The controller within the meaning of the Swiss Data Protection Act (DSG) is Hotel & Eventcenter der Meilenstein GmbH, Lotzwilstrasse 66, 4900 Langenthal, Switzerland. Privacy enquiries should be directed to [email protected] or +41 62 919 18 18.

We process personal data lawfully, in good faith, proportionately and for specific purposes. Purposes include in particular the operation and security of the website, responding to enquiries, initiating and processing reservations and providing hotel, restaurant and event services, fulfilling legal obligations and protecting legitimate business interests.

When the website is accessed, technically necessary data such as IP address, date and time, requested URL, referrer, browser, operating system and device information are recorded in server logs. This serves delivery, stability, error analysis and protection against misuse. The website is hosted on infrastructure of Hetzner Online GmbH in Germany. Web server logs are normally rotated every 14 days; in case of security incidents individual records may be retained longer.

If you use forms or contact us, we process, in particular, your name, email address, telephone number, message, event requirements and any voluntary information for handling, communication, preparing offers and, where applicable, contract fulfilment. Mandatory fields are marked as such.

Hotel, restaurant or voucher bookings may involve external booking services. Once you open them, the respective provider processes data under its own responsibility and in accordance with its privacy policy. Before concluding a contract, the contractual and privacy information shown there also applies.

When you subscribe, we process your email address and any optional name details for the newsletter you select. We also process language, brand or segment assignment, registration source, timestamps, the consent wording used and a check value derived from the IP address to prevent misuse. New registrations are verified by a confirmation email (double opt-in) and enabled for delivery only after confirmation. The confirmation link is valid for 48 hours. Registration applies to the newsletter named in the form and does not subscribe you generally to other brands. Marketing delivery is based on your consent and, where the GDPR applies, Article 6(1)(a). The controller remains the organisation identified in this privacy notice.

We use COMROCKET Newslater and the Postal delivery software to manage and send newsletters. Technical support is provided by comrocket GmbH in Germany. Newsletter data and delivery services run on Hetzner Online GmbH servers in Falkenstein, Germany. Centrally assigned replies are also processed in a technical mailbox with Linevast, a brand of Droptop GmbH in Germany. Relevant staff and the technical providers needed for operation and support have access. Transfers from Switzerland to Germany are to a country recognised as providing adequate protection. Normal email routing and the mail providers you choose may involve other countries.

We process technical sending, delivery and failure information. Replies and automatic responses may be centrally matched to the contact and newsletter and analysed using rules to recognise, for example, unsubscribe requests, invalid addresses, address changes and absence notices. Personal replies are forwarded to the relevant contact person. Clear unsubscribe or erasure requests trigger a marketing block; an erasure request removes the contact from the active mailing list. Any broader erasure rights and necessary evidence are assessed separately. This technical classification does not make decisions with legal or similarly significant effects on you. Please limit newsletter replies to information needed for your request.

Our newsletters are configured for performance measurement by default. This may use a small remotely loaded image and individually assigned redirect links. Opens, clicked links and timestamps can be associated with the particular delivery and contact; technical connection and device information is also processed. This helps us assess and improve our newsletters. You can turn off personal open and click measurement through the newsletter preferences link without unsubscribing. This choice is applied to subsequent messages. It does not retrospectively change messages already sent or records already collected. Delivery, unsubscribe and security information remains necessary to operate the service. Measurement must meet the applicable legal requirements; offering an opt-out does not replace prior consent where that consent is legally required.

You can withdraw newsletter consent at any time for the future through the unsubscribe link or by writing to the contact address above. This does not affect the lawfulness of earlier processing. No further marketing for that newsletter is sent after unsubscribing. Necessary suppression records and evidence of consent, delivery and processing may be retained to respect your objection, demonstrate consent, meet legal obligations or protect legitimate claims. Retention depends on the purpose, legal obligations and applicable limitation periods; expiry of a confirmation link does not automatically erase all evidence. Where the GDPR applies, necessary operational and evidential processing may in particular rely on Article 6(1)(f) and, where applicable, (c). Your other data protection rights remain available.

In the public area we do not currently use our own analytics or marketing cookies. For protected administration sessions a technically necessary, securely configured session cookie is used. Embedded services may use their own technologies. Your browser allows you to delete or block cookies; this may restrict functionality.

The website may load content from third-party providers, in particular the TrustScore from TrustYou and maps or media. In doing so, IP address, browser data and the page you accessed may be transmitted to the provider. HotelsCombined and event venue pages are only loaded when clicked. Third-party providers process data in accordance with their own privacy statements.

Personal data may be disclosed to carefully selected IT, hosting, communications, booking, payment and other service providers where necessary. These include in particular the hosting provider Hetzner, the hotel or restaurant booking systems you access and, for embedded guest reviews, TrustYou. Contracted processors may only handle data for the specified purpose and with appropriate security measures. Disclosure to authorities takes place where required by law.

Individual service providers may process data abroad. For countries without an adequate level of data protection we use a legally recognised safeguard, in particular appropriate standard contractual clauses, or rely on a legal exception. Where possible, we prefer processing in Switzerland or in the European Economic Area.

We retain personal data only for as long as the processing purpose, contractual claims or legal obligations require; thereafter they are deleted or anonymised. We take appropriate technical and organisational measures against unauthorised processing, loss, alteration or disclosure. Absolute security cannot be guaranteed.

Under applicable law you may in particular request access to, rectification, deletion, the handover or transfer of your data, as well as restriction or cessation of certain processing. Consent may be revoked for the future. Statutory retention obligations remain unaffected. You may contact the Federal Data Protection and Information Commissioner.

We will update this statement if processing, service providers or the legal situation change. The version published at any given time is authoritative.