1. Introduction

This Privacy Policy explains how Swiss Travel Collection SAGL, operating under the brand Ceresio Travel Collection ("Ceresio", "we", "us" or "our"), collects, uses, stores, shares and protects personal data when you visit ceresiotravelcollection.com, browse our tours, experiences or other services, make or manage a booking, purchase a product or service, request a cancellation or rescheduling, contact us, submit a consultation or enquiry form, communicate with us by email, use features made available through our website or otherwise interact with Ceresio Travel Collection.

For the purposes of applicable data-protection legislation, Swiss Travel Collection SAGL is the controller of the personal data described in this Privacy Policy, except where another organisation acts as an independent controller for its own services.

We process personal data primarily in accordance with the Swiss Federal Act on Data Protection (FADP) and its implementing legislation. Where the EU General Data Protection Regulation (GDPR), UK GDPR or other applicable data-protection legislation applies to a particular processing activity or individual, we will also process personal data in accordance with those applicable requirements.

This Privacy Policy is separate from our Terms & Conditions, which govern purchases and bookings made with Ceresio.

2. Who Is Responsible for Your Personal Data?

The controller is:

Swiss Travel Collection SAGL
trading as Ceresio Travel Collection
Via Tesserete 64
6900 Lugano
Switzerland

For questions or requests concerning privacy or personal data, please contact info@ceresiotravelcollection.com. Where possible, please use the subject line Privacy Request.

3. Personal Data We Collect

Depending on how you interact with Ceresio, we may collect the following categories of personal data.

3.1 Identity and contact information

This may include your first name, surname, email address, telephone number, postal address, billing address, country of residence and other contact information you voluntarily provide.

3.2 Booking information

When you book an experience, we may process information such as the booking reference, selected experience, selected date, selected starting time, duration, number of participants, selected language, booking status, cancellation or rescheduling requests, booking notes, customer requests, meeting arrangements and other information necessary to organise or provide the experience.

3.3 Information about other participants

A person making a booking may occasionally provide information about other participants. The person making the booking should only provide another individual's personal data where they are entitled to do so and where that information is reasonably necessary for the booking. Where appropriate, the person making the booking should make the other participants aware of this Privacy Policy.

4. Accessibility and Health-Related Information

You may voluntarily tell us about mobility requirements, accessibility requirements, allergies or other information relevant to safely or appropriately providing an experience. We ask that you provide only information that is genuinely necessary for us to understand or accommodate the request.

Where this information constitutes sensitive personal data or special-category personal data, we will process it only where permitted by applicable law and only for the purpose for which it was provided. We do not seek to create medical profiles of our customers. Please do not provide detailed medical information unless it is reasonably necessary for us to assist you.

5. Payment and Transaction Information

When you make a purchase, we may process transaction-related information including order number, booking reference, products or services purchased, transaction amount, currency, payment status, refund status, billing details, payment method and limited payment information supplied to us by the relevant payment provider.

Ceresio does not normally receive or store your complete payment-card number or card security code. Full payment credentials are processed by the payment service providers made available during Shopify checkout.

Depending on the payment method selected, this may include services such as Shopify Payments, Shop Pay, PayPal, Google Pay, other card or payment networks, or another payment provider displayed at checkout. Those providers may process personal data in accordance with their own privacy policies and legal obligations.

6. Communications

If you contact us, we may process your name, email address, telephone number, the content of your message, attachments you send, booking reference, our correspondence with you and records of how your enquiry was handled.

This includes communications concerning bookings, cancellations, refunds, rescheduling, accessibility, consultations, complaints, general enquiries and customer support.

7. Consultation and Tailor-Made Enquiries

Where you use a consultation, tailor-made experience or corporate enquiry form, we may collect information that you choose to provide concerning your requirements. This could include name, email address, telephone number, preferred dates, group size, interests, preferred experiences, budget information where requested, travel preferences, comments and other information included in your enquiry.

