Privacy Policy

The Logout Neuchâtel Association is an association under Swiss law active in prevention, education and awareness-raising about the risks associated with digital use, digital health and the digital transition.

This policy explains how we collect, use, disclose, store and protect personal data in connection with:

• visits to our institutional website;
• contact and partnership requests;
• relations with institutions, funders and organisations;
• the management of members and membership fees;
• the organisation of events and activities;
• registrations, payments and administrative communications;
• the prevention and support activities offered by the Association.

The Logout Drive educational platform has a separate privacy policy describing the processing specific to its operation.

We seek to apply the following principles:

• Minimisation: collect only the data necessary for the purposes pursued.
• Transparency: explain the processing and the recipients concerned.
• Security: implement technical and organisational measures appropriate to the risks.
• Storage limitation: do not keep data longer than necessary, subject to legal obligations.
• Confidentiality: limit access to data to authorised persons who need it.
• No commercialisation: we neither sell nor rent personal data.

Our aim is not to exploit personal data for behavioural advertising purposes. Any technical and analytical processing is described in the corresponding sections.

We process personal data in accordance with the Swiss Federal Act on Data Protection (FADP, SR 235.1) and its implementing ordinance (DPO, SR 235.11).

The European Union's General Data Protection Regulation (GDPR) applies where the conditions of its territorial scope are met.

Other provisions may apply depending on the nature of the service concerned, the persons involved and the circumstances of the processing.

The Association's non-profit status and the preventive purpose of its activities do not, in themselves, exempt it from complying with applicable legal obligations.

The data processed depends on your relationship with the Association and the services used.

We process personal data for the following purposes:

• Operating, maintaining and securing our website.
• Responding to requests and following up on exchanges.
• Organising events, activities and registrations.
• Managing memberships, membership fees and relations with members.
• Managing partnerships, funding requests and institutional relations.
• Processing payments when a payment service is used.
• Sending administrative communications related to activities.
• Complying with applicable legal and accounting obligations.
• Preventing abuse, handling incidents and defending the Association's rights where necessary.
• Evaluating prevention activities where such evaluation is justified and carried out in accordance with applicable requirements.

We do not use personal data for purposes incompatible with those stated without first examining the applicable legal requirements.

In Switzerland, processing is subject to the requirements of the FADP, which does not exactly mirror the general structure of legal bases under the GDPR.

Where the GDPR applies, the legal basis is determined according to the purpose and circumstances of the processing. It may in particular be:

• the consent of the data subject;
• the need to take pre-contractual steps or to perform a contract;
• compliance with a legal obligation;
• the legitimate interest of the Association, after weighing the rights and interests concerned;
• another legal basis applicable to the processing concerned.

Where processing is based on consent, consent may be withdrawn under the conditions provided by law. Withdrawal does not affect the lawfulness of processing carried out before it.

Our website may use cookies and similar technologies necessary for its operation, for security or for remembering certain preferences.

The website may contain links to external platforms or, depending on the pages and features actually used, embedded content from third-party services.

Opening an external link may result in data being processed by the provider concerned.

Embedded content may also establish a connection with the third-party service as soon as it loads, depending on how it is embedded. That service may then receive technical information, including the IP address and information transmitted by the browser.

When external videos or posts are embedded, we seek to limit unnecessary connections and apply appropriate protective measures.

If you interact with the Association's social media accounts, the processing carried out by the platforms concerned is also subject to their own privacy policies.

We neither sell nor rent personal data.

Where necessary, certain data may be disclosed or made accessible to the following categories of recipients:

• authorised persons within the Association;
• hosting and infrastructure providers;
• email and communications management providers;
• payment providers;
• database providers and associated technical service providers;
• service providers necessary for organising events;
• accounting or administrative service providers;
• the Association’s auditor, for the annual audit of the accounts;
• video-conferencing providers, for online sessions and virtual General Assemblies;
• competent authorities where required by law.

Data may only be disclosed in line with the purposes pursued and the applicable operational or legal needs.

Where a service provider processes data on behalf of the Association, the contractual obligations and safeguards required by applicable law must be put in place.

Some service providers may process or store data outside Switzerland, depending on their infrastructure, their subcontractors and the settings of the service used.

