Privacy

Unexpected Fall
c/o Bob Mendler
Birkenweg 6, CH-3374 Wangenried, Switzerland
info@unexpectedfall.ch

Unexpected Fall is a music group without a registered legal form. The band members Marco Ryf, Sascha von Arx, Holger Neu and Bob Mendler are responsible for the processing. For any privacy question or to exercise your rights, contact us at info@unexpectedfall.ch.

The Swiss Federal Act on Data Protection (FADP) governs this website. Where the EU General Data Protection Regulation (GDPR) applies to visitors from the EU or EEA, we rely on the following legal bases:

• Contract or pre-contractual steps (Art. 6(1)(b) GDPR) – booking inquiries, access to the organizer area
• Consent (Art. 6(1)(a) GDPR) – external media and visit statistics, including campaign details
• Legitimate interest (Art. 6(1)(f) GDPR) – answering general messages and emails, secure operation of the website, and abuse prevention

We do not make automated individual decisions and do not build advertising profiles.

The website is hosted in Switzerland by Infomaniak Network SA. Each request causes the server to process technically necessary data: IP address, time, requested address, referrer, browser, and operating system. These server logs are used for operation, troubleshooting, and defense against attacks, and are deleted automatically when the host’s retention period ends.

To protect the forms from abuse, the IP address is also briefly held in server memory to limit the number of requests per time window. Fonts and images on the website are served from our own server.

When you use the contact or booking form, we process the details you enter – for the contact form your name, email address, subject, and message; for the booking form the organizer, contact person, email address and/or phone number, preferred contact method, venue and town, date or period, and message. We also store the language, time, IP address, and browser details to detect abuse. We need the required fields to handle your inquiry; the form cannot be sent without them. There is no legal obligation to provide them.

The inquiry is stored in our database on the server in Switzerland and you receive a reference number. We receive an email notification and you normally receive an acknowledgement at the address you provided, if you provided an email address. These emails are sent via Resend. An acknowledgement does not confirm a booking.

If you have allowed visit statistics, we keep the campaign details from the link (utm_source, utm_medium, utm_campaign, utm_content, utm_term) and the name of the website you came from for the current session. These details are sent with a contact or booking inquiry and stored with it so we can see where inquiries come from.

If you email us directly at info@unexpectedfall.ch, your message is stored in our mailbox at Infomaniak in Switzerland and used to reply.

To protect the forms from automated spam, we use Cloudflare Turnstile. On the contact and booking pages your browser loads a script from Cloudflare that evaluates technical characteristics such as your IP address and browser and device details to detect bots. The result of the check is sent with the form to our server and confirmed with Cloudflare there. Cloudflare also uses these characteristics under its own responsibility to improve bot detection. The legal basis is our legitimate interest in preventing abuse (Art. 6(1)(f) GDPR). The form cannot be sent without this check; you can email us directly at info@unexpectedfall.ch instead. Details: Cloudflare Turnstile privacy addendum.

YouTube videos (via youtube-nocookie.com) and the 30-second Spotify previews on the music and lyrics pages load only once you allow external media – in the cookie banner, on the cookie page, or directly at the video or preview. Video thumbnails are served from our own server, so your browser does not contact YouTube for them. After your consent, YouTube (Google) or Spotify receive technical data such as your IP address and browser details; YouTube may also use its own storage technologies in the player. Details: Google privacy policy, Spotify privacy policy.

You can withdraw consent at any time with effect for the future. Ordinary links to Spotify, Apple Music, YouTube, Instagram, Facebook, ticket sellers, or other websites only transfer data to those providers once you follow them.

If you allow visit statistics, the website loads Cloudflare Web Analytics. The service counts page views and referrers and, according to Cloudflare, sets no cookies and builds no profiles of individual visitors. Details: Cloudflare privacy policy.

There are no advertising, retargeting, or social media pixels.

In your browser we store only what the website’s functions need (language, your consent choice, display preferences) and – with consent – campaign details. In maintenance mode the server sets a time-limited access cookie. See Cookies & storage for the full list.

