Privacy Policy

This privacy policy explains how Stieregg Rentals GmbH processes personal data when you use our direct booking website, submit a booking request, or complete payments and cancellations. It is based on the Swiss Federal Act on Data Protection (FADP / DSG).

1. Controller

The controller is Stieregg Rentals GmbH, Weidweg 5, 3818 Grindelwald, Switzerland, email: info@stieregg.ch, UID CHE-202.275.796.

2. Data we process

Booking request: name, email address, optional phone number, message, requested dates and guest count, selected listing, language, and your acceptance of the terms (including version and timestamp).

Technical and security data: IP address and the country derived from that IP at request time, for abuse prevention, rate limiting, and consent evidence; Cloudflare Turnstile tokens for bot protection.

Payments: payment status, amounts, and references (for example payment-link or session IDs). Card data is processed by Stripe; we do not store full card numbers.

Communications: email content and delivery metadata for booking confirmations, payment reminders, cancellations, and support.

3. Purposes

We process data to review and respond to booking requests, prepare and perform contracts, process payments and refunds, manage calendars and availability, meet legal obligations (for example tourist tax / registration and accounting), and protect against abuse and technical attacks.

4. Legal bases

Processing is based in particular on steps prior to entering into a contract and contract performance, compliance with legal obligations, and legitimate interests (operating the website, security, and abuse prevention).

5. Recipients and processors

We use service providers that process data on our behalf or as independent controllers where applicable: hosting and database (including Vercel and Supabase), email delivery (Resend), bot protection (Cloudflare Turnstile), and payment processing (Stripe).

These providers receive only the data needed for their role and may not use it for their own purposes where they act as processors.

6. Retention

We retain personal data only as long as needed: 24 months after check-out for paid stays (accounting), 12 months after the last update for declined, expired, or unpaid cancelled requests, and 48 hours for abuse and rate-limit data. We keep data longer where legal retention duties or the establishment, exercise, or defence of legal claims require it.

7. Cookies and similar technologies

We do not use marketing or advertising tracking cookies. Technically necessary technologies may be used to run the site and protect against automated abuse (including Cloudflare Turnstile, which may use cookies or similar storage).

Your browser may also store local preferences (for example language) where the application provides that feature.

8. Cross-border disclosure

Some providers may process data in the EU/EEA or other countries (including the United States). Where required, we rely on appropriate safeguards (for example standard contractual clauses) or legally permitted exceptions.

9. Your rights

Under the FADP you have, in particular, the right to access, rectification, erasure, and restriction of processing, and, where applicable, to object. To exercise your rights, contact us using the details below.

You may also lodge a complaint with the competent supervisory authority (in Switzerland: the Federal Data Protection and Information Commissioner, FDPIC / EDÖB).

Privacy contact

For privacy questions or to exercise your rights, email us at info@stieregg.ch.