We use this information principally to respond to your request and prepare or discuss an appropriate service. Submitting an enquiry does not automatically subscribe you to marketing communications.

8. Website and Technical Information

When you access our Website, certain technical information may be collected automatically. This can include IP address, browser type, browser version, device type, operating system, language settings, referring website, pages viewed, date and time of access, session information, general interaction information, cookie identifiers and security or diagnostic information.

Some of this information is necessary for the Website to operate, protect itself against misuse and deliver pages correctly.

9. How We Obtain Personal Data

Directly from you

For example, when you make a booking, complete checkout, contact us, complete a form, request a refund, request rescheduling, communicate with us or provide booking instructions.

Through Shopify

Information relating to orders, customers, payments, checkout and Website activity may be provided through Shopify's e-commerce platform.

Through our booking system

Booking details may be processed through Easy Appointment Booking by Servicify in order to manage appointments, availability and booking-related communications.

Through payment providers

Payment providers may return information to us confirming whether a transaction was successful, refunded, disputed or otherwise changed.

From someone booking on your behalf

For group bookings, another participant may supply information about you where necessary for the booking.

10. Why We Process Personal Data

10.1 To provide our services

Including to process bookings, reserve requested dates and times, provide tours and experiences, organise guides, manage group information, manage customer requests and fulfil our contractual obligations.

10.2 To manage bookings

Including to send confirmations, identify a booking, process cancellations, process refunds, manage rescheduling, handle no-shows or changes, communicate meeting information and resolve booking problems.

10.3 To process payments

Including to receive payments, verify payment status, administer refunds, respond to payment disputes, prevent fraudulent transactions and maintain transaction records.

10.4 To provide customer service

Including to answer questions, respond to complaints, investigate problems, communicate with customers, provide information requested by customers and resolve disputes.

10.5 To provide consultation services

Including to understand customer requirements, respond to tailored requests, develop proposed itineraries or services, communicate quotations or proposals and manage related correspondence.

10.6 To produce invoices and business records

Including to generate invoices and receipts, maintain accounting records, reconcile transactions, meet tax and accounting obligations and establish or defend legal claims.

10.7 To operate and secure our Website

Including to maintain Website functionality, identify technical problems, maintain security, prevent abuse, prevent fraud, protect accounts and transactions and improve the reliability of our services.

10.8 To comply with legal obligations

Including obligations relating to accounting, taxation, consumer protection, fraud prevention, court orders, regulatory requirements and lawful requests from competent authorities.

11. Legal Grounds for Processing

Under Swiss data-protection law, we process personal data in accordance with the principles and requirements of the FADP. Where the GDPR or another legal regime requiring a specific legal basis applies, our processing will generally rely on one or more of the following grounds.

Performance of a contract

Where processing is necessary to make or administer your booking, process payment, provide an experience, process cancellation or rescheduling, respond to a request relating to an existing contract or take requested steps before entering into a contract.

Legal obligations

Where processing is necessary to comply with accounting, tax, regulatory or other legal requirements.

Legitimate interests

Where necessary for legitimate business purposes such as operating and securing the Website, preventing fraud, providing customer support, managing our business, improving services, protecting legal rights and resolving disputes, provided those interests are not overridden by applicable rights and freedoms.

Consent

Where applicable law requires your consent, including for certain non-essential cookies, marketing communications or sensitive information voluntarily provided by you. Where processing is based on consent, you may withdraw that consent for future processing at any time. Withdrawal does not make earlier lawful processing unlawful.

12. Shopify

Our online store is hosted and operated using Shopify. Shopify provides infrastructure used for functions such as Website hosting, checkout, customer and order records, payment integration, fraud prevention, customer accounts where enabled, order administration, cookies and privacy controls and related e-commerce functions.

Shopify operates internationally and may process or transfer personal data through its group companies and authorised subprocessors. When customers independently use Shopify consumer services such as Shop or Shop Pay, Shopify may act as an independent controller for those services.

