EN

Privacy policy

This English translation is provided for information only. In case of discrepancy, the French version prevails.

1. Introduction and scope

This policy explains how Plugin.ch Sàrl processes personal data in connection with its showcase website plugin.ch, its sports club management application app.plugin.ch (including the clubs’ own domains) and its iOS and Android mobile applications (together “the Application”).

It is based on the Federal Act on Data Protection (revised FADP, in force since 1 September 2023) and its ordinance (DPO). Where the European Union’s General Data Protection Regulation (GDPR) applies, in particular for persons located in the European Union, we also comply with its requirements.

Terms used: the Club is Plugin’s customer (association, municipality, sports centre, company, etc.); the User is any person holding an account with a Club; the Administrator is a person appointed by the Club to manage its account.

2. Controller and contact

Plugin.ch Sàrl
Som-La-Proz 23
1937 Orsières (Valais), Switzerland
UID CHE-366.084.733
Telephone: +41 79 780 10 63
Contact: plugin.ch/en/contact/

For any question relating to data protection or to exercise your rights, you may write to us at the above address or via our contact page.

3. Roles: Club as controller, Plugin as processor

Data of a Club’s members and Users. Each Club is the controller of the data of its members and Users (registrations, bookings, membership fees, lessons, invoices, access, etc.). Plugin processes such data solely on behalf of the Club, as a processor, in accordance with the Club’s instructions and with the contract binding it to the Club. If you are a member or User of a Club, please address your questions and requests primarily to your Club; the Club’s privacy policy applies. If you contact us directly, we forward your request to the Club concerned.

Plugin’s own data. Plugin is the controller of the data of its customers and prospects (Clubs and their representatives), of persons who contact it and of visitors to the showcase website.

4. Data processed

4.1. Clubs, Administrators and prospects

  • identity and contact data: surname, first name, e-mail address, telephone number(s), postal address, position, name of the Club;
  • Club data: contact details, geolocation (latitude/longitude), website, time zone and language, bookable spaces, opening hours, payment gateway configuration;
  • contractual and invoicing data: pack and options subscribed, invoices, payments;
  • correspondence and support requests.

4.2. Users of a Club (processed on behalf of the Club)

  • identity and contact data: surname, first name, e-mail address, telephone number(s), address, and other data that the Club chooses to collect (for example date of birth, membership category);
  • account data: username, password (stored only in hashed form), notification and language preferences;
  • usage data: bookings, lesson registrations, subscriptions, change history (audit log accessible to the Club);
  • financial data: invoices, payments, wallet balance; payment card data are never stored by Plugin (section 7);
  • access data, if the Club uses access control: access codes or badges and opening logs.

4.3. Visitors to the showcase website

  • data entered in the contact form: name, Club, e-mail address, telephone (optional), subject and message;
  • technical data recorded automatically by the server: IP address, date and time, page viewed, browser.

5. Purposes and legal bases

We process personal data for the following purposes. For persons to whom the GDPR applies, the corresponding legal basis (Art. 6(1) GDPR) is indicated in brackets.

  • concluding and performing the contract with the Club: creation and management of the account, support, invoicing and collection (performance of a contract, point (b));
  • providing the Application to the Club and its Users: accounts, authentication, bookings, payments, notifications, Club statistics (on behalf of the Club, on the legal basis determined by the Club);
  • responding to requests sent via the contact form, by e-mail or by telephone (pre-contractual measures or legitimate interest, point (b) or (f));
  • ensuring the security of the Application and of our servers, preventing and detecting abuse, fraud and unlawful activities (legitimate interest, point (f));
  • improving our services and analysing their use on an aggregated basis (legitimate interest, point (f));
  • sending Clubs information about our products; you may object to this at any time (legitimate interest, point (f), or consent, point (a));
  • complying with our legal obligations, in particular accounting and tax obligations (legal obligation, point (c)).

We do not sell or rent any personal data and do not take any automated individual decision within the meaning of Art. 21 FADP.

6. Recipients and processors

Data are disclosed only to the following recipients, to the extent necessary:

  • the Club and its Administrators, for the data of its Users; depending on the Club’s settings, certain data (for example the name on a booking schedule) may be visible to other logged-in Users of the same Club;
  • Hetzner Online GmbH (Germany), which hosts our servers;
  • the payment providers TWINT, Stripe, Worldline (SaferPay) and PayPal, when an online payment is made; they act in accordance with their own privacy policies;
  • each Club’s own outgoing mail (SMTP) servers: notifications and messages from the Application are sent through the mail server of the Club concerned, chosen and controlled by that Club;
  • our access control partner, where the Club uses this option, for the data necessary for its operation;
  • the authorities, where required by law, a court decision or criminal proceedings.

Our processors are bound by contract and may process the data only on our instructions and for the purposes indicated.

