Privacy Policy

including cookie policy – Landgasthof Halbinsel Au

1. What this is about

In this privacy policy we, Landau AG, explain which personal data we process in connection with our website www.halbinselau.com, with table reservations, room bookings and stays, events, voucher sales, our newsletter, our virtual concierge, our social media presences and job applications, for which purposes we do so, and what rights you have.

We comply with the Swiss Federal Act on Data Protection (FADP) and the Data Protection Ordinance (DPO). Where the EU General Data Protection Regulation (GDPR) applies to a processing activity – for example because we offer services to guests from the EU – we comply with it as well. We use the terms «personal data» and «processing» in the same sense under both laws.

2. Controller and contact

The controller for the processing described in this policy is:

Landau AG, Landgasthof Halbinsel Au, Austrasse 59, 8804 Au ZH, Switzerland

Phone: +41 44 782 01 01 · E-mail: landgasthof@halbinselau.com

For questions about data protection and to exercise your rights, please contact us at the postal or e-mail address above.

We do not pass personal data on to other businesses or companies we are associated with (for example Fuxägufer Davos). Guest data is processed exclusively for Landgasthof Halbinsel Au.

3. Data we process

Depending on the service you use, we process in particular the following categories of personal data:

• Contact and master data, e.g. form of address, first and last name, address, e-mail address, telephone number, language, company name for business customers.
• Reservation, booking and contract data, e.g. date, time, number of people, services booked, room category, arrival and departure, menu choice, requests and remarks, cancellations and no-shows.
• Registration data for overnight stays, e.g. date of birth, nationality, type and number of identity document, where required by law.
• Payment data, e.g. payment method, transaction data and – via our payment service providers – credit card details as a guarantee. We do not store full card numbers ourselves.
• Communication data, e.g. the content of e-mails, forms, telephone calls and chat messages.
• Preference and profile data, e.g. preferences, feedback, visit and booking history, interests for personalised offers.
• Technical and usage data, e.g. IP address, device and browser information, pages visited, time of access, cookie IDs, interactions with newsletters and advertisements.
• Application data, e.g. CV, references, covering letter.

Particularly sensitive personal data such as information on allergies, intolerances or reduced mobility is processed only if you provide it to us yourself, and only for the purpose for which you provided it (for example to prepare an allergen-free meal). Where necessary, we obtain your express consent.

We receive most data directly from you. In some cases we also receive data from third parties, for example from booking platforms (such as Booking.com), from people who reserve or book on your behalf, or from companies organising an event with us.

4. Purposes and legal bases

We process personal data for the purposes described in the following sections. Under the FADP, processing personal data is generally permitted provided the data protection principles are observed; we obtain consent where the law requires it. Where the GDPR applies, we rely on the following legal bases:

• Contract (Art. 6(1)(b) GDPR): processing to initiate, conclude and perform contracts, e.g. reservations, room bookings, events, voucher purchases.
• Legal obligation (Art. 6(1)(c) GDPR): e.g. the duty to register guests, retention obligations under commercial and tax law.
• Legitimate interests (Art. 6(1)(f) GDPR): e.g. secure and stable operation of the website, responding to enquiries, preventing misuse, enforcing claims, direct marketing to existing guests within the limits of the law.
• Consent (Art. 6(1)(a) and Art. 9(2)(a) GDPR): e.g. analytics and marketing cookies, newsletter, profiling by the virtual concierge, processing of health-related information. You may withdraw your consent at any time with effect for the future.

5. Visiting our website

5.1 Server log files

When you access our website, your browser automatically transmits technical data to our server (IP address, date and time, page accessed, referrer URL, browser and operating system, status code). We process this data to provide the website, to ensure its security and stability and to detect misuse. Log files are deleted automatically after a short period unless they are needed to investigate a security incident. To protect the website against attacks and spam we also use a security plug-in (firewall) that evaluates access including IP addresses and logs and blocks suspicious requests.

5.2 Hosting and content management system

Our website is hosted by Multimedia Networks AG (brand «Hoststar»), Fraubrunnen BE, Switzerland. The servers are located in data centres in Switzerland and Germany. The website is based on the WordPress content management system with the Elementor page builder, which we operate on our own servers or with our host. The host processes the data as a processor exclusively on our behalf.

5.3 Contact form, e-mail and telephone

If you contact us via the contact form, by e-mail or by telephone, we process the information you provide (in particular your name, contact details and the content of your enquiry) in order to respond to your request. Form entries are sent to us by e-mail. We use our e-mail service provider to deliver these messages on our behalf. Depending on the form, the information is additionally stored in our content management system. We delete enquiries once they have been dealt with and no retention obligation or contractual relationship stands in the way, as a rule after 12 months.

