Association, Club and Verein Member Forms

vitamin B, the Swiss specialist agency for associations, puts the number of Vereine at around 100,000. They run the football pitch, the music society, the neighbourhood association, the parents' group, the political local branch and the professional body. Almost all of them are administered in the evening by volunteers with day jobs, on whatever tool was free when the last secretary took over — a free form builder, a spreadsheet on a personal drive, and a chat group where the membership list gets forwarded as an attachment twice a year.

That is not negligence. It is what happens when a legal person with real data-protection duties has no compliance function, no budget and a committee that changes every three years. Schweizerform is built for exactly that shape: forms that are encrypted in the member's browser before anything leaves the device, with encrypted submissions stored in Switzerland, and only a holder of the Vault key able to read them. We cannot read your membership applications — not for support, not for analytics, not under legal process, because we do not hold the key. Everything exists in German, French, Italian and English, which for a cantonal or national association is the difference between a form and an obstacle.

A Verein Is a Legal Person With Data Duties and Almost No Compliance Capacity

An association under Art. 60 CC acquires legal personality as soon as its intention to exist as a corporate body is apparent from its written statutes — no register entry, no notary, no capital. That accessibility is the reason there are so many of them, and it is also why so many committees are surprised to learn that the nFADP applies to them in full. There is no small-association exemption in Swiss data protection law. The association is the controller, the committee is responsible, and the fact that everyone involved is a volunteer changes the risk appetite but not the legal position.

What changed on 1 January 2023, and what most committees still have not noticed

The anti-money-laundering revision added obligations aimed at a small subset of associations but written into general association law. Under Art. 61 para. 2 CC an association must now enter the commercial register if it conducts a commercial business to pursue its purpose, if it is subject to an audit requirement, or — the new third case — if it mainly collects or distributes, directly or indirectly, assets abroad for charitable, religious, cultural, educational or social purposes, subject to the published exemptions. Registered associations must keep a member directory under Art. 61a CC listing each member's first and last name or company and address, kept so that it is accessible from Switzerland at all times, with the information and supporting documents retained for five years after a member is removed. Art. 69 para. 2 CC requires a representative domiciled in Switzerland, and Art. 327b SCC makes an intentional breach of the directory and representative duties punishable by a fine.

On the data-protection side, most associations sit inside the exemption in Art. 24 DPO from keeping a register of processing activities, which applies to businesses and organisations with fewer than 250 employees. But that exemption falls away where the processing involves sensitive personal data on a large scale or high-risk profiling — and, as the next section shows, an association's membership list can be sensitive data by its very existence. The practical Swiss checklist for a small organisation is in the nFADP compliance checklist for forms.

The Membership List Is Often Sensitive Data by Its Very Existence

Art. 5 lit. c nFADP lists as sensitive: data on religious, philosophical, political or trade-union views or activities; data on health, the intimate sphere or racial and ethnic origin; genetic and biometric data identifying a person; data on administrative or criminal proceedings and sanctions; and data on social-assistance measures. Read that list next to a membership register. The member list of a church association is data about religious affiliation. The list of a party's local branch is data about political views. A union's list is trade-union membership. The association did not ask a sensitive question — the sensitivity is in belonging.

How Do You Run a Member Vote That Is Verified and Still Secret?

This is the question that blocks every conversation about digitising an association, and it deserves a direct answer rather than a sales one. The requirement is genuinely contradictory: one vote per member, verifiably, and no way to connect a vote to the member who cast it. Any single form that authenticates the voter can, in principle, link the ballot to the voter. That is not a limitation of our product; it is the reason national e-voting systems are an entire regulated discipline.

What Swiss association law actually requires

• Art. 67 CC — all members have equal voting rights in the general assembly, and resolutions are taken by a majority of the votes of the members present. Weighted voting, proxies and quorums exist only if your statutes create them.
• Art. 66 para. 2 CC — the written consent of all members to a proposal is equivalent to a resolution of the assembly. Read that carefully: without a statutory provision, a circular resolution needs unanimity, not a majority. This is where most improvised online votes fail.
• A purely virtual or hybrid assembly needs an express basis in your statutes. Since the 2023 company-law revision this is the settled expectation. If your statutes are silent, amend them at a physical assembly first — in that order, not the other way round.
• Art. 68 CC — a member is excluded by law from voting on a resolution concerning a transaction or dispute between the association and that member, their spouse or a direct relative.
• Art. 75 CC — any member who did not consent may challenge a resolution that violates the law or the statutes in court within one month of learning of it. A procedurally sloppy online vote is not merely embarrassing; it is challengeable for a month by anyone who lost.

