Privacy Policy - nuNight Management System

Your privacy is important to us. This Privacy Policy outlines how we collect, use, store, and protect personal data on behalf of our clients when they use the nuNight Management System. We are committed to protecting personal information and complying with applicable data protection laws, including the General Data Protection Regulation (GDPR) and the Swiss Federal Act on Data Protection (nFADP).

1. Data Controller and Processor Roles

The nuNight Management System acts as a data processor, handling personal data on behalf of the clients that use our service. The clients are the data controllers, responsible for determining the purpose and legal basis for processing the data they collect from their members, guests, and other users.

2. Types of Data Collected

Our clients may collect various types of personal data using our platform, including but not limited to:

• Email address (required)
• Full name (first and last name)
• Sex
• Company name
• Postal address
• Phone number
• Date of birth
• Password (for user accounts)

If the user is a member, the following additional data may be stored:

• Sponsor (if referred)
• Membership duration (start and end dates)
• Payment status (paid or unpaid) and amount due
• Member cards (type, ID number, and card status)

3. Consent and Communication Preferences

Users may provide consent for various communication channels, such as:

• SMS (yes/no)
• Newsletters (yes/no)
• Post Marketing (yes/no)

4. Reservations and Event Data

Our platform enables our clients to manage reservations for lounges and events. The following data is processed:

• Lounge reservations, including guests' details (name, email, phone, etc.) entered by the user.
• Pre-order details (drinks, lounge packages) and payment status.
• Guest check-ins for events and lounge reservations.

Payment-related data is forwarded to our third-party processor, Payrexx, for secure handling of transactions.

5. Data Exports

Our clients have the ability to export data from the system. Once exported, the client is responsible for ensuring the security and proper handling of this data in compliance with applicable data protection laws.

6. Use of Third-Party Processors and Hosting Providers

We use trusted third-party services to process certain types of data, including:

• Campaign Monitor (Marigold) for newsletter management, which involves the processing of email addresses and names. Campaign Monitor operates under the Marigold group, headquartered in the United States, and data transferred to them is safeguarded by Standard Contractual Clauses in accordance with GDPR.
• Payrexx for secure payment processing within Switzerland, ensuring compliance with Swiss data protection laws.
• Hetzner as our hosting provider. Our servers are hosted by Hetzner in Germany, which maintains standard security protocols, including logs of server activity. These logs are used for operational purposes only and do not include personally identifiable information for any marketing or profiling purposes.

7. Cookies and Tracking Technologies

Our platform uses cookies and similar technologies strictly for essential purposes, such as:

• Managing user login sessions.
• Saving pending reservation information during active user sessions.

No other tracking technologies or cookies are used for marketing or behavioral profiling.

8. Legal Basis for Processing Data

We process personal data based on the following legal bases, as outlined under the GDPR:

• Consent: For marketing communications such as newsletters, SMS, or post marketing, we rely on the explicit consent of the data subject, which is managed by the respective client.
• Performance of a contract: We process personal data to fulfill the services our platform offers, such as managing reservations, guest check-ins, and memberships.
• Legitimate interest: We may process data for statistical purposes to help our clients improve their services, as long as these interests do not override the privacy rights of the individuals concerned.

9. Data Security

We implement industry-standard security measures, including encryption, access controls, and secure backups, to protect personal data from unauthorized access, loss, or disclosure.

10. Data Breach Notification

In the event of a data breach that compromises personal data, we will notify the affected client(s) and the relevant supervisory authority without undue delay. Where applicable, the affected data subjects will also be informed, particularly if the breach poses a high risk to their rights and freedoms.

11. Data Subject Rights

As the data controller, clubs are responsible for managing data subject requests in accordance with GDPR and Swiss nFADP. These rights include:

• The right to access personal data.
• The right to correct inaccuracies in personal data.
• The right to request deletion of personal data.
• The right to restrict or object to the processing of personal data.

If you wish to exercise any of these rights, please contact the respective client directly.

12. Data Retention

Personal data is retained in our system for as long as necessary to fulfill the purpose for which it was collected, or as required by law. Upon termination of service with a client, all data is securely deleted. Our clients may also delete individual users or reservations at any time.

13. Client Access and Responsibility

Clients using our platform have the ability to assign internal users (such as staff members) with access to manage and view personal data. It is the responsibility of the club, as the data controller, to manage and monitor staff access and ensure that internal users comply with the applicable data protection laws and this policy.

14. Data Transfers

Data processed via our platform may be transferred to countries outside of Switzerland or the EEA. When this occurs, we ensure that appropriate safeguards, such as Standard Contractual Clauses, are in place to protect the data in compliance with GDPR and Swiss nFADP.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable laws. Updates will be posted on this page, and we encourage our clients and users to review this policy periodically.

If you have any questions or concerns regarding this policy, please contact us at info@nunight.com.