Privacy and Cookie Policy

PRIVACY POLICY APPENZELLER HUUS

Version October 2026

1. GENERAL INFORMATION

1.1 The protection of your personal data is important to us. This Privacy Policy explains what personal data we process, for what purposes we process it, to whom personal data may be disclosed and what rights you have under applicable data protection law.

1.2 This Privacy Policy applies to the services offered by APPENZELLER HUUS AG through its properties HUUS QUELL, HUUS BÄREN 1602 and HUUS LÖWEN 1878, as well as to our website and related digital services.

1.3 We process personal data in particular in connection with

Use of our website
Enquiries and contact requests
Reservations and bookings
Stays at our hotels
Restaurant, spa, wellness and other services
Payments and invoicing
Vouchers and our online shop
Newsletters and marketing communications
Job applications
Events and customer relationships
The security of our buildings, facilities and IT systems

1.4 This Privacy Policy is based primarily on the Swiss Federal Act on Data Protection (FADP). Where the European Union's General Data Protection Regulation (GDPR) applies to specific data processing activities, we also comply with the relevant provisions. The applicable requirements depend on the specific circumstances of each processing activity.

Where the GDPR applies, we additionally provide information on the relevant legal basis for processing, recipients, retention periods and the rights of data subjects.

2. DATA CONTROLLER

2.1 The controller responsible for processing personal data is

APPENZELLER HUUS AG
Dorfstrasse 7
9108 Gonten
Switzerland
Telephone: +41 71 511 05 00
Email: [email protected]

2.2 If you have any questions about data protection or wish to exercise your data protection rights, you may contact us using the contact details provided above.

3. WHAT PERSONAL DATA DO WE PROCESS?

3.1 Depending on how you use our services, we may process the following categories of personal data in particular

First and last name
Form of address and, where applicable, title
Address
Email address
Telephone number
Date of birth or age, where required for specific services or legal obligations
Nationality or information from identity documents, where legally required
Reservation and stay details
Arrival and departure dates
Room and booking information
Information about accompanying persons
Special requests and preferences
Information relating to restaurant, spa, wellness, event and other reservations
Correspondence and information provided in enquiries
Payment and invoicing information
Voucher and purchase information
Marketing and newsletter preferences
Information contained in job applications
Technical data relating to the use of our website and digital services
IP address
Information about your browser, operating system, device and use of our website
Cookies and comparable online identifiers
Where applicable, image and video data collected through our video surveillance systems

3.2 As a general rule, we only process personal data that is necessary for the relevant purpose or that you voluntarily provide to us.

3.3 SPECIAL CATEGORIES OF PERSONAL DATA

Depending on how you use our services, we may in individual cases also process special categories of personal data within the meaning of applicable data protection law.

This may include health data, such as information relating to

Allergies
Food intolerances
Special dietary requirements
Health-related restrictions
Special needs in connection with spa, wellness or other services

Such information may be processed in particular when you voluntarily provide it to us or when it is necessary to provide a service you have requested. We process this information exclusively for the relevant purpose, particularly to accommodate your needs, provide the requested service safely and appropriately, or fulfil legal or safety-related obligations. We ask you to provide only those special categories of personal data that are necessary for, or relevant to, the service requested.

Access to such information is restricted to employees and service providers who need it to deliver the specific service. Unless statutory retention obligations or overriding interests prevent this, the information will be deleted or removed from your permanent guest profile once the relevant service has been completed.

3.4 SOURCE OF PERSONAL DATA

As a general rule, we obtain personal data directly from you. In certain cases, we may also receive personal data from third parties, particularly booking platforms, tour operators, individuals making reservations on behalf of other guests, business partners or event organisers. In addition, technical data may be collected by our systems or service providers when you use our website and digital services. We process such data for the purposes described in this Privacy Policy and in accordance with applicable data protection law.

4. VISITING OUR WEBSITE

4.1 When you visit our website, technically necessary information is processed. This may include, in particular

IP address
Date and time of access
Browser type and version
Operating system
Pages visited
Referrer URL
Technical information about the device used
Information about your use of and technical interactions with our website

This data is processed primarily to

Make our website technically available
Ensure the stability and security of our website
Identify and resolve errors
Detect and prevent misuse and attacks on our systems
Ensure the technical functionality of our website

4.2 We use, among others, Positioner as our hosting and website service provider and Cloudflare for technical security and performance services.

4.3 SERVER LOG FILES

Technical access to our website may be recorded in server log files. Depending on the system used, this may include technical information such as IP addresses, access dates and times, and other technical details. The retention period depends on the system concerned and its storage capacity.