5.4 Spam protection (Google reCAPTCHA)

To protect our forms against automated entries (spam, bots) we use Google reCAPTCHA provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (affiliated with Google LLC, USA). reCAPTCHA analyses information such as your IP address, time spent on the site, mouse movements and browser data, and transmits it to Google. The legal basis is our legitimate interest in protecting our website against misuse or, where required, your consent. Further information: https://policies.google.com/privacy

5.5 Maps (Google Maps)

To show our location we embed Google Maps provided by Google Ireland Limited. When the map loads, your IP address and information about the page accessed in particular are transmitted to Google; if your browser is signed in to a Google account, Google may associate the visit with that account. The map is loaded only once you have given your consent.

5.6 Fonts

The fonts used on this website are stored locally on our server. No connection to servers of Google or other font providers is established when you access the website.

5.7 Review award

On our website we display an award for our guest reviews, which is loaded from the provider of the review platform. Technical data such as your IP address is transmitted to that provider in the process. The award is loaded only once you have given your consent in the cookie settings.

6. Cookies and similar technologies (cookie policy)

6.1 What are cookies?

Cookies are small text files stored on your device when you visit a website. Similar technologies include pixels, tags and local storage. We refer to all of these as «cookies» below.

6.2 Categories

• Necessary cookies are required to operate the website, e.g. to store your cookie settings and for security functions and forms. They cannot be switched off.
• Functional cookies enable convenience features, e.g. displaying maps or embedded content.
• Analytics cookies help us understand how the website is used so that we can improve it.
• Marketing cookies are used to measure the effectiveness of our advertising and to show you relevant ads on other platforms.

6.3 Consent and withdrawal

We use functional, analytics and marketing cookies only if you have consented via our cookie banner when visiting the website. You can change or withdraw your choice at any time via the «Cookie settings» link in the footer of every page. For this we use the consent tool Cookiebot provided by Usercentrics A/S, Copenhagen, Denmark. Cookiebot stores your choice together with an anonymous consent ID in order to document your consent. A detailed and continuously updated list of all cookies used, including provider, purpose and storage period, can be found in the cookie settings.

You can also block or delete cookies in your browser. In that case some functions of the website may not be available.

6.4 Overview of the services used

6.5 Google Analytics 4

With your consent we use Google Analytics 4 provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to analyse the use of our website statistically (e.g. pages viewed, time spent, approximate location at country or region level, devices used, source of visits). Google Analytics 4 does not store full IP addresses. The data may be transferred to servers of Google LLC in the USA (see section 13). Analytics data is stored for a maximum of 14 months.

Further information: https://policies.google.com/privacy

6.6 Meta Pixel

With your consent we use the Meta Pixel provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland. It allows us to measure how visitors who reach our website via an ad on Facebook or Instagram use the website (for example opening the «Book a room» page), and to show ads to people who have shown an interest in our offers (custom audiences). Meta may associate this data with your Facebook or Instagram account and use it for its own purposes.

We are joint controllers with Meta for the collection and transmission of the data; any further processing by Meta is carried out under its sole responsibility. We have concluded a corresponding agreement with Meta (https://www.facebook.com/legal/controller_addendum). You can adjust your ad settings at https://www.facebook.com/adpreferences. Further information: https://www.facebook.com/privacy/policy – If the «advanced matching» function is enabled, encrypted information you have entered with us (for example your e-mail address) may also be transmitted.

7. Table reservations (aleno)

For table reservations made via our website, by telephone, by e-mail or through the virtual concierge we use the reservation system aleno provided by aleno AG, Aegerterstrasse 6, 8003 Zurich, Switzerland. We process in particular your name, contact details, date, time, number of people and your requests and remarks in order to confirm and carry out your reservation and to contact you if necessary. aleno processes the data as a processor on our behalf. The aleno reservation form is embedded directly in our website; when the relevant pages are loaded, a connection to aleno’s servers is established and technical data such as your IP address is transmitted.

Credit card guarantee: In certain cases, for example for larger groups or on special days, we may ask for a credit card as a guarantee to secure the reservation. The card details are collected and processed directly by the payment service provider integrated in aleno; we do not receive full card numbers. In the event of a no-show or late cancellation, a fee may be charged in accordance with our GTC.

Guest profile: In aleno we keep a profile of our guests containing previous reservations and preferences so that we can look after you personally and attentively on future visits. Information on allergies and intolerances is stored in the profile only with your express consent. You may request the deletion of your guest profile at any time. The guest profile is linked to the virtual concierge (see section 11). We delete guest profiles if you have not made a reservation for three years, unless statutory retention obligations apply.

