Data protection notice

This notice explains which personal data is processed when you visit eventplanix.ch, fill in one of the public forms of the EventPlanix platform (request to a venue, acceptance of an offer, satisfaction survey, proposal from an agency) or use the platform with an account. It is based on the Swiss Federal Act on Data Protection (FADP) and, for people located in the European Union, on the General Data Protection Regulation (GDPR).

Who is responsible for your data

EventPlanix is a platform operated by:
Stagend SA
Via G. e F. Ciani 14
6900 Lugano
Switzerland
Email: [email protected]

Roles depend on where you enter your data:

- Website eventplanix.ch and contact form: Stagend SA is the controller.
- Public forms of a venue (quote request, acceptance of an offer, post-event survey): the controller is the VENUE (hotel, event centre, location) that receives your request and makes you the offer. Stagend SA processes the data on its behalf as a processor, under a data processing agreement.
- Requests forwarded by an agency to several venues: the agency is the controller for its client's data; each receiving venue is the controller for the file it opens.
- Accounts of venues, agencies and tourism bodies: Stagend SA is the controller for account and usage data.

What EventPlanix does and what the venue does

For the data of the public forms the split of responsibilities is as follows.

The venue (controller): decides why and how your data is used, replies to you, prepares offers and documents, keeps the file according to its own obligations, answers your requests about your data (access, rectification, erasure) and is your contact for any question about the event.

Stagend SA (processor): hosts the data in Switzerland, sends on the venue's behalf the emails related to the file (confirmations, offers, reminders, survey), ensures technical security, does not use your data for its own purposes nor pass it to third parties, assists the venue in fulfilling your requests and deletes or returns the data at the end of the contract with the venue.

If a venue publishes its own notice, you will find it linked next to this one in its forms: for its part, that notice prevails.

Visiting eventplanix.ch

The website is hosted by Infomaniak Network SA in Switzerland. Traffic goes through the network of Cloudflare, Inc. (USA), which protects the site from attacks and speeds it up.

On every visit technical data is recorded automatically: IP address, date and time, requested page, browser and operating system, referring page. It is used only to run and secure the site; logs are deleted after a limited period. GDPR legal basis: legitimate interest in a secure, working website (art. 6(1)(f)).

The website uses no cookies, analytics, tracking or advertising. The language chosen with the selector stays in your browser only (localStorage).

Website contact form

When you write to us we process name, venue or company, email, phone (optional), message and page language. The form sends them to our server (app.eventplanix.ch, at Infomaniak in Switzerland), which does not store them in a database but forwards them by email to the mailbox [email protected], also at Infomaniak, through the Mandrill service of The Rocket Science Group LLC (Mailchimp, USA). We log the date and version of the accepted terms and, to protect against repeated submissions, the IP address for a limited time.

The form is protected by Cloudflare Turnstile, a service of Cloudflare, Inc. (USA) that checks the submission comes from a person; to do so it processes technical data of the browser and device, including the IP address. Turnstile is not used for advertising. Information: cloudflare.com/privacypolicy.

We use this data only to reply to you and, if applicable, arrange a demo. GDPR legal basis: pre-contractual steps at your request and legitimate interest in replying (art. 6(1)(b) and (f)).

Public forms of the platform

Request to a venue: name, email, phone, company, language and the event details you provide (dates, participants, type of event, message). Purpose: handling the request and preparing an offer for you. Legal basis: pre-contractual steps at your request (art. 6(1)(b) GDPR).

Acceptance or decline of an offer: your decision, the name of the person accepting, the billing address if given, the answers to the points to confirm, the date and IP address at the moment of acceptance, which serve as a simple electronic signature. Purpose: concluding and performing the contract with the venue (art. 6(1)(b) GDPR).

Post-event survey: rating and optional comment, linked to the event. Purpose: the venue's service quality; legitimate interest (art. 6(1)(f) GDPR); you may simply not reply.

Proposal shared by an agency: the page is read-only and collects no data; only the technical logs described above are recorded.