The pattern that works: separate the person who knows the members from the person who counts

«Anonymous but verified» is achieved organisationally, not cryptographically. One role — typically the membership secretary or an election committee — issues single-use codes against the member register and never sees the ballots. A second role opens the encrypted form and counts, seeing ballots and never the register. No individual holds both halves, and the statutes or the assembly minutes record who does what. It is more work than a mail merge, and it is the only version of a secret member vote that survives an Art. 75 CC challenge from someone who lost narrowly.

Where Associations Use Schweizerform

Membership applications and the Beitrittserklärung

The classic entry point, and the one where the free tools cost you the most. A membership application in a religious, political or union association is sensitive data from the first field, and it usually also carries a bank relationship for the subscription. Encrypted intake means the application is unreadable to everyone except the committee members who hold the key — including us, including whoever runs the club's mail domain, and including a future secretary who should not inherit fifteen years of files by default. Publish the same form in four languages and a national association stops filtering its own membership by language.

Registrations, tournaments, camps and the Anmeldetalon

Signup forms are where health data arrives without anyone deciding to collect it: an allergy field, a medication note, an emergency contact, a swimming-ability question on a camp form. The rule that saves the most trouble is to ask for the accommodation rather than the condition — «is there anything the camp leader must know to keep your child safe?» collects what you need to act on, and far less of what you would then have to protect. The full treatment is in collecting health data in forms, and event-specific handling in the event registration use case.

Anonymous member surveys

Associations run the hardest version of the anonymity problem: everybody knows everybody, the committee being evaluated often controls the tool, and a section with eleven members produces reports on cells of two. The arithmetic of when a group is large enough to report is worked through in how many responses before a survey is really anonymous, and the design patterns transfer directly from the employee survey use case — publish the reporting threshold with the invitation, keep free-text comments out of circulation below it, and let a role that is not the committee hold the key if the survey is about the committee.

Volunteers, committee roles and honorary work

Volunteer signup for youth work in Switzerland increasingly involves a special private criminal-record extract, which is data on criminal proceedings and sanctions and therefore sensitive under Art. 5 lit. c nFADP. Collect the confirmation and the date of the check rather than archiving the document, keep the reader set to one or two named people, and keep the volunteer file separate from the general membership list. The same applies to the paperwork nobody thinks of as sensitive — a coach's availability, a driver's licence details for the club minibus, a caregiver's own health limitations.

Expense claims and honorary compensation

Expense forms carry bank details, and bank details plus a plausible email address are the raw material of the invoice-fraud attempts that hit associations constantly. An encrypted form with a named recipient is a meaningful improvement on a claim emailed as a photo to whoever is treasurer this year. Keep what the accounts require and delete the rest; the association's bookkeeping duties are the retention driver, not the form tool's convenience.

Umbrella federations collecting from member clubs

A cantonal or national federation collecting annual returns, licence applications or statistics from a few hundred affiliated clubs has a distribution problem rather than a compliance one — until it notices that its returns contain member counts, finances and sometimes the personal data of club officials, sitting in one inbox. One encrypted form per return cycle, in four languages, with an explicit deletion date, replaces a mail folder nobody is willing to open.

The Handover Problem Nobody Writes Into the Statutes

Associations lose data protection at the handover, not at the breach. The secretary steps down and the membership list stays in a personal cloud account. The treasurer's laptop keeps the arrears file. The camp leader's phone keeps three years of photos of other people's children. Nothing was hacked; the data simply never left. Encryption does not fix an organisational habit, but it changes what a handover means: access is a key and a workspace membership, and both can be transferred and withdrawn as a deliberate act with a date on it.

• Name two Vault key custodians in the committee's rules of procedure, with an offline copy stored where the association — not a person — controls it. If the key is lost, the submissions are unrecoverable; that is the same property that keeps everyone else out.
• Put the handover in the annual cycle. The assembly elects a new committee; the same week, memberships and key custody move. A handover that waits for a quiet moment does not happen.
• Use the viewer role for people who need to see and not touch — an auditor, a co-opted advisor, an outgoing officer during a transition. Roles run owner, admin, member and viewer, with viewer read-only.
• Write a deletion rule per form, and diarise it. Deletion is a deliberate action, individually or in bulk, not an automatic per-form schedule — so it belongs on the committee agenda, in the same slot every year.
• Keep the Art. 61a directory, if it applies to you, as the one authoritative list rather than one of several. Everything else is a form with a lifespan.