Further information: https://www.aleno.me/de/policy

8. Room bookings and your stay

For online room bookings we use the booking engine provided by Mews, a service of Mews Systems B.V., Wibautstraat 137D, 1097 DN Amsterdam, Netherlands. Mews also serves as our property management system, in which we keep all room bookings – including those made by telephone or via booking platforms – as well as guest and registration data. The Mews booking function is embedded directly in our website so that you can check availability and book rooms. When our pages are loaded, a connection to Mews servers is established and technical data such as your IP address is transmitted to Mews. The booking page sets its own cookies, which you can manage there in a separate cookie banner. If analytics or marketing services are used on the booking page, they are activated only with the consent you give there. We process the data required for the booking, your stay and billing, in particular contact details, booking data, payment data, requests and information about fellow travellers. The providers process the data as processors on our behalf.

Duty to register guests: As an accommodation provider we are required by law to keep a guest register and to issue registration forms for all guests (§ 21(4) of the Police Act of the Canton of Zurich; for foreign guests additionally Art. 16 of the Foreign Nationals and Integration Act). For this purpose we record in particular your name, date of birth, nationality, address, identity document details and arrival and departure dates, and transmit this data electronically to the Zurich Cantonal Police. The police use the data to establish identity and, where applicable, for investigations and to search for missing persons. We retain the registration data for as long as applicable law requires and delete it afterwards.

Booking platforms: If you book via a platform such as Booking.com or Expedia, we receive the data required for the booking from that platform. The platform processes your data under its own responsibility and in accordance with its own privacy policy. If there is a disagreement or dispute in connection with such a booking, the platform may provide us with further information about the booking (for example a copy of the booking confirmation). We process this data in order to safeguard or enforce our claims.

Services during your stay: If you use additional services during your stay (for example food and drinks charged to your room, parking or extras), we record the type, time and price of the service for billing purposes.

Guest Wi-Fi: Our guest Wi-Fi is password-protected and does not require registration. Only the connection data required for technical operation (e.g. device identifier, assigned IP address, time of connection) is processed, and only briefly.

9. Events

If you enquire about or book an event via the «Event request» form, by e-mail or by telephone, we process your contact details and the information about the event (e.g. type of event, date, number of people, menu and drinks requests, room preferences, invoicing address) in order to prepare an offer and host the event. If you provide us with data about your guests (e.g. guest lists, menu choices, intolerances), please make sure that you are entitled to do so and that your guests are informed about this privacy policy.

Photographs and videos may be taken at events. We publish images in which guests are identifiable only with their consent or the consent of the organiser.

10. Voucher shop (FirstVoucher)

We sell our vouchers through the online shop at halbinselau.firstvoucher.com, which runs on the firstvoucher platform operated by prointernet GmbH & Co. KG, Marktplatz 8, 56288 Kastellaun, Germany. prointernet processes the data as a processor on our behalf. When you make a purchase, we – or the provider on our behalf – process your contact details, billing and delivery address, order data, voucher codes and payment data in order to process the order, issue the voucher and manage its redemption. Payment is handled by the payment service providers offered in the shop, which process your payment data under their own responsibility.

You may optionally create a customer account in the shop in order to view your orders; the related information is likewise stored on our behalf. If analytics or marketing services are used in the shop, they are activated only with the consent you give there.

We retain invoice and order data for ten years due to statutory obligations.

11. Virtual concierge (WhatsApp / AI)

11.1 What is the virtual concierge?

We offer a virtual concierge via the messenger service WhatsApp. It is an automated assistant based on artificial intelligence (AI), not a member of our team. The concierge answers questions about our business, takes reservations, makes suggestions and offers tailored to your interests and collects your feedback.

You can start the conversation using the WhatsApp button on our website or via our Google Business Profile (see section 15). The button on our website is a simple link; no data is transmitted to WhatsApp or third parties when you merely visit our website. Only when you click the button does WhatsApp open and you can begin the conversation with the concierge.

Use is voluntary. Our staff is also available to you personally for any matter. At the start of the conversation we point out that AI is used, refer to this privacy policy and obtain your consent for the profiling described below.

We do not use the concierge to contact you on our own initiative; the conversation always begins with a message from you.

