Privacy policy
Version of 6 November 2026
The controller is Lead & Link, a non-profit association under Swiss law, which operates the game A table for 5. For any question about your data, write to us through the contact form of this site.
This policy covers the showcase site, the online game and the desktop app. It follows the Swiss Federal Act on Data Protection (FADP) and the GDPR. We sell no data, show no ads and build no advertising profiles. The French version is authoritative.
What data, why, for how long
| Situation | Data | Why | Retention |
|---|---|---|---|
| Visiting the site | Aggregated visit statistics, without cookies and without identifying visitors | Knowing which pages are read | Aggregated, no time limit |
| Any request to the site or the game | IP address, requested page, date, browser | Security, protection against attacks and abuse, diagnostics | A few days in our logs (automatic rotation), under Cloudflare's rules for its own logs |
| Contact form | Name, email, organisation, message | Answering you, organising a training | 2 years after the last exchange, unless the law requires otherwise |
| Facilitator account | Username, password stored as a hash (Argon2id, never in clear text), account expiry date | Giving access to running games | As long as the account exists |
| Guest player | Chosen first name or nickname, role held, no account and no password | Playing the game | See the game journal |
| Game journal | Game actions, results, players' nicknames, game description | Debrief with the facilitator, replaying the game, improving the game | No time limit |
| Evening break questionnaire | Answers per role and per game, without names | Assessing and improving the training | No time limit |
| Technical telemetry | Errors, reconnections, device performance indicators | Fixing bugs, helping the facilitator | 12 months |
| Browser storage | Settings (language, text size), solo games | Playing comfort | Stays on your device, can be erased at any time |
| Desktop app in local mode | Local game database | Playing without internet | Stays on the host computer, sent to the server only if the facilitator imports the journal |
Basis: performing the service you ask for (playing, facilitating, being contacted) and our legitimate interest in securing and improving the game. For participants in the European Union: Art. 6(1)(b) and (f) GDPR.
Providers and countries
| Provider | Role | Country |
|---|---|---|
| Hostinger | Hosting of the game server and its database | France (European Union) |
| Cloudflare | Site delivery, protection against attacks, bot check, cookie-free statistics | United States and worldwide network |
| Resend | Sending the contact form messages | United States |
For transfers to the United States we rely on the Swiss-U.S. Data Privacy Framework where the provider is certified, otherwise on the standard contractual clauses recognised by the Federal Data Protection and Information Commissioner (FDPIC).
Cookies
The showcase site sets no cookies. The game uses a single, strictly necessary cookie: it keeps your session open (facilitator or guest) and is not used for tracking. No consent is therefore requested. The Cloudflare Turnstile bot check sets no advertising cookie.
Security
All connections are encrypted (HTTPS). Passwords are never stored in clear text. Access to the server is limited to the association's administrators, and the server can only be reached through Cloudflare.
Your rights
You can ask for access to your data, its correction, its erasure or its delivery in a common format, and object to processing. Write to us through the contact form: we normally answer within 30 days. You can also contact the FDPIC (www.edoeb.admin.ch) or, in the European Union, the data protection authority of your country.
Changes
We may adapt this policy when the game or the site changes. The version in force is always published here, with its date.