When you enter an access code in the organizer area, the server sets a strictly necessary, signed session cookie (uf_veranstalter, HttpOnly, only for the organizer area, at the longest until the code expires, and at most 7 days for a code without an expiry date). For each code we keep a label (for example the organizer or event), the date, the validity, the areas it opens, an internal note, the number of sign-ins and the time of last use, and the show-day details (status, position on the bill, times, name and phone number of the band contact). We store the code as a check value and also in encrypted form so that we can show it again if needed; we delete the encrypted copy 30 days after the code was revoked or expired. Sign-ins, sign-outs and failed attempts are logged with IP address and browser details to prevent abuse, and these entries are deleted after 90 days.

When you answer the questions about the show in the organizer area, we store your answers and comments, the details on load-in, parking, settlement and sound level (for example the name and phone number of a contact person) and, if you give one, an email address for our replies. We get a notification by email. Our replies appear on the page and go to that address via Resend.

We share personal data with service providers that process it for the purposes described, and we do not sell data. YouTube (Google) and Spotify receive data only after your consent and also process it for their own purposes under their own responsibility. Some providers process data outside Switzerland. No further safeguards are needed for countries on the Federal Council list (Annex 1 of the Data Protection Ordinance, DPO); this includes US companies certified under the Swiss–US Data Privacy Framework. In other cases we rely on standard contractual clauses. This does not apply to YouTube (Google) and Spotify: we have no contract of our own with them, and they rely on their own safeguards (see the table). You can obtain a copy of our standard contractual clauses by writing to info@unexpectedfall.ch.

We keep personal data only as long as needed for the relevant purpose:

• Contact and booking inquiries: 24 months after the last activity, after which they are deleted automatically with their messages and notes. If you ask for deletion, the band deletes the inquiry sooner; it can then still be restored for 30 days and is deleted for good after that.
• Access codes for the organizer area: for as long as cooperation or follow-up correspondence can be expected. There is no automatic deletion period; we delete them manually when they are no longer needed or when you ask us to.
• Answers in the organizer area and the email address for them: one year after the code’s last valid day, after which they are deleted automatically; earlier together with the code.
• The IP address and browser details of an inquiry and the sign-in log of the organizer area: 90 days, after which they are deleted automatically.
• Administration area log (actions and sign-in attempts with the time, IP address, browser details and, if signed in, the person’s email address; for access codes also their label, for inquiries the reference number, also after the inquiry is deleted, for invitations and test emails the recipient’s address): one year in the database and two years in a log file on the server, after which the entries are deleted automatically. Sign-in sessions in the administration area (IP address and browser details): up to 30 days after they end.
• Emails to us: as long as they are needed for the reply or an ongoing cooperation. There is no automatic deletion period. They stay in the mailbox at Infomaniak.
• Emails sent via Resend: as long as our contract with Resend is active; after the account is closed, Resend deletes the data within 90 days.
• Server logs: according to the host’s automatic deletion period.
• Browser settings: until you clear them; campaign details only for the current session.

Backups of the database, uploaded files and this log are kept on our server at Infomaniak in Switzerland. Daily backups are deleted automatically after about two weeks. Before website updates we also create a database backup; the five newest of these are kept. Encrypted copies are also kept away from the server at Backblaze B2 in the Netherlands: daily copies of the database for about 37 days, weekly copies of the uploaded files and the log for about 35 days, and monthly copies of the database for about 372 days. They are encrypted on our server before they leave it, and we manage the key ourselves. Deleted data may remain in backups until those are deleted.

Within the limits of applicable law, you have the right in particular to:

• access the personal data we process about you
• have incorrect data corrected
• have your data deleted unless a retention duty applies
• receive your data or have it transferred in a common electronic format
• object to processing and – under the GDPR – have processing restricted
• withdraw consent with effect for the future

To do so, write to info@unexpectedfall.ch. We may ask for proof of identity so that data is not disclosed to the wrong person.

Right to object: Where we process personal data based on our legitimate interest (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation. To do so, write to info@unexpectedfall.ch.

You can file a report with the Swiss Federal Data Protection and Information Commissioner (FDPIC, Feldeggweg 1, 3003 Bern); the FDPIC decides whether to act. People in the EU or EEA may also contact the data protection authority in their country of residence.

The website is served exclusively over encrypted connections (HTTPS). Form input is validated and size-limited, and the administration area is accessible only to people authorized by the band. No online system offers absolute security. We update this policy when the website or the services we use change; the version published here applies.