Log data is generally retained for a maximum of 90 days and is then deleted or anonymised. Longer retention is permitted only where necessary to investigate a specific security incident, analyse an error or comply with legal obligations.

5. CONTACT FORMS AND OTHER ENQUIRIES

5.1 If you contact us through a contact form, by email, by telephone or by other means, we process the information you provide.

Our contact form may collect the following information in particular

Name
Email address
Telephone number
Reason for your enquiry
Message
Other information provided voluntarily

5.2 The contact form on our website is provided through Umbraco Forms. No separate external form provider is used.

We use this data in particular to

Process your enquiry
Answer your questions
Handle reservations or requests for changes
Contact you if we require further information
Provide our services

5.3 We retain the data only for as long as necessary to process the enquiry or as required by statutory retention obligations.

6. RESERVATIONS AND BOOKINGS

6.1 When you book a room, service or package offered by APPENZELLER HUUS AG, we process the personal data necessary to manage the reservation and provide your stay.

This includes, in particular

Name and contact details
Duration of stay
Room and booking details
Number of accompanying persons and, where applicable, their details
Requests and preferences
Invoicing information
Where applicable, payment and guarantee information

6.2 We use AZDS as our technical booking solution for online reservations. The AZDS booking interface is connected to SynXis/Sabre as our reservation system. We use Shiji to manage hotel guests and stay information.This processing is carried out primarily to prepare, provide and administer the stay you have requested and to fulfil legal obligations.

6.3 For group reservations, seminars, banquets and events, we may also receive participants' personal data from the event organiser, tour operators or other persons making reservations on behalf of third parties. This may include names, contact details, room allocation information, arrival and departure dates, booked services and any special requirements necessary for the service concerned. We use this data to prepare, organise and invoice the reservation or event, communicate with the individuals concerned and fulfil legal obligations. The current version of this Privacy Policy is made available to participants through the event organiser, at the time of booking, during digital check-in or, at the latest, upon check-in.

7. BOOKINGS THROUGH THIRD-PARTY PROVIDERS AND DISTRIBUTION PARTNERS

7.1 Rooms and services offered by APPENZELLER HUUS AG may also be booked through various distribution partners and online booking platforms.

These include, among others

Booking.com
Expedia
The Leading Hotels of the World (LHW)
Preferred Hotels & Resorts
Hotelcard
Weekend4Two
American Express Fine Hotels + Resorts (FHR)
Tablet Hotels

7.2 If you make a booking through one of these providers, the data required to manage the reservation and provide your stay may be transmitted to us. Depending on the provider and its business model, the relevant provider may itself be responsible for certain processing activities. We process the data transmitted to us as the responsible hotel for the subsequent provision of your stay. The respective booking and distribution partners' own privacy policies also apply to their processing of personal data.

8. YOUR STAY AT APPENZELLER HUUS

8.1 During your stay, we process personal data to the extent necessary to provide our hotel services.

This may include, in particular

Booking and stay information
Contact details
Room and service information
Restaurant and table reservations
Spa and wellness reservations
Special requests and preferences
Invoicing information
Communication records
Where applicable, information you voluntarily provide about yourself or your preferences

We use this information primarily to

Provide the services you have booked
Organise your stay
Respond to your enquiries
Accommodate your requests and preferences
Develop and improve our services

9. RESTAURANT RESERVATIONS

9.1 We use Aleno to manage restaurant reservations. When you make a table reservation, the following data may be processed in particular

Name
Contact details
Reservation date and time
Number of guests
Other information provided voluntarily

9.2 If you voluntarily provide information about allergies, food intolerances, special dietary requirements or other health-related needs in connection with a restaurant reservation, this information may be processed as special categories of personal data. Such information is used exclusively to the extent necessary to prepare and safely provide the dining service you have requested.

10. VOUCHERS AND ONLINE SHOP

10.1 We use e-guma to sell and manage vouchers and operate our online shop.

The following data may be processed in particular

Name
Billing and contact details
Email address
Order and voucher information
Payment and transaction information

10.2 This processing is carried out to fulfil your order, provide your voucher, process payments, provide customer support and meet legal obligations.

11. NEWSLETTERS AND ELECTRONIC MARKETING COMMUNICATIONS

11.1 If you subscribe to our newsletter or other electronic marketing communications, we process your contact details and information about your communication preferences.

11.2 Newsletters are generally sent only where we have obtained the appropriate consent or where another legally permitted basis applies. You may withdraw your consent at any time with effect for the future. You can do so, in particular, by using the unsubscribe option provided in a newsletter or by contacting us directly. We use Brevo to distribute and manage our newsletters.

