PREAMBLE | COMPLIANCE

We are highly committed to protecting personal data and respecting the privacy of our clients and users.

The purpose of this privacy policy (the « Policy ») is to inform our clients, as well as the end-users (« you ») of the VIRTUAL HALL® application (the « Application »), by the Swiss Federal Act on Data Protection (« FADP ») and, where applicable for the users concerned, the General Data Protection Regulation of the European Union (« GDPR »).

It details the personal data that may be processed when using the Application, why they are processed, how we use or access it, and your rights.

Important note on data collection: Under guidance from our technical team, Virtual Hall® is designed to minimise the direct collection of personally identifiable data. We only collect and process data that is strictly necessary for the application’s technical operation and the optional services explicitly described below (such as the newsletter if you subscribe to it separately). 

Meta Platforms Ireland Limited (or the applicable platform provider) manages user account management, purchases, and basic statistics linked to your account on the platform according to its privacy policy.

Where consent is referred to as the legal basis for processing, we request your explicit agreement before collecting or processing the relevant data (for example, via a checkbox when subscribing to the newsletter on our website or a setting within the Application for an optional feature). If you do not consent or withdraw it subsequently, the relevant data will not be processed (or will cease to be processed).

Where the performance of a contract is referred to as the legal basis, this means that the processing is essential to providing the service you have requested (to use the VIRTUAL HALL® Application) and that it is based on the contract between us, such as the terms of use of the VIRTUAL HALL® Application.

Where legitimate interest is referred to as the legal basis, we process data to ensure our services’ technical operation and security or to analyse usage globally and anonymise to improve our services. We guarantee that this processing respects your rights and freedoms.

You may object to some of this processing (see Section 6).

You will find further information below regarding:

• Who we are and how to contact us (including our representative in the EU) (Section 1).
• The products and services concerned (Section 2).
• The categories of personal data processed, their sources, purposes, and legal bases (Section 3).
• The recipients of your data (platform, processors) (Section 4).
• The retention period (Section 5).
• Your rights (access, rectification, erasure, objection, etc.) and how to exercise them (Section 6).
• Amendments to this Policy (Section 7).
• Data security (Section 8).
• The validity of the Policy (Section 9).

1. CONTACT DETAILS

1.1. Data Controller (Switzerland)

The joint controllers responsible for this Policy and any processing of personal data relating to our products and services are:

• Initiative/Registered Trademark: Fondation de l’Orchestre de la Suisse Romande à Genève (FOSR)
• Designer and Operating Licence Holder: CYBEL’ART SA / IDE: CHE-110.130.923
• Address: Grand’Rue 29, 1110 Morges (VD), Switzerland
• Technology: Powered by Real Illusions XR Engine

We can be contacted using the following details:

• By telephone: +41(21) 802 50 86 or +41(22) 807 00 00
• By e-mail: contact@virtual-hall.com or desk@cybelart.dev    

1.2. Representative in the European Union (under Art. 27 GDPR)

For users located in the European Union, our designated representative for data protection matters is:

• Name: Philippe Font at Real Illusions (France)
• Email: desk@cybelart.dev | rgpd@realillusions.io  

You may contact our representative with any questions regarding processing your personal data under the GDPR.

2. SCOPE OF APPLICATION

This Policy applies to the following products and services:

2.1. The VIRTUAL HALL® Application

The VIRTUAL HALL® Application is an immersive application available on the Meta Horizon Store (Meta Quest) and potentially other future platforms.

2.2. E-mail and Newsletter Services (Optional)

Communication relating to products and services, informational newsletters, and promotional offers (including those from partners) is solely subject to your voluntary subscription and explicit consent via our website or another means separate from the Application.

3. CATEGORIES AND PURPOSES OF DATA PROCESSED

3.1. Data We Do NOT Process Directly

We wish to emphasise the categories of data that we do NOT collect or process directly via the Application:

• 3.1.1. Virtual Hall®-Specific User Account Data: We do not create or manage separate user accounts for the Application. Access and identification are handled via your Meta account (or other applicable platform account). Therefore, we do not collect your name or email address directly via the Application for account management purposes.

