PRIVACY POLICY

Version 1 – Date: 24.08.2026

Sponsor Plus GmbH (in incorporation, not yet registered in the Commercial Register)

Jurastrasse 3

CH-5406 Rütihof

datenschutz@sponsor-plus.ch

This privacy policy provides information on how personal data is processed when using the Sponsor Plus platform, the sponsor-plus.ch website, as well as the club and organisation areas operated via Sponsor Plus.

Sponsor Plus is a digital platform for clubs and organisations and provides, among other things, functions for club projects, sponsoring projects, donation projects, events, membership fees, participant management, invoicing, payment reconciliation and other organisational tasks.

1. Responsible Entity

Responsible for the data processing that Sponsor Plus carries out for its own purposes is:

Sponsor Plus GmbH

(in incorporation, not yet registered in the Commercial Register)

E-mail:

datenschutz@sponsor-plus.ch

After the registration of Sponsor Plus GmbH in the Commercial Register, the complete official company and address data will be supplemented accordingly.

For certain processing of member, participant, sponsor, donor or event data, the respective club or the respective organisation itself is responsible.

Further information on this can be found under:

“Responsibility of Sponsor Plus and the organisations”

2. Which personal data is processed

Depending on the use of Sponsor Plus, different categories of personal data may be processed.

2.3 Participant data

In the context of projects and events, the following in particular may be processed:

• First and last name
• Address
• E-mail address
• Date of birth, if required
• Class
• Team
• Group
• Start number
• Participant number
• Photo, if applicable
• QR code
• Participant link
• Sponsor link
• Project assignment
• Performance and result data

Depending on the project, for example, the following performances can be recorded:

• Rounds
• Points
• Goals
• Assists
• Kilometres
• Hits
• individually defined performance units

Changes to performance data may be logged for traceability and security purposes.

2.8 Financial and billing data

For the creation and administration of invoices, payments and accounting information, the following in particular may be processed:

• Billing address
• Invoice number
• Invoice date
• Invoice items
• Invoice amount
• Payment status
• Payment references
• QR invoice data
• Bank details
• Booking records
• Payment reconciliation data
• tax and VAT-relevant information

Where card payments are processed via external payment providers, full credit card details are generally not stored by Sponsor Plus, provided that payment processing is carried out entirely by the respective payment provider.

2.9 Communication data

When sending e-mails, the following in particular may be processed:

• Sender
• Recipient
• E-mail address
• Time of sending
• Delivery status
• Technical dispatch information
• If applicable, communication content

In the case of organisation-related communication, the stored billing or organisation e-mail address can be used as a reply address (Reply-To).

2.1 User accounts

For administrators and other users, the following in particular may be processed:

• First and last name
• E-mail address
• User role
• Organisation affiliation
• Login and authentication data
• Password hash
• Session information
• Two-factor authentication information
• IP address
• Browser and device information
• Login timestamps
• security-relevant events

Passwords are not stored in plain text.

2.5 Particularly sensitive personal data and health data

For camps or events, health-related information may be processed to a limited extent, insofar as this is necessary for the safe conduct of the event.

This may in particular include:

• Allergies
• Food intolerances
• Medically relevant nutritional information
• Required information on medication
• Other health information necessary for safe conduct

Health data belongs to the category of particularly sensitive personal data.

It may only be processed to the extent that it is necessary for the respective purpose.

The respective club or the respective organisation is responsible for the legality of the collection.

Access to health data should only be granted to persons who need this information for the conduct of the event.

Health data is not used for advertising, marketing or profiling.

2.4 Data of children and adolescents

Sponsor Plus can be used by clubs and organisations for, among other things, junior camps, sports events, sponsored runs and other projects with minor participants.

In this context, the following in particular may be processed:

• First and last name
• Date of birth
• Gender, if required
• Birth year
• Team or club
• T-shirt or clothing size
• Photo, if applicable
• Information on legal guardians
• E-mail address
• Telephone number
• Emergency contact

The respective club or the respective organisation is responsible for ensuring that necessary consents and information are correctly obtained or provided to legal guardians.

2.2 Club and organisation data

Depending on the organisation, the following in particular may be processed:

• Club or organisation name
• Address
• Contact details
• Telephone number
• Organisation e-mail address
• Billing e-mail address
• Display name for e-mail dispatch
• Legal form
• UID number
• VAT number and VAT status
• Bank details
• IBAN or QR-IBAN
• Contract data
• Subscription data
• Billing address
• Logos
• Branding data
• Colours
• public texts and images

2.7 Members and membership fees

When using member functions, the following in particular may be processed:

• Name
• First name
• Address
• E-mail address
• Membership
• Fee category
• Fee amount
• Billing data
• Payment status
• Payment references

Membership fees are used for internal club or organisation administration.

