Data protection

1. General Information

The Association for the 2027 Swiss Folk Music Festival in Altstätten, CH-9450 Altstätten SG (hereinafter referred to asthe “Organizer”or“we”) organizes and hosts the 2027 Swiss Folk Music Festival (hereinafter referred to as“EVMF”).

The EVMF collects and processes personal data about you. In this Privacy Policy, we describe what we do with your data when you use our website (https://www.altstaetten27.ch/) or our WhatsApp channel, participate in our event, communicate with us, or otherwise interact with us.

If necessary, we will inform you in a timely written notice of any additional processing activities not mentioned in this Privacy Policy. In addition, we may inform you separately about the processing of your data, e.g., in consent forms, contract terms, additional privacy policies, forms, and notices.

2. Categories of Data

We process various categories of data about you, including current information and, where applicable, past information if any details change. The most important categories are as follows:

Master and Contract Data: By “master and contract data,” we mean the data we need to manage our contractual and other business relationships or for marketing and advertising purposes, such as name, address, date of birth, phone number, and email address, as well as payment information. The payment data we collect is the payment method you have selected. If you paid by credit card, we collect only the expiration date and the last few digits of the credit card number.
Communication Data: When you contact us via the contact form, by email, phone, mail, or other means of communication, we collect the data exchanged between you and us, including your contact information and the details of the communication.
Photos and Videos: We will be taking videos and photos throughout the 2027 Swiss Folk Music Festival. Please be aware that you may be recognizable in these photos and videos if you attend the Swiss Folk Music Festival in Altstätten.
Technical Data: When you visit our website, we collect technical data such as your IP address, device information, browser type, date and time of access, and usage data. This data is used primarily to ensure the security, stability, and optimization of our online services.

3. Purposes of Processing

3.1 Conclusion and Performance of the Contract

When you purchase a ticket for the EVMF or sign up for the “WhatsApp channel,” we collect all the data we need to enter into and fulfill the contract. This includes, in particular, your personal and contract information.

We collect this data regardless of whether you purchase the ticket through our website or through one of our selected contractual partners (e.g., Starticket). Our contractual partners provide us with your data so that we can fulfill the contract with you. We do not receive any personal data from individual contractual partners, but only a ticket code that allows us to identify the ticket upon entry to the festival. For further information, please refer to the privacy policy of the contractual partner through whom you purchase the tickets.

We process your data—in particular your master data and contract data—for the purpose of organizing the festival. The data is processed primarily for security and access control purposes at the festival.

3.2 Communication

We process your data in connection with our communication with you, in particular to respond to inquiries and to facilitate the exercise of your rights (Section 12), and to contact you if we have any questions. For this purpose, we use, in particular, communication data and master data.

3.3 Photography and Video Notice

We will be taking videos and photographs during the 2027 Swiss Folk Music Festival as well as at pre-event activities. Please be aware that you may be recognizable in these photos and videos if you attend our events. These recordings will be used to document and promote our event. The recordings may be used in various media, such as print media (e.g., flyers), electronic media (e.g., website, social media), and for internal communication purposes (e.g., presentations). If you do not wish to be photographed or filmed, please inform the photographer or camera crew directly on site.

You also have the right to request the removal of a photo or video at a later date if you find it on our website or in other media and do not consent to its publication. Please contact the responsible parties for such requests. We will make every effort to remove the content from the Internet promptly, to the extent that this is technically possible and legally permissible.

Please note that once photos and videos are posted online, they can be viewed by third parties and potentially reused without your consent. Despite all technical precautions, it cannot be completely ruled out that such content may be edited or shared without authorization. The EVMF 2027 assumes no liability for such actions by third parties.

3.4 Newsletter

If you subscribe to the newsletter through our website, we will collect your first and last name as well as your email address. The newsletter contains the latest information about EVMF as well as advertisements for our products and services, and also for offers from third parties (e.g., advertising partners). You can unsubscribe from the newsletter at any time.

4. Services in Use

4.1 Hosting and CDN

Webflow (Webflow Inc., San Francisco, USA): Website creation and hosting; collects log files and security data; sets necessary cookies.
Cloudflare / pages.dev (Cloudflare Inc., San Francisco, USA): CDN, DDoS protection, DNS, hosting. Processes technical connection data and may set security cookies.
Amazon CloudFront CDN (Amazon Web Services EMEA SARL, Luxembourg): global delivery; processes technical connection data.
unpkg (UNPKG.com, USA): Delivery of script and CSS files via CDN; technical connection data; no profiling.
jsDelivr (jsDelivr / Volentio JSD Limited): Delivery of static web files via CDN, technical connection data, no profiling.

4.2 Consent Management

Cookiebot (Usercentrics A/S, Copenhagen, Denmark): Manages consent; stores the user's decision and an anonymous ID in a cookie.

4.3 Tagging and Analysis Tools

Google Tag Manager (Google Ireland Ltd., Dublin): Tag management; no proprietary tracking profiles. Technical data such as IP addresses may be transmitted. The service is used to control other scripts.
Google Analytics (Google Ireland Ltd.): Audience measurement, cookies and similar technologies, pseudonymous user profiles, IP anonymization enabled. Used only with consent (consent banner).

4.4 Communication and Forms

Email and Phone: Once you contact us, we will store and process your information to handle your inquiry.
useBasin (Basin Inc., USA): Processes contact forms and transmits form data to us. Data is stored and processed on servers in the United States in accordance with standard contractual clauses.
WhatsApp Business (WhatsApp Ireland Ltd., Dublin): End-to-end encryption for content; metadata is collected. Please review WhatsApp's Terms of Service.
cal.com (Cal.com Inc., USA): Scheduling; processes contact and appointment data. Data is transmitted only when a booking is active. Data is stored on servers in the EU or the U.S.