12. MARKETING, MARKET RESEARCH AND HOTEL ANALYTICS

12.1 We use Hotellistat for market research, marketing and hotel analytics. Data from various sources and systems may be analysed to

Analyse market trends and demand
Optimise our offerings and prices
Evaluate marketing activities
Further develop our services
Analyse the use and commercial performance of our offerings

12.2 We also use WIHP/Cendyn for digital marketing and metasearch activities. An additional Google Ads identifier is used through WIHP/Cendyn for metasearch purposes.

13. COOKIES AND SIMILAR TECHNOLOGIES

13.1 Our website uses cookies and comparable technologies. Cookies are small files stored on your device. They may be used for various purposes, including

The technically necessary operation of the website
Saving settings and preferences
Improving user experience
Statistical analysis
Marketing and advertising

13.2 We use Cookiebot, a service provided by Usercentrics in Denmark, to manage and document cookie consent. Through our cookie banner, you can select your preferences for non-essential cookies and comparable technologies and change or withdraw your consent at any time. Analytics, marketing and other comparable non-essential technologies are activated only after you have given your consent. No data is transmitted to the relevant providers through these technologies before consent has been given. Technically necessary technologies may be used without consent where they are required to operate the website or provide a function you have expressly requested. Further details about the specific cookies and technologies in use are available through the settings in our cookie banner.

14. GOOGLE SERVICES

14.1 We use various Google services, in particular

Google Analytics
Google Ads
Google Tag Manager
Google Fonts
Google Maps, potentially in the future

14.2 GOOGLE ANALYTICS

We use Google Analytics to analyse the use of our website and generate statistical reports. This may involve processing information about page views, interactions, technical characteristics of the device used and other usage data.

14.3 GOOGLE ADS

We use Google Ads to run, measure and optimise online advertising campaigns. This may include analysing interactions with our website and advertising activities. We may use remarketing functions, whereby information about visits to our website and the use of our digital services may be used to create target audiences and deliver or measure advertising. Depending on the function used, information about website activity may be matched with information from the Google advertising network or with information associated with signed-in Google accounts.

14.4 GOOGLE ENHANCED CONVERSIONS

We may use Google Enhanced Conversions. In this context, first-party data provided by you on our website, particularly your email address, telephone number, name or address details, may be used to measure conversions. Before transmission to Google, this data may be hashed using a one-way hashing process. Google may subsequently match the hashed data with corresponding information associated with signed-in Google accounts to improve the measurement and attribution of conversions related to Google advertising.

14.5 GOOGLE TAG MANAGER

We use Google Tag Manager to technically manage and deploy website tags.

14.6 GOOGLE FONTS

We use the Google font DM Sans. The font is currently loaded directly from Google. When the font is requested directly, technical information, particularly your IP address and information about the device used, may be transmitted to Google.

14.7 GOOGLE MAPS

Our website does not currently contain an embedded Google Maps map. Google Maps services may be introduced in the future. If such services are integrated, technical information and, depending on the implementation, location and usage data may be transmitted to Google. The relevant Privacy Policy and cookie configuration will be updated accordingly before any such service is activated.

Where consent is required for the relevant Google services or functions, they are activated only after you have provided the necessary consent through our cookie management system. Google may also process personal data outside Switzerland. International data transfers are subject to the conditions described in Section 22.

15. META – FACEBOOK AND INSTAGRAM

15.1 We use Meta technologies on our website, particularly the Meta Pixel and a server-side interface to Meta.

These technologies may be used to
Analyse the use of our website and marketing activities
Measure advertising performance
Create target audiences
Deliver interest-based advertising
Measure conversions and bookings

15.2 Data may be transmitted to Meta Platforms in this context. Where required, the relevant technologies are activated only after you have given your consent through our cookie management system.

16. SOCIAL MEDIA

16.1 APPENZELLER HUUS AG maintains a presence, among others, on the following social media platforms and may establish a presence on additional platforms in the future

Instagram
Facebook
LinkedIn
TikTok
YouTube

16.2 When you visit our social media profiles, the respective platform operators may process personal data about you. Our ability to influence these processing activities is limited. The privacy policies of the respective platform operators also apply. TikTok and YouTube are used only to the extent that corresponding profiles, content or functions are actually operated or embedded. Google services may also create an indirect connection to YouTube, particularly in connection with Google Ads and advertising measurement.

17. POP-UPS AND WEBSITE COMMUNICATION

17.1 We use GetSiteControl on our website to display and manage certain pop-ups and website communications. Depending on the specific function, technical data and information about interactions with the relevant website elements may be processed.

17.2 Where consent is required for specific functions, these functions are activated only after the necessary consent has been given.

