Verein Vibes4Future Version: August 2026
1. Data Controller and Data Protection Contact
The controller within the meaning of the General Data Protection Regulation (GDPR) and the Swiss Data Protection Act (revDSG) is:
Verein Vibes4Future Selzweg 11 3422 Kirchberg Canton of Bern, Switzerland UID: CHE-473.750.375 Email: info@vibes4future.org
Data Protection Contact: André Saile (President) Email: privacy@vibes4future.org
2. Applicable Legal Basis
Verein Vibes4Future is based in Switzerland and also provides its services to users in the European Union. Therefore, the following apply concurrently: – the revised Swiss Data Protection Act (revDSG), in effect since September 1, 2023 – the EU General Data Protection Regulation (GDPR) for users residing in the EU
Throughout this document, the legal bases under the GDPR are cited; these are consistent in substance with the requirements of the revDSG.
3. Data Processing Principles
Verein Vibes4Future is a nonprofit, tax-exempt organization. All data collected is used exclusively to ensure the functionality of our platform and to support our charitable mission.
We do not process personal data for advertising purposes, do not send newsletters, and do not use any analytics or advertising tracking tools. Technical device identifiers are used exclusively for system integrity purposes (prevention of multiple accounts), not for behavioral tracking or advertising.
4. Collection and Processing of Personal Data
4.1 Registration and User Identification
To register, you only need your email address and a username that has not been used yet. This is used to uniquely identify you and to authenticate and authorize your account. First and last names are optional; if provided, they are stored along with your email address. This information is not used for advertising purposes or to send newsletters.
Legal basis: Art. 6(1)(b) GDPR (performance of a contract)
4.2 Contact Form
When you contact us via the form, we collect the following information: – Name – Email address – Content of your message
This data is used exclusively to process your inquiry and is deleted afterward.
Legal basis: Art. 6(1)(b) and (f) GDPR
4.3 Donation Receipt and Address Information
A mailing address is stored only if a registered user actively requests a donation receipt. In this case, the following information is stored: – First and last name – Mailing address
This data is used exclusively for the purpose of issuing the donation receipt and is deleted once the statutory retention periods have expired.
Legal basis: Art. 6(1)(c) GDPR (legal obligation)
4.4 Donations and Payment Processing
Donations can be made through our donation page or by bank transfer. Depending on the method you choose, the transaction is processed by one of the following payment service providers:
– Stripe – card payments and TWINT, processed via the Stripe Payment Element (Stripe Technology Europe Ltd, Ireland, and Stripe, Inc., USA). – PayPal – PayPal Europe S.à r.l. et Cie, S.C.A., Luxembourg. – Bank transfer – processed by our bank; we receive the transaction details (name, amount, reference) via our account statement.
Donation management and the issuing of receipts are handled with the GiveWP plugin (Impress.org, LLC, USA). We do not store complete payment details (e.g., full card numbers or bank account data) ourselves; card, TWINT, and PayPal processing is handled directly by the respective provider. Data processing agreements (DPAs) in accordance with Art. 28 GDPR are concluded with the processors, which contractually ensure the protection of your data. Donation records are retained in accordance with the statutory retention periods (10 years). For more information, please refer to the providers’ privacy policies (Stripe, PayPal, GiveWP).
Legal basis: Art. 6(1)(b) and (c) GDPR
4.5 ChariToken – Conversion of Steps and Ranking
As part of the app’s functionality, users’ recorded steps are converted into ChariToken. ChariToken is an internal unit-of-value system developed by Verein Vibes4Future and has no trading value on stock markets or exchanges. It serves exclusively the charitable purpose of the platform.
Data is processed for the following purposes: – Conversion: Steps are algorithmically converted into ChariToken and credited to the user’s account. – Monthly Ranking: Users are ranked monthly based on their step count. The top rankings are rewarded with additional ChariToken.
This processing is a technically necessary core function of the app and does not constitute profiling within the meaning of Art. 22 GDPR, as no automated decisions are made that have legal effects or significantly adversely affect the user.
