How we handle your data.

This page explains what data themepark.com collects, why, and how it's handled. The short version: very little, only when you contact us, and never sold or shared with advertisers.

Last updated: 25 April 2026

Who we are

Theme Park AG, a Swiss Aktiengesellschaft registered in the Commercial Register of the Canton of Zürich (UID CHE-420.189.003). Full company details and registered office are in the imprint. Contact: via the contact form.

What we collect

We only collect what we need to run a website and respond to people who contact us.

• Contact form submissions. When you send a message, we receive your name, email address, and the content of your message.
• Server logs. Our web server records standard request data — IP address, timestamp, requested URL, browser user agent, referrer. Used for operating and securing the site.
• Network-level cookies from Cloudflare. The site is served through Cloudflare, which may set cookies (e.g. __cf_bm, cf_clearance) for bot detection and DDoS protection. These are operational, not analytical.

What we don't do

• No analytics, no tracking pixels, no third-party advertising scripts.
• No cookies set by us beyond what Cloudflare's network protection requires.
• No selling, renting, or sharing your data with advertisers or data brokers — ever.

Why we collect it

• Contact form: to read and respond to your message. Legal basis: pre-contractual measures (GDPR Art. 6(1)(b)) and our legitimate interest in responding to inbound communication.
• Server logs and Cloudflare: security, abuse prevention, and reliable operation of the site. Legal basis: legitimate interest (GDPR Art. 6(1)(f)) under Swiss FADP equivalents.

Where data goes

Contact form submissions are routed through Mailgun (Mailgun Technologies, Inc., based in the United States), which forwards the message to our internal inbox. Mailgun acts as a data processor on our behalf. This means a limited amount of data — your name, email, and message — crosses the Swiss/EU border to a US-based processor. Mailgun is contractually bound to handle the data only as instructed and under EU Standard Contractual Clauses.

Cloudflare (Cloudflare, Inc., United States) serves the site as our content delivery network and security layer. They process traffic metadata and may briefly cache page content.

We do not host your data with any other third party.

How long we keep it

• Contact form messages: retained in our inbox for as long as needed to handle your request and any follow-up. Older correspondence is archived or deleted on a periodic basis.
• Server logs: rotated and retained for up to 30 days, then deleted.
• Cloudflare network cookies: short-lived, expire automatically (typically minutes to hours).

Your rights

Under the Swiss Federal Act on Data Protection (FADP) and, where applicable, the EU GDPR, you have the right to:

• Request access to the personal data we hold about you
• Have inaccurate data corrected
• Have your data deleted (subject to legal retention requirements)
• Object to or restrict processing based on legitimate interest
• Receive your data in a portable format
• Lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC) or your local EU supervisory authority

To exercise any of these rights, send a request via the contact form.

Security

The site is served exclusively over TLS. Form submissions travel encrypted end-to-end. Access to the inbox where messages are received is restricted to authorized personnel and protected by strong authentication.

Changes to this policy

If we make material changes to this policy, we'll update the date at the top and, where the change affects how we use existing data, take reasonable steps to notify affected individuals. The current version always lives at this URL.