Data Privacy

Privacy Policy

ZOE SCHOOL FOR DANCE MOVEMENT THERAPY (zoe ArtsTherapy) – www.zoeschool.ch

As of: September 2026

This is a translation of the German version. In case of any discrepancies, the German version shall prevail.

1. Controller

The controller responsible for data processing within the meaning of the Swiss Federal Act on Data Protection (FADP) is:

zoe ArtsTherapy – ZOE SCHOOL FOR DANCE MOVEMENT THERAPY GmbH

Elsässerstrasse 34, CH-4056 Basel

UID: CHE-201.996.462

Phone: +41 61 382 60 76

Email: brigitte.zueger@zoeschool.ch

For data protection questions and to exercise your rights, you can contact us using the contact details above.

Where required by law, we have appointed the following representative in the EU:

Datenschutzpartner AG, Hauptstrasse 19 5742 Kölliken Switzerland info@datenschutzpartner.ch

2. Scope and applicable law

This privacy policy informs you about how we process personal data. Personal data is any information relating to an identified or identifiable person. Processing means any handling of personal data, in particular its collection, storage, use, disclosure, archiving or deletion.

This privacy policy applies to the use of our website www.zoeschool.ch and the digital services offered through or linked to it. These include in particular contact and course registrations, registrations for information evenings, introductory days, entrance examinations and training programmes, newsletter subscriptions, appointment bookings, use of our learning platform, as well as interactions with our social media profiles, insofar as we are responsible for them.

The governing law is the Swiss Federal Act on Data Protection (FADP) and Art. 45c of the Telecommunications Act (TCA) concerning cookies and similar technologies. Insofar as you are located in the European Union or the EEA and the processing is related to the monitoring of your behaviour, the provisions of the EU General Data Protection Regulation (GDPR) also apply.

This privacy policy is provided for information purposes and does not form part of any contract with you, even if a contract refers to this privacy policy.

3. Hosting and server log files

Our website is technically operated via oriented.net, i.e. oriented GmbH, which according to its own information has its servers and registered office in Switzerland. The hosting provider is ISO 27001 certified.

Each time our website is accessed, our hosting provider automatically collects technical access data and stores it as server log files. This includes in particular:

page/file visited, date and time of access
amount of data transferred and access status (success/error)
referrer URL (previously visited page)
browser, operating system and IP address used

This data serves the technical provision, security, error analysis and stability of the website. Insofar as the GDPR applies, we base the processing on our legitimate interest in the secure and uninterrupted operation of the website (Art. 6(1)(f) GDPR).

Server log files are generally deleted after 30 days, unless security-related incidents or legal reasons require longer retention.

4. Contact, course registrations and admission procedures

If you contact us by email, by phone or via a contact or registration form, or register for courses, information evenings, introductory days, entrance examinations or training programmes, we process the data you submit. Depending on the process, this includes in particular your name, address, email address, phone number, desired course, desired training programme or appointment, billing details, the content of your message and any other information you provide to us in the course of registration or communication.

For candidates in admission procedures, we may additionally process application documents, CVs, letters of motivation, information from questionnaires, interview notes and other information, insofar as these are necessary for assessing admission and conducting the admission procedure. Application dossiers and admission questionnaires may also be exchanged by email.

Our website forms are technically protected by an anti-spam function. According to current technical findings, no personal data is transmitted to third parties as a result.

Providing the data marked as mandatory fields in the respective form is necessary for us to process your enquiry, registration or application. Without this information, we may be unable to process the respective enquiry, registration or application, or only to a limited extent.

Please only send us sensitive personal data, in particular information about your health, therapy experience or comparable personal circumstances, if we expressly request it or if it is necessary for the admission procedure or for conducting a course or training programme. Insofar as the GDPR applies and special categories of personal data are concerned, we only process such data if an exception under Art. 9(2) GDPR applies, in particular your explicit consent or another legal basis provided by law.

Insofar as the GDPR applies, processing is carried out for the performance of pre-contractual measures or a contract (Art. 6(1)(b) GDPR). Where no contract is being initiated or performed, we base the processing on our legitimate interest in handling your enquiry and in orderly communication (Art. 6(1)(f) GDPR).