13. Easy Appointment Booking

We use Easy Appointment Booking by Servicify to provide and administer booking functionality. It may process information necessary to display available dates and times, create appointments, associate appointments with Shopify orders, manage booking information, send booking-related notifications and maintain booking functionality.

Relevant personal data may be processed in jurisdictions in which Servicify and its authorised service providers operate, which may include Canada and the United States. Payment-card information is not processed through Easy Appointment Booking; payment is handled through Shopify and the relevant payment providers.

14. Calendar and Scheduling Services

Ceresio uses Google Calendar in connection with internal availability and scheduling. Where a booking is synchronised with our business calendar, relevant information such as booking date, booking time, experience, booking reference and limited information necessary to identify or administer the appointment may be processed through Google services.

We seek to avoid placing unnecessary personal information into calendar entries.

15. Google Maps and External Media

Our Lugano tour page offers an optional interactive route map provided by Google Maps. The Google Maps iframe is not loaded automatically. It is only created after you select “Load interactive map”. If you choose to load it, your browser connects directly to Google and Google may receive technical information such as your IP address, browser/device information, the page or request involved and related connection data. If you instead choose the external Google Maps link, you leave our Website and Google's own privacy terms apply.

Some licensed tour-highlight photographs are currently delivered from Wikimedia Commons. Loading those images may cause your browser to send a request to Wikimedia infrastructure, including your IP address and ordinary technical request information. We configure those image requests with a no-referrer policy so the specific Ceresio page URL is not intentionally transmitted in the HTTP referrer header. Image authorship and licence information is displayed on the relevant tour page.

16. Business Email

We may use Google Workspace and related Google services to receive and manage business email communications. Accordingly, personal data contained in emails sent to addresses ending in @ceresiotravelcollection.com may be processed through the relevant business email infrastructure.

Please avoid sending unnecessary sensitive personal data by email.

17. Order Printer Pro

We use Order Printer Pro to create and provide documents such as invoices, receipts, booking or order documents and downloadable PDF documents. The application may retrieve relevant customer and order information from Shopify in order to generate those documents and provide related functionality.

18. Payment Providers

Payment information may be disclosed to or processed by the payment service selected during checkout. Those providers process personal data for purposes that can include authorising payments, authenticating transactions, preventing fraud, processing refunds, complying with financial regulations, handling chargebacks and maintaining legally required transaction records.

Where a payment provider acts as an independent controller, its processing is governed by its own privacy policy. Ceresio does not control all independent processing carried out by banks, card networks and payment providers.

19. Other Recipients of Personal Data

Where reasonably necessary, personal data may also be disclosed to professional advisers such as accountants, auditors, lawyers, insurance advisers and other professional advisers; IT and technical providers where needed to host, secure, maintain or support our systems; and courts, tax authorities, law-enforcement authorities, regulators or other competent public authorities where disclosure is required or permitted by applicable law.

If Swiss Travel Collection SAGL or relevant parts of its business are reorganised, acquired, merged or transferred, personal data may be transferred as part of that transaction where permitted by law and subject to appropriate safeguards.

20. We Do Not Sell Personal Data

Swiss Travel Collection SAGL does not sell customer personal data to data brokers. We do not provide customer booking information to unrelated third parties in exchange for payment for their independent marketing purposes.

Where a technology provider independently processes information under its own privacy terms, that processing is governed by the provider's applicable legal role and policies.

21. Cookies and Similar Technologies

Essential cookies

Certain cookies are required for functions including keeping the Website operational, remembering session information, shopping-cart functionality, checkout, security, payment processing, customer privacy preferences and fraud prevention. These technologies may be necessary for the Website or service requested by the user to function.

Non-essential technologies

Where analytics, personalisation, advertising or similar non-essential technologies are used and applicable law requires consent, those technologies should only be activated after the relevant consent has been obtained.

Users can make choices through the cookie or privacy controls available on the Website. You can also control many cookies through your browser settings, although disabling essential cookies can prevent parts of the Website from functioning correctly.