The location of the domain, the DNS or the mailbox is not, on its own, sufficient to determine all the places where data may be processed.

We must identify the countries involved in the actual processing, in particular for hosting, sending emails, payments, databases and audience analytics.

When personal data is disclosed abroad, we apply the requirements of Swiss law and, where the GDPR applies, the corresponding European requirements. Depending on the circumstances, this may require an adequacy decision, appropriate safeguards or reliance on a legal exception.

The recipient countries and applicable safeguards must be specified on the basis of the providers' actual configuration.

We keep personal data for as long as necessary for the purposes pursued, subject to legal obligations and legitimate needs for management or the defence of rights.

Retention periods depend in particular on:

• the nature of the data;
• the purpose of the processing;
• the relationship with the data subject;
• accounting and administrative obligations;
• security needs;
• any retention or evidentiary obligations.

The following criteria apply by category:

• Contact requests: the time needed to handle and follow up on the request, followed by additional retention where justified by an administrative, contractual or legal need.
• Partnerships: the duration of the relationship, plus additional retention where necessary to follow up on commitments.
• Event registrations: the time needed to organise and follow up on the event, subject to accounting obligations or funding reporting requirements.
• Memberships: the duration of the membership, plus the additional periods necessary for administrative, accounting or legal obligations.
• Payments: the time needed to manage the payment and to meet applicable evidentiary, accounting and retention obligations.
• Technical data: a period defined according to security and diagnostic needs and the infrastructure settings.
• Audience analytics data: a period determined by the actual Google Analytics 4 settings and applicable rules.
• Coaching sessions: booking and payment records as for payments; any notes on the content of a session only for as long as necessary for the service, as set out in the coaching agreement.

Precise retention periods must be set and documented in internal procedures. When data is no longer needed, it is deleted or anonymised where appropriate and technically feasible.

We implement technical and organisational measures appropriate to the risks, the nature of the data and the resources available.

These measures may include in particular:

• limiting access to authorised persons;
• protecting accounts and credentials;
• encrypting communications where appropriate;
• managing permissions;
• technical updates;
• monitoring and handling incidents;
• backup measures appropriate to the systems concerned.

No system can guarantee absolute security.

In the event of an incident affecting personal data, we assess the risks and apply the handling and notification obligations provided by applicable law.

When a school, company, foundation, public administration or other organisation organises or funds an activity, certain administrative information may be disclosed to it where necessary and legally justified.

The fact that an organisation funds or organises an activity does not automatically give it access to all the personal information shared by participants.

Where appropriate, information relating to participation in or evaluation of an activity may be shared in aggregated or anonymised form.

Sensitive or confidential personal information must be subject to safeguards appropriate to the nature of the activity and the applicable legal obligations.

Subject to the conditions and limitations provided by applicable law, you may in particular:

• ask whether personal data concerning you is being processed;
• request access to the data and to the information provided for by law;
• request the correction of inaccurate data;
• request the deletion of data where the legal conditions are met;
• object to certain processing where applicable law allows;
• withdraw consent where processing is based on it;
• exercise the other rights recognised by the applicable legal regime.

Data portability and restriction of processing are subject in particular to the conditions laid down by the GDPR where it applies; they must not be presented as identical rights in all situations governed by Swiss law.

The exercise of rights may be subject to exceptions, legal limitations and reasonable identity checks.

For any question or request relating to your personal data, contact:

• Logout Neuchâtel Association
• Rue de Maillefer 34, 2000 Neuchâtel, Switzerland
• Email: privacy@logoutne.ch

We may ask for the information reasonably necessary to verify your identity or your authority to act on behalf of another person.

We respond within the time limits provided by applicable law.

Our website may contain links to websites operated by other organisations.

When you follow an external link, the provider concerned may process your data in accordance with its own terms and privacy policies.

We do not control the independent processing carried out by these providers.

We may amend this policy when our activities, services, service providers, technologies or legal requirements change.

The date of the last update appears at the top of the document.

In the event of a significant change, we will endeavour to inform the persons concerned by appropriate means. Where the law requires specific information or consent, we apply the corresponding requirements.

For any question about this policy or the processing of your personal data:

• Logout Neuchâtel Association
• Rue de Maillefer 34, 2000 Neuchâtel, Switzerland
• Email: privacy@logoutne.ch