3.1 Contacting us
If you contact us via our contact addresses and channels (e.g., by email, telephone, or contact form), your personal data will be processed. The data you have provided us with (e.g., your name, email address, or telephone number and your request) will be processed. The data collected in the case of a contact form can be seen on the respective form. In addition, the time of receipt of the request will be documented. Mandatory fields in contact forms are marked with an asterisk (*).
We process this data exclusively for the purpose of fulfilling your request (e.g., providing information about our hotel, assisting with contract processing, such as questions about your booking, incorporating your feedback into the improvement of our services, etc.). The legal basis for this data processing is our legitimate interest within the meaning of Art. 6 (1) lit. f EU GDPR in fulfilling your request or, if your request is aimed at concluding or processing a contract, the necessity for carrying out the necessary measures within the meaning of Art. 6 (1) lit. b EU GDPR.
3.2 Use of our chat function
When you contact us via chat, your personal data will be processed. The data you provide us with (e.g., your name, email address, and your request) will be processed. In addition, the time of receipt of the request will be documented. We process this data exclusively for the purpose of fulfilling your request (e.g., providing information about a hotel, assisting with contract processing, such as questions about your wine order, providing information about an event, or assisting with registration for an event, incorporating your feedback into the improvement of our services, etc.).
We use a software application from HiJiffy, R. das Eiras 5, 7960-262 Vidigueira, Portugal, to handle communication via the chat function. Your data may therefore be stored in a HiJiffy database, which may allow HiJiffy to access your data if this is necessary for the provision of the software and for support in using the software. Further information on data protection at HiJiffy can be found here.
The legal basis for this data processing is our legitimate interest within the meaning of Art. 6 (1) (f) GDPR in the use of modern communication technologies or, if your request is aimed at the conclusion or execution of a contract, in the implementation of the necessary measures within the meaning of Art. 6 (1) (b) GDPR.
HiJiffy may wish to use some of this data for its own purposes (e.g., to send marketing emails or for statistical analysis). HiJiffy is the controller for this data processing and must ensure compliance with data protection laws in connection with this data processing. Information about data processing by HiJiffy can be found here.
3.3 Ordering via our online shop
You can order a wide range of products and vouchers on our website. To do this, we collect various data from you (e.g. your name, address, email address, telephone number, payment details). The mandatory fields in the corresponding form are marked with an asterisk (*).
We use this data and other data you voluntarily provide only to fulfill your order according to your wishes. This data is therefore processed in accordance with Art. 6 (1) (b) EU GDPR for the purpose of implementing pre-contractual measures and executing a contract.
We use a software application from Idea Creation GmbH, Walchestrasse 15, 8006 Zurich, Switzerland (Idea) to provide the online shop. Your data may therefore be stored in a database belonging to Idea, which may allow Idea to access your data if this is necessary for the provision of the software and for support in using the software. Further information about data processing in connection with Idea can be found here.
3.4 Data processing for bookings
3.4.1 Booking on the website, by correspondence, or by telephone
If you make bookings via our website, by correspondence (e-mail or letter) or by telephone, we will process the personal data you provide (e.g. name, e-mail address, telephone number, credit card information) in order to make your reservations and process other purchase transactions. The mandatory fields in the corresponding form are marked with an asterisk (*).
We will only use this data and other information you voluntarily provide (e.g., expected arrival time, vehicle registration number, preferences, comments) to process the contract, unless otherwise stated in this privacy policy or you have given your separate consent. We will process the data by name in order to record your booking as requested, to provide the booked services, to contact you in case of uncertainties or problems, and to ensure correct payment. Your credit card details will be automatically deleted after your departure.
The legal basis for data processing for this purpose is the fulfillment of a contract in accordance with Art. 6 (1) (b) EU GDPR or your consent in accordance with Art. 6 (1) (a) EU GDPR. You can revoke your consent at any time with future effect.
For booking processing via our website, we use a software application from Sabre Hospitality Solutions GmbH, Unterschweinstiege 2–14, 60549 Frankfurt am Main, Germany (Sabre). Therefore, your data may be stored in a Sabre database, which may allow Sabre to access your data if necessary for the provision of the software and for support in using the software. Further information about data processing in connection with Sabre can be found here.
3.4.2 Bookings via booking platforms
If you make bookings via a third-party platform (i.e., via Booking, Hotel, Escapio, Expedia, Holiday-check, Hotel Tonight, HRS, Kayak, Mr. & Mrs. Smith, Splendia, Tablet Hotels, Tripadvisor, Trivago, Weekend4Two, etc.), we receive various personal information from the respective platform operator in connection with the booking made. This is usually the data listed in section 3.4 of this privacy policy. In addition, inquiries about your booking may be forwarded to us. We will process this data by name in order to record your booking as requested and to provide the booked services. The legal basis for data processing for this purpose is the implementation of pre-contractual measures and the fulfillment of a contract in accordance with Art. 6 (1) (b) EU GDPR.