Legal basis: Art. 6(1)(b) GDPR (performance of a contract / terms of use)
4.6 Wallet Address and Blockchain
To transfer ChariToken to users, a wallet address is required, which the user must create independently and outside of our platform and provide to us. The following applies: – We do not permanently store the wallet address. – It is used exclusively via email for transaction processing. – Once the ChariToken have been transferred, we immediately delete the wallet address. – The transaction itself is recorded on a public blockchain. Blockchain entries are technically immutable and cannot be altered or deleted by us. – Since we do not permanently store the wallet address and do not link it to a specific individual, from our perspective this constitutes pseudonymized data with no direct reference to a specific person. – Verein Vibes4Future has no influence over the blockchain infrastructure and is not responsible for its operation.
Users who provide a wallet address acknowledge that blockchain transactions are, by their very nature, permanent and publicly viewable. This is inherent to blockchain technology and beyond the control of Verein Vibes4Future.
Legal basis: Art. 6(1)(b) GDPR (performance of a contract)
4.7 Cookies and Session Data
Our website uses only technically necessary session cookies. These are used to maintain your login session. They do not contain any personal data and expire automatically after a set period of inactivity.
No analytics or tracking tools are used. Our website is not connected to any analytics service. Only general, anonymized statistical data that does not identify individuals (e.g., total number of page views) is collected. Separate consent is not required for technically necessary cookies.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in operating the website)
5. Mobile Apps (iOS and Android)
The Vibes4Steps app is available for iOS (Apple App Store) and Android (Google Play).
5.1 Step Count Data (Apple Health / Health Connect)
With your explicit consent, the app accesses your step-count data — on iOS via Apple Health, and on Android via Android Health Connect. This data forms the basis of the app’s functionality (see Section 4.5). Step-count data is considered health data within the meaning of Art. 9 GDPR and is subject to a higher level of protection. It: – is not shared with third parties, – is not used for advertising purposes, – is used exclusively to calculate ChariToken and the monthly ranking.
You can revoke access at any time — on iOS under Settings → Privacy & Security → Health, and on Android in the Health Connect settings.
Legal basis: Art. 9(2)(a) in conjunction with Art. 6(1)(a) GDPR (explicit consent)
5.2 No Advertising Tracking
The app does not use cross-device ad tracking, does not use an Advertising Identifier (IDFA on iOS / Advertising ID on Android), and does not integrate any advertising SDKs. Consent under Apple’s App Tracking Transparency (ATT) framework is therefore not required.
5.3 Device Data
To improve app stability and prevent abuse, we process technical device data during app usage: – Device type and operating system version – App version – Technical device identifiers (e.g., Android ID)
This data is used exclusively to enforce a limit of one account per device, in order to protect the integrity of the reward system (ChariToken), and to prevent fraud. The device identifiers are used solely to detect multiple accounts on the same device — not to identify individual persons and not for advertising.
Legal basis: Art. 6(1)(f) GDPR (legitimate interests)
5.4 In-App Donations
Where the app provides a way to donate, you are directed to our donation page and to the external payment providers described in Section 4.4. In-app donations are not processed through Apple In-App Purchase or Google Play Billing. We receive only a transaction confirmation via the relevant provider, not your full payment details.
Legal basis: Art. 6(1)(b) GDPR (performance of a contract)
5.5 App Distribution and Store Providers
Distribution and updates of the app are handled through the Apple App Store (Apple Inc.) and Google Play (Google LLC). When you download or update the app, the respective store processes data (e.g., account identifier, device data, and download/usage statistics) as an independent controller under its own privacy policy. On Android, Health Connect is provided by Google; access to it requires your consent and is governed by Google’s Health Connect data policies.
6. Transfer of Data to Third Countries
The following service providers are based outside the EU/EEA and Switzerland, specifically in the United States:
Apple Inc. (App Store and Health framework on iOS) Apple is certified under the EU-U.S. Data Privacy Framework. Data is transferred on the basis of an adequacy decision and/or the European Commission’s Standard Contractual Clauses (SCCs).
