Privacy Policy

The controller responsible for data processing within the meaning of the GDPR and the Swiss FADP is: SpaceP5 GmbH (Citizen Space Zurich), Heinrichstrasse 267A, 8005 Zürich, Switzerland, UID: CHE-376.554.350, e-mail: booking@citizenspace.ch, telephone: +41 44 291 31 01.

This policy applies to the website citizenspace.ch, to bookings of Daily Tickets, memberships and meeting rooms, to the members' area and to on-site check-in.

When the website is accessed, our server automatically processes technical data: IP address, date and time, page accessed, browser and operating system, and the previously visited page. We need this data to deliver the website, to ensure its security and stability and to fix errors.

The legal basis is our legitimate interest in the secure operation of the website (Art. 6(1)(f) GDPR). The log data is deleted after 30 days.

The website is hosted by Hostpoint. The provider processes the data on our behalf; a data processing agreement has been concluded with it (Art. 28 GDPR).

When you purchase a Daily Ticket, book a meeting or workshop room or enquire about a membership, we process the details you provide to us: name, e-mail address, company, requested day or booked time and room and, for invoices, the billing address. For a Daily Ticket, we generate a ticket code with a QR code.

We use this data to confirm and fulfil your booking, to check you in at the entrance, to issue invoices and to allocate payments.

The legal basis is the performance of a contract or the implementation of pre-contractual measures (Art. 6(1)(b) GDPR). We retain accounting-relevant data on the basis of legal obligations (Art. 6(1)(c) GDPR), in Switzerland for ten years. Without this information, we cannot carry out the booking.

Member account. When you create an account, we store your name, your e-mail address, your access password in protected form and the type of your membership. In the members' area, you can view and manage your meeting room bookings. The legal basis is the performance of a contract (Art. 6(1)(b) GDPR). We delete the account when the membership ends and there are no further retention obligations.

Check-in on the tablet. At the entrance, you scan your ticket code and select a free desk on the floor plan. In doing so, we store who checked in at which desk and when. We need this information to allocate the seat and to manage occupancy (Art. 6(1)(b) and (f) GDPR).

Calendar feed. Members can subscribe to a personal calendar feed for Google Calendar, Outlook or Apple Calendar. The feed contains your bookings. Do not share the link, as anyone with the link can see your bookings. By subscribing, you transmit the calendar data to the provider of your calendar app, which is itself responsible for its processing.

You can book rooms via the AI assistant Claude. What you enter there, such as the requested date, room, name and e-mail address, is transmitted to Anthropic, the provider of Claude (USA), in order to process your request. From this, we receive the booking details, which we process as described in section 3.

The legal basis is the performance of your booking (Art. 6(1)(b) GDPR). Please do not enter any sensitive personal data in the chat. We base the transfer to the USA on the EU Standard Contractual Clauses or the Data Privacy Framework. Anthropic processes the data in accordance with its own privacy policy.

Contact. If you contact us by e-mail or telephone, for example for a viewing, a free trial day or a quotation, we process your name, your contact details and the content of your enquiry in order to respond to it. The legal basis is the implementation of pre-contractual measures and our legitimate interest in efficient communication (Art. 6(1)(b) and (f) GDPR). We delete enquiries once they have been dealt with and there is no retention obligation.

Cookies. The website uses technically necessary cookies, for example for logging in to the members' area. We use these on the basis of Art. 6(1)(f) GDPR. We only use analytics cookies with your consent (Art. 6(1)(a) GDPR), see below.

Google Analytics. With your consent, we use Google Analytics, a web analytics service of Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) or Google LLC (USA). Google Analytics sets cookies and processes information about your use of the website, such as pages accessed, time spent, origin of visitors, clicks, approximate location and device and browser data. We use the analyses to improve the website and to tailor our services to users.

Google Analytics is only loaded after you have given your consent in the cookie banner. You can withdraw your consent at any time with effect for the future in the cookie settings. In addition, you can prevent data collection by means of Google's browser add-on. The data is stored for 14 months. Google may transfer data to the USA; the safeguards set out in section 7 apply.

Links to social media. On the website, we link to our profiles on Instagram, Facebook and LinkedIn. No plug-ins are embedded; data is only transmitted to the respective provider when you click the link.

We do not sell your data. We only disclose it where this is necessary for the purposes stated in this policy, to the following recipients:

• service providers for hosting, e-mail delivery and the booking system, who act on our behalf and are contractually bound to comply with data protection (Art. 28 GDPR)
• accounting, fiduciary and banks, insofar as necessary for invoicing and payment transactions
• Google, if you consent to web analytics (section 6), and Anthropic, if you book rooms via Claude (section 5)
• authorities, where we are legally obliged to do so

Some recipients are located outside Switzerland and the EEA, for example in the USA. Data is only transferred there if an adequate level of data protection exists or appropriate safeguards are in place, such as the EU Standard Contractual Clauses (Art. 46 GDPR) or certification under the Data Privacy Framework.

We only store personal data for as long as the purpose requires or the law prescribes. We retain accounting records for ten years, server log data for 30 days, member account data until the end of the membership and enquiries until they have been dealt with. Thereafter, we delete or anonymise the data.

We protect your data by means of technical and organisational measures, for example encrypted transmission (HTTPS), access restrictions and protected storage of passwords.

Under the GDPR and the Swiss FADP, you have the following rights:

• access to the data we hold about you (Art. 15 GDPR)
• rectification of inaccurate data (Art. 16 GDPR)
• erasure of your data (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• receipt of your data in a commonly used format (Art. 20 GDPR)
• objection to processing based on legitimate interests (Art. 21 GDPR)
• withdrawal of consent given, with effect for the future (Art. 7(3) GDPR)

Send your request to booking@citizenspace.ch. We will review it and generally respond within 30 days. We may request proof of identity.

You may also lodge a complaint with a data protection supervisory authority: in Switzerland with the Federal Data Protection and Information Commissioner (FDPIC), in the EU with the authority of your place of residence.

We may amend this privacy policy, for example when new features are introduced. The version published on the website at the relevant time applies.