Updated: 29.09.2026
Who is responsible?
Eli Gujer, Studenrain 7, 8122 Binz (Maur), Switzerland, is the controller for this website and the Vintage-Box rental service. For privacy requests: info@vintage-box.ch. We process personal data in accordance with the Swiss Federal Act on Data Protection.
Visiting this website
Our hosting service processes technical connection data such as IP address, time, requested URL, browser information and response status to deliver the site, maintain security and diagnose errors. This is not an advertising profile. Logs are managed within the hosting service and retained as necessary for those purposes.
Hosting, email and recipients
Website hosting: METANET AG; primary data location: Schweiz / Switzerland. Email transport and mailboxes: METANET AG; primary data location: Schweiz / Switzerland. Providers process data to supply their services, including necessary infrastructure and support. Provider subprocessors and any applicable overseas support access depend on the contracted services; their published data-processing information applies. METANET’s published list includes email-filtering suppliers in Germany and the USA, and support suppliers in Spain, Bulgaria and the USA. Which of these is involved depends on the activated service. Foreign disclosure is subject to the safeguards required by Swiss data-protection law. We use no external advertising, analytics, CAPTCHA, font or video-embed services on the public site. Ordinary email can pass through other providers, and recipients may use providers abroad. We disclose data to payment services you choose, and to authorities or advisers only where required or necessary for legitimate claims.
Inquiries and booking records
We collect the name, email, mobile phone number for rental inquiries, event date and type, venue/town, country, optional message and partner code, requested print media and acceptance of terms/privacy information. We use these to answer inquiries, coordinate logistics, calculate the agreed price, administer payments and perform the rental. Internal payment references, amounts, deadlines, pickup/return proposals and action history support administration. An inquiry does not create a customer account. We do not publish customer names or counts in the availability calendar.
Forms and spam prevention
Forms use server validation, a hidden bot trap, minimum completion time, a signed form token and rate limits. Short-lived keyed hashes derived from IP addresses and email addresses help limit repeated submissions. These counters expire automatically. We do not send your form data to a third-party CAPTCHA or spam-scoring provider. Contact messages are stored so a mail failure does not lose them.
Partners and cookies
Partner accounts store login details, organisation/name, email, a hashed partner code, booking history and eligibility status. WordPress authentication cookies are necessary while partners and administrators sign in. Ordinary visitors do not need an account. The public site sets no advertising or analytics cookies. The inquiry form token stays in the page and is not a tracking cookie.
Event photographs and private downloads
We process event photo archives to deliver them to the agreed recipient. Files are stored outside the public web root and delivered using an unguessable link. Anyone who has the link can download; please share it only with intended recipients. Access expires after no more than 30 days, and expired files are scheduled for deletion. A download is not a public gallery, and we do not use event pictures in advertising without separate permission. The renter should inform guests about photography and sharing. Save your own copy before expiry.
Retention
Online event archives are limited to 30 days. Technical access denial works at expiry; physical cleanup runs with the website maintenance schedule. Contact messages are automatically removed after 180 days. Unconfirmed inquiries are reviewed for deletion after 365 days; contract, payment and evidentiary records are reviewed separately and retained where contractual, statutory or claims-related needs justify it, including up to 10 years where accounting duties apply. Sent email bodies in the website outbox are removed after 30 days; mailbox copies and backups have separate retention. Private event archives are excluded from ordinary WordPress backups by their separate storage location.
Your rights and contact
You may request information about your data and, as applicable, correction, delivery or transfer, or deletion. You may object to processing and withdraw a consent for future processing. Legal retention obligations and justified overriding interests may restrict individual requests. Contact info@vintage-box.ch; we may need appropriate proof of identity. You can also contact the Swiss Federal Data Protection and Information Commissioner (FDPIC).
Security and changes
We use access controls, HTTPS, restricted administrative actions and limited public data. No online transmission is completely risk-free. We update this notice when services or processing change.