11.2 Data we process

• First and last name, telephone number, WhatsApp profile name, language
• The content of the conversation, i.e. your messages and the concierge’s replies
• Reservation and booking data, feedback you give
• Preferences and interests arising from the conversation and from your previous reservations
• Usage, metadata and connection data (e.g. time of messages, delivery status)

If you tell the concierge about allergies or intolerances, this information is stored in your guest profile in the aleno reservation system so that our kitchen can take it into account during your visit. This is particularly sensitive health data; we process it exclusively for that purpose and only because you provide it voluntarily and thereby expressly consent to its processing. Please do not share payment card details or other sensitive information in the chat.

11.3 Purposes and legal bases

• Answering enquiries and taking reservations: to initiate and perform a contract or on the basis of our legitimate interest in responding to your enquiry.
• Profiling and personalised offers: the concierge creates a profile of you which is analysed and enriched using AI. For this purpose the conversation and the information derived from it are linked with your guest profile in our aleno reservation system (e.g. previous reservations, preferences) so that we can address you personally and make suitable suggestions. This profiling takes place exclusively with your express consent.
• Evaluation of feedback: to improve our services, based on our legitimate interest.

The concierge does not take automated individual decisions that produce legal effects concerning you or significantly affect you. Reservations are confirmed according to our usual rules; in case of doubt our team takes over.

11.4 Recipients

The concierge is operated for us by heyteo AG, Steigstrasse 18, 8463 Benken ZH, Switzerland, as a processor. We have concluded a data processing agreement with heyteo AG. heyteo AG in turn uses the following sub-processors, with which corresponding agreements are likewise in place:

• WhatsApp Ireland Limited, Dublin, Ireland (messenger service) – https://www.whatsapp.com/legal/privacy-policy-eea
• OpenAI Ireland Ltd, Dublin, Ireland (AI language model) – https://openai.com/policies/eu-privacy-policy/
• Google Ireland Limited, Dublin, Ireland (cloud infrastructure / AI services) – https://cloud.google.com/privacy/gdpr
• Twilio Inc., San Francisco, USA (communication interface) – https://www.twilio.com/en-us/legal/privacy
• aleno AG, Zurich (reservation system, see section 7)

Some of these companies also process certain data under their own responsibility for their own purposes, in particular for the security, misuse prevention, maintenance and support of their systems; this applies in particular to WhatsApp with regard to usage and connection data. For details please see the privacy policies linked above. The AI services are used via business interfaces under which, according to the providers’ terms, your data is not used to train AI models.

Further information about heyteo AG: https://www.heyteo.ch/legal-pages/datenschutz

11.5 Storage period and withdrawal

Conversations and the concierge profile are stored for a maximum of 24 months after your last interaction and are then deleted or anonymised. You may withdraw your consent to profiling at any time by writing to us at the address given in section 2. The lawfulness of processing carried out before withdrawal remains unaffected.

12. Newsletter (Mailchimp)

If you sign up for our newsletter using the form on our website, we use the information provided there (first name, last name and e-mail address) to send you regular information about offers, events and news. We send the newsletter only if you have signed up for it and thereby consented; your sign-up is logged (time and form used).

We use Mailchimp, a service of The Rocket Science Group LLC, 405 N Angier Ave NE, Atlanta, GA 30308, USA (Intuit group), to send our newsletters. Mailchimp processes the data as a processor; the data is stored in the USA (see section 13). Our newsletters contain tracking pixels and links which allow us to analyse whether and when a newsletter was opened and which links were clicked. This analysis serves to improve our content.

The legal basis is your consent. You can unsubscribe at any time using the unsubscribe link in every e-mail. After you unsubscribe we remove your data from the distribution list or store your e-mail address on a suppression list to make sure you receive no further newsletters.

Information from our contact form or event form is not transferred to Mailchimp.

Guests without a separate newsletter sign-up: our aleno reservation system is connected to Mailchimp. If you have made a reservation or booking with us, we may therefore add your e-mail address to our distribution list and inform you about our own similar offers. We rely on Art. 3(1)(o) of the Swiss Unfair Competition Act (UCA) and, where the GDPR applies, on our legitimate interest in direct marketing to existing customers. You may object to this use at any time – when making your reservation, via the unsubscribe link in every e-mail or by sending us a message.

13. Transfers abroad

Our service providers are mainly located in Switzerland and the European Economic Area (EEA), whose level of data protection is considered adequate. Some providers (in particular Google, Meta, Mailchimp, Twilio and OpenAI or their group companies) may also process personal data in the USA or other countries.

Data is disclosed to countries without an adequate level of data protection only where appropriate safeguards are in place. For the USA we rely on the Swiss-U.S. and EU-U.S. Data Privacy Framework where the recipient is certified, and otherwise on the standard contractual clauses approved by the European Commission and recognised by the Swiss Federal Data Protection and Information Commissioner (FDPIC). You may request a copy of these safeguards at the address given in section 2. Please note that authorities in the USA may under certain circumstances access such data.