In every form that sends data we ask you to accept the terms of use and to acknowledge this notice: we log the date, text version and IP address of the acceptance. We do not ask for consent to the processing because it is not needed: the data is necessary for what you are requesting. We do not use your data for marketing and do not pass it to third parties.

Users with an account (venues, agencies, tourism bodies)

For people using the platform with an account we process name, email, language, organisation, role and access level, plus the session data and action logs needed for security and traceability (for example who sent an offer or took charge of a service order). Sign-in is by single-use email link, without a password.

Purpose: providing the service under the contract with the organisation, security, support, invoicing. Legal basis: contract and legitimate interest. The operational data the organisation enters about its own clients remains under its responsibility (see above).

Destination statistics

Tourism bodies connected to the platform (for example the destination's convention bureau) see only aggregated, anonymous data: number of events, participants, estimated room nights, by period, type and region. Each value is shown only when enough distinct venues contribute, so that no single venue, company or person can be identified. Agencies may record their events with statistical data for this purpose, without participant names.

Providers and transfers abroad

We use contractually bound providers that process data on our behalf:

- Infomaniak Network SA, Geneva (Switzerland): hosting of the platform, the website and the mailboxes, backups.
- The Rocket Science Group LLC (Mandrill / Mailchimp, USA): sending of system emails and of client emails on behalf of venues that do not use their own mail server.
- Cloudflare, Inc. (USA): protection and acceleration of the eventplanix.ch website and anti-spam check of the contact form.
- Anthropic, PBC (USA): AI assistance features (extracting request data from a pasted email, translating client documents) used ONLY if the venue enables them and only on the text the venue user chooses to process; the data is not used to train models.
- Stagend SA (Switzerland): catalogue of experiences and suppliers; when a venue asks for the availability of a proposal, the essential event data (dates, place, number of participants) is transmitted to Stagend.

Mandrill, Cloudflare and Anthropic may process data in the United States. Transfers rely on appropriate safeguards: certification under the Swiss-US and EU-US Data Privacy Framework or standard contractual clauses.

Beyond these providers we disclose data to third parties only where the law requires it. Venues may in turn use their own mail server (in that case email sending goes through their provider).

Cookies and local storage

The platform uses only strictly necessary cookies: the session cookie after sign-in, the language cookie and display preferences stored in the browser (for example calendar density). Platform users can keep a read-only offline copy of some pages, stored in the device's browser. No tracking or advertising cookies; a consent banner is therefore not required.

How long we keep data

- Requests and offers: for the duration of the relationship with the venue and afterwards according to its obligations; documents with accounting relevance (accepted offers, invoices) for 10 years as Swiss law requires.
- Unconcluded requests: closed automatically after 60 days without reply and archived; the venue can delete or anonymise them on request.
- Satisfaction surveys: 3 years.
- Website contact-form correspondence: as long as needed to handle it.
- Accounts: as long as the organisation has an active contract, then deletion within 12 months subject to legal obligations.
- Technical logs: 90 days. Backups: 30 days, then overwritten.

The periods are declared here; deletion takes place at the venue's request or at the end of the contract.

Security

Data and backups are hosted in Switzerland. Traffic is encrypted (TLS), access to the platform is by single-use email link, each organisation's data is separated and access levels limit what each user sees. Attachments and images are stored in the database and served only to those entitled.

Your rights

You may at any time ask which data is processed about you, request its rectification or erasure, the restriction of processing and its delivery in a readable format; you may also object to the processing. For data entered in a venue's forms, contact the venue (controller): its contact details are in the offer or the form. For the website and accounts, or if you do not know whom to contact, write to [email protected]: we will help you or forward the request.

You also have the right to lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC) or, if you live in the European Union, with the supervisory authority of your country.

Changes

We may update this notice when the platform, providers or the law change. The version published on this page prevails; logged acceptances carry the version in force at the time.

Last updated: 25 September 2026

← Back to home