Google LLC (Google Play and Health Connect on Android) Google is certified under the EU-U.S. Data Privacy Framework. Data is transferred on the basis of an adequacy decision and/or Standard Contractual Clauses (SCCs).
Stripe, Inc. (payment processing) For users in the EU, processing is provided by Stripe Technology Europe Ltd (Ireland). Where data is transferred to Stripe, Inc. in the United States, this is done on the basis of Standard Contractual Clauses (SCCs).
GiveWP / Impress.org, LLC (donation management) Impress.org, LLC is based in the United States. Data is transferred on the basis of Standard Contractual Clauses (SCCs) adopted by the European Commission. For more information, see: https://givewp.com/privacy-policy
Public Blockchain Blockchain transactions are globally visible and subject to no geographical restrictions. Since the transferred data (wallet address) is pseudonymized and we have no influence over the blockchain infrastructure, we cannot control a classic transfer to a third country. Users are expressly notified of this (Section 4.6).
PayPal (Luxembourg) is located within the EU and therefore does not constitute a third-country transfer.
7. Order Processing
To the extent that we use external service providers who process personal data on our behalf (e.g., hosting, payment processing), we enter into data processing agreements (DPAs) with them in accordance with Art. 28 GDPR. These agreements require the service providers to comply with data protection requirements.
The website is hosted by za-internet GmbH (Germany). The hosting provider processes server log data (IP addresses, access times) on our behalf. A Data Processing Agreement (DPA) in accordance with Art. 28 GDPR has been concluded with the hosting provider.
8. Retention Period
| Data category | Retention period |
|---|---|
| Contact requests | Until processed, then deleted |
| Email address (registration) | Until the account is deleted |
| First and last name (optional) | Until the account is deleted or upon request |
| Address (donation receipt) | 10 years (statutory retention requirement) |
| Donation data | 10 years (for tax purposes) |
| Wallet address | Deleted following the transfer of ChariToken |
| Device identifiers (app) | Duration of app use / abuse-prevention purpose |
| Session cookies | Automatic expiration after inactivity |
| Step count data | Processing period only; not permanently stored |
9. Account Deletion
You may request the deletion of your account and all associated personal data at any time. You can: – use our dedicated deletion page at https://www.vibes4future.org/delete-account/, or – send an informal email to privacy@vibes4future.org.
We will delete your data immediately, or within 30 days at the latest, provided there are no legal retention requirements that prevent us from doing so.
10. Your Rights
You have the following rights under the GDPR and the revised Swiss Data Protection Act: – Right of access (Art. 15 GDPR / Art. 25 revDSG): access to your stored data – Rectification (Art. 16 GDPR / Art. 32 revDSG): correction of inaccurate data – Erasure (Art. 17 GDPR / Art. 32 revDSG): erasure of your data, provided there are no retention obligations – Restriction of processing (Art. 18 GDPR) – Data portability (Art. 20 GDPR): receipt of your data in a machine-readable format – Objection (Art. 21 GDPR) – Withdrawal of consent (Art. 7(3) GDPR) – at any time with future effect
Please direct inquiries to: privacy@vibes4future.org
Competent supervisory authorities:
Switzerland: Federal Data Protection and Information Commissioner (FDPIC) Feldeggweg 1, 3003 Bernhttps://www.edoeb.admin.ch
EU (for users residing in the EU): The competent national data protection authority in your country of residence.
11. Data Security
All data transfers are encrypted via HTTPS. We implement technical and organizational measures (TOMs) to protect your data from unauthorized access, loss, or tampering.
12. Current Status of This Statement
This Privacy Policy is current as of August 2026. Users will be notified of any significant changes via email or through the app.
13. Contact
Verein Vibes4Future Selzweg 11 3422 Kirchberg Canton of Bern, Switzerland Email: info@vibes4future.org