4.5 Bot Protection

hCaptcha (Intuition Machines Inc., Los Angeles, USA): Protects against abuse and spam; analyzes user interactions. The service may be automatically enabled on certain subpages.

5. Cookies and Similar Technologies

What We Use

We use essential cookies for site operation, security, and settings. These are permitted without consent. We only use analytics and marketing cookies with your consent. You can manage your preferences in the cookie banner and in the footer under "Cookie Settings."

Legal Situation in Switzerland

In Switzerland, for non-personal cookies, providing information and an opt-out option is sufficient. We require consent for analytics purposes to increase transparency and comply with EU regulations.

Withdrawal

You can withdraw your consent at any time. Delete cookies in your browser or change your selections in the cookie settings.

6. Google Analytics

We use Google Analytics on our website. The provider of the “Google Analytics” service is Google LLC. For the purposes of the DSG, Google Ireland Ltd. is the data controller (both “Google”). Google uses performance cookies (see above) to track visitor behavior on our website (duration, frequency of page views, geographic origin of access, etc.) and, based on this data, generates reports for us on the use of our website. We have configured the service so that visitors’ IP addresses are truncated by Google in Europe before being transmitted to the U.S., thereby preventing them from being traced. Google provides us with reports and can therefore be considered our data processor; however, it also processes data for its own purposes. Under certain circumstances, Google may use the collected data to infer the identity of visitors, create personal profiles, and link this data to these individuals’ Google accounts. You should assume that this processing will occur if you consent to the use of performance cookies.

You can find information on Google Analytics’ privacy policy here [https://support.google.com/analytics/answer/6004245], and if you have a Google account, you can find further details on Google’s processing practices here [https://policies.google.com/technologies/partner-sites?hl=de].

7. Social Media

On our website, we provide links to our profiles (company pages) on Facebook, Instagram, and LinkedIn (“social networks”). For information on the purpose and scope of data collection, as well as the further processing and use of data by the social networks, and your rights and settings options in this regard, please refer to the privacy policies of the respective social networks.

Certain pages of our websites also contain social plugins, such as Facebook’s “Like” button (hereinafter “plugins”). The plugins are identified by a logo or a text label. When you visit a page on our websites that contains such a plugin, your browser establishes a direct connection to the networks’ servers. The content of the plugin is transmitted directly from the social networks to your browser and integrated into the website by your browser. If you are logged in to one of these social networks, it is possible that the social network will associate your visit with your account on that network. When you interact with the plugins, the corresponding information is transmitted from your browser to the social networks. The social networks then associate this information with your account on their respective platforms. For information on the purpose and scope of data collection, as well as the further processing and use of the data by the social networks and your options in this regard, please refer to the privacy policies of the respective social networks.

8. WhatsApp

When using WhatsApp, WhatsApp’s privacy policy also applies. It cannot be ruled out that data may be transferred to countries outside Switzerland and the EU in the process.

9. Disclosure of Data

In connection with our contracts, the website, our services and products, our legal obligations, or otherwise to protect our legitimate interests and for the other purposes listed in Section 5, we also transfer your personal data to third parties, in particular to the following categories of recipients:

Service Providers: We work with service providers in Germany and abroad who process data about you on our behalf or under joint responsibility with us, or who receive data about you from us under their own responsibility (e.g., IT providers and advertising service providers).

When transferring data to countries that do not have an adequate level of data protection, we rely in particular on the standard contractual clauses recognized by the European Commission or other legally permissible safeguards.

Contract Partners: We provide our contract partners with marketing materials, which they distribute through their own advertising channels. These marketing materials include photos and videos taken during the festival.

Government Agencies: We may disclose personal data to government agencies, courts, and other authorities in Germany and abroad if we are legally obligated or authorized to do so, or if it appears necessary to protect our interests.

These data recipients are not located solely in Switzerland. Your data may therefore also be processed in Europe; in exceptional cases, however, it may be processed in any country in the world.

If a recipient is located in a country without adequate legal data protection, we contractually require the recipient to comply with data protection requirements, unless the recipient is already subject to a legally recognized framework for ensuring data protection and we cannot rely on an exception.

10. Retention Period and Deletion

We process your data for as long as required by our processing purposes, the statutory retention periods, and our legitimate interests in processing for documentation and evidentiary purposes, or as long as storage is technically necessary.

Unless there are any legal or contractual obligations to the contrary, we will delete or anonymize your data after the retention or processing period has expired as part of our standard procedures.

11. Data Security

We take appropriate organizational and technical measures to safeguard the confidentiality, integrity, and availability of your personal data and to protect it from tampering, loss, destruction, or unauthorized processing. These measures—such as TLS encryption, access restrictions, backups, and logging—are reviewed on a regular basis.

12. Rights of Data Subjects

You have the following rights with respect to the organizer:

the right to request information from us regarding whether we process your data and, if so, what data we process;
the right to have data corrected if it is inaccurate;
the right to request the erasure of data;
the right to request that we provide you with certain personal data in a commonly used electronic format or transfer it to another data controller;
the right to withdraw consent, to the extent that our processing is based on your consent.

Please submit a written request to the contact address below, enclosing a copy of an official identification document.

13. Contact

If you have any questions or requests, please contact us in writing at the following address:

Association for the 2027 Swiss Folk Music Festival
Data Protection Officer
CH-9450 Altstätten SG
info@altstaetten27.ch

14. Changes

We reserve the right to change this Privacy Policy at any time. Changes will be published on our websites and will take effect as soon as they are posted.

Altstätten, June 2026