2.10 Technical data and log data

During the operation of the platform, technical information may be generated automatically, for example:

• IP address
• Date and time
• Browser
• Operating system
• Device information
• Session information
• Login events
• Failed login attempts
• security-relevant actions
• Error logs
• Audit logs

This information is used in particular for system security, error analysis, abuse prevention and the stability of the platform.

3. Purposes of data processing

Personal data is processed in particular for the following purposes:

• Provision of the Sponsor Plus platform
• User and organisation management
• Authentication and access control
• Conducting club and organisation projects
• Management of participants
• Management of members
• Management of sponsors and donors
• Conducting events and camps
• Management of membership fees
• Sponsoring and donation processing
• Invoicing
• Sending invoices
• Payment processing
• Payment reconciliation
• Communication
• Financial and budget management
• Accounting
• Statistics and analysis
• Platform and information security
• Abuse and fraud prevention
• Error analysis
• Audit logging
• Fulfilment of legal retention obligations
• Contract and subscription management
• Operation, maintenance and further development of the platform

Personal data is not used for unrelated purposes without a corresponding reason.

4. Responsibility of Sponsor Plus and organisations

The role under data protection law depends on the respective data processing.

2.6 Sponsor and donor data

Depending on the project, the following in particular may be processed:

• First and last name
• Address
• E-mail address
• Company or organisation name
• Sponsoring amount
• Donation amount
• Selected sponsoring model
• Assignment to participant or project
• Payment status
• Payment reference
• Billing information
• Communication data

Where intended, donations can be displayed anonymously to the public.

4.2 Clubs and organisations as Controllers

For personal data that clubs and organisations collect and process via Sponsor Plus within the scope of their own activities, the respective organisation generally decides on the purpose and scope of the data processing.

This concerns in particular data of:

• Members
• Participants
• Children and adolescents
• Legal guardians
• Helpers
• Sponsors
• Donors
• Invoice recipients

4.1 Sponsor Plus as Controller

Sponsor Plus is particularly responsible for data processing that is carried out for its own purposes, for example:

• User account management
• Authentication
• Contract management
• Subscription management
• Own invoicing
• Platform operation
• Platform and information security
• Abuse prevention
• Technical logging
• Fulfilment of own legal obligations

4.3 Sponsor Plus as Processor

Insofar as Sponsor Plus processes such personal data exclusively on behalf of and according to the instructions of an organisation, Sponsor Plus acts as a processor.

The respective organisation remains responsible for the legality of its data processing.

5. Legal bases

Sponsor Plus processes personal data in accordance with the Swiss Data Protection Act (DPA) and other applicable legal regulations.

Processing is carried out in particular:

• for the execution and performance of contracts
• for the provision of the platform
• for the fulfilment of legal obligations
• for ensuring information and system security
• based on overriding private interests, where permitted
• based on consent, where such is required

Insofar as the General Data Protection Regulation of the European Union (GDPR) is applicable to specific processing, its requirements are also taken into account.

6. Service providers and processors

Sponsor Plus uses external service providers for the operation and provision of the platform.

Depending on the currently activated platform configuration, these may in particular include:

• Base44 – platform and hosting infrastructure
• Cloudflare – network, security and backup infrastructure
• Resend – e-mail dispatch
• Stripe – payment processing, if activated
• Payrexx – payment processing, if activated
• Google – insofar as corresponding technical services are actually activated

Other service providers may be used if this is necessary for the operation and further development of the platform.

Sponsor Plus reviews the providers used and concludes the necessary data protection or processor agreements.

7. Disclosure of personal data abroad

When using international service providers, personal data may also be processed or accessed outside of Switzerland.

This may in particular concern states of the European Economic Area as well as – depending on the respective service provider and its sub-processors – other states such as the USA.

In the case of data transfers abroad, it is checked whether an adequate level of data protection exists in the respective state.

If there is no adequate level of data protection, appropriate protection mechanisms are used where necessary, for example, recognised standard data protection clauses or other legally permitted guarantees.

The actual providers, data locations and protection mechanisms used are regularly reviewed.

8. Retention and deletion of personal data

Sponsor Plus generally stores personal data only for as long as is necessary for the respective processing purpose or as required by legal retention obligations.

8.2 Base44 Data Version History

After a final change or deletion, previous data states may still be available for a limited time in the technical Data Version History depending on the Base44 plan used.

