Privacy Policy

This privacy policy applies to the processing of personal data in connection with participation in the 31DAYS project and the use of the website https://www.31days.ch in this context, within the scope of the Swiss Federal Act on Data Protection (FADP).

It gives you the most important information you need to know: which data we process, for what purpose we need it, how we protect it, what added value you gain from the data processing and how you can object to it.

The controller responsible for the data processing is SBB AG as the client commissioning the 31DAYS project. The project is carried out by SBB AG together with the data processor 42hacks mobility Genossenschaft.

You have the data protection rights listed below. To exercise these rights, you can send an email to: hallo@31days.ch. Please note that we may ask you to verify your identity before we respond to such requests in substance.

There are clear legal rules on the use of personal data, to which we refer repeatedly in this privacy policy. They relate to the law applicable in Switzerland.

Applicable law requires us to retain certain data about you. We are obliged to disclose the requested data in response to requests from law enforcement or other authorities.

If you have any questions about this privacy policy, please do not hesitate to contact us:

42hacks mobility Genossenschaft
Berg 29, 9043 Trogen, Switzerland
hallo@31days.ch

Types of data – what we store and how it is used

When you use our services, we may collect or receive personal data for a number of purposes related to our business operations. This includes the following:

• Usage and analytics data (e.g. identifiers, number of clicks, tracking data)
• Contact details of both you and persons living in the same household, if you provide them to us (e.g. name, address, telephone number, date of birth)
• Enquiry details (e.g. details and content of your enquiries and communications to us)
• Website visitor data (e.g. IP address, log files, device ID)
• Vehicle data (e.g. mileage, number plate, vehicle registration document)
• Customer card numbers (e.g. SwissPass number)
• Photos and videos relating personally to the participants

There is no obligation to provide your personal data. Please note, however, that our services cannot be provided if you do not provide the required data that is strictly necessary for the performance of the contract between you and us.

Data when applying for the challenge

• Contact details of both you and persons living in the same household, if you provide them to us (e.g. name, address, telephone number, date of birth, SwissPass customer number)
• Information about your motivation to take part in the challenge
• Information about your current mobility (e.g. car use, public transport use).
• Vehicle data (e.g. vehicle registration document, mileage, number plate) so that we know that you own a car and leave it parked for 31 days.

To decide on your participation in the challenge, we use your public transport usage from the 2 years before the challenge. Even if your participation in the challenge does not work out, we analyse your public transport mobility behaviour before and after your application in pseudonymised form in order to continuously improve the challenge. For this purpose, we use your public transport usage up to 2 years after the challenge in pseudonymised form. If you do not want this, you can send an email to: hallo@31days.ch. Further information can be found in the section «Managing and unsubscribing from the services».

Data when taking part in the challenge

• Usage behaviour and satisfaction during the challenge (e.g. which packages you use and how)
• Photos and videos relating personally to the participants (e.g. someone shares their travel experiences with the GA travelcard with the community)
• Registrations for webinars and personal consultations
• Coupon codes for partner offers (e.g. Mobility)
• Exchanges with us by email, WhatsApp or SMS for the running of the challenge
• Information you provide when using the app

As part of the challenge, you receive a coupon for a challenge GA. You can redeem this coupon at SBB points of sale. We check whether the coupon has been correctly redeemed by a person taking part in the challenge. Further information on data processing in public transport can be found in the SBB privacy policy.

Data when contacting us via WhatsApp

We use WhatsApp, a messaging service provided by WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, for private individuals in the EU/EEA and Switzerland ("WhatsApp"). We use WhatsApp as a means of communicating with you, through messages, voice and video calls and through the chatbot integrated into the website. WhatsApp also makes it possible to send and receive images and videos and to display your status and location whenever you choose to share them with us. By using this service, you share certain personal data with WhatsApp. This includes your account information (e.g. mobile number, profile name, profile picture and About section), user content (e.g. messages, media in messages and calls), status information and precise location information, as well as your connections. In addition, WhatsApp shares your personal data with us when we use it to communicate with you. This includes the user content you choose to communicate with us (e.g. messages, videos, images, audio files and other information you send to us), as well as information linked to your account depending on your privacy settings (e.g. profile name, telephone number, last seen information and message receipts).

Further information about WhatsApp's privacy practices can be found in its privacy policy.

