Privacy policy
This privacy policy explains how Tourismusconsult GmbH processes personal data when you visit our website tourismusconsult.ch, contact us, book an appointment or subscribe to our monthly newsletter. It follows the Swiss Federal Act on Data Protection (FADP) and, where applicable, the EU General Data Protection Regulation (GDPR). The GDPR applies to us as soon as we specifically offer goods or services to persons in the EU or evaluate their behaviour on the website. We use the terms «processing» (FADP) and «processing» (GDPR) synonymously.
Controller
Tourismusconsult GmbH
Stadthausstrasse 14
8400 Winterthur
Switzerland
Phone: +41 52 566 10 19
Email: office@tourismusconsult.ch
For any questions about data protection, you can reach us at office@tourismusconsult.ch, subject line «Data protection».
What data we process and why
We only process the data we need for the respective purpose. In detail:
| Situation | Data | Purpose | Legal basis under GDPR |
|---|---|---|---|
| Visiting the website | IP address (shortened), date and time, page accessed, referrer, browser and operating system | Operation, security, error analysis | Art. 6(1)(f) (legitimate interest) |
| Contact form, email, phone | Name, business, email, phone, business website, content of the inquiry | Responding to the inquiry, possibly an offer | Art. 6(1)(b) (pre-contractual measures) or (f) |
| Booking an initial consultation | Name, email, chosen appointment, any details on the matter | Planning and conducting the consultation | Art. 6(1)(b); loading the appointment scheduler: (a) (consent) |
| Monthly newsletter | Email address, time of registration | Sending the monthly newsletter, proof of consent | Art. 6(1)(a) (consent) |
| Statistics and marketing | Usage data, cookie IDs, device information | Reach measurement, website optimisation, campaign performance measurement | Art. 6(1)(a) (consent) |
| Job applications | Information and documents you send us | Conducting the application process | Art. 6(1)(b); Art. 88 GDPR |
Under Swiss law, we generally do not need a legal basis for processing, but we must comply with the principles of the FADP (lawfulness, good faith, proportionality, purpose limitation, transparency). Where we obtain your consent, we do so in accordance with the FADP as well.
You are not obliged to provide us with data. However, without the necessary information, we cannot respond to inquiries or arrange appointments.
Hosting
Our website is operated by Infomaniak Network SA, Rue Eugène-Marziano 25, 1227 Les Acacias (Geneva), Switzerland. The servers are located in Switzerland. Infomaniak processes the data exclusively on our behalf.
When you access the website, the server automatically stores log data (server log files). We need this to operate the website reliably and securely and to detect attacks. The log files are deleted after 30 days, unless they are needed longer to investigate a security incident.
Contact and email
If you contact us via the contact form, by email or by phone, we process your information to respond to your inquiry. Our website is static and does not accept forms itself. The forms transmit your entries to Formspree, Inc., 21750 Hardy Oak Blvd, San Antonio, TX 78258, USA. Formspree turns this into an email to office@tourismusconsult.ch and additionally stores the submission in our account there, so that no inquiry is lost. In doing so, data is transferred to the USA (see item 11).
For our email communication, we use Google Workspace provided by Google Cloud EMEA Limited, Ireland (parent company: Google LLC, USA). It cannot be ruled out that data is transferred to the USA in this process (see item 11).
We delete inquiries once they have been resolved and no statutory retention obligations apply. If an assignment results from this, we retain business-relevant correspondence for ten years in accordance with commercial law obligations (Art. 958f CO).
Appointment booking and video calls
For booking the initial consultation, we use the appointment scheduling function of Google Calendar (Google Cloud EMEA Limited / Google LLC). The scheduler is only loaded once you click on «Load scheduler», thereby giving your consent. Only then is data such as your IP address and the information you enter transmitted to Google.
The initial consultation takes place via Google Meet. You will receive the link with the calendar invitation. During participation, Google processes technical connection data as well as video and audio, to the extent you enable these. We do not record calls.
Monthly newsletter
We only send our monthly newsletter with your consent. Registration takes place via the form in the footer of the website. Your email address is transmitted to Formspree, Inc. (USA) and forwarded from there to us; the information under item 4 applies.
A confirmation process with double opt-in is not currently in place, nor is any measurement of opens or clicks. We store your address and the time of registration.
You can unsubscribe from the monthly newsletter at any time by emailing office@tourismusconsult.ch. After unsubscribing, we delete your address from the distribution list. We may retain proof of your previous consent for up to three years.
Cookies and consent management
Cookies are small text files stored by your browser. We use technically necessary cookies without consent, for example to save your cookie selection. All other cookies and comparable technologies (pixels, tags, local storage) only load once you have given consent via our cookie banner.
Control is carried out via Google Consent Mode v2. As long as you have not given consent, no statistics or marketing cookies are set.
You can change or withdraw your selection at any time via «Settings» in the page footer. The withdrawal applies for the future.
Statistics and analysis
These services only load with your consent.
