Privacy policy

1. Who is responsible

The controller of your personal data is the Art & Creativity Consortium (ACC), a non-profit association (Verein) under Articles 60 ff. of the Swiss Civil Code, with its seat in Lugano, Ticino, Switzerland. You can reach us through the contact form. We process personal data in line with the Swiss Federal Act on Data Protection (FADP) and, where it applies to you, the EU General Data Protection Regulation (GDPR).

2. What data we process and why

Visiting this website. Our web server records technical data when you visit, such as your IP address, the date and time, the pages requested, and your browser and device type. We use it to deliver the site, keep it secure and fix errors. We do not use analytics or advertising trackers on this website.

Contact form. If you write to us through the contact form, we receive your name, email address, subject and message. We use them to read and answer your message.

Volunteer applications. If you apply through the volunteer form, we receive your name, email address, the position you apply for, your optional message, and the file you upload (for example a CV or portfolio). We use them to assess your application and to contact you about it.

Spam protection. Our forms use Google reCAPTCHA v3 to tell people from automated programs. It runs in the background and may collect data such as your IP address and information about your browser and how you use the page. Google processes this data under its own privacy policy and terms.

3. Emails we receive and send

Form submissions reach us as emails. This is how it works:

• Received by us. Each submission is sent by email to a mailbox of the ACC. It includes everything you entered in the form, and for volunteer applications your uploaded file as an attachment.
• Sent to you. After you submit a form you receive an automatic confirmation email from a no-reply address. It includes a copy of your message. Replies to this address are not read.
• How emails are sent. The website sends these emails through our Google Workspace account, using the Gmail connection set up for the site. Our mailboxes are hosted by Google, so the content of these emails is stored and processed on Google’s systems.
• Website email log. The website keeps a technical log of the emails it sends, including the recipient, subject and content, to detect delivery problems. Log entries are deleted automatically after 14 days.
• No storage on the website. The website does not keep a copy of form submissions in its database. Uploaded files are held temporarily on the server while the email is sent and then removed.
• Emails you write to us directly. If you write to one of our email addresses, we process your address, your message and any attachments to answer it.

4. Legal basis

We process your data to answer your requests and to handle your application, which is needed to take steps at your request. We also process technical data and use spam protection because we have a legitimate interest in running a secure website and in protecting it from abuse. Where we rely on consent, you can withdraw it at any time.

5. Who receives your data

Your data is accessed only by the people at the ACC who need it to answer you or to assess your application. We use the following service providers, who process data on our behalf or under their own terms: Google (email hosting through Google Workspace, and reCAPTCHA) and our web hosting provider. We do not sell your data and we do not pass it on for advertising.

6. Transfers abroad

Google may process data outside Switzerland and the EU, including in the United States. Where this happens, it relies on recognised safeguards such as an adequacy decision or standard contractual clauses.

7. How long we keep data

We keep emails and messages as long as we need them to deal with your request, and afterwards only as long as the law or a legitimate interest requires. We keep volunteer applications while the position is open or may become available again, and delete them when you ask us to. Server logs are kept for a short period for security reasons.

8. Cookies

This website uses only the technical cookies it needs to work. We do not set analytics or advertising cookies. Google reCAPTCHA may set its own technical cookies or read information from your browser to detect abuse.

9. Your rights

You have the right to ask us for access to your data, to have it corrected or deleted, to restrict or object to its processing, and to receive it in a common format. If the GDPR applies to you, you may also lodge a complaint with your local data protection authority. In Switzerland, you can contact the Federal Data Protection and Information Commissioner (FDPIC). To exercise your rights, write to us through the contact form and tell us which data and request concern you.

10. Changes

We may update this policy when our website or our practices change. The date at the top shows when it was last changed.