Data when contacting us

We use Twilio, a communication service of Twilio Inc. (101 Spear Street, 1st Floor, San Francisco, CA 94105, USA), to contact you by SMS. We use Twilio as a means of communicating with you, in particular for notifications and information in the context of the challenge. By using this service, you share certain personal data with Twilio. This includes in particular your telephone number and the content of the messages sent. Twilio processes this data on our behalf in order to enable the delivery of the messages and to inform us of the delivery status.

Further information about Twilio's privacy practices can be found in its privacy policy.

When you contact us by email or SMS, we prepare our replies with the support of artificial intelligence. Further information on the use of our chatbot can be found here.

Data when using our chatbot

On our website, you can ask us questions about the challenge via a chatbot. For this we use Crisp, a customer service platform of Crisp IM SAS (2 boulevard de Launay, 44100 Nantes, France). The chatbot answers your questions automatically with the support of artificial intelligence. The answers may contain errors. You can ask to speak to a person from our support team at any time.

By using the chatbot, you share certain personal data with Crisp. This includes in particular the content of your messages and of the files you send, your email address if you provide it, and technical data such as IP address, browser, device and approximate location. Crisp processes this data on our behalf in order to provide the chat and stores it in the EU.

Further information about Crisp's privacy practices can be found in its privacy policy.

Data after taking part in the challenge

After the challenge, we ask you about your user experience and motivate you in the app, by email, WhatsApp or SMS to change your behaviour in the long term.

In order to measure the impact and continuously improve the challenge, we analyse your public transport mobility behaviour before, during and after the challenge. For this purpose, we use your public transport usage from 2 years before the challenge to 2 years after the challenge. We may contact you for surveys for up to 3 years after the challenge.

Data for advertising and marketing

Participants' usage data and measurements of success are used on 31days.ch and for advertising and marketing purposes (acquisition of new participants). If you consent, the photo and video material you provide will also be used on 31days.ch and for advertising and marketing purposes (acquisition of new participants)

Data for our email newsletters

We send newsletters and other notifications by email and via other communication channels, and may also deliver them with the help of third parties. In principle, you must expressly consent to receiving newsletters and other notifications from us, unless this is permitted for other legal reasons.

Newsletters and other notifications may contain web links or tracking pixels that record whether an individual newsletter or notification has been opened and which web links have been clicked (performance measurement). Such web links and tracking pixels record the use of newsletters and other notifications. We use this statistical recording of usage, including the measurement of success and reach, in order to be able to offer newsletters and other notifications effectively and in a user-friendly manner, as well as permanently, securely and reliably, based on the reading habits of the recipients.

Participants in the 31DAYS challenge have the right at any time to object, in whole or in part, to the use of their personal data or to withdraw their consent.

The withdrawal can be sent by email to hallo@31days.ch. Please state which processing you are referring to:

• No WhatsApp communication
• No SMS communication
• No use of my photos / data for advertising purposes
• No participation in customer surveys
• No use of my public transport usage to improve the challenge if you do not take part in the challenge

We will comply with your request and inform you of its implementation. Please note that a complete withdrawal may also lead to the termination of your participation in the challenge if essential communication channels are affected.

We do not sell your data to third parties.

Your personal data is only disclosed to selected service providers – and only to the extent necessary to provide the service.

These include

• third parties that we involve in the course of providing our services, such as consultants or freelancers
• third parties that support us with IT and software solutions

Service providers that process data on our behalf are contractually obliged to comply with the relevant data protection provisions and are not considered third parties under data protection law.

Your data may be disclosed to mobility partners (such as Pick-e-Bike AG, Publibike AG, Tier Mobility Suisse GmbH, Voi Technology Switzerland AG, Mobility Genossenschaft) for the provision of the service. When you leave 31DAYS via a link to the partner's app, we inform you which data, if any, will be disclosed for the free registration, for example to ensure that you do not already have an account with this partner.

We may also be legally obliged to disclose data, or disclosure may be necessary to protect our rights.

Retention period

The data is stored for 36 months so that we can also review the success of the challenge in the long term (e.g. by surveying the participants).

Storage location

We and/or our service providers may transfer your personal data to and process it in the following locations:

• EU and EEA
• USA

We may use service providers that are partly located in so-called third countries (outside Switzerland) or process personal data there, i.e. in countries whose level of data protection does not correspond to that of Switzerland.

We protect your personal data in accordance with our contractual obligations and applicable data protection laws when we transfer data abroad.

