Privacy Policy of Guggach AG

What data processing takes place?

Use of the website

Log data on the web server

Most of our website can be used worldwide without registration. The following data is logged and deleted after 6 months: IP address, operating system, date, access time, browser type, browser request including referrer.

The data is used internally for forensic investigations in case of hacking or other security analyses. This safeguards your data and enables quick countermeasures. Anonymous usage statistics are also created.

Legal basis: Art. 6(1)(f) GDPR.

Cookies, Google Analytics, Google Maps

a) Cookies: Our system sets a session cookie that is technically required to return the correct filter result or form to your browser. It is deleted shortly after.

b) Google Analytics: We use Google Analytics to analyse website usage and optimise our site and campaigns. Provided by Google Ireland Limited. Google processes usage data on our behalf under contractual safeguards for security and confidentiality.

Collected: pages visited, goal completions (e.g. contact requests/bookings), on-page behaviour (time, clicks), approximate location (country/city), truncated IP address, technical info (browser, provider, device, resolution), traffic source.

No personal data such as name or contact details is sent to Google Analytics. Data is transferred to Google servers in the USA. Cookies persist for up to two years. Transfer occurs only with your consent via the cookie banner. Legal basis: consent Art. 6(1)(a) GDPR (revocable).

c) Google Maps: We use Google Maps API to display maps. Usage information including IP address is sent to Google in the USA. Legal basis: legitimate interest Art. 6(1)(f) GDPR.

d) Google Ads Remarketing: We use Google Ads Remarketing to show interest-based ads. Cookies identify a browser. Legal basis: consent Art. 6(1)(a) GDPR (revocable).

e) Matterport: We use Matterport to provide 3D tours. Data such as IP address, browser type, and usage behaviour may be sent to Matterport Inc. in the USA. Legal basis: consent Art. 6(1)(a) GDPR (revocable).

Contact form

The contact form collects: reason, salutation, name, ZIP/city, email, phone, message (mandatory). We use the data to respond. Legal basis: pre-contractual measures Art. 6(1)(b) GDPR or legitimate interest Art. 6(1)(f) GDPR.

Booking on our website

For bookings we also need move-in/move-out dates, date of birth, nationality, language, names of additional guests, confirmation of T&Cs and privacy consent. Purpose: create accommodation contract and invoice. Legal basis: contract performance Art. 6(1)(b) GDPR.

Contact / booking by correspondence, phone, or in person

We only process data you disclose. For bookings we need the data listed in section 3. Legal basis: legitimate interest Art. 6(1)(f) GDPR.

Processing related to your stay

a) Legal registration duties: Required data includes first/last name, address, date/place of birth, nationality, email, phone, ID number, vehicle number, credit card number, question on domicile registration. Contract data: apartment number, arrival/departure, extra services, prices. Legal basis: Art. 6(1)(b)(c) GDPR.

b) Recording services used: Additional services (e.g. fitness, internet) are recorded for billing.

c) Credit card transactions: Processed via payment provider; receipts store only necessary data. Legal basis: Art. 6(1)(b)(c) GDPR.

Application for long-term rental

In addition to 1.3 data we need: debt register extract, income source/amount, profession, employer, marital status, family situation, household size, references, current rent, reason for moving, noise-relevant facts. Used for selection; if rejected, data is deleted/shredded. If accepted, archived up to 10 years (GeBüV).

Physical visits (house/parking)

CCTV in garage, entrances, reception. Recordings protect property/persons and may be given to authorities after incidents. More information at Video Surveillance. Retention 48–72 hours.

Storage and sharing with third parties

Bookings via platforms

We receive booking data (see 1.4 and 4) from platforms such as booking.com, HRS, Immoscout24, Homegate to record bookings and provide services. Legal basis: Art. 6(1)(b) GDPR; disputes: legitimate interest Art. 6(1)(f) GDPR.

Cloud storage and email

Files and emails are stored with Microsoft Ireland Operations Ltd. (servers in Europe), encrypted in transit and at rest. ISO 27001 certified.

Website hosting

Web host: Hoststar Multimedia Networks AG, servers in Switzerland. Purpose: provide and maintain the website. Legal basis: legitimate interest Art. 6(1)(f) GDPR.

Payment providers and acquirers

Payments via Wallee Group AG; acquirers: Postfinance, Concardis Schweiz AG, Worldline Schweiz AG (PCI DSS certified).

Retention periods

We keep personal data only as long as needed. Retention duties arise from registration, accounting, tax law and Swiss GeBüV (correspondence, communication, contracts, booking records up to 10 years).

Data security

We use technical and organisational measures to protect personal data from manipulation, loss, and unauthorised access. Staff and service providers are bound to confidentiality and data protection.

Your rights

You may object to processing unless restricted by law.

Right of access: view stored personal data.

Right to rectification: correct inaccurate/incomplete personal data and be informed of the correction.

Right to erasure: request deletion in certain cases (unless legally excluded).

Right to complaint: lodge a complaint with a competent supervisory authority.

Exercise rights in writing, by email, or in person; official ID required for verification.

Data transfers to the USA

Some providers are based in the USA where surveillance measures can reduce the level of data protection. The US Cloud Act 2018 may require US providers to disclose data even if stored in Europe.

Microsoft commits to resist unlawful access, apply encryption, pursue legal remedies, and inform customers transparently.

Contact

Responsible: Guggach AG, Enrica Ruedin, +41 44 363 32 10, datenschutz@guggach.com. Alternatively, use the contact form. For privacy matters, please contact the person named.

Changes to this privacy policy

This privacy policy is not part of a contract. We may change it at any time. The version published on the website is the current one. Last updated: 3 July 2023.