PRIVACY POLICY

achesa Management AG, Hamelirainstrasse 5, CH-8302 Kloten is the operator of the website and therefore responsible for the collection, processing and use of your personal data and the compatibility of the data processing with the applicable data protection law.

Your trust is important to us, which is why we take the issue of data protection seriously and ensure appropriate security. It goes without saying that we comply with the legal provisions of the Federal Act on Data Protection (FADP), the Ordinance to the Federal Act on Data Protection (FADP), the Telecommunications Act (TCA) and any other applicable data protection provisions of Swiss or EU law, in particular the General Data Protection Regulation (GDPR).

So that you know what personal data we collect from you and for what purposes we use it, please take note of the information below:

1. Data processing in connection with our website

1.1 Visiting our websites:

Die achesa Management AG operates the following websites:

www.a-chesa.ch
www.achesahomes.ch
www.allegra-lodge.ch
www.hotel-welcomeinn.ch
www.tschadun.ch
www.restaurant-mercato.ch
www.pizzeria-giardino.ch
www.achesaliving.ch

and therefore, responsible for the collection, processing and use of your personal data and the compatibility of the data processing with the applicable data protection law.

When you visit one of our websites, our servers temporarily save each access in a log file. The following technical data is recorded without your intervention, as is the case with every connection to a web server, and stored by us until automatic deletion after 24 months at the latest:

• the IP address of the requesting computer
• the name of the owner of the IP address range (usually your internet access provider)
• the date and time of the visit
• the website from which you access the website (referrer URL), possibly with the keyword used
• the name and URL of the retrieved file
• the status code (e.g., error message)
• the operating system on your computer
• the browser you use (type, version, and language)
• the transmission protocol used (e.g., HTTP/1.1) and
• possibly your user name from a registration/authentication

The collection and processing of this data is carried out for the purpose of enabling the use of our website (connection establishment), to permanently guarantee system security and stability and to enable the optimisation of our internet offer as well as for internal statistical purposes. This is our legitimate interest in data processing within the meaning of Art. 6 Para. 1 lit. f GDPR.

Furthermore, the IP address is evaluated together with the other data in the event of attacks on the network infrastructure or other unauthorised or abusive website use for the purpose of clarification and defence and, if necessary, used in the context of criminal proceedings for the purpose of identification and civil and criminal proceedings against the users concerned. This is our legitimate interest in data processing within the meaning of Art. 6 para. 1 lit. f GDPR.

The content of our website has been carefully compiled and checked several times, but we do not assume any liability for the topicality, correctness and completeness of the information provided. Claims for damages due to the use or non-use of the information or due to the use of incorrect or incomplete information are excluded. All offers are subject to change and non-binding. We reserve the right to change, supplement or delete the offer or parts thereof without prior notice or to temporarily or permanently cease publication of the website.

The content and programming of our website are protected by copyright and ancillary copyright. Any reproduction – including excerpts – and public reproduction, in particular the copying of texts, graphics, and photos, is prohibited without our prior written consent.

1.2 Using our contact form:

You have the option of using a contact form to get in touch with us. For this we require the following information (*mandatory):

• First name* and last name*
• Email*
• Message incl. subject*

We only use these data as well as a phone number provided voluntarily by you to answer your contact request individually and to the best of our ability. Processing these data is therefore necessary for taking steps prior to entering into a contract in accordance with Art. 6 (1) (b) GDPR, or for the purpose of pursuing our legitimate interests in accordance with Art. 6 (1) (f) GDPR.

1.3 Using the DialogShift chat application on our website:

Our website uses the chat application of DialogShift GmbH, Rheinsberger Str. 76/77, 10115 Berlin. This application processes and stores data for the purpose of web analysis, to operate the chat application and to answer queries. For the operation of the chat function, the chat texts are stored and a cookie with a unique ID is set – this is used to recognise you as a customer.