22. Marketing Communications

Booking a tour or submitting an enquiry does not, by itself, mean that you agree to receive general promotional emails. Where we offer a newsletter or other electronic marketing, we will obtain any consent required by applicable law.

You may withdraw from optional email marketing at any time by using the unsubscribe mechanism included in the communication or contacting us at info@ceresiotravelcollection.com.

We may nevertheless continue to send non-marketing communications necessary for existing bookings, payments, cancellations, refunds, safety information, legal notices or customer-service matters.

23. International Transfers

Some of the service providers used by Ceresio operate internationally. Accordingly, personal data may be processed outside Switzerland, including in Switzerland, member states of the European Economic Area, Ireland, the United Kingdom, Canada, the United States and other countries in which authorised service providers or subprocessors operate.

Where personal data is transferred to a country that does not provide an adequate level of protection under applicable law, appropriate safeguards will be used where required, such as recognised standard contractual clauses, contractual data-protection obligations, recognised adequacy mechanisms, binding corporate rules where applicable or another legally permitted transfer mechanism.

24. How Long We Keep Personal Data

We do not intend to retain personal data indefinitely. Retention depends on the purpose for which the information was collected.

Orders, invoices and accounting records

Transaction and accounting documentation that must be retained as part of our statutory business records will generally be retained for the applicable statutory period. Swiss accounting rules generally require accounting books and supporting accounting records to be retained for 10 years.

Booking information

Operational booking information will be retained for as long as reasonably necessary to provide the experience, deal with follow-up requests, process refunds, manage complaints, maintain appropriate business records and establish or defend legal claims. Information forming part of an accounting record may need to be retained for the longer statutory period described above.

Enquiries and consultation requests

Enquiries that do not result in a booking will generally be retained only for as long as reasonably necessary to respond to the enquiry and deal with related follow-up. Where there is no continuing relationship or legal reason to retain the information, we aim to delete or anonymise it when it is no longer needed.

Marketing information

Optional marketing details are retained until you unsubscribe, withdraw consent, the marketing programme is discontinued or retention is no longer reasonably necessary, subject to keeping minimal suppression information where necessary to ensure that an opt-out continues to be respected.

Legal disputes

Relevant information may be retained for longer where reasonably necessary because of actual or potential legal proceedings, regulatory enquiries, disputes, fraud investigations or another legal requirement.

25. Data Minimisation

We seek to collect only personal data that is reasonably necessary for the relevant purpose. Customers are encouraged not to provide unnecessary passport information, government identification numbers, financial information, medical information, sensitive personal information or information about unrelated third parties unless specifically required for a legitimate purpose.

26. Accuracy of Personal Data

We rely on customers to provide accurate information when making bookings or contacting us. If your information changes or you believe information we hold about you is incorrect, please contact info@ceresiotravelcollection.com.

We may ask for sufficient information to identify the relevant booking or record.

27. Security

We use reasonable technical and organisational measures intended to protect personal data against unauthorised access, unauthorised disclosure, loss, alteration, misuse, destruction and other unlawful processing. Our service providers also maintain their own security measures.

However, no internet service, electronic transmission or storage system can be guaranteed to be completely secure. Customers should therefore also take reasonable steps to protect their own devices, email accounts and login credentials.

28. Data Breaches

If we become aware of a personal-data security breach, we will investigate the incident and take measures appropriate to the circumstances. Where applicable law requires notification to the FDPIC, another competent supervisory authority and/or affected individuals, we will make the required notification in accordance with the applicable legal requirements.

29. Automated Decision-Making and Fraud Prevention

Ceresio does not ordinarily make decisions about whether a person may participate in a tour or use our services solely through automated processing producing legal or similarly significant effects.

However, Shopify, payment providers, card networks or fraud-prevention providers may use automated systems to assess transaction risk, suspected fraud, payment authenticity or account security. This may result in a transaction being subject to further verification or refused by the relevant provider. Where such a provider acts independently, additional information may be available in that provider's privacy documentation.

