DRAFT — not yet approved; for this demo only.
This notice explains how your personal data is processed when you buy tickets on this website or attend the Salesforce FIDE World Championship in Geneva.
1. Who is responsible
The Fédération Internationale des Échecs (FIDE), Avenue de Rhodanie 54, 1007 Lausanne, Switzerland ("we"). For any question about your data: [email protected].
2. What we collect
- Your first and last name and your email address, entered at checkout, and your phone number if you give it (it is optional).
- Your order: the tickets, days and slots chosen, prices, promo code, the language you used, and when you reserved and paid.
- From our payment provider, Stripe: a payment reference and the status of the payment. We never receive your card details. Stripe may ask for other details needed for the payment; it processes them under its own privacy policy.
- At the entrance: when and at which gate each ticket was scanned.
- What we need to run the site securely: your IP address and browser information in our server logs, and the signals Cloudflare Turnstile uses to tell people from bots when you reserve tickets.
We do not ask for your postal address or date of birth, and we do not build profiles.
3. Why we use it
- To process your order, send your tickets, let you in and recognise your order when you contact us (performance of the contract).
- To tell you about changes to your order or to a game day, by email or, if you gave it, by phone, and to refund you if a day is cancelled or not played (performance of the contract).
- To keep accounting records (legal obligation).
- To protect the shop and the event against fraud, bots and misuse, and to fix errors (legitimate interest).
We do not send marketing emails and we do not sell your data.
4. Who processes it for us
- Stripe: payments.
- Postmark: sending the ticket emails; it tells us whether an email was delivered.
- Fly.io: hosting, with servers in Frankfurt, Germany.
- Cloudflare: network security and bot protection.
- Sentry: error reports, stored in the EU; email addresses and other personal details are removed before a report is sent.
They act on our instructions, or as the law requires for payments. Some of them are based in the United States; transfers are covered by appropriate safeguards, such as the data privacy frameworks or standard contractual clauses.
5. How long we keep it
- Orders and payments, including your name: 10 years, as Swiss accounting law requires.
- Your phone number: deleted no later than 12 months after the event.
- Entry scans, email delivery reports and server logs: no longer than 12 months after the event.
- Tickets prepared as a PDF for our support team: one hour.
6. Cookies and storage
The shop uses no advertising or analytics cookies. Your selection is kept in your browser (session storage) until you close the tab. Stripe and Cloudflare may set the cookies they need for payment and security.
7. Your rights
You may ask to see, correct or delete your data, to receive it in a portable format, or object to its processing, within the limits of the law (accounting records, for example, must be kept). Write to [email protected]. You may also complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC) or, if you live in the EU, to the data protection authority of your country.
8. Changes
We may update this notice; the current version is always on this page.