Privacy policy

1. Data controller

ARTBOX.GROUPS GmbH
Schmidgasse 4
6300 Zug
Switzerland

Email: office@swissartexpo.com
Phone: +41 41 539 19 22

For questions about data protection or to exercise your rights, you can contact the address above at any time.

2. Principles

We process personal data in good faith, lawfully and proportionately. We collect only the data required for the respective purposes and keep it only as long as necessary for those purposes or by legal obligation.

3. What data we process and for what purpose

3.1 Visiting the website (server log files)

When you visit our website, our hosting provider automatically records technical data transmitted by your browser (in particular IP address, date and time of access, page requested, browser type and operating system). This data serves the secure and stable operation of the website and the prevention of abuse. We do not combine this data with other sources to identify individual persons.

3.2 Contact form and email contact

If you contact us via the contact form or by email, we process the data you provide (e.g. name, email address, message) in order to answer your enquiry. This data is processed through our email service (Microsoft 365).

3.3 Exhibitor registration and exhibitor area

As part of the application as an exhibitor and the use of the exhibitor area, we process the data you provide: name and artist name, contact details and address, the submitted works with images, titles, dimensions and prices, booking and invoicing details, hanging plans and labels, uploaded documents, and any discount codes issued in your name. This data is used to carry out the application and participation process, to organise the exhibition and for billing. Information about your participation — such as your name, your artist name and exhibited works — becomes publicly visible in the context of the exhibition and its promotion.

3.4 Events and tickets

For registration to events (e.g. artists' apéro, ART PARTY, Meet the Artist) and the issuing of tickets we process the necessary details, where applicable also about registered accompanying persons.

3.5 Payments

Payments are handled by the payment service provider Stripe. You enter the payment data (e.g. card details) directly with Stripe; we do not store complete payment means data ourselves. Stripe's privacy policy applies in addition. For invoicing and accounting we use Bexio; we transmit the details required for invoices there, such as name, address, line items and amounts.

3.6 Newsletter

If you subscribe to our newsletter, we process your email address in order to send you information about SWISSARTEXPO. Dispatch takes place via Mailchimp. You can unsubscribe at any time using the link in every newsletter email or by informing us; we will then delete your address from the distribution list.

3.7 Live chat (Frizzy)

A chat is available on our website. The answers are generated by a language model from the provider Anthropic; in its first sentence the chat states that it is an artificial intelligence. Your questions are transmitted to Anthropic in order to generate the answer and are stored by us: the conversation, the language, the page you asked from, and the time. According to Anthropic, content submitted through the interface is not used to train its models. Conversations are deleted automatically after 90 days. We also receive every completed conversation as a transcript by email so that we can check and improve the answers. If the chat cannot answer a question, you can have it forwarded to our team; for this we ask for your first name, last name and email address, and the conversation is sent to our mailbox together with these details. If you are logged in to the exhibitor area, the chat may use information about your own participation; it does not receive other people's data. Please do not enter sensitive personal data or payment data into the chat.

3.8 Applications for advertised positions

If you apply for an advertised position, an internship or a helper assignment, we process the details from the application form (first and last name, email address, telephone number, address, date of birth, what you tell us about yourself) as well as the documents you upload, such as a CV and references. This data is used to assess your application and to communicate with you. The documents are kept in a non-public storage area; only the people involved in the selection process have access. Once the process is complete we delete the application, unless we agree otherwise with you or an employment relationship comes about.

3.9 Employees, interns and helpers

If an employment relationship, an internship or a helper assignment comes about, we process the personnel and payroll data required for it: address, date of birth, social security number, bank details (IBAN), information on the assignment and working hours, and the signed contract. The basis is the employment or assignment contract and the fulfilment of legal obligations relating to social insurance, taxes and accounting. This information is processed exclusively on the server, the contracts are stored in a non-public storage area, and only those people who need them for these tasks have access. Retention follows the statutory periods.

3.10 Visit statistics

We keep our own simple statistics on the use of the website. For each page view we store: the page visited and its title, the language, the referring page, any campaign parameters (utm_…), the type of device, the browser and operating-system type, and the country that our hosting provider derives from the IP address. In addition there is an identifier calculated with a secret key from the IP address, the browser identification and the date; it changes daily and is not combined with any other data source. We do not store the IP address itself, and we do not use cookies for this. The statistics run on our own infrastructure and help us understand which content is being used.