5. Cookies and consent management

Our website uses cookies and similar technologies, e.g. local storage, pixel tags or comparable online identifiers. A cookie is a small text file that is stored on your device when you visit our website. Such technologies may be necessary to provide the website technically, or they may serve to analyse the use of our website, embed content, or measure advertising and its success.

We distinguish in particular between the following categories:

Technically necessary cookies and similar technologies: These are required for the basic operation of our website, e.g. for language settings, security functions, form functions or the technical provision of the website. Without these technologies, the website may not be usable, or only partially. Insofar as the GDPR applies, we base the corresponding processing on our legitimate interest in the secure, stable and functional operation of our website (Art. 6(1)(f) GDPR).
Analytics cookies and similar technologies: We use these to evaluate the use of our website and to improve our online offering, in particular with Google Analytics. Such technologies are only set or activated after you have given your consent via our cookie banner. Insofar as the GDPR applies, we base the processing on your consent (Art. 6(1)(a) GDPR).
Marketing cookies and similar technologies: We use these to measure the effectiveness of our advertising and to display our offers on external platforms in a more targeted manner, in particular via Google Ads as well as Meta/Facebook and Instagram. Such technologies are only set or activated after you have given your consent via our cookie banner. Insofar as the GDPR applies, we base the processing on your consent (Art. 6(1)(a) GDPR).

When you first visit our website, our cookie banner informs you about the use of cookies and similar technologies. There you can select which categories you wish to allow, reject all non-essential cookies, or change or withdraw your selection at any time later. You will find a corresponding link in the footer of our website under «Cookie Settings».

Under Swiss law, we provide information about cookies and similar technologies in accordance with Art. 45c TCA and obtain consent where required. You can withdraw your consent at any time with effect for the future. The withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

6. Google Analytics

We use Google Analytics, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (parent company: Google LLC, USA).

Google Analytics uses cookies or online identifiers to analyse your use of our website. In particular, information on pages visited, time spent on the site, origin of access, device and browser information, approximate location and interactions with the website may be processed.

The purpose is to measure reach and to design and improve our website in line with users’ needs. Processing only takes place after you have given your consent via our cookie banner. Insofar as the GDPR applies, we base the processing on your consent (Art. 6(1)(a) GDPR).

The retention period in the Google Analytics account is configured in a data-minimising way according to the current technical status. Event data is generally retained for 2 months and user-level data generally for 14 months, unless shorter or longer retention is technically or legally required.

The data collected may be transferred to Google LLC in the USA. For such transfers, we rely, where applicable, on the Swiss-U.S. Data Privacy Framework or the EU-U.S. Data Privacy Framework, provided that Google LLC is certified accordingly, and, where appropriate, on standard data protection clauses or other safeguards provided by law.

You can withdraw your consent at any time via our cookie settings.

7. Google Ads and conversion tracking

We use Google Ads from Google Ireland Limited / Google LLC to draw attention to our offering on external websites and to measure the effectiveness of our advertising campaigns.

In this context, conversion tracking and, where applicable, remarketing may be used: Google may use a cookie or comparable technologies for this purpose when you reach our website via a Google ad placed by us or carry out a certain action on our website, e.g. submitting a form.

Data processed may include in particular IP address, device and browser information, pages visited, referrer URL and conversion events. The purpose is to measure, manage and optimise the success of our advertising campaigns.

Processing only takes place after you have given your consent via our cookie banner. Insofar as the GDPR applies, we base the processing on your consent (Art. 6(1)(a) GDPR). Data may be transferred to Google LLC in the USA; the information in Section 17 applies to such transfers.

8. Meta/Facebook Pixel and Facebook Conversions API

Our website uses the Meta Pixel and the Facebook Conversions API of Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. The parent company is Meta Platforms, Inc., USA.

These tools make it possible to track the behaviour of website visitors in order to design advertisements on Facebook and Instagram in a more targeted manner and to measure their success. In addition to browser-based transmission via the pixel, event data may also be transmitted server-side via the Facebook Conversions API.

If the «Advanced Matching» function is activated and we hold contact data, this data may be transmitted to Meta in hashed form in order to attribute advertisements to a person or a user account. Hashing means that the data is converted by a technical process before transmission. However, this does not rule out identification by Meta.