7. Online payments

Payment card data are entered directly on the secure pages or applications of the payment providers (TLS connection). They do not pass through our servers, and neither Plugin nor the Clubs have access to full card numbers. We receive only the information necessary to track the payment (amount, date, status, transaction reference).

The API keys of the Clubs’ payment gateways are transmitted over an encrypted connection and stored on our servers in encrypted form (AES-256).

8. Disclosure of data abroad

Our servers are hosted by Hetzner Online GmbH in Germany. The Application’s data are therefore stored outside Switzerland, in a Member State of the European Union whose legislation ensures an adequate level of protection according to the Federal Council (Annex 1 DPO). For persons in the European Union, the data remain in the European Economic Area or in Switzerland, which is also recognised as adequate by the European Commission.

The payment providers and, where you activate them on the showcase website, the third-party services mentioned in section 12 may process certain data in other countries, including outside Europe. They do so under their own responsibility and in accordance with their own safeguards (for example standard contractual clauses).

9. Retention period

  • Account data of Clubs and Users: for the duration of the contract with the Club, and then until the account is deleted. The data in a Club’s production database are retained for a maximum of 6 years, unless the Club instructs otherwise. After the end of the contract, they are deleted within 7 days (or archived for up to 12 months if the Club so requests).
  • Backups: 90 days, in encrypted form, followed by permanent erasure.
  • Accounting records (invoices, payments, entries): 10 years, in accordance with Art. 958f CO.
  • Messages sent via the contact form and correspondence: for as long as necessary to handle the request and follow up the relationship, after which they are deleted, no later than 6 months after the last exchange where there is no contract.
  • Server technical logs: 6 months.

When a User is deleted, certain non-accounting data (for example their past bookings) may be retained in anonymised form for statistical purposes.

10. Data security

We take appropriate technical and organisational measures to protect data against loss, unauthorised access, alteration or disclosure, in particular:

  • TLS encryption of all communications between your browser or mobile application and our servers;
  • AES-256 encryption of backups and of payment API keys;
  • regular backups of production data;
  • access to data restricted to authorised persons, to the extent necessary for their tasks, who are bound by confidentiality.

In the event of a data security breach likely to result in a high risk for the data subjects, we inform the Federal Data Protection and Information Commissioner as soon as possible (Art. 24 FADP) and, where the GDPR applies, the competent supervisory authority within 72 hours. Where the data concerned are processed on behalf of a Club, we inform the Club without delay so that it can fulfil its own obligations. Data subjects are informed where required by law.

11. Your rights

Within the limits of the applicable law, you have the following rights:

  • right of access: to know whether we process data concerning you and to obtain a copy, in principle free of charge;
  • right to rectification of inaccurate data;
  • right to erasure, subject to statutory retention obligations;
  • right to delivery or transmission of data (portability) in a commonly used electronic format;
  • right to object to processing, in particular to the sending of promotional information, and, under the GDPR, the right to restriction of processing;
  • right to withdraw your consent at any time, where the processing is based on consent, without affecting the lawfulness of prior processing.

How to exercise your rights. Users of a Club can view and modify much of their data themselves in the “My profile” menu of the Application. For other requests concerning their member data, they should contact their Club, which is the controller. For data processed by Plugin as controller, please send your request via our contact page or by post (section 2). In order to prevent any abuse, we may ask you to provide proof of your identity. We respond in principle within 30 days.

Supervisory authority. You may lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, www.edoeb.admin.ch. If you are located in the European Union, you may also contact the supervisory authority of your country of residence or work.

12. Showcase website: cookies and third-party services

The plugin.ch showcase website uses no advertising cookies, no tracking tools and no social network pixels.

  • Session cookie: a technical session cookie is set for the operation and security of the contact form. It is deleted when the browser is closed.
  • Theme preference: your choice of light or dark display is stored in your browser’s local storage (localStorage). This information remains on your device and is not transmitted to us.
  • Map (OpenStreetMap): the map is loaded only after you click on it. Your browser then connects to the OpenStreetMap servers, which receive in particular your IP address.
  • Videos (YouTube): videos are embedded in privacy-enhanced mode (youtube-nocookie.com) and are loaded only after you click on them. Google may then process data concerning you (in particular your IP address), including in the United States, in accordance with its own privacy policy.

You can delete cookies and local storage at any time in your browser settings.

The Application (app.plugin.ch) uses the technical cookies necessary for logging in and for the operation of the service.

13. Changes to this policy

We may amend this policy to take account of changes to our services or to the legislation. The version published on our website is authoritative. In the event of a significant change, we inform the Clubs by e-mail or in the Application.

Version of 4 October 2026.

Contact us

For any question concerning data protection:

  • via our contact page;
  • by telephone on +41 79 780 10 63;
  • by post: Plugin.ch Sàrl, Som-La-Proz 23, 1937 Orsières, Switzerland.