Privacy Policy

Last updated: 2 November 2026

1. Controller

TUNNL is operated by PEDL Labs SA, Rue du Grand-Pont 12, 1003 Lausanne, Switzerland (company number CHE-132.000.482, legal@pedllabs.com). PEDL Labs SA is the controller under the Swiss Federal Act on Data Protection (FADP), the EU General Data Protection Regulation (GDPR) and the UK GDPR, and the responsible party under South Africa's Protection of Personal Information Act (POPIA), for personal data processed through the TUNNL website at tunnl.app, including the early access sign-up and any contact forms. Where these laws differ, we apply the standard that gives you the greater protection.

TUNNL is built on KINTRA, PEDL Labs SA's own fan identity and loyalty platform.

2. Data we process

• Details you give us: your email address and, where a form asks for them, details such as your name, country, the teams or shows you follow, and any message you send us. Today the early access form asks only for your email address.
• Sign-up records: the date and time you signed up and, where we record it, the TUNNL page you signed up from.
• Technical data: IP address, browser and device type, pages viewed and timestamps, which our hosting provider necessarily sees to deliver and secure the site.
• Correspondence: emails you exchange with us, for example at unsubscribe@tunnl.app or legal@pedllabs.com.

We do not ask for, and do not want, special category personal data (GDPR) or special personal information (POPIA).

Giving us your email is voluntary. If you choose not to, nothing else on the site is affected.

TUNNL is for people aged 18 and over. Please do not sign up if you are under 18. We do not knowingly collect personal data from anyone under 18, and if we learn that we have, we will delete it.

3. Why we use it and legal basis

• Early access emails: to confirm your sign-up and email you about TUNNL early access, product updates and launch news. Legal basis: your consent (GDPR Article 6(1)(a); POPIA sections 11(1)(a) and 69), given by submitting the form, which you can withdraw at any time. The wording shown when you sign up is: By signing up you agree to the TUNNL Terms and Privacy Policy, and to hear from us by email. You can leave whenever you like.
• Direct marketing under POPIA: we send electronic direct marketing only with your consent, which we ask for once when you sign up.
• Messages and requests: to answer what you send us. Legal basis: our legitimate interest, or steps you ask us to take before entering into a contract (GDPR Article 6(1)(f) or (b)).
• Security and running the site: to run, secure and improve the site and keep our forms free from abuse, including recording sign-up times. Legal basis: our legitimate interest (GDPR Article 6(1)(f); POPIA section 11(1)(f)). The data is minimal, expected and used only for these purposes.
• Legal duties: to meet our legal obligations (GDPR Article 6(1)(c)).
• Your TUNNL fan profile: we use the details you give us to create and maintain your TUNNL fan profile on KINTRA, so we can manage your early access and, later, your TUNNL membership and rewards. Legal basis: your consent, given when you sign up. Your profile and consent are used only for TUNNL, and are never used for marketing by any other business using KINTRA.
• Anonymised statistics: we may combine data into anonymised, aggregated statistics that cannot identify you, to improve our products. Legal basis: our legitimate interest (GDPR Article 6(1)(f)).

We do not make decisions about you by automated means, and we do not use your data for profiling (automated analysis to evaluate or predict things about you).

4. Who receives it

We use service providers who act only on our instructions, as processors (GDPR) and operators (POPIA), under written contracts that require them to protect your data. Currently these are:

• Netlify, Inc. (United States): hosts the website and runs the code that receives our forms.
• Supabase, Inc. (United States): provides the database where sign-up details are stored.
• Resend (United States): sends our emails, including your sign-up confirmation from hello@tunnl.app.
• GoDaddy (United States): forwards emails sent to unsubscribe@tunnl.app.
• Amazon Web Services (United States): hosts the KINTRA platform, where your TUNNL fan profile is kept.
• Okta, Inc. (Auth0) (United States): provides sign-in and security for KINTRA.