Finally, we may be informed by the platform operators about disputes in connection with a booking. In this context, we may also receive data relating to the booking process, which may include a copy of the booking confirmation as proof of the actual booking. We process this data to protect and enforce our claims. This constitutes our legitimate interest within the meaning of Art. 6 (1) lit. f EU GDPR.
Please also note the information on data protection provided by the respective booking platform.
3.5 Data processing during payment processing
3.5.1 Payment processing at the hotel
When you purchase products or services or pay for your restaurant visit using electronic means of payment, data processing is required. By using the payment terminals, you transmit the information stored in your payment method, such as the name of the cardholder and the card number, to the payment service providers involved (e.g., payment solution providers, credit card issuers, and credit card acquirers). They also receive information that the payment method was used in one of our companies, the amount, and the time of the transaction. Conversely, we only receive the credit for the amount of the payment made at the relevant time, which we can assign to the relevant receipt number, or information that the transaction was not possible or was canceled. Please always note the information provided by the respective company, in particular the privacy policy and the general terms and conditions. The legal basis for this transfer is the fulfillment of the contract with you in accordance with Art. 6 (1) lit. b GDPR.
For payment processing via the contact form, we use a software application from Worldline Switzerland AG, Hardturmstrasse 201, 8021 Zurich, Switzerland (Worldline). Your data may therefore be stored in a Worldline database, which may allow Worldline to access your data if this is necessary for the provision of the software and for support in using the software. Further information about data processing in connection with Worldline can be found here.
3.5.2 Online payment processing
If you make paid bookings on our website, depending on the service and desired payment method, you will be required to provide additional information in addition to the information specified in sections 3.3 and 3.4, such as your credit card details or login details for your payment service provider. This information, as well as the fact that you have purchased a service from us for the relevant amount and at the relevant time, will be forwarded to the respective payment service providers (e.g., payment solution providers, credit card issuers, and credit card acquirers). Please always note the information provided by the respective company, in particular the privacy policy and the general terms and conditions. The legal basis for this transfer is the fulfillment of a contract in accordance with Art. 6 (1) (b) GDPR.
We reserve the right to store a copy of your credit card information as security. In order to avoid payment defaults, the necessary data, in particular your personal details, may also be transmitted to a credit agency for automated assessment of your creditworthiness. In this context, the credit agency may assign you a so-called score value. This is an estimated value of the future risk of default, e.g. based on a percentage. The value is calculated using mathematical-statistical methods and data from the credit agency and other sources. We reserve the right not to offer you the “invoice” payment method based on the information received. The legal basis for this data processing is our legitimate interest pursuant to Art. 6 (1) lit. f. GDPR in avoiding payment defaults.
3.6 Reserving a table
On our website, you have the option of reserving a table at one of the restaurants listed on our website. To do this, we collect various data from you (e.g., your name, email address, telephone number, desired number of guests, comments, date, and time of the reservation). The mandatory fields in the corresponding form are marked with an asterisk (*).
We collect and process the data solely for the purpose of processing the reservation, in particular to compile your reservation request in accordance with your wishes, to make the reservation, and to contact you in case of any uncertainties or problems.
We use the restaurant management system of Aleno AG, Werdstrasse 21, 8004 Zurich, Switzerland (aleno) to manage and process reservations in our restaurants. Your data is therefore stored in an aleno database, which allows aleno to access your data if this is necessary for the provision of the software and for support in using the software. For more information on how aleno works and its data protection policy, please refer to aleno's terms of use and privacy policy. The legal basis for processing your data for this purpose is the fulfillment of a contract in accordance with Art. 6 (1) (b) EU GDPR.
3.7 Submission of reviews
To help other users make purchasing decisions and to support our quality management (in particular the processing of negative feedback), you have the option of reviewing our products on our website. The data you have provided us with will be processed and published on the website, i.e. in addition to your review and the time it was submitted, this may also include any comments you have added to your review or the name you have provided.
The legal basis for data processing is your consent within the meaning of Art. 6 (1) (a) EU GDPR.
We reserve the right to delete illegal reviews and to contact you if we suspect any such reviews and ask you to comment. The legal basis for this processing is our legitimate interest within the meaning of Art. 6 (1) lit. f EU GDPR in providing the comment and review function and preventing misuse of this function.