• 3.1.2. Payment Data: Transactions related to the purchase of the Application or additional content are processed directly by Meta (or the relevant distribution platform) via your account on that platform. We cannot access your payment information.
• 3.1.3. Special Categories of Personal Data: We do not actively process sensitive data (racial or ethnic origin, political opinions, religious or philosophical beliefs, health data, data concerning a natural person’s sex life or sexual orientation, genetic data, biometric data to uniquely identify a natural person,1 data concerning criminal convictions and offences). Suppose you voluntarily provide us with unsolicited data (for example, via a revealing email address in the context of a support request). In that case, it will only be processed strictly to respond to your request.
• 3.1.4. Audio Data (Voice Input): We do not currently collect voice data from the microphone of your headset or device.
• 3.1.5. Social Data (Multiplayer Interactions): The Application does not currently include multiplayer features. Therefore, we do NOT collect data related to direct interactions between users within the Application (e.g., friends list, chat history).
• 3.1.6. Content of Media Files Accessed: The Application allows access to video, audio, and image files. These files may be temporarily stored (cached) on your device to optimise performance and reduce bandwidth usage. We do not collect, analyse, or share the content of these files.

3.2. Categories of Personal Data Processed, Purposes, Legal Bases, and Sources

The personal data we may process is limited to the following categories:

• 3.2.1. Technical and Connection Information Collected During Use of the VIRTUAL HALL® Application

• 3.2.2. Virtual Reality (VR) Interaction Data Processed in Real Time

• 3.2.3. Information collected via E-mail and Newsletter Services (if voluntarily subscribed)

4. RECIPIENTS OF DATA (PLATFORM, PROCESSORS)

We do not sell or rent your data. We only share your identifiable personal data with third parties in limited and controlled circumstances:

4.1. Distribution Platform (Meta)

Using the Application via the Meta Horizon Store implies that Meta Platforms Ireland Limited processes your specific data as the platform provider (managing your Meta account, payments, providing the execution environment, and potentially collecting usage statistics). This processing is subject to Meta’s privacy policy, which we invite you to consult.

4.2. Transmission to External Service Providers (Processors)

We use service providers for specific technical operations. We only transmit to them the data strictly necessary for their task and require them, by contract (Data Processing Addendum), to respect the confidentiality of your data, use it only on our behalf and according to our instructions, in compliance with the FADP and GDPR (Art. 28).

We prefer providers in Switzerland or the European Economic Area (EEA). If data transfer outside these areas is necessary (e.g., to the United States for video hosting), it only occurs if appropriate safeguards are in place (e.g., Standard Contractual Clauses approved by the European Commission and recognised by the FDPIC, relevant adequacy decision).

4.3. List of Main Providers and Purposes

4.4. Legal Obligations

We may be required to disclose your data if required by law (e.g., to a judicial or administrative authority) or if we believe in good faith that this is necessary to comply with a legal procedure, respond to claims, or protect our rights, property, or safety, or those of our users or the public.

5. DATA RETENTION PERIOD

5.1. General Principle

We retain the personal data we process directly only for the duration necessary to achieve the purposes they were collected, including satisfying any legal or reporting requirements applicable to that specific data.

5.2. Specific Durations

• Account Data: We do not retain separate user account data. [source: 56] Account management is handled via your Meta account (or other applicable platform account) according to their retention policy.
• Technical Logs: Technical logs (e.g., IP address for security when connecting to content servers) are kept for a limited period not exceeding 30 days unless a legal or compelling security need justifies longer retention.
• Interaction Data: Real-time interaction data (movements, commands, hand tracking if enabled) are not stored by Virtual Hall®.
• Analytics Data: Aggregated and anonymised usage data are retained as long as they are helpful for service improvement, but without allowing personal identification.
• Newsletter Data (if applicable): Your email address is retained if you do not withdraw your consent. This retention only applies if you have voluntarily subscribed to our newsletter separately from using the Application.

