Privacy
Privacy policy
Last updated: 23 October 2026. This policy explains which personal data the SpendeDirekt association processes when you visit this website, donate or subscribe to our newsletter, why we need it and what rights you have.
1. Who is responsible?
We process personal data in accordance with the Swiss Federal Act on Data Protection (FADP). Where the EU General Data Protection Regulation (GDPR) applies, for example to donations from the EU, we also comply with it.
2. Visiting the website
The website runs on our donation platform (Frappe/ERPNext). Goodvantage GmbH, Sursee, operates the platform on our behalf on servers of Hetzner Online GmbH in Germany. The encrypted connection (HTTPS) is received by an upstream proxy server, which Goodvantage also operates at Hetzner in Germany.
Every request technically involves your IP address, date and time, the page requested, information about your browser and the previously visited page (referrer); these are stored in server logs. We use this data only for secure operation, troubleshooting and preventing abuse, and keep it only as long as necessary for these purposes.
We serve fonts and scripts ourselves, except for the security check (section 4). We do not use any analytics, advertising or tracking services on the website.
3. Cookies and browser storage
We only use technically necessary cookies:
sid (session, up to 7 days) and system_user, full_name, user_id and user_lang (login status and language, until you close your browser). The platform sets them on every visit, even if you are not logged in. We do not use them for advertising or analytics.If you arrive via a link with campaign parameters (e.g.
utm_source) or a click ID from Google, Meta or Microsoft (gclid, fbclid, msclkid), your browser stores these and the landing page in the tab's session storage (sessionStorage); they are deleted when you close the tab. If you donate or sign up for the newsletter, we send them along to see which campaigns lead to donations. We do not pass them on to advertising platforms.4. Security check (CAPTCHA)
To protect our forms against abuse, your browser loads the Goodvantage CAPTCHA from captcha.goodvantage.ch, a server of Goodvantage GmbH in Switzerland. As the footer of every page contains the newsletter form, this happens on every page, and your IP address is transmitted. The check runs in your browser; only the proof that it was solved is sent with the form. The CAPTCHA sets no cookies and is not used to recognise you or build profiles.
5. Donations
For an online donation we process your first and last name, your e-mail address, optionally your postal address and a message, the amount, the donation target and the share you chose for the association. We use this to process the donation, thank you and issue your annual donation receipt for your tax return.
Card and TWINT: Payments are processed by Payrexx AG, Thun (Switzerland), on a payment page at pay.goodvantage.ch. Payrexx processes the payment data itself; we do not receive any card details. The terms of TWINT or the card schemes also apply.
Earlier recurring donations: Recurring donations set up on the previous website continue to run via Stripe (Stripe Payments Europe Ltd., Ireland, and Stripe, Inc., USA) until they are migrated.
Bank transfers: We receive your name, account details, amount and payment message from Luzerner Kantonalbank, also electronically via the EBICS banking interface, and match the payment to your donation.
Tribute donations: If you donate in honour or in memory of someone, we also process that person's name. If you request a notification, we also process the name, e-mail or postal address of the person to be notified and your dedication message, solely for this notification. Only provide such details if you are entitled to do so.
6. Donor portal
In the donor portal you can see your donations and your recurring donations. If you enter your e-mail address there and we know you as a donor, we send you a personal access link. It can be used once and is valid for 3 days. On your first login we create a user account for your e-mail address. If you want to end a recurring donation, we handle your request internally as a task.
7. Newsletter
For the newsletter we process your first name, optionally your last name, and your e-mail address. You confirm your subscription via a link we send you by e-mail (double opt-in). We send the newsletter via our own platform.
We record whether you open a newsletter and which links in it you click. For this, each issue contains an invisible image and links that run via our server and are linked to your subscription. Links to our website carry campaign parameters (utm). We use this information to improve the newsletter. If you do not want this, you can unsubscribe at any time; you can also prevent the recording of opens by turning off image loading in your e-mail program.
You can unsubscribe at any time via the link in every issue. We took over earlier subscriptions from Mailchimp; we no longer use Mailchimp.
8. E-mail
We send and receive e-mails, including the platform's confirmations and newsletters, via Microsoft 365 (Microsoft Ireland Operations Ltd.). Data may also be processed in the USA (see section 11).
9. Partner posts, social media and videos
Public posts by our partner organisations on Facebook and LinkedIn that mention SpendeDirekt are loaded onto our server, including images, via these platforms' interfaces and shown here. Your browser does not connect to Facebook or LinkedIn in the process. If you appear in such a post and do not want to, please contact us.
YouTube videos (youtube-nocookie.com, Google) are only loaded when you click on the video; Google's privacy policy then applies. Links to our profiles on Facebook, Instagram, LinkedIn and YouTube are ordinary links: your browser only connects to the platform when you follow one.
10. Data taken over from earlier systems
When we moved to the new website in October 2026, we transferred donation and contact data from the previous website and from Microsoft Dynamics, Stripe and Mailchimp to our platform, so that your donation history and your donation receipts remain complete.
11. Recipients and disclosure abroad
We do not sell personal data or pass it on for advertising. To operate, we work with these service providers, who receive personal data for this purpose:
Goodvantage GmbH, Sursee: operation of the platform and the proxy server, CAPTCHA (Switzerland)
Hetzner Online GmbH: hosting (Germany)
Payrexx AG, Thun: card and TWINT payments (Switzerland)
Stripe: earlier recurring donations (Ireland and USA)
Microsoft: e-mail (EU and USA)
Luzerner Kantonalbank: bank account (Switzerland)
Hetzner Online GmbH: hosting (Germany)
Payrexx AG, Thun: card and TWINT payments (Switzerland)
Stripe: earlier recurring donations (Ireland and USA)
Microsoft: e-mail (EU and USA)
Luzerner Kantonalbank: bank account (Switzerland)
Under Swiss law, Germany, Ireland and the other EU states ensure adequate data protection. Where service providers process data in the USA, we rely on the Swiss-U.S. Data Privacy Framework if they are certified under it, otherwise on standard contractual clauses.
12. Retention
We keep donation data relevant for accounting, for example for donation receipts, for 10 years (Art. 958f of the Swiss Code of Obligations). We process newsletter data until you unsubscribe; we keep proof of your consent for as long as we need it as evidence. We delete or anonymise other data when we no longer need it and no retention obligation applies.
13. Legal bases under the GDPR
Where the GDPR applies, we rely on processing your donation (Art. 6(1)(b) GDPR), on legal obligations such as bookkeeping (Art. 6(1)(c)), on our legitimate interest in secure operation, in looking after our donors and in evaluating our campaigns (Art. 6(1)(f)), and on your consent for the newsletter including the recording of opens and clicks (Art. 6(1)(a)). You can withdraw your consent at any time.
14. Your rights
You can request information about your data (Art. 25 FADP) and its release or transfer (Art. 28 FADP). You can ask us to correct inaccurate data or delete data, and you can object to processing unless a legal obligation prevents it. Where the GDPR applies, you also have the rights under Art. 15 to 21 GDPR. Write to us at info@spendedirekt.ch.
You can lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC) or, in the EU, with the data protection authority of your country of residence.
15. Security
The connection to the website is encrypted (HTTPS). Only authorised persons have access to donor data.
16. Changes
We update this privacy policy when our processing changes. The version published here applies.