Data processed may include in particular IP address, device and browser identifiers, pages visited, interaction events and, where applicable, hashed contact data. The purpose is to measure reach, measure success and optimise advertisements, as well as to build target audiences, e.g. retargeting or lookalike audiences.

Processing only takes place after you have given your consent via our cookie banner. Insofar as the GDPR applies, we base the processing on your consent (Art. 6(1)(a) GDPR).

For certain processing operations in connection with Meta Business Tools, we may be jointly responsible with Meta, in particular for the collection and transmission of event data to Meta. Meta provides the essential information on this in its terms for joint controllership. You can assert your data subject rights against us or against Meta.

Data may be transferred to Meta Platforms, Inc. in the USA. For such transfers, we rely, where applicable, on the Swiss-U.S. Data Privacy Framework or the EU-U.S. Data Privacy Framework, provided that Meta Platforms, Inc. is certified accordingly, and, where appropriate, on standard data protection clauses or other safeguards provided by law.

9. Google Maps

On individual pages, e.g. in connection with contact details or directions, we may embed map material from the Google Maps service. The provider is Google Ireland Limited / Google LLC.

When the map is loaded, data, in particular your IP address as well as device and browser information, may be transmitted to Google. Google may also process this data for its own purposes.

The map is only loaded after you have given your consent via our cookie banner or, if technically implemented accordingly, after you have actively clicked on a map preview. Insofar as the GDPR applies, we base the processing on your consent (Art. 6(1)(a) GDPR).

Data may be transferred to Google LLC in the USA; the information in Section 17 applies to such transfers.

10. YouTube videos

We may embed videos via YouTube on individual pages. The provider is Google Ireland Limited or Google LLC. Where possible, we use YouTube’s privacy-enhanced mode via the domain youtube-nocookie.com. This type of embedding reduces data transmission to Google as long as you do not play the video.

When you play a video, data, in particular your IP address as well as device and browser information, is nevertheless transmitted to Google. Google may also process this data for its own purposes.

Processing takes place after you have given your consent via our cookie banner or by actively starting the video, if a two-click solution is used. Insofar as the GDPR applies, we base the processing on your consent (Art. 6(1)(a) GDPR).

Data may be transferred to Google LLC in the USA; the information in Section 17 applies to such transfers.

11. Web fonts (MyFonts/Monotype)

To display fonts consistently, our website embeds web fonts provided via a service of Monotype Imaging Holdings Inc. (MyFonts), USA.

When the fonts are loaded, your IP address may be transmitted to Monotype or MyFonts, possibly in the USA. The processing serves the technical provision and correct display of the fonts used.

Insofar as the GDPR applies, we base the processing on our legitimate interest in a consistent and technically stable presentation of our website (Art. 6(1)(f) GDPR). The information in Section 17 applies to any data transfers abroad.

12. Newsletter

We use Brevo, a service of Brevo SAS, 7 rue de Madrid, 75008 Paris, France, to send our newsletter.

When you subscribe to the newsletter, we process your email address and, where applicable, other data you provide, e.g. your name. You can subscribe via our website or via subscription forms provided by Brevo.

Using Brevo, we evaluate in aggregated form how our newsletters are used, in particular open and click rates, in order to optimise their content and design.

Insofar as the GDPR applies, we base the sending and the evaluation on your consent (Art. 6(1)(a) GDPR). You can withdraw your consent at any time with effect for the future, in particular via the unsubscribe link in every newsletter.

A data processing agreement is in place with Brevo. According to the information available to us, it is provided for as part of Brevo’s terms of use.

13. Appointment booking via Zeeg

We use Zeeg, a service of Zeeg GmbH, Berlin, Germany, to book consultation appointments. This applies in particular to free consultations, which we may advertise via our social media profiles or advertisements on Facebook, Instagram or LinkedIn.

If you book an appointment via Zeeg, the data you provide when booking is processed. This includes in particular your name, your contact details, information about the desired appointment, appointment confirmations and, where applicable, other information you provide in the course of booking.