6. YOUR RIGHTS REGARDING YOUR DATA

Under the FADP and GDPR (for concerned users), you have the following rights regarding the personal data we may hold about you:

• 6.1. Right of Access: To confirm whether or not we are processing personal data concerning you, and, where that is the case, access to the personal data and a copy thereof.
• 6.2. Right to Rectification: To obtain the correction of inaccurate or incomplete personal data we hold concerning you (primarily the newsletter email address if you are subscribed).
• 6.3. Right to Erasure (‘Right to be Forgotten’): To request the deletion of personal data we hold concerning you, in the cases provided for by law.
• Data concerned: Personal data we might hold about you (e.g., your email address if subscribed to the newsletter or temporary technical logs linked to your IP address before their automatic deletion).
• Limitations: This right is not absolute. We may retain specific data if necessary to comply with a legal obligation or to establish, exercise or defend legal claims. Data processed by Meta is subject to their policy.
• 6.4. Right to Restriction of Processing: To request the ‘freezing’ of the use of data we hold concerning you in certain situations (contesting accuracy, unlawful processing, etc.).
• 6.5. Right to Object:
• To object, on grounds relating to your particular situation, to processing your data based on our legitimate interest (e.g., use of IP address for security).
• To object to processing your data for direct marketing purposes (mainly concerns the newsletter).
• 6.6. Right to Data Portability: To receive the personal data concerning you, which you have provided to us and which we hold (primarily your email address if you are subscribed to the newsletter and the processing is automated), in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller, where the processing is based on consent3 and carried out by automated means.
• 6.7. Right to Withdraw Consent: Where processing is based on your consent (e.g., newsletter, hand tracking), you may withdraw it without affecting the lawfulness of processing based on consent before its withdrawal. Withdrawal can be done via the provided mechanisms (unsubscribe link, setting in the Application for hand tracking) or by contacting us.
• 6.8. Right to Lodge a Complaint: If you consider that the processing of your data infringes applicable law, you have the right to complain to the competent supervisory authority:
• Switzerland: Federal Data Protection and Information Commissioner (FDPIC).
• EU: The data protection authority of your country of habitual residence, place of work or place of the alleged infringement.
• 6.9. Exercising Your Rights: To exercise your rights listed above, please email us at contact@virtual-hall.com or, for EU residents, contact our representative at desk@cybelart.dev. We may ask you to prove your identity to ensure the security of your data and will process your request within the legal timeframes (generally 30 days).

7. AMENDMENTS TO THIS PRIVACY POLICY

We may occasionally revise this Policy to adapt it to legal, technological, or functional developments. The applicable version is in force on the date you use the Application, as published on our website www.virtual-hall.com/privacy-policy-vhapp (or an equivalent link accessible from within the Application).

If substantial changes significantly impact your rights or how we process your data, we will inform you by appropriate means (e.g., notification within the Application or on our website). We encourage you to consult this Policy regularly. Prior versions are archived and available upon request.

8. DATA SECURITY

We implement appropriate technical and organisational measures to protect the personal data we process (primarily temporary IP logs and newsletter emails, where applicable) against loss, unauthorised access, disclosure, alteration or destruction, by applicable legal requirements and the state of the art. This includes measures such as logical and physical access control, relevant encryption (e.g., for data transfers), pseudonymisation where possible, and data processing agreements with our processors imposing strict security obligations on them. 

However, no security measure is infallible, and we cannot guarantee absolute security.

9. VALIDITY AND LANGUAGE

• Date of last revision: 31st March 2025
• Current version: 2.1.1
• Effective date: 31st March 2025

This Policy was initially drafted in French. In case of discrepancy, the French version shall prevail if translated into other languages.

END

Politique de confidentialité