For the currently used Base44 Elite Plan, this technical history is currently:

up to 7 days

These versions serve in particular for restoration after accidental changes or deletions.

After the corresponding period has expired, older versions are automatically removed.

8.1 Soft-delete and Recycle Bin

Deleted entity records are generally initially deleted via soft-delete.

They remain for up to:

30 days

in the recycle bin or “Recently Deleted” area and can potentially be restored during this time.

After this period has expired, they are permanently removed from the productive database, provided there is no legal retention obligation or other permissible reason for further storage.

8.3 External Sponsor Plus backups

Sponsor Plus also creates external data backups in a private Cloudflare R2 storage.

The backups are used for:

• Data security
• Restoration after technical disruptions
• Disaster recovery

For the backup area:

backups/

there is a lifecycle rule with a maximum retention period of:

90 days

After that, the corresponding backup objects are automatically deleted.

The external R2 backups are to be distinguished from legal archiving and retention obligations.

9. Concrete retention periods

Insofar as there are no legal obligations or other permissible reasons to the contrary, the following retention periods generally apply.

9.3 Participant data

Participant data is generally retained until:

2 years after the end of the project

and subsequently deleted, provided there is no other legal basis or legal obligation.

9.5 Health data

Health-related information is treated particularly restrictively.

It is only stored for as long as is necessary for the safe conduct of the respective event and any necessary post-processing.

Health data is generally deleted at the latest:

90 days after the end of the event

It is not stored further due to longer-running financial or accounting retention periods.

9.10 Login and security data

Login and security information is generally retained until:

90 days after the last relevant event

9.11 Cookie consents

Consent decisions and corresponding technical evidence are generally retained for:

12 months

or until a prior revocation.

10. Legal retention and Legal Hold

Data that is subject to legal retention obligations may not be permanently deleted during this period.

Sponsor Plus can technically protect corresponding data records against premature deletion.

This applies in particular to relevant invoice, payment and accounting information.

If there is an additional need for retention due to a:

• legal dispute
• official proceeding
• open legal claim
• legal reason

affected data records can be temporarily provided with a Legal Hold.

During a Legal Hold, no automatic permanent deletion takes place.

11. Historical invoices and accounting documents

Already issued invoices and accounting documents must remain traceable during the legal retention period.

Subsequent changes to, for example:

• Organisation name
• Address
• Bank details
• QR-IBAN
• Billing e-mail address
• VAT status
• Invoice recipient

must not retroactively falsify already issued invoices.

Relevant invoice information is therefore historically stored or stored as a snapshot.

12. Private files, images and documents

Sponsor Plus can process files such as:

• Logos
• Images
• Invoice PDFs
• Contracts
• Vouchers
• Documents
• Participant lists
• Other attachments

Access to private files is protected according to the existing technical infrastructure and can take place, for example, via time-limited or signed access mechanisms.

The retention period depends on:

• the purpose of the respective file
• the associated data record
• legal retention obligations
• the respective deletion concept

Invoice or accounting documents subject to retention are not prematurely removed solely due to the deletion of a project or user account.

13. Data security

Sponsor Plus takes appropriate technical and organisational measures to protect personal data.

This includes in particular:

• encrypted data transmission using TLS
• secure storage of passwords
• two-factor authentication for security-relevant functions
• role-based access controls
• multi-tenancy separation
• server-side authorisation checks
• audit logs
• brute-force protection
• time-limited access mechanisms
• backup and recovery procedures
• security monitoring

The technical and organisational protection measures are regularly reviewed according to risk and technical state.

14. Multi-tenancy separation

Data of different clubs and organisations is logically separated from each other.

Administrators and users of an organisation are generally only allowed to retrieve data of their own organisation.

The:

org_admin

possesses administrative rights within his own organisation.

Platform-wide access rights are possessed exclusively by appropriately authorised Sponsor Plus superadmins.

Multi-tenancy separation is implemented not only via the user interface but also through server-side access controls.

15. AI functions

Sponsor Plus can use AI-supported functions.

In doing so, only that data should be processed which is necessary for the respective function.

Particularly sensitive personal data should not be transmitted to AI services without corresponding necessity, legal basis and protective measures.

Personal data of Sponsor Plus users is not used for the general training of external AI models without a corresponding basis.

The actually used AI functions and providers are reviewed according to the technical platform configuration.

16. Cookies and similar storage technologies

Sponsor Plus uses cookies, local storage and comparable technologies, insofar as these are necessary for technical operation.