A cookie is a small text file that is stored locally in the cache on your device. Using this cookie, our application recognises the device and can retrieve past chat transcripts. This cookie is stored for 90 days since last use. You can disable the storage of cookies in your browser settings. However, without the use of cookies, the chat function cannot be performed. The possible disclosure of e.g., name, e-mail address or a telephone number is voluntary and with the consent to temporarily use and store this data for the purpose of contacting you until the end of the contact. This personal data is deleted after 90 days. The legal basis for data processing is Article 6 (1) lit. F GDPR based on our legitimate interest in effective customer support, for statistical analysis of user behaviour and for optimisation purposes of our offers. DialogShift offers further information on the collection and use of data as well as your rights and options for protecting your privacy at https://www.dialogshift.com/en/data-privacy .

1.4 Registering for our newsletter:

You have the possibility of subscribing to our newsletter on our website. To do this, you must register. As part of the registration process, you are required to submit the following data (* mandatory):

• Title*
• First name and last name*
• Email address

The above data is necessary for data processing. We process this data exclusively in order to personalise the information and offers sent to you and to better align them to your interests. By registering, you give us your consent to process the data provided for the regular dispatch of the newsletter to the address you have provided and for the statistical evaluation of user behaviour and the optimisation of the newsletter. This consent constitutes our legal basis for the processing of your e-mail address within the meaning of Art. 6 para. 1 lit. a DSGVO. We are entitled to commission third parties with the technical processing of advertising measures and are entitled to pass on your data for this purpose (cf. point 14 below).

At the end of each newsletter, you will find a link that allows you to unsubscribe from the newsletter at any time. After unsubscribing, your personal data will be deleted. Further processing only takes place in anonymised form to optimise our newsletter.

1.5 Booking a room on the website, by correspondence or by telephone:

When you make a reservation either via our website, by correspondence (email or letter), or by telephone, we require the following data to process the contract (* mandatory):

• Title*
• First name and last name*
• Credit card details*
• Email address
• Telephone number*

We will only use this data and other information voluntarily provided by you (e.g., language, postal address, expected time of arrival, motor vehicle registration plate, preferences, remarks) for the purpose of processing the contract, unless otherwise stated in this data protection declaration or you have separately consented to this. We will process the data by name in order to record your booking as requested, to provide the booked services, to contact you in the event of any uncertainties or problems and to ensure correct payment. The legal basis of data processing for this purpose is the fulfilment of a contract according to Art. 6 para. 1 lit. b GPDR.

We use the service Mews System B.V., headquartered in Amsterdam, to process the online booking. Further information on how Mews processes personal data can be found here (https://app.mews.com/Platform/Document/PrivacyPolicy?language=en ).

We also use the service of Revinate Solutions, based in Amsterdam. For more information on how Revinate Solutions processes personal data, please click here
https://www.revinate.com/privacy/

Our legitimate interest within the meaning of Art. 6 (1) lit. f GDPR lies in the fulfilment of the legal requirements.

1.6 Subscription to our newsletter in connection with a booking:

In connection with a booking, you have the separate option of subscribing to our newsletter. By registering in connection with a booking, you give us your consent to process the data provided above for the regular dispatch of the newsletter to the address you have provided and for the statistical evaluation of user behaviour and the optimisation of the newsletter.

We process this data exclusively in order to personalise the information and offers sent to you and to better tailor them to your interests. This consent constitutes our legal basis for the processing of your e-mail address within the meaning of Art. 6 para. 1 lit. a DSGVO. We are entitled to commission third parties with the technical processing of advertising measures and are entitled,

pass on your data for this purpose (cf. section 14 below). At the end of each newsletter you will find a link that allows you to unsubscribe at any time. When unsubscribing, you can voluntarily inform us of the reason for the unsubscription. After unsubscribing, your personal data will be deleted. Further processing only takes place in anonymised form to optimise our newsletter.

1.7 Making contact via email:

On our website you have the possibility of contacting us and sending us an email. To this end, we are obliged to record your email address. We only use your email address and other data provided voluntarily by you (e.g., your first and last name) to answer your contact request individually and to our best of our ability. The processing of these data is therefore necessary to take steps prior to entering a contract in accordance with Art. 6 (1) (b) GDPR or for the purpose of pursuing our legitimate interest in accordance with Art. 6 (1) (f) GDPR.

