Privacy Notice
1. Controller and scope
Terravate Verein, Maertenweg 5, 5073 Gipf-Oberfrick, Switzerland; telephone +41 79 924 51 43; www.SustainPass.ch (“Terravate”) is responsible for SustainPass platform processing. This notice applies to owners, representatives, employees and contacts of prospective or participating businesses, nonprofits and sponsors. Contact privacy requests through the website or postal address until a dedicated privacy email is published.
2. Data collected
Business and representative names, business contact details, role, partner login credentials, eligibility documentation, submitted profiles and offers, invoices and payment records, correspondence, support requests and partner-level campaign and reporting data. We may also process support communications, verification records, usage and security logs, and the information needed to administer Impact Points and community voting, where relevant. Data categories depend on enabled app functions.
3. Purposes and safeguards
We use information for registration, eligibility, contractual administration, offers and activities, points, support, security, misuse prevention, reporting, and compliance. Access to identifiable user records is limited to authorised Terravate personnel with a legitimate operational need, including the app administrator who is also conducting a University of Basel master’s thesis. Operational access does not by itself authorise research use.
4. Business partner reports
Participating businesses cannot view or export individual app-user records, identities, activity histories or voting records through SustainPass. They receive only anonymised aggregate reports generated by Terravate. We suppress or combine small groups and avoid publishing data that could reasonably identify a person. Partners may separately hold personal data obtained directly from their own customers outside SustainPass, under their own responsibilities.
5. University of Basel master’s thesis
The SustainPass administrator is also a University of Basel master’s student studying engagement, incentives and sustainable participation. Research may analyse effectively anonymised, aggregated data. Identifiable or re-identifiable user-level data will not be used for the thesis unless the individual first provides separate, specific, informed consent. Refusal or withdrawal of research consent will not affect ordinary app access or partner participation. Research procedures will follow applicable University of Basel ethics requirements, including any review or approval required before research begins. No University endorsement or approval is implied by this notice. Published findings will not identify individuals.
6. Research consent and rights
Where identifiable research use is proposed, users will be told what information is used, research aims, who will access it, retention and withdrawal arrangements before choosing an optional, unticked consent control. Consent may be withdrawn prospectively; already irreversibly anonymised results may not be retrievable. If there is no separate consent, identifiable data remain available only for legitimate non-research platform purposes.
7. Processors, disclosures and international transfers
hello again GmbH, Leonding, Austria, provides the white-label platform as a processor. Its supplied Statement of Commitment lists Google Cloud/Google Ireland, Twilio/SendGrid, Meta/Facebook, Apple, SendBird, LINK Mobility and Weezmo among subcontractors; not all are necessarily enabled for SustainPass. Transfers or access may involve Austria, Ireland, the United States, Israel or other confirmed locations. Terravate will verify actual services and apply Swiss-law cross-border safeguards where required. No sale of personal data is authorised by this notice.
8. Security, retention and deletion
We apply role-based access, confidentiality, appropriate security and vendor controls. Records are retained only for necessary purposes and applicable legal periods; exact category-specific periods and backup cycles must reflect the live configuration. Hello Again states that personal records can be deleted on instruction and that individual backup entries cannot be deleted immediately but safeguards prevent their reintroduction on restoration. Account deletion does not necessarily remove legally required accounting or security records immediately.
9. Individual rights and communications
Under applicable Swiss law, individuals may request access, correction, deletion and, where applicable, disclosure or portability; other rights may apply where GDPR applies. Optional marketing or non-essential tracking requires the applicable transparency and consent/objection choices. Operational messages may still be sent where needed to deliver the service. The Swiss FDPIC is the competent federal data protection authority in relevant cases.
10. Law, languages and updates
This notice is available in English, German, French and Italian. In case of ambiguity or translation differences, the English version prevails to the extent permitted by mandatory law. Swiss substantive law governs disputes, subject to mandatory protections and jurisdiction. We will announce material changes appropriately. Effective date: 27 October 2026.