Une équipe. Une mission. Des possibilités infinies.

1. Purpose

1.1. The purpose of this Privacy Policy is to inform Users about the nature of the personal data collected and processed by Smeetz, as well as about the purpose of this processing and Users' rights in terms of the personal data collected.

1.2. This Privacy Policy applies in addition to the general terms and conditions as well as to other documents included in the Contractual Documentation. Should there be a divergence between the general terms and conditions and these terms and conditions, the latter shall take precedence.

1.3. In case of disagreement with this Policy, the User is invited not to use the Website, the App or the Platform and not to communicate his personal data.

1.4. A summary table of the data processed is attached to this Privacy Policy.

2. Data Collected

2.1. Information collected automatically. By consulting the Website or by using the App, certain data concerning the User is collected automatically (IP address, location, pages on the Platform consulted, date and time of consultation, cookies or similar technologies, browser preferences, operating system, access data, etc.). In addition to data collected directly by Smeetz, some data may be collected by other service providers such as Google Analytics, Hubspot or Hotjar. Only the privacy policies of these service providers are applicable when they collect data and Smeetz cannot be held liable for data processing of these third party companies. To learn more about the use of cookies, please consult the Cookie Management Policy.

2.2. Information provided freely by users. The User may be required to provide personal data in order to use the Services offered by Smeetz. The data necessary for the use include :

1. For all Users : the email address, first name, last name, respectively the company name.
2. For Buyers : the delivery address, billing address, password.
3. For Organisers and Sellers : the field of activity, Sellers’ bank details, descriptions of personal abilities related to the activities offered on the Platform.

This data is mandatory and the lack thereof may render the provision of these Services impossible. In addition to the data required for accessing the Services, the User may provide optional data such as a photograph, interests, hobbies, biography, recreational activities, saved payment methods, etc., on a voluntary basis. The data necessary for use (mandatory) is referred to in the forms in the fields with an asterisk, which indicates that the form cannot be validated without filling in the dedicated field.

2.3. Informations provided by third parties. By registering on the Website via a social network login or by linking to its user account such service providers (e.g. Facebook, Google, Swisspass), the User grants Smeetz permission to access, collect and use the information related to the social media profile (name, first name, e-mail address, friends list, likes, etc.). To improve the content of the offers proposed by Smeetz based on the User’s interests, said User may also decide to share with Smeetz data collected by third parties such as Spotify, Linkedin, or any other internet service provider that can link to his/her user account from the dedicated Platform page used for this purpose.

2.4. Information concerning minors. No data concerning minors under the age of 13 is collected. Data that might be collected unintentionally is destroyed as soon as possible. Personal data of minors between the ages of 13 and 16 can be collected with the consent of parents or legal guardians.. Minors may not register on Smeetz for Business.

2.5. Information related to the use. By using the Smeetz Services, certain data is collected. This includes events visited, Tickets purchased or sold, photos, videos, descriptions of activities offered.

‍

3. Use of collected data

3.1. Data collected automatically. The data collected automatically allows Smeetz to analyze the behavior of Users on the Website, traffic and preferences, in particular to optimize and improve the quality of its Services.

3.2. Data provided by Users or by third parties. Smeetz processes and uses the data necessary to fulfill its contractual obligations and to verify compliance with the terms and conditions of use. The processing of this data also makes it possible to provide personalized content to better meet User expectations.

3.3. Data collected when using the Services. Smeetz also records User behavior on the Platform in order to provide personalized content to better meet User expectations and improve the quality of its Services.

4. Communication and transmission of data

4.1. The User's personal data will not be transmitted to third parties with the intention of using them for direct marketing purposes.