18. JOB APPLICATIONS

18.1 You may apply through our website for advertised positions, apprenticeships, internships and other roles at APPENZELLER HUUS AG. As part of the recruitment process, we process, in particular, personal details, contact information, CVs, information about education and professional experience, employment references, referees' details and other application documents you provide.

18.2 This processing is carried out to assess your application, conduct the recruitment process, communicate with you and prepare for potential employment.

18.3 RECRUITMENT MANAGEMENT WITH CV MANAGER

We use the applicant management system “CV Manager”, provided by PowerSearch Management Consulting, Rätusstrasse 23, CH-7000 Chur, Switzerland, to manage job applications. PowerSearch Management Consulting processes application data on our behalf and in accordance with our instructions. When using CV Manager, technical data may also be processed in addition to application data. This may include IP addresses, access dates and times, and browser and operating system information. According to the provider, IP addresses are retained for a maximum of five days.

18.4 RETENTION AND DELETION

Application data is retained only for as long as necessary for the recruitment process. If no employment relationship is established, we generally delete application documents three months after communicating our decision, unless a longer retention period is required for legal reasons. Longer retention, for example in a talent pool, takes place only with your explicit consent. You may withdraw this consent at any time with effect for the future. If you are hired, the data required for the employment relationship will be transferred to your personnel file and processed in accordance with the applicable retention periods.

18.5 DISCLOSURE AND INTERNATIONAL TRANSFERS

Within APPENZELLER HUUS AG, your application data is accessible only to the individuals responsible for the recruitment process. PowerSearch Management Consulting processes the data as a data processor. Data is disclosed to other recipients only where necessary for the recruitment process, required by law or authorised by you. Where application data is processed outside Switzerland by CV Manager or its technical service providers, this takes place in accordance with the statutory requirements for international data transfers. Further information is provided in Section 22.

19. VIDEO SURVEILLANCE

19.1 Video surveillance is used in certain public areas of APPENZELLER HUUS AG.

Video surveillance serves, in particular, to

Protect guests, employees and third parties
Protect buildings and facilities
Prevent and investigate criminal offences and security incidents
Safeguard the Hotel’s right to control access to and use of its premises

19.2 Video surveillance is carried out only in designated areas that are clearly marked before entry. Areas requiring a heightened level of privacy are not monitored. Video recordings are generally retained for a maximum of 90 days and are then automatically deleted or overwritten.

19.3 Longer retention may be necessary if a security incident has been identified and the recordings are required for an investigation, preservation of evidence, the safeguarding or enforcement of legal claims, or compliance with statutory obligations. Access to video recordings is restricted to authorised individuals.

20. GUEST WI-FI

20.1 APPENZELLER HUUS AG provides guests with Wi-Fi access. To provide the guest Wi-Fi service, technical data may be processed, including

IP address
Device information
Time of connection
Duration of connection
Technical connection information

20.2 No communication content is stored. The processing is carried out primarily to provide and operate the guest Wi-Fi securely, analyse technical faults, prevent misuse and ensure IT security. Network log data is generally retained for a maximum of 30 days and is then deleted or anonymised. Longer retention is permitted only where necessary to investigate a specific security incident or comply with legal obligations. UniFi is managed through our own controller. WatchGuard logging is performed locally. The network log data described above is not transferred to external cloud logging services.

21. DISCLOSURE OF DATA TO SERVICE PROVIDERS

21.1 We may disclose personal data to carefully selected service providers where necessary to deliver our services, operate our systems, process enquiries, conduct marketing activities or fulfil legal obligations.

These service providers may operate in the following areas, among others

Hotel and reservation systems
Booking platforms
Website operation and hosting
IT and data security
Payment processing
Restaurant reservations
Vouchers and online shop
Marketing and analytics
Newsletters and communications
Recruitment management
IT support
Invoicing and accounting

Our service providers and integrated third-party services include, among others

AZDS
SynXis/Sabre
Shiji
Booking.com
Expedia
The Leading Hotels of the World (LHW)
Preferred Hotels & Resorts
Hotelcard
Weekend4Two
American Express Fine Hotels + Resorts
Tablet Hotels
Aleno
Hotellistat
e-guma
Positioner
Cloudflare
Usercentrics/Cookiebot
Google
Meta
GetSiteControl
Brevo
Microsoft 365
WIHP/Cendyn
CV Manager

AZDS and SynXis/Sabre are used for bookings and reservations. e-guma is used for vouchers and the online shop. We use Microsoft 365 for email and communication with guests.

21.2 PAYMENT PROCESSING

Payment data may be processed for bookings made through SynXis/Sabre and for voucher purchases through e-guma.

