Privacy Policy

Responsible entity

Scope

This privacy policy applies to the use of the website mettmi.ticketova.com and to the online purchase of tickets and season passes. It describes which personal data is collected in this context, for what purpose and to whom it is disclosed.

Data collected

When visiting the website

When the website is accessed, technical data is automatically collected: IP address, browser type, operating system, pages visited, date and time of access. This data is required for the technical operation and security of the website.

When purchasing day tickets

Email address, payment information (processed by Stripe, not stored locally) and booking details (ticket type, date, quantity, price).

When purchasing season passes

In addition to the above: first name, last name, date of birth and a photo. The photo is used exclusively for identification and abuse prevention and is deleted after the end of the season plus a reasonable retention period.

When using a partner code

When a partner code is redeemed, the name, date of birth, email address and the partner code used are shared with the respective partner. This is necessary to verify eligibility for the discount. The partner is independently responsible for the data processing carried out.

Resident tariff

When purchasing a discounted resident day or season pass, your first name, last name, date of birth and address (street, house number, postal code and city) are collected and forwarded to Gemeinde Mettmenstetten for residency verification. Your IP address is transmitted together with the data to prevent misuse.

On site (POS & scanner)

At the POS terminals and scanning machines, scan timestamps and ticket validation data are recorded.

Purpose of data processing

Personal data is processed for contract fulfilment (ticket sales, booking management, payment processing), creation and validation of day and season passes, sending confirmation and informational emails, residency verification for the resident tariff (carried out by Gemeinde Mettmenstetten), verification of partner discounts, improvement of services and offerings, creation of anonymised statistics and analyses, and ensuring the technical operation and security of the website.

Legal basis

Data is processed on the basis of contract fulfilment (ticket purchase), consent (communication via third-party channels, marketing) and legitimate interests (operation and security of the website, abuse prevention, improvement of services, statistical analyses). Under Swiss law, data processing is permissible provided it does not unlawfully violate personal rights (Art. 30 ff. DPA).

Disclosure to third parties

TICKETOVA

TICKETOVA (ticketova.com) operates the ticketing platform as a processor (Art. 9 DPA). Data is hosted in Switzerland.

Stripe

Payment processing is carried out by Stripe (stripe.com). No access to payment data exists. Stripe's privacy policy applies.

Partners

When a partner code is redeemed, the data necessary for eligibility verification is shared with the respective partner (see above). The partner is independently responsible for the data processing carried out.

Authorities

In cases provided for by law, data is disclosed to authorities.

Data transfer abroad

Data is generally stored in Switzerland. Through the use of Stripe and optionally WhatsApp, data may be transferred to the EEA (Ireland) and the USA. These transfers are safeguarded by the Swiss-U.S. Data Privacy Framework and/or Standard Contractual Clauses pursuant to Art. 16 para. 2 lit. d DPA.

Cookies

This website uses only technically necessary cookies (e.g. shopping cart, language setting). No tracking or advertising cookies are used. Separate consent is therefore not required.

Retention period

Booking and invoice data is retained for 10 years in accordance with the statutory retention obligation (Art. 958f CO). Correspondence and enquiries are retained for up to 3 years. Season pass photos are deleted after the end of the season plus a reasonable retention period. Data is otherwise retained for as long as there is a legitimate interest in its retention or a legal obligation requires it.

Data security

Appropriate technical and organisational measures are taken to protect the data, in particular TLS/SSL encryption of all data transmissions, encrypted storage of sensitive data, role-based access controls, regular backups and hosting in Switzerland.

Data subject rights

There is a right to access stored data (Art. 25 DPA), to rectification of inaccurate data (Art. 32 DPA), to deletion of data, to receive data in a commonly used format (data portability, Art. 28 DPA) and the right to withdraw consent at any time.

Marketing & communication

Promotional messages (e.g. by email, SMS or other channels) are only sent with express consent. Every promotional message contains an option to unsubscribe. Consent can be withdrawn at any time.

Changes

This privacy policy may be amended at any time. The current version is always available on this website. Last updated: 01.04.2026.