We may also share personal data with our professional advisers where necessary, with courts, regulators or law enforcement where the law requires it, and with a buyer or successor if PEDL Labs SA is sold, merged or reorganised, subject to this policy continuing to apply. We do not sell your personal data, and we do not give it to anyone for their own marketing. If we add providers, we will update this list.

5. Transfers abroad

Your sign-up details are stored in the European Union (Ireland). PEDL Labs SA is established in Switzerland, which the European Commission and the United Kingdom recognise as providing adequate protection.

Netlify, Supabase, Resend, GoDaddy, Amazon Web Services and Okta are United States companies and may access or process your data in the United States, and Amazon Web Services may also process it in other regions where it operates. We rely on the European Commission's Standard Contractual Clauses (as adapted for Switzerland), the UK International Data Transfer Addendum and, where applicable, the providers' certifications to cover these transfers. You can ask for a copy of these safeguards by emailing legal@pedllabs.com.

For people in South Africa: under POPIA section 72, we transfer your personal information outside South Africa to Switzerland, the European Union, the United States and, through Amazon Web Services, other regions where it operates. These transfers are covered by laws or binding contractual terms that provide protection substantially similar to POPIA, and you consent to them when you submit the form.

6. Storage period, security and breaches

We keep early access and contact details, including your TUNNL fan profile, for 24 months after you sign up or last contact us, whichever is later, then delete them. If we close the early access programme, or TUNNL does not launch, we delete the list. We may keep information for longer where the law requires it, or to establish, exercise or defend a legal claim.

If you unsubscribe, we stop emailing you and keep only what we need to make sure we don't email you again.

We protect your data with measures appropriate to the risk, including encryption in transit (TLS), encryption at rest in our database, and access restricted to the people who need it. Our providers are contractually required to apply equivalent measures. No system is completely secure, so we cannot promise absolute security.

If a personal data breach is likely to result in a risk to you, we will notify the relevant authority where the law requires it (within 72 hours under the GDPR and UK GDPR, and as soon as reasonably possible under the FADP and POPIA), and tell you without undue delay where the risk to you is high.

7. Your choices and rights

Every email we send carries an unsubscribe link, and you can also unsubscribe by emailing unsubscribe@tunnl.app.

Under the FADP, the GDPR and UK GDPR (Articles 15 to 22) and POPIA (sections 23 to 25), you have the right to:

• access the personal data we hold about you and receive a copy;
• have inaccurate data corrected;
• have your data deleted, subject to legal exceptions;
• restrict how we use your data in certain circumstances;
• receive your data in a portable format, where we rely on your consent;
• object to processing based on our legitimate interests;
• object at any time to direct marketing; and
• withdraw consent at any time, without affecting what we did before.

To exercise any right, email legal@pedllabs.com. We will respond within one month under the GDPR and UK GDPR, and within a reasonable time under the FADP and POPIA. We may ask you to verify your identity first. We will not charge you unless a request is manifestly unfounded or excessive.

You can also complain to a supervisory authority: the Federal Data Protection and Information Commissioner in Switzerland; your local supervisory authority in the European Economic Area; the Information Commissioner's Office in the United Kingdom; or the Information Regulator in South Africa (complaints@inforegulator.org.za).

8. Cookies and tracking

The site uses only the cookies and local storage needed for it to work, and runs no analytics, tag manager, advertising or tracking pixels. When a page loads, our hosting provider, Netlify, necessarily sees your IP address and browser details in order to deliver the page. We do not use this to identify or track you.

If we add analytics or tracking cookies later, we will ask for your consent first where required and update this policy.

9. Updates to this policy

We may update this policy as TUNNL or the law changes. The date at the top shows when it last changed. If we make a significant change, such as collecting new kinds of data or using it for new purposes, we will take reasonable steps to tell you, including emailing the early access list where appropriate.

10. Contact

Privacy questions or requests: legal@pedllabs.com, or PEDL Labs SA, Rue du Grand-Pont 12, 1003 Lausanne, Switzerland (CHE-132.000.482).