The purpose is to schedule and manage appointments and to conduct the consultation. Insofar as the GDPR applies, processing in connection with the initiation or performance of a service is carried out on the basis of Art. 6(1)(b) GDPR. Where no contract is being initiated or performed, we base the processing on our legitimate interest in efficient appointment organisation (Art. 6(1)(f) GDPR).

14. Learning platform (Moodle) for students

For students and course participants, we provide a closed learning platform based on Moodle via zoeschool.moodle.ch. Accounts are created for students and course participants.

In connection with the learning platform, we process in particular account and contact data, login data, role and course assignments, course- and training-related data, course progress, communication within the learning platform, as well as submitted work and contributions.

The purpose is to provide and conduct the training programme or the respective course, to organise learning content, to communicate with students and course participants, and to document learning progress and submitted work.

Depending on the course or training programme, submitted work, reflections or contributions may also contain personal information. We only process sensitive personal data insofar as this is necessary for conducting the course or training programme or if you provide it yourself.

The learning platform may be technically operated by an external Moodle hosting provider. This provider may process personal data as a processor. Insofar as providers or subcontractors process personal data outside Switzerland, the information in Section 17 applies.

Insofar as the GDPR applies, processing is carried out for the performance of the training or course contract (Art. 6(1)(b) GDPR) and, where necessary, on the basis of our legitimate interest in the secure and orderly conduct of our courses and training programmes (Art. 6(1)(f) GDPR).

15. Social networks

We operate or link to profiles on social networks, in particular Facebook, Instagram and LinkedIn. Merely visiting our website does not transmit any data to the respective platforms through plain links to these profiles.

If you actively click on a link, visit our profiles or interact with us on a platform, we may process the resulting communication and interaction data. This includes in particular your profile name, public profile information, messages, comments, reactions and other interactions.

The purpose is to communicate with interested persons, to provide information about our offerings, for public relations, and to promote our courses, information evenings, introductory days, training programmes and consultation appointments.

The platform providers also process data for their own purposes and in accordance with their own privacy policies. For Facebook and Instagram, Meta Platforms Ireland Limited is responsible in particular; for LinkedIn, LinkedIn Ireland Unlimited Company is responsible in particular. The providers may also process data outside Switzerland and the EEA.

Insofar as we are jointly responsible with platform providers for certain processing operations, in particular for statistical evaluations or certain advertising functions, the joint controllership agreements provided by the platform providers apply. You can assert your rights both against us and against the respective platform provider.

Insofar as the GDPR applies, we base our own processing in connection with social media on our legitimate interest in communication, public relations and marketing (Art. 6(1)(f) GDPR) or, where consent is required, on your consent (Art. 6(1)(a) GDPR).

16. Recipients and categories of recipients

In the course of our activities, we only disclose personal data insofar as this is necessary for the purposes described, there is a legal basis, or you have given your consent.

Recipients or categories of recipients may include in particular:

hosting providers and IT service providers, in particular oriented.net, i.e. oriented GmbH;
web design, maintenance and technical service providers, in particular Fox Computers, insofar as they have access to website or system data;
providers of analytics, map, video and advertising services, in particular Google Ireland Limited, Google LLC, Meta Platforms Ireland Limited and Meta Platforms, Inc.;
providers of web fonts, in particular Monotype or MyFonts;
newsletter service providers, in particular Brevo SAS;
appointment booking service providers, in particular Zeeg GmbH;
Moodle hosting providers and technical service providers of the learning platform;
social media platforms, in particular Meta and LinkedIn;
lecturers, course leaders, persons responsible for admissions and other persons involved, insofar as this is necessary for conducting courses, training programmes, admission procedures or events;
banks, payment service providers, accounting, auditing and advisory bodies, insofar as this is necessary for payments, accounting or administrative processes;
authorities, public offices, courts and other bodies, insofar as we are legally obliged or entitled to disclose data;
other third parties, insofar as this is necessary to safeguard our rights, to defend against claims or to conduct legal proceedings.

Service providers generally process personal data on our behalf and in accordance with our instructions, unless they are independent controllers.

17. Data transfers abroad

Recipients of personal data may be located in Switzerland, in the EU or EEA, in particular in Germany, France and Ireland, in the USA and in other countries worldwide. This applies in particular to service providers and their subcontractors.