1.8 Making contact by telephone:

On our website you have the possibility of contacting us by telephone. We only use your telephone number and other data provided voluntarily by you (e.g., your first and last name, email address) to answer your contact request individually and to our best of our ability. The processing of these data is therefore necessary for taking steps prior to entering a contract in accordance with Art. 6 (1) (b) GDPR or for the purpose of pursuing our legitimate interests in accordance with Art. 6 (1) (f) GDPR.

1.9 Ordering and purchasing event tickets and vouchers:

On our website, it is possible to place orders for certain services or value vouchers online. In this context, the following data is collected (* mandatory):

• Title*
• First and last name of the purchaser*
• First and last name of the beneficiary*
• Credit card number*
• Email*

We will use this data and any other information you voluntarily provide (e.g., postal address, telephone number, personal dedication, video greeting, etc.) only to process the contract, unless otherwise stated in this privacy policy or you have separately consented to this. We will process the data by name in order to record your purchase as requested, to provide the services, to contact you in the event of any uncertainties or problems and to ensure correct payment. The legal basis of data processing for this purpose is the fulfilment of a contract according to Art. 6 para. 1 lit. b DSGVO.

1.10 Restaurant reservation:

On our website you have the possibility of reserving a table. The following data are collected in connection with this (* mandatory):

• First name and last name*
• Email*
• Telephone number*

We use the service of TheFork Swiss SA, Rue Muzy 8, 1207 Geneve, Switzerland to process table reservations. Further information on how TheFork Swiss SA processes personal data can be found here: https://www.thefork.com/legal#PrivacyPolicy

This data is collected and processed for the purpose of reserving a table for a certain number of people. The legal basis of the data processing for this purpose is the implementation of pre-contractual measures and the fulfilment of a contract according to Art. 6 para. 1 lit. b GDPR.

1.11 Application for a vacant position:

You have the option on our website to apply for a job posting or spontaneously via e-mail. To do this, you must submit a complete application. The following data must be included in the application (* mandatory):

• Title*
• First and last name*
• Postal address*
• Nationality*
• Civil status*
• Date of birth*
• Email*
• Telephone number*
• Letter of motivation, curriculum vitae, photo*
• References*

This data is used to process the application process. Unless you explicitly consent to further processing, the data will be deleted after the respective application process.

The legal basis for data processing is therefore the implementation of pre-contractual measures and our legitimate interest pursuant to Art. 6 Para. 1 lit. b and f GDPR. The legal basis for further data processing is your consent pursuant to Art. 6 para. 1 lit. a GDPR.

1.12 Cookies:

Cookies help in many ways to make your visit to our website easier, more enjoyable and more meaningful. Cookies are information files that your web browser automatically stores on your computer’s hard drive when you visit our website. For example, we use cookies to temporarily store your selected services and entries when you fill out a form on the website so that you do not have to repeat the entry when you call up another sub-page. Cookies may also be used to identify you as a registered user after you have registered on the website, without you having to log in again when you call up another sub-page. Most internet browsers automatically accept cookies. However, you can configure your browser so that no cookies are stored on your computer, or a message always appears when you receive a new cookie. On the following pages you will find explanations of how you can configure the processing of cookies in the most common browsers:

• Microsofts Windows Internet Explorer
• Microsofts Windows Internet Explorer Mobile
• Mozilla Firefox
• Google Chrome für Desktop
• Google Chrome für Mobile
• Apple Safari für Desktop
• Apple Safari für Mobile

Deactivating cookies may mean that you cannot use all the functions of our website.

1.13 IP anonymisation:

The IP address transmitted by your browser as part of Google Analytics will not be merged with other Google data. We would like to point out that the code “_anonymize Ip();” has been added to Google Analytics on this website to ensure that IP addresses are recorded anonymously. This means that IP addresses are processed in abbreviated form, which means that they cannot be linked to a specific person. Insofar as the data collected about you is related to a person, this is therefore immediately excluded, and the personal data is thus immediately deleted.