This includes in particular functions for:

• Login
• Authentication
• Session management
• Security
• Language settings
• Technical user preferences
• Cookie consents

Non-necessary analysis or tracking functions are only used if the necessary prerequisites for them are met.

Further information can be found in the Sponsor Plus Cookie Policy.

17. Automated decisions and profiling

As of the current status, Sponsor Plus does not use automated individual decisions that have significant legal or comparable effects on the affected persons.

As of the current status, Sponsor Plus does not conduct profiling with a high risk for advertising or marketing purposes.

Should corresponding functions be introduced in the future, this privacy policy will be adapted.

18. Rights of data subjects

Affected persons can, within the scope of applicable data protection law, exercise in particular the following rights:

• Information about processed personal data
• Correction of incorrect data
• Deletion of data, insofar as no retention obligation stands in the way
• Release or transfer of data, insofar as the legal requirements are met
• Revocation of given consent for future processing
• Further rights according to the respectively applicable data protection law

Requests can be directed to:

datenschutz@sponsor-plus.ch

Insofar as the respective club or the organisation is responsible for the relevant data processing, Sponsor Plus can forward the request to the responsible organisation or support them in processing it.

19. Deletion requests

Affected persons can request the deletion of their personal data, insofar as the legal requirements are met.

A complete deletion cannot, in particular, be carried out or not carried out immediately if:

• legal retention obligations exist
• data is needed for the assertion or defence of legal claims
• a Legal Hold exists
• other legal reasons stand in the way of deletion

After the expiry of the corresponding reasons, the data is deleted according to the intended deletion concept or, if sensible, anonymised.

20. Data security breaches

Sponsor Plus maintains processes for the detection and treatment of security incidents.

Security incidents are:

• investigated
• documented
• treated according to their risk

Insofar as a breach of data security is reportable according to applicable law, the necessary reports are made to the competent authorities.

Affected persons are informed, insofar as this is legally required or necessary for their protection.

21. Data protection impact assessment

Sponsor Plus takes into account the risks to the personality and fundamental rights of affected persons during the development and operation of the platform.

For processing that is expected to present a high risk, it is checked whether a data protection impact assessment is required.

This applies in particular to extensive processing of particularly sensitive personal data.

22. Processor agreement

Insofar as Sponsor Plus processes personal data on behalf of a club or an organisation, the processing is regulated according to legal requirements.

In this context, the following are taken into account in particular:

• Subject and purpose of processing
• Data categories
• Confidentiality
• Data security
• Sub-processors
• Disclosure abroad
• Support with data subject rights
• Deletion or return of data
• Regulations after contract end

23. Changes to this privacy policy

Sponsor Plus can adapt this privacy policy if, in particular:

• legal requirements
• platform functions
• data processing
• service providers
• technical infrastructure
• security measures
• retention or deletion processes

change.

The respectively current version is published via Sponsor Plus.

In the event of material changes, registered organisations can additionally be informed.

24. Contact Data Protection

For questions about data protection or the processing of personal data:

Sponsor Plus GmbH (in incorporation)

E-mail:

datenschutz@sponsor-plus.ch

After the registration of Sponsor Plus GmbH in the Commercial Register, the complete official company information will be supplemented.

9.7 Invoice and accounting data

Relevant invoice and accounting documents are generally retained for:

10 years

in accordance with legal retention obligations.

This concerns in particular:

• Invoices
• Accounting vouchers
• Booking records
• Payment information
• QR invoice data
• tax-relevant documents
• Business books
• Annual financial statement documents

The retention is technically separated from normal deletion processes.

User, project, subscription or organisation deletion must not prematurely remove financial data that is required to be retained by law.

9.1 User accounts

Upon account deletion:

Soft-delete → 30 days recycle bin → permanent deletion

Information that must be retained by law remains unaffected by this.

9.4 Camp and event registrations

Data from camp and event registrations is generally retained until:

1 year after the end of the event

Invoice and accounting data are excluded from this.

9.6 Sponsor and donor data

Sponsor and donor data is generally retained until:

2 years after the end of the project

Invoice, payment and accounting information may be stored longer due to legal regulations.

9.9 E-mail logs

Technical e-mail logs are generally retained for:

90 days

9.8 Audit logs

Audit logs are generally retained for:

2 years

9.2 Club and organisation data

After the termination of the contractual relationship, organisation data is generally still retained for:

90 days

This grace period serves in particular for proper contract termination and possible data export.

Subsequently, data that is no longer required is deleted, provided there are no legal retention obligations.