If personal data is transferred to countries that do not guarantee adequate data protection under the applicable data protection law, we rely on appropriate safeguards. These include in particular the Swiss-U.S. Data Privacy Framework or the EU-U.S. Data Privacy Framework, insofar as the respective recipient is certified accordingly, standard data protection clauses, recognised contractual safeguards and supplementary technical and organisational measures.

In certain cases, we may also transfer data abroad on the basis of a statutory exception, in particular if you have given your consent, the transfer is necessary for the performance of a contract, the transfer is necessary for the establishment, exercise or enforcement of legal claims, there are overriding public interests, or the data has been made generally accessible by you and you have not objected to the processing.

You can request further information on the safeguards used or a copy of the relevant safeguards via the contact details in Section 1, unless overriding confidentiality interests prevent this.

18. Retention period

We only store personal data for as long as is necessary for the respective purposes, as long as we have a legitimate interest in storing it, or as statutory retention obligations require. Once the purpose no longer applies or the relevant periods have expired, we delete or anonymise personal data.

The following principles apply in particular:

Server log files are generally deleted after 30 days, unless security-related incidents or legal reasons require longer retention.
We store data from enquiries and general communication for as long as is necessary to process the enquiry and for any follow-up communication.
We store data from course, training and contractual relationships for the duration of the relationship and thereafter for as long as statutory retention obligations exist or claims can be asserted.
We generally retain accounting and billing-related data for ten years.
We store data from admission procedures for the duration of the procedure. In the case of unsuccessful admission procedures, we generally delete the data after six months, unless longer retention has been agreed, is required by law, or legitimate interests prevent deletion.
We store newsletter data until you unsubscribe or withdraw your consent. After unsubscribing, we may continue to store certain data insofar as this is necessary to document the consent or the unsubscription.
We store data relating to cookie consents for as long as is necessary to document your selection.
We store data in analytics and marketing services in accordance with the respective settings and provider functions; Google Analytics data is currently generally configured to 2 months for event data and 14 months for user-level data.

19. Rights of data subjects

Depending on the applicable data protection law and subject to the respective statutory requirements, you have certain rights. These include in particular:

the right of access to the personal data processed by us;
the right to rectification of inaccurate or incomplete data;
the right to erasure or destruction of personal data, insofar as the statutory requirements are met and no retention obligations or overriding interests prevent this;
the right to restriction of processing, insofar as the GDPR applies;
the right to receive or transfer the data you have provided in a common electronic format, insofar as provided for by law;
the right to object to certain processing, in particular direct marketing;
the right to withdraw consent given at any time with effect for the future;
the right, in the case of automated individual decisions, to be informed in accordance with the applicable law and to state your own point of view;
the right to lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC) or, insofar as the GDPR applies, with a competent data protection supervisory authority in the EU.

If you wish to exercise a right, please contact us at the contact address given in Section 1. We may require proof of your identity in order to process your request. This serves to protect your data against unauthorised access.

20. Automated decisions and AI

We do not make any decisions based solely on automated processing that have legal effects on you or similarly significantly affect you.

We currently do not use any AI systems to assess registrations, admission procedures or admission decisions automatically. Should we use AI systems in the future for purposes that are significant for you or that trigger special data protection requirements, we will inform you appropriately.

21. Data security

We take appropriate technical and organisational security measures to protect your personal data against manipulation, loss, destruction, unauthorised access and unauthorised disclosure.

Our website is delivered via an encrypted HTTPS connection. Please note that data transmission over the internet may in principle have security gaps; complete protection against any access by third parties is not possible.

22. Changes to this privacy policy

We may amend this privacy policy at any time, in particular if our data processing, the services we use or legal requirements change. The version published on our website at the time of your visit applies.

23. Contact for data protection questions

If you have any questions about data protection or about exercising your rights, please contact:

zoe ArtsTherapy – ZOE SCHOOL FOR DANCE MOVEMENT THERAPY GmbH

Elsässerstrasse 34, CH-4056 Basel

Email: brigitte.zueger@zoeschool.ch

Phone: +41 61 382 60 76