1.14 Recipient:

The recipient of the data is:

Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland as an order processor. We have concluded an order processing agreement with Google for this purpose. Google LLC, based in California, USA, and possibly US authorities can access the data stored by Google.

1.15 Borlabs Cookie:

This website uses Borlabs Cookie, which sets a technically necessary cookie (borlabs-cookie) to store your cookie consents. Borlabs cookie does not process any personal data. The borlabs-cookie stores the consent you gave when you entered the website. If you wish to revoke these consents, simply delete the cookie in your browser. When you re-enter/reload the website, you will be asked again for your cookie consent.

1.16 Tracking Tools und Plug-ins:

a) General:

For the purpose of demand-oriented design and continuous optimisation of our website, we use the web analysis service of Google Analytics. In this context, pseudonymised usage profiles are created and small text files stored on your computer (“cookies”) are used. The information generated by the cookie about your use of this website is transmitted to the servers of the providers of these services, stored there and processed for us. In addition to the data listed under point 1, we may receive the following information as a result:

• Navigation path taken by a visitor to the site
• the time spent on the website or sub-page
• the sub-page on which the website is left
• the country, region or city from which the site is accessed
• terminal device (type, version, colour depth, resolution, width and height of the browser window) and returning or new visitor.

The information is used to evaluate the use of the website, to compile reports on website activity and to provide other services related to website and internet use for the purposes of market research and to tailor this website to your needs. This information may also be transferred to third parties if this is required by law or if third parties process this data on our behalf.

b) Google Analytics and Re-Marketing:

This website uses Google Analytics and Google Re-Marketing. These are services provided by Google Inc (“Google”). Google uses “cookies”, which are text files placed on your computer, to help the website analyse how users use the site. The information generated by the cookie about your use of the website (including your IP address) will be transmitted to and stored by Google on servers in the United States. The IP address is then shortened by Google by the last three digits, so that a clear assignment of the IP address is no longer possible. Google observes the data protection provisions of the “US Safe Harbor” agreement and is registered with the “Safe Harbor” programme of the US Department of Commerce. Google will use this information for the purpose of evaluating your use of the website, compiling reports on website activity for website operators and providing other services relating to website activity and internet usage. Google may also transfer this information to third parties where required to do so by law, or where such third parties process the information on Google’s behalf. Third-party providers, including Google, place advertisements on websites on the Internet. Third-party vendors, including Google, use stored cookies to serve ads based on a user’s previous visits to this website. Google will not associate your IP address with any other data held by Google. You can object to the collection and storage of data at any time with effect for the future. You can deactivate the use of cookies by Google by visiting the Google advertising deactivation page.

Alternatively, users can deactivate the use of cookies by third-party providers by visiting the Network Advertising Initiative deactivation page. In addition, you can prevent the collection of data generated by the cookie and related to your use of the website (incl. your IP address) to Google as well as the processing of this data by Google by downloading and installing the browser plug-in available at the following link:

https://tools.google.com/dlpage/gaoptout?hl=en. However, please note that if you do this you may not be able to use the full functionality of this website. By using this website, you consent to the processing of data about you by Google in the manner and for the purposes set out above. You may object to the collection and storage of data at any time with effect for the future. Further information on Google’s terms and conditions can be found here.

c) YouTube:

Our website uses plugins from the YouTube site operated by Google. The operator of the pages is YouTube, LLC, 901 Cherry Ave, San Bruno, CA 94066, USA. When you visit one of our pages equipped with a YouTube plug-in, a connection to the YouTube servers is established. This tells the YouTube server which of our pages you have visited.

