at any time using the link provided in each newsletter or by contacting us.

Mailchimp is established in the United States and states that its servers are also located in the United States. Mailchimp’s subprocessors may also process data in other countries. Mailchimp states that it participates in the Swiss-U.S. Data Privacy Framework and provides contractual clauses in its data processing agreement for international transfers where required.

9. Website Security – WP Cerber

Our website uses WP Cerber Security to protect its infrastructure against unauthorised access, abusive login attempts, attacks and other malicious activities.

In this context, technical data may be recorded, including IP addresses and information relating to requests or login attempts.

Under our current configuration, logs relating to visitors and logged-in users are retained for 90 days.

The Cerber Security Cloud feature is also enabled. In this context, IP addresses may be transmitted to Cerber’s infrastructure in order to compare them with information relating to malicious activity and help detect and block such activity. This infrastructure may involve data processing in different countries.

10. Social Media Content

Everybody’s Perfect may display content from its social media accounts, including Instagram, on its website using the Smash Balloon Instagram Feed plugin.

This content may be cached on our website. Depending on the feed configuration and the availability of the Instagram service, loading certain external content may result in a connection to the relevant services and the transmission of technical data, such as an IP address.

When you access a social network directly or interact with it, any subsequent processing of your data is subject to the practices and policies of the relevant service.

11. Photographs and Videos During the Festival

Atmosphere photographs and videos may be taken during the festival in order to document its activities and communicate about Everybody’s Perfect, including on our website, social media, communication materials and in our activity reports.

These may include images of screening rooms, queues, public areas, parties or social gatherings.

We seek to distinguish between atmosphere or group images and portraits or photographs that place particular emphasis on an individual. Where appropriate, particularly for individual portraits, we ask for the consent of the person concerned.

If you do not wish to appear in photographs or videos, you can inform our reception team or the person taking the images.

If you appear in a photograph or video published by Everybody’s Perfect and would like to request its removal, you can contact us at . We will consider the request in light of the circumstances and applicable rights.

Given the nature of the festival and the importance that the confidentiality of attendance at an LGBTIQ+ event may have, we pay particular attention to respecting people who are photographed or filmed.

12. Recipients and Service Providers

We do not sell our audience’s personal data.

Certain data may, however, be disclosed or made accessible to service providers required for our activities, including for ticketing, payments, hosting and IT security, website usage analytics and newsletter distribution.

We may also disclose data where required by law or where necessary for the establishment, exercise or defence of legal claims.

13. Data Processing Abroad

Some of our service providers process or may process data outside Switzerland.

When personal data is disclosed abroad, we take care to comply with the requirements of Swiss data protection legislation and, where necessary, to use the safeguards provided for by that legislation.

In particular:

· the PostHog data described above is currently hosted in the European Union, in Frankfurt, Germany;

· Mailchimp processes data in the United States and may use subprocessors established in other countries;

· WP Cerber’s security infrastructure may involve processing in different countries.

14. Data Retention

We retain personal data for as long as necessary for the purposes for which it was collected, to comply with our legal obligations or to defend our rights.

Specific retention periods known to us are set out in the relevant sections of this policy, in particular for Ticketack, PostHog and the website’s security logs.

When we no longer need data that can identify an individual, it is deleted or anonymised where possible.

Truly anonymised statistics and reports may be retained for longer periods provided they no longer allow the individuals concerned to be identified.

15. Data Security

Everybody’s Perfect takes appropriate organisational and technical measures to protect personal data against loss, unauthorised access, alteration, disclosure or misuse.

In particular, we restrict access to data to people who need it in connection with their duties and use tools designed to protect our IT systems.

These measures are adapted according to the risks involved and the technical means available.

16. Your Rights

Within the limits provided for by applicable law, you may request information as to whether we process personal data concerning you and obtain the information provided for by law.

Where the applicable conditions are met, you may also request, in particular, the rectification or deletion of data, object to certain processing, request the release or transfer of certain data, or withdraw consent you have given.

To exercise your rights or ask a question about the processing of your data, please contact:

We may request information reasonably necessary to verify the identity of the person making the request.

17. Changes to This Policy

We may amend this policy when our activities, tools or applicable requirements change.

The version published on our website is the version currently in force. The date of the latest update is shown at the top of this document.