Google Tag Manager (Google Ireland Limited / Google LLC): A tool we use to manage tags on the website. The Tag Manager itself does not set cookies and does not evaluate data, but establishes a connection to Google servers.
Google Analytics 4 (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland / Google LLC, USA): We use this to measure how visitors use our website, for example which pages are accessed and where the visit comes from. IP addresses are not stored in Google Analytics 4. Data is deleted after 14 months. Google may transfer data to the USA.
Microsoft Clarity (Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland / Microsoft Corporation, USA): Clarity shows us in aggregated form how the website is used, for example through heatmaps and anonymised session recordings (mouse movements, clicks, scrolling). Entries in form fields are masked and not recorded. Microsoft may transfer data to the USA.
Hotjar (Hotjar Ltd., Malta): Hotjar likewise shows us in aggregated form how the website is used, for example through heatmaps and session recordings. Entries in form fields are not captured.
Advertising and performance measurement
These services only load with your consent.
Google Ads Conversion Tracking and Remarketing (Google Ireland Limited / Google LLC): This lets us know whether someone carries out a specific action, such as submitting an inquiry, after clicking one of our ads. With remarketing, we can show ads again later to people who have visited our website.
Meta Pixel (Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland / Meta Platforms Inc., USA): We use this to measure the effectiveness of our ads on Facebook and Instagram and to build target audiences. We are jointly responsible with Meta for collecting and transmitting the data to Meta (Art. 26 GDPR). Further processing at Meta takes place under its own responsibility.
OpenAI Ads Measurement Pixel (OpenAI, L.L.C., 1455 3rd Street, San Francisco, CA 94158, USA): We use this to measure whether someone carries out a specific action in ChatGPT after clicking one of our ads. The pixel loads from bzrcdn.openai.com, sends events to bzr.openai.com and sets a cookie named __oppref for this purpose. According to OpenAI, this transmits advertising identifiers as well as an encrypted version of the email address and phone number, where available. The data is transferred to the USA (see section 11).
You can additionally disable personalized advertising in your accounts: at Google under adssettings.google.com, at Meta in your account's ad settings.
Data transfer abroad
Our website runs on Swiss servers. Some of the service providers named above are based in the EU or in the USA, or may transfer data there.
- EU/EEA: Switzerland recognizes the EU/EEA states as countries with an adequate level of data protection. Conversely, the EU Commission recognizes Switzerland as adequate.
- USA: Transfers are made to companies certified under the EU-US Data Privacy Framework and the Swiss-US Data Privacy Framework (Google, Microsoft, Meta, Formspree). As of the date of this statement, OpenAI is not listed there. Where no certification exists, we rely on the EU Commission's standard contractual clauses, recognized by the Federal Data Protection and Information Commissioner (FDPIC), with the adaptations required for Switzerland.
Links to external pages and social networks
On our website, we link to external offerings, such as our LinkedIn profile, our Google reviews (Google Maps) and partner organisations. These are simple links: no data is transmitted to these providers when our website loads. Only when you click a link do the privacy provisions of the respective provider apply.
Applications
If you apply to us, we process your information exclusively for the application procedure. We delete documents from applicants we do not hire no later than six months after the procedure has ended, unless you have consented to longer storage.
Disclosure to third parties
We do not sell personal data. Disclosure only takes place to the service providers named in this statement, who work on our behalf and are contractually bound to data protection, or where we are legally obliged to do so.
Retention and deletion
We retain personal data only as long as necessary for the purpose or as required by law. We state the specific periods in the respective sections. We retain business records for ten years in accordance with Art. 958f OR.
Data security
We protect your data with appropriate technical and organisational measures. These include encrypted transmission (TLS/HTTPS), access restrictions and the careful selection of our service providers. However, no one can guarantee complete protection when transmitting data over the internet.
Automated individual decisions and profiling
We do not make automated individual decisions within the meaning of Art. 21 FADP or Art. 22 GDPR. With your consent, the services described in sections 8 and 9 may create usage profiles for statistical and advertising purposes.
Your rights
Under the FADP and GDPR, you have in particular the following rights:
- Information on whether and which data we process about you
- Correction of inaccurate data
- Deletion of your data, provided no retention obligation applies
- Restriction of processing
- Data release or portability in a common electronic format
- Objection to processing based on our legitimate interest
- Withdrawal of consent at any time with effect for the future
An email to office@tourismusconsult.ch is sufficient for your request. To prevent misuse, we may need to verify your identity. We generally respond within 30 days.
You also have the right to lodge a complaint with a supervisory authority. In Switzerland, this is the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, www.edoeb.admin.ch. If you reside in the EU, you can contact the supervisory authority of your state of residence.
Changes
We adapt this privacy statement whenever our website, our services or the legal situation change. The version published on this page at any given time applies.
Version of 28 September 2026. The sections on forms, the monthly letter and analytics tools were adapted to how this website actually works. These adaptations are to be reviewed by Tourismusconsult GmbH’s legal advisers.