If you are logged into your YouTube account, you enable YouTube to assign your surfing behaviour directly to your personal profile. You can prevent this by logging out of your YouTube account. YouTube is used in the interest of an appealing presentation of our online offers. This represents a legitimate interest within the meaning of Art. 6 Para. 1 lit. f DSGVO. Further information on the handling of user data can be found in YouTube’s privacy policy at:

 https://www.google.de/intl/de/policies/privacy

d) Google Maps:

This website uses Google Maps to display maps and to create directions. Google Maps is operated by Google Inc, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. By using this website, you consent to the collection, processing, and use of automatically collected data and data provided by you by Google, one of its agents, or third parties.

The terms of use for Google Maps can be found under the terms of use for Google Maps.

e) Facebook Pixel, Custom Audiences and Facebook Conversion:

We use communication tools of the social network Facebook, in particular the product Custom Audiences and Website Custom Audiences. In principle, a non-reversible and non-personal checksum (hash value) is generated from your usage data, which can be transmitted to Facebook for analysis and marketing purposes. For the Website Custom Audiences product, the Facebook cookie is addressed. Further information about the purpose and scope of the data collection and the further information on the processing and use of data by Facebook and your settings options for protecting your privacy, please refer to Facebook’s privacy policy, which can be found at https://www.facebook.com/ads/website_custom_audiences/ and https://www.facebook.com/privacy/explanation , among other places. If you wish to object to the use of Facebook Website Custom Audiences, you can do so at https://www.facebook.com/ads/website_custom_audiences/ .

2. Storage and exchange of data with third parties

2.1 Booking platforms:

If you make bookings via a third-party platform, we receive various personal information from the respective platform operator. This is usually the data listed in section 5 of this privacy policy. In addition, we may receive enquiries about your booking. We will process this data by name to record your booking as requested and to provide the booked services. The legal basis of data processing for this purpose is the fulfilment of a contract according to Art. 6 para. 1 lit. b GDPR.

Finally, we may be informed by the platform operators about disputes in connection with a booking. In the process, we may also receive data on the booking process, which may include a copy of the booking confirmation as proof of the actual booking completion. We process this data to protect and enforce our claims. This is our legitimate interest within the meaning of Art. 6 para. 1 lit. f GDPR. Please also note the information on data protection of the respective provider.

2.2 Retention period:

We only store personal data for as long as it is necessary to use the tracking services mentioned above as well as the further processing within the scope of our legitimate interest. We retain contractual data for longer, as this is required by legal retention obligations. Retention obligations that oblige us to retain data result from regulations on registration law, on accounting and from tax law.

According to these regulations, business communication, concluded contracts and accounting vouchers must be kept for up to 10 years. As far as we no longer need this data to perform the services for you, the data will be blocked. This means that the data may then only be used for accounting and tax purposes.

2.3 Disclosure of data to third parties:

Your personal data may be disclosed by us within the group, considering the permitted purposes of use, to processors (e.g., for our electronic advertising in the form of newsletters) and, to third parties who need to be involved in the provision of the services you have requested, all of whom have undertaken to us to comply with the applicable data protection standards.

We will only disclose your personal data if you have expressly consented to this, if there is a legal obligation to do so or if this is necessary to enforce our rights, in particular to enforce claims arising from the contractual relationship. In addition, we pass on your data to third parties insofar as this is necessary in the context of the use of the website and the processing of contracts (also outside the website), namely the processing of your bookings.

Finally, we forward your credit card information to your credit card issuer and to the credit card acquirer when you pay by credit card on the website. If you decide to pay by credit card, you will be asked to enter all mandatory information. The legal basis for passing on the data is the fulfilment of a contract in accordance with Art. 6 Para. 1 lit. b GDPR. Regarding the processing of your credit card information by these third parties, we ask you to also read the general terms and conditions as well as the privacy policy of your credit card issuer.

2.4 Transfer of personal data abroad:

We are also entitled to transfer your personal data to third companies (contracted service providers) abroad for the purpose of the data processing described in this data protection declaration. These are obligated to data protection to the same extent as we ourselves. If the level of data protection in a country does not correspond to that in Switzerland or the EU, we ensure by contract that the protection of your personal data always corresponds to that in Switzerland or the EU.