4.2. The User's personal data may be transmitted or communicated to third parties in the cases listed in the attached table and in particular in the following cases :

1. for the purpose of executing the contract between Buyer and Seller. Data collected during a Ticket purchase may also be used to promote similar or identical items that may be of interest to the User;
2. for the purpose of fulfilling obligations under the terms and conditions applicable to Organizers affiliated with a « Destination » or similar programs, in particular to provide Smeetz customers with (As defined in the Software as a Service contract - the SaaS Contracts - concluded between a « Destination » or a similar Client and Smeetz) a record and usage data of Authorized Users (as defined in the respective SaaS Agreements) ;
3. for the purpose of fulfilling the obligations arising from the subscription to a Plan (As defined in the Terms and conditions for the use of Smeetz for Business ;
4. in connection with the provision of services on behalf of Smeetz ;
5. when the User has agreed to them;
6. when required by law or communication is reasonably necessary to implement a court decision or to respond to a legal claim ;
7. in the event of a merger, acquisition of the company or divisions thereof by another company.

4.3. It should be borne in mind that the processing of data by third parties to which Smeetz may be required to communicate data falls exclusively under the privacy policy of said third parties. Smeetz cannot be held liable for the use of this data.

4.4. Smeetz reserves the right to anonymize certain data for the purpose of transmitting it to third parties for research, statistical or marketing purposes.

5. User rights

5.1. Right of access and right to data portability. The User may at any time request that the personal data stored by Smeetz about him or her be transmitted in a structured, commonly used and machine-readable format. In addition, the User may request Smeetz to transfer such personal data directly to another controller, which Smeetz will do within a reasonable period of time and to the extent technically possible.

5.2. Droit of rectification. User whose data is inaccurate or incomplete have the right to obtain it for rectification.

5.3. Droit to withdraw and/or object. The User may at any time object to the collection or processing of certain data concerning him/her (opting out). This objection may result in the termination of the use of the Website, App or Platform. In particular, if an Authorized User opts out of the transmission of data to Smeetz customers by an Authorized User (art. 4.2(2)), the latter will be removed from the program (i.e. from the List of Authorized Users) and will no longer benefit from the advantages offered by the Destination or similar Smeetz customer.

5.4. Right to erasure. The User has the right to request the erasure of his/her personal data if their use is no longer necessary or if the User no longer agrees with the processing of his/her data. The data will be deleted as soon as possible, unless otherwise provided by law or contractual agreement.

5.5. Exercice of rights. To exercise the rights above, the User can make a request at any time to the following address : support@smeetz.com

6. Security

6.1. Smeetz takes the protection of its Users' data very seriously and is committed to handling their personal data confidentially and with the utmost care. In particular, Smeetz takes appropriate security measures to prevent unauthorized access, disclosure, alteration or destruction of collected data in accordance with the Swiss Federal Data Protection Act (DPA) and the related ordinance (DPAO). However, although some personal data is encrypted, Smeetz cannot guarantee full and complete protection of the data against unauthorized processing due to the risks associated with the use of the Internet and electronic means of communication.

7. Data retention

7.1. The data collected by is retained for as long as the purpose for which it was collected so requires, subject to legal provisions providing for longer data retention periods. After this time, personal data will be deleted.

8. Modifications

8.1. Smeetz reserves the right to modify its Privacy Policy at any time. The modifications will be published on the Website and will come into force as of the date of posting.

8.2. The Online Privacy Policy is applicable. By continuing to browse the Site or the App, the User accepts the privacy policy in force.

Summary table of the data processed

9. AI connectors and sub-processors

Why this section exists

Smeetz operates the Smeetz MCP server, which lets an organizer's authorized users connect a third-party AI assistant (Claude, ChatGPT, or another MCPcompatible client) to their Smeetz data. This section explains what data is processed through that channel, who else processes it, and how it is protected.

The rest of the Smeetz Privacy Policy applies in full. This section adds disclosures specific to the MCP.

B.1. What the MCP can access

The MCP exposes a defined set of tools that operate only within the scope of the authenticated user's permissions in the Smeetz back office. Through these tools, the MCP can read or modify the following categories of data, depending on the user's role:

• Organizer configuration (venues, products, ticket categories, pricing rules).
• Bookings, orders, and tickets (including customer name, email, booked product, amount).
• Sales, payments, and refund records.
• Promo codes, vouchers, and membership records
• Operational data (timeslots, capacity, availability).

The MCP does not access:

• Payment card data (held by the PSP, not by Smeetz).
• Credentials or hashed passwords.
• Data outside the authenticated user's organizer scope.