22. INTERNATIONAL DATA TRANSFERS

22.1 Some of our service providers are based outside Switzerland or process personal data partly outside Switzerland. Personal data is transferred abroad only where the legal requirements of the applicable data protection legislation are met. Where the recipient country provides an adequate level of data protection, transfers may take place on that basis. For countries that do not provide an adequate level of data protection, we ensure that appropriate safeguards are in place where required by law. These may include, in particular, standard contractual clauses (SCCs) issued by the European Commission and recognised by the Swiss Federal Data Protection and Information Commissioner (FDPIC), as well as other safeguards recognised by law. Transfers to the United States may, among other grounds, rely on the Swiss-U.S. Data Privacy Framework, provided that the relevant US service provider is certified under that framework. The Swiss-U.S. Data Privacy Framework provides an adequate data protection framework for certified US companies.

22.2 If a US service provider is not appropriately certified, other suitable safeguards, particularly standard contractual clauses, are used where required. Due to the international operations of certain providers we use, personal data may be processed in countries within the European Economic Area, the United Kingdom, the United States or other countries.

22.3 Upon a justified request, we will inform affected individuals, within the limits of applicable law, about the recipient country, the categories of recipients and, where required, the safeguard or derogation used for a specific international transfer. An up-to-date internal overview of the service providers used and the applicable transfer mechanisms is maintained and reviewed regularly.

23. DATA RETENTION AND DELETION

23.1 We retain personal data only for as long as necessary for the relevant processing purpose. In addition, statutory retention obligations may apply, particularly in connection with

Accounting
Invoicing
Tax law
Contractual documents
Business records
Statutory reporting obligations

Once the applicable retention period has expired, the data is deleted or anonymised unless another legal basis permits further processing. Different retention periods may apply to different categories of data. The specific period depends in particular on the purpose of processing, statutory retention obligations, the nature of the data and legitimate interests in preserving evidence.

23.2 Unless a different statutory obligation or a specific legal matter requires longer retention, the following principles apply; Job application documents are retained in accordance with Section 18.4; Newsletter data is retained until consent is withdrawn or the subscription is cancelled; Video recordings are retained for a maximum of 30 days; Website log data is retained for a maximum of 90 days; Wi-Fi log data is retained for a maximum of 30 days; Business records, invoices and booking-related contractual documents are retained for the statutory retention period.

24. DATA SECURITY

24.1 We implement appropriate technical and organisational measures to protect personal data against loss, misuse, unauthorised access, alteration and disclosure. Security measures are designed and adjusted as necessary, taking into account the state of the art, the nature and scope of processing and the risks involved. Despite all security measures, complete security of data transmission over the internet cannot be guaranteed.

25. YOUR RIGHTS

25.1 Under applicable data protection law, you may have the following rights, in particular

The right to request information about the processing of your personal data
The right to request the correction of inaccurate personal data
The right to request the deletion of your personal data, subject to statutory requirements
The right to request restriction of processing, subject to statutory requirements
The right to object to certain processing activities where the legal requirements are met
The right to withdraw consent at any time with effect for the future
The right, subject to statutory requirements, to request the disclosure or transfer of your personal data in a commonly used electronic format

The exercise of these rights may be subject to statutory restrictions. In particular, statutory retention obligations, overriding interests or other legally recognised grounds may prevent deletion or restriction of processing.

To exercise your rights, please contact us at

APPENZELLER HUUS AG
Dorfstrasse 7
9108 Gonten
Switzerland
Email: [email protected]
Telephone: +41 71 511 05 00

26. WITHDRAWAL OF CONSENT

26.1 Where processing is based on your consent, you may withdraw that consent at any time with effect for the future. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal. For cookies and comparable technologies, you can manage or withdraw your consent through the settings in our cookie banner.

27. RIGHT TO LODGE A COMPLAINT

27.1 If you believe that your personal data is being processed unlawfully, you may lodge a complaint with the competent data protection supervisory authority.

In Switzerland, this is

Swiss Federal Data Protection and Information Commissioner (FDPIC)
Feldeggweg 1
3003 Bern
Switzerland
Website: www.edoeb.admin.ch

28. CHANGES TO THIS PRIVACY POLICY

28.1 We may amend this Privacy Policy at any time, particularly if our services, technical systems, legal requirements or data processing activities change. The current version published on our website shall apply.

29. CONTACT

If you have any questions about data protection or the processing of your personal data, you may contact us at any time.

APPENZELLER HUUS AG
Dorfstrasse 7
9108 Gonten, Schweiz

Telephone: +41 71 511 05 00
E-Mail: [email protected]