3. Data processing in connection with your stay

3.1 Data processing to fulfil statutory reporting requirements

Upon arrival at our hotels or serviced flats, we require the following information from you and your accompanying persons (*mandatory):

• First and last name*
• Postal address and canton*
• Date of birth*
• Place of birth*
• Nationality*
• Official identification card and number*
• Date of arrival and departure

We collect this information to comply with legal reporting obligations arising in particular from hospitality or police law. Insofar as we are obliged to do so under the applicable regulations, we forward this information to the competent police authority.

3.2 Recording of services received:

If you obtain additional services during your stay (e.g., visits to the restaurant, the hotel bar, use of the private spa, etc.), we will record the subject of the service and the time at which the service was obtained for billing purposes. The processing of this data is necessary within the meaning of Art. 6 para. 1 lit. b GDPR for the processing of the contract with us.

4. Further information

4.1 Right to information, correction, deletion, and restriction of processing; right to data portability:

You can object to data processing at any time, especially data processing in connection with direct advertising (e.g., against advertising emails). You also have the following rights:

Right of access: you have the right to request access to your personal data stored by us at any time and free of charge if we are processing it. This gives you the opportunity to check what personal data we are processing about you and that we are using it in accordance with applicable data protection regulations.

Right to rectification: You have the right to have inaccurate or incomplete personal data rectified and to be informed of the rectification. In this case, we will inform the recipients of the data concerned of the adjustments made, unless this is impossible or involves disproportionate effort.

Right to erasure: You have the right to have your personal data erased under certain circumstances. In individual cases, the right to deletion may be excluded.

Right to restriction of processing: You have the right to request that the processing of your personal data be restricted under certain circumstances.

Right to data transfer: Users outside Switzerland have the right, under certain circumstances, to receive from us, free of charge, the personal data you have provided to us in a readable format.

Right to lodge a complaint: You have the right to lodge a complaint with a competent supervisory authority against the way in which we process your personal data.

Right of withdrawal: In principle, you have the right to withdraw any consent you have given at any time. However, processing activities based on your consent in the past will not become unlawful because of your revocation.

4.2 Data security:

We use appropriate technical and organisational security measures to protect your personal data stored with us against manipulation, partial or complete loss and against unauthorised access by third parties. Our security measures are continuously improved in line with technological developments.

You should always treat your access data confidentially and close the browser window when you have finished communicating with us, especially if you share the computer with others.

We also take internal company data protection very seriously. Our employees and the service companies we commission have been obliged by us to maintain confidentiality and to comply with the provisions of data protection law.

4.3 Note on data transfers in the USA:

For reasons of completeness, we would like to point out to users with residence or registered office in Switzerland that there are surveillance measures in place by US authorities in the USA, which generally require the storage of all personal data of all persons whose data was transferred from Switzerland to the USA. enabled. This is done without differentiation, limitation or exception based on the objective pursued and without any objective criterion that makes it possible to limit the US authorities’ access to the data and their subsequent use to very specific, strictly limited purposes, both of which are related to the access to justify any intervention associated with the use of this data. We would also like to point out that there are no legal remedies in the USA for data subjects from Switzerland that would allow them to gain access to the data concerning them and to have it reported or deleted, or there is no effective legal protection against general access rights of US authorities.

We expressly point out this legal and factual situation to those affected in order to make an appropriately informed decision to consent to the use of their data.

We would like to point out to users residing in an EU country that, from the perspective of the European Union – due, among other things, to the topics mentioned in this section – the USA does not have an adequate level of data protection. To the extent that we have explained in this data protection declaration that recipients of data (such as Google) are based in the USA, we will either contractually regulate this company or by ensuring that this company is certified under the EU or Swiss-US -Privacy Shield ensures that your data is protected with an appropriate level by our partners.

4.4 Contact person:

 You have the right to complain to a data protection supervisory authority at any time.

Contact details of our data protection officer:

Email: datenschutz@a-chesa.ch

Kloten in September 2023