14. Other recipients

We disclose personal data only where this is necessary for the purposes described, in particular to:

• IT, hosting, reservation, booking, voucher, newsletter and communication service providers (processors) who are contractually bound to comply with data protection requirements;
• payment service providers and banks for processing payments;
• authorities, where we are required to do so by law (e.g. guest registration);
• advisers such as fiduciaries, auditors or lawyers, where necessary;
• partners providing services at an event (e.g. decoration, music), where necessary to host the event.

We do not sell personal data.

Overview of our main service providers

15. Social media presences

We maintain presences on the following social networks:

• Instagram: @halbinselau (https://www.instagram.com/halbinselau)
• Facebook: https://www.facebook.com/HalbinselAu
• LinkedIn: https://www.linkedin.com/company/landgasthof-halbinsel-au

If you interact with our posts, follow us or send us messages, we process the data transmitted in order to communicate with you and to manage our presences. The networks also provide us with statistical analyses (insights or page analytics) on the use of our profiles. We receive only aggregated, non-personal statistics.

Instagram and Facebook are operated for users in Europe by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland. We are joint controllers with Meta for the creation of these statistics (https://www.facebook.com/legal/terms/page_controller_addendum). Otherwise Meta processes your data under its own responsibility in accordance with https://www.facebook.com/privacy/policy

LinkedIn is operated for users in Europe by LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland. We are joint controllers with LinkedIn for the page statistics (https://legal.linkedin.com/pages-joint-controller-addendum). Otherwise LinkedIn processes your data under its own responsibility in accordance with https://www.linkedin.com/legal/privacy-policy

The networks may also transfer data to the USA (see section 13). You can enforce your rights against the networks most effectively directly with them; of course you may also contact us.

Google Business Profile: We maintain a business profile with Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland), through which our business is shown in Google Search and Google Maps. If you leave a review there, send us a message or use the WhatsApp link provided, we process the data transmitted in order to respond to your request. Google also provides us with aggregated statistics on the use of the profile and otherwise processes your data under its own responsibility in accordance with https://policies.google.com/privacy

On our website we link to our social media profiles with simple links. No data is transmitted to the networks when you access our website.

16. Job applications

If you apply for a position with us, we process your application documents exclusively in order to carry out the application procedure. Once the procedure is complete, we delete the documents of unsuccessful applicants at the latest after six months, unless you have consented to longer retention for future vacancies.

17. Storage periods

We process personal data for as long as is necessary for the respective purpose, as long as statutory retention obligations apply, or as long as we have a legitimate interest in retaining it (for example to enforce or defend claims during limitation periods). Accounting records such as invoices and receipts are retained for ten years (Art. 958f CO). Specific periods for individual processing activities are set out in the relevant sections. After that, the data is deleted or anonymised.

18. Data security

We take appropriate technical and organisational measures to protect your personal data against loss, misuse and unauthorised access, in particular SSL/TLS-encrypted transmission on our website, access restrictions and the careful selection of our service providers. However, fully secure transmission of data over the internet cannot be guaranteed. For confidential information we recommend that you do not contact us by unencrypted e-mail.

19. Your rights

Within the scope of applicable data protection law you have in particular the following rights:

• Access to whether and which personal data we process about you (Art. 25 FADP, Art. 15 GDPR);
• Rectification of inaccurate data (Art. 32 FADP, Art. 16 GDPR);
• Erasure or destruction of your data (Art. 32 FADP, Art. 17 GDPR);
• Restriction of processing (Art. 18 GDPR);
• Data portability, i.e. release and transfer of your data in a common electronic format (Art. 28 FADP, Art. 20 GDPR);
• Objection to processing, in particular to direct marketing (Art. 30 FADP, Art. 21 GDPR);
• Withdrawal of consent given, with effect for the future.

To exercise your rights, please contact us at the address given in section 2. We may request proof of identity. We generally respond within 30 days. These rights may be restricted by law, for example where retention obligations apply.

You also have the right to lodge a complaint with a data protection supervisory authority. In Switzerland this is the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern (www.edoeb.admin.ch). Individuals in the EU may contact the supervisory authority of their country of residence.

20. Changes to this privacy policy

We may amend this privacy policy at any time, in particular if we introduce new services or the legal situation changes. The version published on our website at the relevant time applies.

This privacy policy is available in German and English. In the event of any discrepancy, the German version prevails.

Version: 25 September 2026