Privacy policy

1. Controller

The controller responsible for data processing is Brainfuzz AG, Badenerstrasse 116, 8952 Schlieren, Switzerland. This policy applies to the marketplace for event equipment and is based on the Swiss Federal Act on Data Protection (FADP) and, where applicable, the EU General Data Protection Regulation (GDPR). Contact for data protection questions: [email protected].

2. Data we process

• Account data: first name, surname, email address, telephone number (for booking enquiries, verified by SMS code), role (renter/provider), password (encrypted).
• Proof of identity: for bookings with a rental total of CHF 1'000 or more, or at the provider’s request, renters upload an identity document. It is stored outside the public area, is accessible only for our verification and is deleted 30 days after our verification decision; after that we keep only the result (verified/rejected) and the date of verification.
• Provider data: company, address, telephone, proof of business activity; the only telephone number displayed publicly is one the provider enters in their profile as a business number (never the private account or SMS number); bank details for payouts are entered directly with Stripe (Stripe Connect).
• Acceptance of the General Terms and Conditions: when you register or take over a prepared listing, we store which version of the General Terms and Conditions you accepted and when; we keep the IP address of that connection only as an encrypted check value (hash with a secret key), not in plain text.
• Invitations for providers: businesses for which we have prepared a listing receive an invitation and no more than two reminders by email. Each of these emails contains an unsubscribe link; after unsubscribing, we mark the business as “do not contact” and no longer write to it.
• Booking data: items rented, periods, messages, amounts.
• Payment data: rental fees, deposits (card reservations), payouts to providers and listing packages are processed by our payment service provider Stripe; we do not store complete card details, only Stripe identifiers (customer, payment, payment method reference for the deposit reservation, the provider’s payout account, subscription) and their status. For their payout account, providers go through Stripe’s identity and account verification (Stripe Connect); identity and bank data are held by Stripe.
• Technical data: log data, IP address, browser type to ensure operation.
• Error reports (“Report an error” button): on every page there is a button at the bottom right for reporting an error or a request to us. Only if you press it and send the report do we receive your text, the page viewed, the browser and screen size, the browser’s most recent error messages, a screenshot of the current view and the content of the form fields currently being filled in – for signed-in users together with their name and email, otherwise only with an email address provided voluntarily. You can deselect the screenshot before sending; passwords are never transmitted, and field contents that look like card numbers or access data are masked. Reports are seen only by the staff who look after the marketplace; they are used exclusively for troubleshooting and further development and are deleted once they have been dealt with (including text, notes and screenshot), at the latest after twelve months.
• AI features: the smart search sends your search input (shortened to 200 characters, with no link to your account) to an AI service, which derives search terms, location and number of people from it. Providers can have listing texts suggested: for this, the facts entered about the item or the public content of the company website entered are sent to the AI service. Please do not enter any personal data of third parties there; we only send the information required for the respective feature.
• Acquisition data of businesses (non-users): in order to win providers for the marketplace, we and the sales partners we engage record business contacts of event businesses (company, location, website, business telephone number and email, where applicable the name of the contact person) as well as notes on our contacts. The information comes from publicly accessible sources (company websites, industry and venue directories, commercial register) or from direct conversation. Its sole purpose is business contact (B2B), on the basis of our legitimate interest. You can object to the processing at any time (an email is sufficient); we will then no longer contact you and will keep only the telephone number and email address in a block list, so that the objection also applies if the business is recorded again later. If no collaboration comes about, we remove the contact person, contact details and notes at the latest 24 months after the last contact; the company name and outcome are kept so that we do not approach you again.

3. Purpose and legal basis

We process data to provide the platform, to handle bookings and payments, for communication between the parties, to prevent fraud and to comply with legal obligations. The basis for this is the performance of the contract and our legitimate interest in the secure operation of the platform.

4. Disclosure to third parties

To handle a booking, the necessary data is shared between renter and provider. Payment data (rental fees, deposit reservations, payouts to providers, listing packages) is transmitted to Stripe Payments Europe Ltd., Dublin, Ireland; provider payout accounts are kept as Stripe Connect accounts, for which Stripe itself carries out the statutory identity verification; Stripe may process data in the USA (Stripe, Inc.) and is certified under the Swiss-U.S. Data Privacy Framework (stripe.com/ch/privacy).

To send the SMS confirmation code, your telephone number is transmitted to Twilio Ireland Ltd., Dublin. For deliveries, we calculate the driving distance via Google Maps; the delivery address is transmitted to Google for this purpose. For the AI features (smart search, text suggestions and website import for providers, see section 2), we transmit the respective input to Anthropic PBC, San Francisco, USA (AI service “Claude”); under its commercial terms, Anthropic does not use this data to train its models. For enquiries to venues and event service providers, the provider receives your name, email address and telephone number with the delivered enquiry, so that they can send you a quote or arrange a viewing; files you send in the chat (PDF, images) are seen only by you, the provider and our support team (in case of queries). For rental items, the provider only sees your contact details after payment. If a provider with the “Premium” package transfers your enquiry with one click to their quoting tool anlassplanung.ch, we transmit your name, your company, your email address and your messages from this conversation (including key details such as occasion, date and number of guests), so that the provider can send you the quote requested; for venues and event service providers, your telephone number as well. We only transmit the billing address if you have already paid for a booking with this provider; for enquiries about rental items, this also applies to telephone number, company and email address. Providers without the “Premium” package cannot use this transfer — anlassplanung.ch also belongs to Brainfuzz AG. The platform runs on servers operated by Hetzner (data centre in Germany) and is delivered via Cloudflare (protection and delivery service, certified under the Swiss-U.S. Data Privacy Framework). Any further disclosure only takes place if we are legally obliged to do so.

5. Cookies, sign-in & analytics

For signing in, we use a technically necessary authentication token (JWT), which is stored locally in the browser and is used exclusively for session management.

For anonymous audience measurement, we use Google Analytics 4 (a separate data stream for this marketplace, kept apart from other services). Analytics cookies are only set once you consent in the cookie banner (Google Consent Mode v2, IP anonymisation). Without consent, no analytical storage takes place. You can change your choice at any time via the “Cookie settings” link in the footer of every page; withdrawing consent deactivates measurement immediately.

6. Retention

We keep personal data only for as long as is necessary for the purposes stated or required by statutory retention obligations. We keep booking, contract, invoice and payment records for the statutory period of ten years (Art. 958f of the Swiss Code of Obligations). We delete identity documents from the identity check 30 days after the verification decision. We delete error reports from the “Report an error” button, including text and screenshot, once they have been dealt with, at the latest after twelve months. For businesses we do not end up working with, we reduce acquisition data to the company name and outcome at the latest 24 months after the last contact (see section 2).

7. Your rights

You have the right to access, rectification, erasure and restriction of processing of your data, as well as the right to data portability. To exercise your rights, please contact us at [email protected].

8. Data security

We take appropriate technical and organisational measures to protect your data against loss, misuse and unauthorised access. Passwords are only ever stored in encrypted form.