3.8 Applying for a vacant position
You have the option of applying to us spontaneously or via a corresponding email address for a specific job advertisement. For this purpose, we collect various data from you (e.g., your name, your address, your email address, the documents and certificates submitted by the applicant). The mandatory fields in the corresponding form are marked with an asterisk (*).
We use this and other data you voluntarily provide to review your application. Application documents from applicants who are not considered will be deleted after the application process has been completed, unless you explicitly agree to a longer retention period or we are legally obliged to retain them for a longer period. The legal basis for processing your data for this purpose is therefore the performance of a contract (pre-contractual phase) in accordance with Art. 6 (1) (b) EU GDPR.
We use software from Yousty AG, Limmatstrasse 21, 8005 Zurich, Switzerland (Yousty) to process applications. Your data may therefore be stored in a Yousty database, which may allow Yousty to access your data if this is necessary for the provision of the software and for support in using the software. Further information about data processing in connection with Yousty can be found here.
3.9 Data processing for the fulfillment of statutory reporting obligations
Upon arrival at our hotel, we require certain information from you and your companions in order to comply with legal reporting requirements, which also includes passing this information on to the relevant local or cantonal authorities (e.g., name, address, date of birth, nationality, official identification document and number, arrival and departure dates). The mandatory fields in the corresponding form are marked with an asterisk (*).
We collect this information to comply with legal reporting requirements, which arise in particular from hospitality or police law. Insofar as we are obliged to do so under the applicable regulations, we forward this information to the relevant police authority.
This data is processed on the basis of a legal obligation within the meaning of Art. 6 (1) (c) EU GDPR
3.10 Recording of services used
If you use additional services during your stay (e.g., wellness, restaurant, activities), we will record the service and the time at which it was used for billing purposes. The processing of this data is necessary for the performance of the contract with us within the meaning of Art. 6 (1) (b) EU GDPR.
3.11 Guest feedback
If you have provided us with your email address in connection with your booking, you will receive an electronic form after departure. For this purpose, we collect data (name, age, nationality, length of stay, experience report of the stay), whereby mandatory information is marked with an asterisk (*) in the corresponding form.
The information is voluntary and helps us to continuously improve our offerings and services and tailor them to your needs. We will use the information provided to us exclusively for statistical purposes, unless otherwise stated in this privacy policy or unless you have given your separate consent. We will process the data by name in order to contact you in case of any uncertainties. For the aforementioned purposes, the legal basis for processing is our legitimate interest within the meaning of Art. 6 (1) (f) EU GDPR.
In connection with guest feedback, we use a software application from Trustyou GmbH, Schmellerstrasse 9, 80337 Munich, Germany (Trustyou). Therefore, your data may be stored in a Trustyou database, which may allow Trustyou to access your data if this is necessary for the provision of the software and for support in using the software. Further information about data processing in connection with Trustyou can be found here.
3.12 Video surveillance
To prevent misuse and to take action against illegal behavior (in particular theft and damage to property), the entrance area and the publicly accessible areas of our companies are monitored by cameras. The image data is only viewed if there is suspicion of illegal behavior.
We use a service provider to provide the video surveillance system, which may have access to the data if this is necessary for the provision of the system. If the suspicion of unlawful conduct is confirmed, the data may then be passed on to consulting firms (in particular our law firm) and authorities to the extent necessary to enforce claims or file a complaint. The legal basis for this is our legitimate interest within the meaning of Art. 6 (1) (f) GDPR in protecting our property and safeguarding and enforcing our rights.
We rely on a service provider, Telsec ESS Schweiz AG, Leuholz 10B, 8855 Wangen (Telsec), to provide the video surveillance system. Telsec has access to the data to the extent necessary for the provision of the system. If suspicion of unlawful conduct is confirmed, the data may be passed on to consulting firms (in particular to a law firm) and authorities to the extent necessary to enforce claims or file a complaint. Further information on data processing in connection with Telsec can be found here.
3.13 Use of our WiFi network
At our companies, you have the option of using the WiFi network operated by Swisscom (Switzerland) AG, Alte Tiefenaustrasse 6, 3050 Bern, Switzerland, free of charge. To prevent misuse and take action against illegal behavior, prior registration is required. When registering, you will provide Swisscom (Switzerland) AG with the following data:
- Mobile phone number
- MAC address of the end device (automatically)
In addition to the above data, each time the WiFi network is used, data on the company visited, including the time, date, and device, is recorded. The legal basis for this processing is your consent. Customers can revoke their registration at any time by notifying us.
