Privacy Policy

1. Controller

Groups AG, Allmendlistrasse 9b, 5507 Mellingen, Switzerland
Email: contact@groupstravel.com
Contact person for data protection: Patrick Weiss

2. Overview

gruppenhaus.swiss is a directory of group accommodation in Switzerland. The website has no user accounts and no input forms. Personal data is processed in the following cases:

• when any page is accessed (server log files, section 3)
• when photos and maps are displayed (sections 4 and 5)
• if you consent to web analytics (section 7)
• if you send us an email (section 9)

3. Hosting and server log files

The website is hosted by Nine Internet Solutions AG (deplo.io) in Switzerland. Each time a page is accessed, the server processes technical access data: IP address, date and time, the requested address (URL), the previously visited page (referrer) as well as browser and operating system.

The requested address also includes search and filter settings. When you use the search, your selected filters appear in the address, e.g. region, number of people, meals and arrival and departure dates (example: /en/suche/?…). This information is therefore recorded in the server log files. No names or contact details are collected.

The log files serve the secure and stable operation of the website and troubleshooting. They are not combined with other data and are deleted after 30 days.
Legal basis under the GDPR: legitimate interest (Art. 6(1)(f)).

The connection is encrypted with TLS.

4. Photos of the accommodation (groups.swiss)

The photos of the accommodation are loaded directly from the server of the groups.swiss platform, which is also operated by Groups AG. Your browser transmits your IP address, browser information and the referring page to this server. This transmission is technically necessary to display the images.

groups.swiss is delivered via the Cloudflare network. The provider is Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. Cloudflare delivers the photos and protects the platform against attacks. To do so, Cloudflare processes the same technical data, in particular your IP address. Data may be transferred to the USA in the process. Cloudflare, Inc. is certified under the EU-US Data Privacy Framework and the Swiss-US Data Privacy Framework.
Legal basis under the GDPR: legitimate interest (Art. 6(1)(f)).

5. Maps (OpenStreetMap)

We display maps on the home page and on the pages of individual accommodation. We serve the mapping library (Leaflet) from our own server. However, your browser loads the map tiles from the servers of the OpenStreetMap Foundation as soon as you scroll to the map. Your IP address, browser information, the referring page and the map section displayed are transmitted in the process.

Provider: OpenStreetMap Foundation, St John’s Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom.
Privacy information: https://osmfoundation.org/wiki/Privacy_Policy

Under Annex 1 of the Swiss Data Protection Ordinance (DPO), the United Kingdom is a country with an adequate level of data protection. For the EU, an adequacy decision of the European Commission applies.
Legal basis under the GDPR: legitimate interest in a clear presentation of the location (Art. 6(1)(f)).

6. Storage of your cookie choice (localStorage)

When you choose “Accept” or “Decline” in the cookie notice, we store this choice in your browser’s local storage (localStorage) under the name gh_consent. Only the value “granted” or “denied” is stored. This means you are not asked again on every page.

The entry remains in your browser and is not transmitted to us or to third parties. It has no expiry date and remains until you change your choice or delete the website data in your browser.
Legal basis under the GDPR: legitimate interest (Art. 6(1)(f)). The entry is strictly necessary to respect your decision.

7. Web analytics with Google Analytics 4 (only with consent)

With your consent, we use Google Analytics 4 to understand how the website is used and to improve it.

Without consent, Google Analytics is not loaded. No data is then transmitted to Google and no Google cookies are set.

After your consent, your browser loads the Google Analytics script and transmits usage data to Google. This includes:

• pages viewed and their address, including search and filter settings
• the previously visited page
• date, time and length of visit
• device and browser information, screen resolution, language
• approximate location (country, region, city), derived from the IP address

According to Google, IP addresses are not logged or stored in Google Analytics 4. We cannot attribute the data to a specific person.

Google Ads: Google Analytics is linked to our Google Ads account. With your consent, usage data is also used to measure the performance of our ads (conversion tracking). If you reach the website via an ad, the address contains a click identifier (gclid). Personalised advertising and remarketing are disabled.

Cookies:

Event data (individual page views and actions) is deleted at Google after 2 months. User-related data linked to the identifier in the _ga cookie is deleted after 14 months; the period restarts with each new visit.

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The parent company is Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

Transfer to the USA: Data may be transferred to Google LLC in the USA. Google LLC is certified under the EU-US Data Privacy Framework and the Swiss-US Data Privacy Framework. The European Commission has adopted an adequacy decision for certified companies. The Federal Council has added the USA, for certified companies, to Annex 1 DPO as a country with an adequate level of data protection.
More information: https://policies.google.com/privacy

Legal basis under the GDPR: your consent (Art. 6(1)(a)).

Withdrawal: You can withdraw your consent at any time with effect for the future. To do so, click “Cookie settings” at the bottom of the page and choose “Decline”. Google Analytics will then no longer be loaded, and the cookies _ga, _ga_<ID>, _gcl_au and _gcl_aw will be deleted. Processing carried out before the withdrawal remains lawful.

8. Links to groups.swiss and the guest account

Enquiries: The “Enquire on groups.swiss” button takes you to the groups.swiss platform, where you send your enquiry to the host.

Guest account: The “Guest account” link at the top of every page leads to login.groupstravel.com. This site is operated by Groups AG. Your language and the origin “gruppenhaus” are passed in the address. There is no login on gruppenhaus.swiss itself.

List a house: The “List a house” link in the footer leads to host.groupstravel.com. This site is operated by Groups AG.

As long as you do not click any of these links, no data is transmitted to these sites, except for the photos described in section 4. Processing on groups.swiss, login.groupstravel.com and host.groupstravel.com is governed by their own privacy policies.

9. Contact by email

When you send us an email, we process your address, your name and the content of the message in order to respond to your request. The message is deleted once the matter has been dealt with, unless statutory retention obligations apply.
Emails are processed by Hostpoint AG, Rapperswil-Jona, Switzerland.
Legal basis under the GDPR: legitimate interest in responding (Art. 6(1)(f)) or pre-contractual measures (Art. 6(1)(b)).

10. Recipients and countries at a glance

We do not sell personal data. We do not make automated individual decisions and do not carry out profiling.

11. Your rights

Under the FADP and the GDPR, you have the following rights:

• Access to the personal data processed about you (Art. 25 FADP, Art. 15 GDPR)
• Rectification of inaccurate data (Art. 32 FADP, Art. 16 GDPR)
• Erasure (Art. 32 FADP, Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data disclosure and portability: receiving your data in a common electronic format (Art. 28 FADP, Art. 20 GDPR)
• Objection to processing based on legitimate interest (Art. 30(2)(b) FADP, Art. 21 GDPR)
• Withdrawal of consent given, at any time and with effect for the future (Art. 7(3) GDPR), for Google Analytics as described in section 7

Please contact the address in section 1. We may ask for proof of identity.

You also have the right to lodge a complaint with a supervisory authority. In Switzerland, this is the Federal Data Protection and Information Commissioner (FDPIC), www.edoeb.admin.ch. In the EU, it is the data protection authority of your country of residence (Art. 77 GDPR).

12. Changes

We update this privacy policy when the website or the legal situation changes. The version published here applies.