Such safeguards may include:

• transfer to countries which, according to the Federal Council, offer an adequate level of protection;
• use of standard contractual clauses, binding corporate rules or other standard contractual obligations that ensure adequate data protection.

If a transfer to a third country takes place and there is no adequacy decision or appropriate safeguards, it is possible, and there is a risk, that authorities in the third country (e.g. intelligence services) may gain access to the transferred data and that the enforceability of data subjects' rights cannot be guaranteed.

Our services use cookies and similar technologies (collectively "tools"), which are provided either by us or by third parties.

A cookie is a small text file that is stored on your device. Comparable technologies are web storage (local / session storage), fingerprinting, tags or pixels. Cookies are only set once you accept them on our website. If you reject cookies or similar technologies, you may not be able to use all of our services without problems.

Below, the tools we use are listed by category, and in particular we inform you about the providers of the tools, the storage period and their purpose. Where personal data is transferred to third countries, we refer to the «Data storage» chapter of our privacy policy, also with regard to the risks that may be associated with this.

Tools we use

Google Analytics 4

• _utma (2 years): to distinguish users and sessions;
• _utmb (30 minutes): to calculate the time you spend on our website;
• _utmc (expires with the browser session): to calculate the time you spend on our website;
• _utmz ([6 months]): to store the keyword and search engine used;
• _ga ([2 years]): recognition and distinction of visitors by means of a user ID;
• _ga_XXXXXX (2 years): retention of the information of the current session;

If you would like to learn more about Google's use of cookies, read the privacy policy here.

Google Ads

• _gcl_au (90 days): to store and track conversions;
• _gcl_aw (90 days): used for the delivery of advertising and retargeting;
• IDE (24 months): recognition and distinction of visitors by means of a user ID, recording of interaction with advertising, delivery of personalised advertising;
• ar_debug (90 days): used for the analysis of advertising and marketing

If you would like to learn more about Google's use of cookies, read the privacy policy here.

Hotjar

• _hjSessionUser_# (1 year): Hotjar cookie that is set when a user first lands on a page with the Hotjar script. It is used to store the Hotjar user ID, which is unique to that site in the browser. This ensures that behaviour on subsequent visits to the same site is attributed to the same user ID;
• _hjSession_# (30 minutes): a cookie that holds the current session data. This ensures that subsequent requests within the session window are attributed to the same Hotjar session.

To learn more about Hotjar's use of cookies, read the privacy policy here.

Heap Analytics

• _hp2_id.# (14 months): used for user interactions on the website. It is a user cookie that stores the user_id, identity and other IDs;
• _hp2_ses_props# (expires with the browser session): used for user interaction on the website and to store actions performed on the website. It is a session properties cookie that stores timestamps and the cookie domain/path.
• userty.core.p. (2 years): related to the management of user sessions, preferences and website functions, containing user replay properties;
• userty.core.s. (2 years): related to the management of user sessions, settings and website functions, containing replay session properties;

To learn more about Heap Analytics' use of cookies, read the privacy policy here.

Our services contain links to websites or apps that are not operated by us. If you click on a third-party link, you will be redirected to that third party's website or app. We have no control over the content, privacy policies or practices of third-party websites or services.

We maintain online presences on social networks in order, among other things, to communicate there with customers and prospective customers and to provide information about our products and services. If you have an account on the same network, it is possible that the information and media you have made available there can be seen by us, for example when we view your profile. In addition, the social network may allow us to contact you. As soon as we transfer personal data into our own systems, we are independently responsible for it. This is then done in order to carry out pre-contractual measures and to perform a contract. For the legal bases of the data processing carried out by the social networks under their own responsibility, please refer to their privacy policies.

Below is a list of social networks on which we maintain an online presence:

• Facebook: Privacy policy
• Instagram: Privacy policy
• LinkedIn: Privacy policy
• YouTube: Privacy policy
• TikTok: Privacy policy

We protect the data stored with us against manipulation, loss and unauthorised access by third parties. To keep it that way, we continuously develop our security measures. 42hacks mobility Genossenschaft will be happy to provide you with additional information on this at hallo@31days.ch.

The transmission of data over the internet and by other electronic means always involves risks. Despite reasonable precautions, we therefore cannot guarantee the security of information transmitted over the internet.

We reserve the right to amend and supplement this policy at any time and at our sole discretion. Please consult this policy regularly.