B.2. How the data flow works

When a user invokes the MCP from an AI assistant:

1. The assistant sends a tool call to the Smeetz MCP server over HTTPS.
2. The MCP authenticates the user via OAuth 2.1 and authorizes the call against the user's role.
3. The MCP fetches data from Smeetz production systems and returns it as a tool result.
4. The AI assistant then incorporates that result into its response to the user.

The end-user's prompts to the AI assistant never reach the Smeetz MCP server. Smeetz only sees the tool calls the assistant decides to make, not the conversation that led to them.

B.3. Sub-processors

When you connect the Smeetz MCP to a third-party AI assistant, that AI provider becomes a sub-processor for any data you cause to flow through it. The current list of AI providers with which the Smeetz MCP is officially compatible is:

• Anthropic PBC (Claude). Data processed under Anthropic's Commercial Terms of Service and DPA.
• OpenAI (ChatGPT, when our submission is approved). Data processed under OpenAI's enterprise terms and DPA.

The full Smeetz sub-processor list, maintained at smeetz.com/sub-processors , is updated when a provider is added or removed. Material changes are notified 30 days in advance to the organizer's primary contact.

If you do not want a specific AI provider to act as a sub-processor for your data, do not connect the Smeetz MCP to that provider's client.

B.4. No training on customer data

Smeetz does not use organizer data accessed through the MCP to train its own models or any third-party model.

For data that flows to AI providers via the MCP:

• Anthropic Claude: under Anthropic's Commercial Terms, customer inputs and outputs sent via the API or commercial products are not used to train Anthropic's models by default. See Anthropic's published terms for the current version of this commitment.

• OpenAI ChatGPT: under OpenAI's API and Enterprise terms, customer data is not used to train OpenAI's models by default. See OpenAI's published terms for the current version.

If an AI provider's policy on this changes, Smeetz will notify organizers and, where relevant, update this section and the sub-processor list.

B.5. Authentication tokens

MCP access tokens are issued per user via OAuth 2.1 with PKCE and Dynamic Client Registration. Tokens are:

• Stored encrypted at rest in Redis and Firestore, behind Smeetz's authenticated infrastructure.
• Scoped to the issuing user and the issuing organizer.
• Short-lived, with refresh tokens rotated according to the published expiry policy.
• Revocable at any time by the user or by Smeetz.

Tokens are not shared with the AI provider beyond what is strictly required for the OAuth handshake.

B.6. Logging and retention

For each MCP call, Smeetz logs:

• The user ID and organizer ID.
• The tool name invoked
• The timestamp and result status (success / failure / error code).
• A non-identifying request ID for support and audit purposes.

Smeetz does not log:

• The end-user's prompt to the AI assistant (it does not reach the Smeetz MCP server).
• The full content of read-tool outputs, beyond what is strictly necessary for debugging within the retention window.

Audit logs are retained for the period defined in the main Smeetz Privacy Policy and deleted thereafter, except where law or contract requires longer retention.

B.7. Data residency

MCP infrastructure (compute, Redis, Firestore) is hosted in the European Union, consistent with Smeetz's standard hosting for European organizers. Tool calls from Anthropic and OpenAI may be routed through their respective regions per their own infrastructure choices, which is the part of the flow governed by their terms.

B.8. Your rights

Your rights under the main Smeetz Privacy Policy (access, rectification, erasure, portability, restriction, objection) apply to data accessed through the MCP. To exercise any of these rights, contact privacy@smeetz.com .

You can revoke MCP access for your user at any time from the Smeetz back office, which immediately invalidates the associated token.

B.9. Security incidents

If you suspect that an MCP token has been compromised, that data has been accessed without authorization, or that the MCP is behaving anomalously, contact security@smeetz.com immediately. Smeetz operates under the incident-response timeline defined in the main Privacy Policy and applicable DPA.

B.10. Changes

Smeetz may update this section at any time. Material changes will be notified through the Smeetz back office or by email to the organizer's primary contact, and the sub-processor list will be updated accordingly.