3.11 Internal notes on past collaborations

For individual people with whom a past collaboration did not go well, we keep an internal note with the name, possibly the email address, and a short, factual reason. When a new application arrives, a corresponding note appears in our internal administration. This note does not lead to any automatic rejection: every application is decided by people. The notes can only be viewed internally and are not passed on. You can request information about them and ask for a note to be corrected or deleted.

3.12 Invitations to past exhibitors

Anyone who exhibited at a previous edition receives a personal invitation to the next one. For this we process name and email address and generate a discount code issued in that person's name. We record whether the link in the invitation was clicked and whether the code was redeemed, so that we know whether the invitation reached its recipient. We store neither the IP address nor any device identifier, we set no cookies, and we do not measure whether the email was opened. You can object to receiving these invitations at any time, informally; we will then no longer write to you.

3.13 Survey after the exhibition

After each edition we ask the exhibitors for feedback. The invitation is sent by email and contains a personal link. Your answers are therefore attributed to you — this is also stated in the invitation: anyone who tells us that something was wrong should be able to receive an answer. For this we process your name, your email address and your answers. Participation is voluntary; if you do not answer, this has no consequences whatsoever for future applications. You can change your answers at any time or request their deletion.

4. Embedded third-party services

On individual pages we embed third-party content. It is NOT loaded automatically: you first see a notice and decide with a click whether the content should load. Only then does the respective provider receive your IP address and can set or read cookies. Your decision is stored in your browser, separately for each provider; you can clear it by removing the site data in your browser.

• Google Maps (Google Ireland Ltd. / Google LLC) — map display on the home page
• Matterport — virtual 360° tours on the “Virtual Tour” page
• YouTube (Google Ireland Ltd. / Google LLC) – embedded videos on the sponsoring page
• Instagram / Meta (Meta Platforms Ireland Ltd.) – link to our profile in the footer of the website. Data is only transmitted once you click the link.

The privacy policies of the respective providers apply in addition to these services.

5. Cookies and consent

Our website uses technically necessary cookies that are required for operation and do not need consent: the chosen language and, in the logged-in exhibitor area, session management. We do not set any other cookies.

We do not use a cookie banner — it would not be necessary for our own processing and not sufficient for the embedded content. Instead, that content only loads when you expressly ask for it (see section 4). You can also manage, block and delete cookies in your browser at any time.

We do not use third-party analytics or tracking tools. Our own visit statistics are described under section 3.10; they work without cookies.

6. Processors and service providers

To provide our services we use carefully selected service providers who process data on our behalf:

• Vercel — hosting/operation of the website
• Supabase — database, authentication and file storage
• Stripe — payment processing
• Microsoft (Microsoft 365) — email communication
• Mailchimp — newsletter dispatch
• Anthropic – language model for the live chat
• Bexio – accounting and invoicing

7. Disclosure of data abroad

Some of the service providers named have their registered office or server locations abroad, including in the USA — this concerns in particular Stripe, Vercel, Supabase, Microsoft, Mailchimp and Anthropic. Where data is transferred to countries without an equivalent level of data protection, we ensure appropriate protection through suitable safeguards (e.g. standard contractual clauses).

8. Retention period

We retain personal data only for as long as is necessary for the respective purposes or as statutory retention periods require. In detail: chat conversations are deleted automatically 90 days after the conversation. Accounting-relevant documents — in particular invoices, payments and contracts — are kept for ten years. Job application documents are deleted once the process is complete, unless we agree otherwise with you. Exhibitor data is kept for the duration of participation and beyond for as long as we need it for processing, proof and future editions. The data is then deleted or anonymised.

9. Data security

We take appropriate technical and organisational measures to protect your data against loss, misuse and unauthorised access. However, transmission over the internet can never be completely secure.

10. Your rights

Within the framework of the applicable laws you have the right to:

• information about the data processed about you
• rectification of incorrect data
• erasure of your data
• restriction of processing and objection to processing
• data portability (where applicable)
• withdrawal of a consent given, with effect for the future

To exercise these rights, a message to the contact address given in section 1 is sufficient. You also have the right to complain to the competent supervisory authority — in Switzerland to the Federal Data Protection and Information Commissioner (FDPIC), within the scope of the GDPR to the respective competent data protection authority.

11. Amendments

We may amend this privacy policy at any time. The version published on this website at the relevant time applies.