Privacy Policy

1. Controller

Lukac Interactive, Marko Lukac, Geeringstrasse 39, 8049 Zürich, Switzerland. Send an e-mail – further details in the Legal Notice.

2. General information on data processing

We process personal data (e.g. name, contact details, information about the child, content of communications) that arises when you visit this website or use our services (e.g. reservations, courses, newsletter) in accordance with the Swiss Federal Act on Data Protection (FADP) and – where applicable – the EU General Data Protection Regulation (GDPR).

Processing takes place only to the extent necessary for the operation of the website, the provision of our services or the protection of legitimate interests, or where consent has been given.

3. Visiting the website and server logs

When you visit our website, the hosting provider automatically records technical information in so-called server log files. This may include in particular:

• IP address and operating system of the device used
• browser type, browser version and language settings
• date and time of access
• pages and files accessed
• amount of data transferred

This data serves the stable and secure operation of the website and the prevention of misuse, and is deleted after a reasonable period unless longer retention is necessary for evidentiary purposes. To protect against automated requests, we also limit the number of form submissions per IP address (rate limiting).

4. Contact requests

If you contact us by e-mail or via a form, we process the information you provide (e.g. name, e-mail address, content of the message) in order to handle your request. The data is retained only for as long as necessary to process the request, to comply with statutory retention obligations or to assert or defend legal claims.

5. Season reservation, camp booking and course participation

To reserve a Season slot or book a camp week, we collect the following in a booking form on our website:

• first name, surname, e-mail address and billing address of the person making the booking
• for bookings by a company or institution, additionally its name and, where applicable, a reference for the invoice (e.g. purchase order number)
• first name and age of the participating children
• the chosen offer (group or week and any add-ons) and the amount

For payment, you are then redirected to the checkout of our payment service provider Stripe. Payment data (e.g. card details) is processed exclusively by Stripe; we do not see it. If, exceptionally, the booking form is not available, Stripe collects the above information in the checkout and transmits it to us.

If you abandon the booking before payment, we do not use your information any further. It is automatically deleted after 30 days at the latest.

We use this information exclusively to process the reservation or booking, for invoicing, for confirmation and status e-mails, to plan the groups and sessions and for any refunds. We send the confirmation e-mail and the invoice via our own mail server (see section 8).

If the Season goes ahead, we additionally process the information necessary for running it (e.g. emergency contact details, relevant health information). This data is treated confidentially, made accessible only to the supervising staff and deleted after the end of the Season, unless a statutory retention obligation applies (accounting records: 10 years).

6. Parent portal and account

With a paid reservation or camp booking, we automatically create an account for the NEOKIDS parent portal for the e-mail address provided. In the portal you can see your bookings, your invoices and payment receipts, your billing address, the details of your child and – once the Season is running – the sessions.

You log in without a password via a login link that we send to your e-mail address. The account stores your e-mail address, your name, your billing address, your child's first name and age, your bookings with the associated invoices and references to the payment (payment ID, amount, payment method, status and a link to the receipt at Stripe). We do not store card details.

The portal is operated on Supabase (Supabase, Inc.) as a processor, with hosting in the European Union. Access is technically restricted so that each account can only see its own data.

The legal basis is the performance of the contract and our legitimate interest in traceable processing. We delete your account and the associated data when you request it, or at the latest twelve months after the end of the last Season – with the exception of accounting records, which are subject to a statutory retention period of ten years. You can request deletion at any time by e-mail.

7. Newsletter

If you sign up for our newsletter, your e-mail address is transmitted to our mailbox and stored there. We use it exclusively to send you information about NEOKIDS – not for third-party advertising.

You can revoke your consent and unsubscribe at any time, either via the note in every newsletter e-mail or by e-mail to us. After you unsubscribe, we delete your address from the mailing list.

8. Service providers used

To operate this website and provide our services, we use services of third parties. Personal data may be transmitted to these service providers or processed by them on our behalf:

• Website hosting: Netlify (Netlify, Inc., USA)
• Payment processing: Stripe (Stripe Payments Europe, Ltd., Ireland)
• E-mail delivery and mailbox: Metanet AG, Switzerland
• Parent portal (account, database): Supabase, Inc. – hosted in the EU
• Web analytics: PostHog, EU Cloud (Frankfurt) – only with your consent

Where data is transferred to countries without an adequate level of data protection, we ensure appropriate protection through suitable safeguards (e.g. standard contractual clauses) or a statutory exception applies.

9. Cookies and local storage

We do not use tracking cookies for the operation of the website itself. We store your decision on the cookie banner in your browser's local storage (key neokids-consent, consisting of your decision and a timestamp) so that we do not have to ask you again on every visit.

If you submit the booking form, your browser also remembers the details in local storage (key neokids-booking-form) so that you do not have to type them in again for a further booking or after an abandoned payment. This copy remains on your device; you can delete it at any time via your browser's site data.

If you log in to the parent portal, we set a technically necessary session cookie that keeps you logged in. It contains no analytics data and expires after 30 days or when you log out.

If you choose a language for the website, or if it is detected from your browser language on your first visit, we store your choice (German or English) in a cookie named neokids-locale. It is technically necessary so that the website stays in the chosen language, contains no analytics data, is not used for tracking and expires after one year. No consent is required for this.

Analytics tools are loaded only after your express consent. Without consent, no data is collected.

You can revoke your consent at any time by deleting the stored site data in your browser. You will be asked again on your next visit.

10. Web analytics with PostHog

We use PostHog to understand how our website is used. The tool is only loaded and activated if you have agreed in the cookie banner. The data collected includes in particular:

• pages visited and time spent
• interactions such as clicks on key buttons (e.g. starting a reservation)
• device information (screen size, browser, operating system)
• approximate location based on the IP address

We use PostHog in the EU Cloud (hosted in Frankfurt), so the data is processed within the EU. Further information can be found in the PostHog privacy policy.

11. Children's data

Reservations and bookings are made exclusively by adults with parental authority. Of children, we process only the information necessary for running the programme (first name, age and – where required – relevant health information). We use photo and video recordings of children only with the prior, express consent of the parents or legal guardians.

12. Retention period

We store personal data only for as long as necessary for the respective purpose or as required by law (e.g. 10 years for accounting records). The data is then deleted or anonymised.

13. Data security

We take appropriate technical and organisational measures to protect your data. The website is delivered exclusively in encrypted form (HTTPS), payment data is processed directly by Stripe, and access to login data is restricted to the persons who need it.

14. Your rights

Under the applicable law, you have in particular the following rights:

• right of access to the data processed about you
• right to rectification of inaccurate or incomplete data
• right to erasure or restriction of processing
• right to object to the processing of your data
• right to data disclosure or transfer (data portability), where applicable
• right to withdraw consent at any time

To exercise these rights, you can contact the controller named above at any time.

15. Right to lodge a complaint

You have the right to lodge a complaint with a competent data protection supervisory authority if you believe that your data protection rights have been violated. In Switzerland, this is the Federal Data Protection and Information Commissioner (FDPIC).

16. Changes to this Privacy Policy

We may change this Privacy Policy at any time. The version published on this website at the time applies.