What We Can Count Without Reading Anything

The public form page loads no analytics provider and no beacon, and a submission carries no IP address, user agent, referrer, geolocation or cookie identifier. What remains against the encrypted form is counting: how many people opened it, how many submitted, how long the median submission took, and — per question — how many of those who saw a question answered it. For an association that is enough to know whether the registration form is too long, which question people abandon, and whether the reminder in the newsletter worked. Counters are flat and never cross-tabulated, receive-time and never decremented, with no retroactive backfill. The reasoning is in form analytics without tracking.

Getting Started as an Association

Running One Association Year End to End

Common Objections — and Realistic Answers

We are forty people and we have used a free form tool for years.

For a hiking club's outing signup, that is a defensible choice and we would rather say so than pretend otherwise. The objection is narrower: the free tools store readable answers on someone else's servers, in a jurisdiction that is usually not Switzerland, and the same account is often used for the sensitive forms as for the outing. If your association is a religious, political or union one, if you run youth activities, or if you handle hardship requests, that is where the calculus changes — not because a fine is likely, but because a leaked membership list of that kind is not a recoverable event for the people on it. The legal picture is set out in can you legally use Google Forms in Switzerland.

Our committee changes every three years. Someone will lose the key.

This is the most realistic objection on the page, and the mitigation is organisational rather than technical: two named custodians, an offline copy kept where the association controls it, a handover step written into the rules of procedure, and one rehearsal before the first real form. If your committee cannot commit to that, end-to-end encryption is the wrong architecture for you, and a conventional tool with a proper contract and a short retention rule is the honest alternative.

We need the membership list in a spreadsheet anyway.

You do, and if Art. 61a CC applies you are legally required to keep one. Export is available on every plan as CSV, with Excel, PDF and ZIP on the paid tiers, and the decryption happens in your browser — so the only plaintext copy is the file you chose to save. The point is not that data never leaves; it is that the master copy is unreadable to the provider, and that the exported copy is one you consciously made, stored where you decided, rather than a permanent readable record sitting on a platform by default.

Can we finally run our general assembly online?

Partly, and the honest sequence matters. Check your statutes first: a purely virtual or hybrid assembly needs an express basis there, and without one Art. 66 para. 2 CC means a written resolution requires the agreement of all members, not a majority. Amend the statutes at a properly convened assembly, then digitise. Registration, proxies, consultations and non-contentious votes work well on encrypted forms; a contested vote on dissolution, merger or an expulsion is exactly the resolution someone will challenge under Art. 75 CC within the month, and it deserves either a physical assembly or a specialist voting provider.

Nobody in our club will fill in a form on their phone.

Some will not, and a paper option is a legitimate accessibility measure rather than a failure — the association whose average member is seventy-five is solving a different problem from the one whose members are fifteen. What an encrypted form does for the paper path is give whoever transcribes it somewhere safe to put the result. The worst pattern is not paper; it is paper photographed and sent by chat to a committee member's personal phone.

Where Schweizerform Is Not the Right Answer

• We are not a membership-management system. No subscription billing, no dunning, no accounting, no member portal, no automatic renewal. We are the intake layer; your club administration software or your spreadsheet stays where it is.
• We are not an e-voting system. No verifiability, no certification, no protection against a committee correlating timing. Use us for routine votes, not for a contested dissolution.
• No server-side analysis of answers. No cross-tabs, no live filtered dashboards, no scoring. Everything happens after decryption, in front of a person.
• No automatic per-form retention rule. Deletion is an action someone takes. In an association, that means it belongs on the committee agenda.
• Key loss is unrecoverable, which for a body whose leadership rotates is a real risk that custody arrangements must address before the first form goes live.

The Bottom Line for Association and Club Forms

An association is a legal person under Art. 60 CC with the full weight of the nFADP on it and, since January 2023, a member-directory duty in Art. 61a CC backed by a criminal fine — administered by volunteers who change every few years. Its membership list can be sensitive data by its very existence, its youth section may be collecting the AHV numbers of minors for Jugend+Sport, and its most politically charged act each year is a vote that must be both verified and secret.

The intake layer is the part you can fix in an afternoon. Encrypt in the member's browser, hold the Vault key in the association rather than in a person, separate the reader set from the people a form is about, and write a deletion date next to every form. What an encrypted form cannot be — a membership database, a billing system, a certified voting platform — we would rather you knew before your next general assembly than after it.