Swisscom must comply with the legal obligations of the Federal Act on the Surveillance of Postal and Telecommunications Traffic (BÜPF) and the associated ordinance. Provided that the legal requirements are met, the WiFi operator must monitor Internet use and data traffic on behalf of the competent authority. The WiFi operator may also be required to disclose the customer's contact, usage, and peripheral data to the authorized authorities. The contact, usage, and peripheral data are stored for six months in a manner that identifies the individual and then deleted.
The legal basis for this processing is our legitimate interest within the meaning of Art. 6 (1) (f) EU GDPR in providing a WiFi network in compliance with the applicable legal requirements.
3.14 Contracual services
We process the data of our contractual partners and interested parties as well as other clients, customers, and principals (“contractual partners”) in order to provide them with our contractual or pre-contractual services. The data processed in this context, the type, scope, and purpose of the processing, and the necessity of the processing are determined by the underlying contractual relationship.
The data processed includes the master data of our contractual partners (e.g., names and addresses), contact details (e.g., email addresses and telephone numbers), contract data (e.g., services used, contract content, contractual communication, names of contact persons), and payment data (e.g., bank details, payment history).
The legal basis for processing your data for this purpose is the fulfillment of a contract in accordance with Art. 6 (1) (b) GDPR.
3.15 Holding events
When we hold events (e.g. to market our products and services), we also process personal data. This includes the name and postal or email address of participants or interested parties and, depending on the event, other data such as your date of birth or photographs taken during the event. We process this information for the preparation, implementation, and follow-up of the events. Data relevant to the implementation may also be passed on to third parties. The legal basis for data processing is your consent within the meaning of Art. 6 (1) GDPR. Participants can revoke their consent at any time by notifying us. Upon revocation, you are no longer entitled to participate in the event.
3.16 Prize draws and competitions
If you participate in prize draws and competitions, we collect the personal data necessary to conduct the prize draw or competition. This usually includes your name and contact details (e.g., email address). The mandatory fields in the corresponding form are marked with an asterisk (*). Communication data may also be collected during the course of the prize draw or competition (e.g., content of emails and other written correspondence, details of the type, time, and, where applicable, location of the communication).
This data is used for the purpose of participating in the prize draw and competition and for conducting the prize draw and competition, i.e., specifically to determine and contact the winners. We may pass on your personal data to our prize draw and competition partners, e.g. to send you your prize. Participation in the prize draw and competition and the associated data collection is, of course, voluntary.
By participating in the competition, participants agree that the relevant data may be processed for the aforementioned purposes. The legal basis for data processing is therefore your consent within the meaning of Art. 6 (1) GDPR. Participants may revoke their consent at any time by notifying us. Upon revocation, participants are no longer entitled to participate in the prize draw or competition. Detailed information can be found in our terms and conditions of participation for the respective prize draw and competition.
3.17 Profiling and automated decision-making
We process your personal data for the purposes stated in this privacy policy and evaluate it in a partially automated manner. This also includes so-called “profiling,” i.e., the automated processing of data for analysis and forecasting purposes. We mainly use profiling to send you targeted information and offers about our products/services. We use analysis tools that enable us to communicate in a needs-based manner and provide personalized advertising, including market and opinion research.
“Automated individual decisions” are understood to be decisions that are made entirely automatically, i.e., without human influence, and that have legal consequences for the person concerned or significantly affect them in other ways. As a rule, we do not make automated decisions for the establishment and execution of a business relationship and do not otherwise rely on fully automated decision-making. If we use such procedures in individual cases, we will inform you separately if this is required by law and explain your rights in this regard. You then have the option of having the decision reviewed by a human being if you disagree with it.
3.18 Artifical intelligence
We may use artificial intelligence (AI) to support our existing activities. Artificial intelligence applications may also process personal data, but this is not always the case. We are aware that the use of artificial intelligence in data processing can entail certain risks and uncertainties. That is why we have internal guidelines that ensure the legally responsible use of AI.
We take responsibility for the content generated or decisions made by AI on our behalf, and if a decision has a significant impact on the person concerned, we ensure that it can be reviewed by a human being (see section 3.18). If AI used by us interacts directly with you, we will inform you of this.
The legal basis for any data processing attributed to us is our legitimate interest within the meaning of Art. 6 (1) (f) GDPR in the use of new technologies such as artificial intelligence. If consent has been requested, processing will be carried out exclusively on the basis of Art. 6 (1) (a) GDPR. You can revoke your consent at any time.
For further processing of the data by the respective provider as the (sole) controller under data protection law, in particular any disclosure of this information to third parties such as authorities due to national legal regulations, please refer to the respective data protection information provided by the provider.