30. Children and Minors

Our Website and online booking process are principally intended to be used by adults capable of entering into a contract. Children may participate in experiences where permitted, but bookings should be made by a responsible adult.

We do not intentionally seek unnecessary personal information directly from children. Where an adult provides information concerning a minor as part of a booking, we will process it only to the extent reasonably necessary for the relevant experience or legal obligation.

31. Your Rights Under Swiss Data-Protection Law

Subject to applicable conditions and exceptions, Swiss data-protection law may give you rights including the right to ask whether we process personal data about you, obtain information about the personal data being processed, request correction of inaccurate personal data, request deletion or destruction of personal data where appropriate, object to or challenge certain processing, request delivery or transfer of certain personal data where the statutory conditions for data portability are met and seek legal remedies in relation to unlawful processing.

32. Additional Rights Where the GDPR Applies

Where the GDPR applies to your personal data, and subject to its conditions and exceptions, you may additionally have rights including access to your personal data, rectification of inaccurate data, erasure, restriction of processing, data portability, objection to certain processing based on legitimate interests, withdrawal of consent where consent is the legal basis, rights relating to certain automated decisions and the right to make a complaint to an appropriate supervisory authority.

33. How to Exercise Your Rights

To exercise a privacy right, contact info@ceresiotravelcollection.com.

Please include your name, sufficient information for us to identify the relevant data or booking, the nature of your request and your booking reference where applicable. We may request reasonable evidence of identity where necessary to prevent personal data being disclosed to an unauthorised person.

We will respond within the period required by applicable law. Some requests may be restricted where we are legally entitled or required to retain information, including for accounting, taxation, legal claims, fraud prevention or another statutory obligation. For example, deleting a customer profile does not necessarily permit us to destroy transaction records that Swiss accounting law requires us to retain.

34. Withdrawal of Consent

Where we rely specifically on your consent, you may withdraw that consent at any time for future processing. Withdrawal of consent does not affect processing that was lawful before withdrawal and does not prevent processing that is permitted on another legal basis.

For cookie consent, use the Website's applicable privacy or cookie settings. For marketing consent, use the unsubscribe mechanism or contact us.

35. Complaints

If you have concerns about how we process your personal data, please contact us first at info@ceresiotravelcollection.com. We will seek to investigate and address the matter appropriately.

You may also have the right to contact the relevant data-protection authority. In Switzerland, the supervisory authority is the Federal Data Protection and Information Commissioner (FDPIC). Where the GDPR applies, you may also have the right to lodge a complaint with the competent supervisory authority in the relevant European jurisdiction.

36. Third-Party Websites

Our Website may link to websites operated by other organisations. Once you leave the Ceresio Website, the collection and use of personal data by the external website is governed by that organisation's privacy practices.

We are not responsible for the privacy practices of independent third-party websites merely because we provide a link to them. We encourage you to review their privacy information before providing personal information.

37. Social Media

If Ceresio maintains profiles on social-media platforms and you interact with us through those platforms, both Ceresio and the relevant platform may process information connected with the interaction. The social-media platform may act as an independent controller for certain processing. Its own privacy policy will therefore also apply.

38. Legal Claims and Protection of Rights

We may retain or use personal data where reasonably necessary to establish a legal claim, exercise legal rights, defend a legal claim, investigate suspected fraud, enforce contractual rights, protect customers, protect Ceresio, cooperate with insurers or legal advisers or respond to lawful proceedings.

39. Changes to this Privacy Policy

We may amend this Privacy Policy when necessary to reflect changes to our services, new Website functionality, new service providers, changes in our processing activities, changes in applicable law or regulatory guidance.

The latest version will be published on the Website with an updated Last updated date. Where a change materially affects how personal data is processed and applicable law requires additional notice or consent, we will take appropriate steps.

40. Contact Us

Questions concerning this Privacy Policy or the processing of personal data should be sent to:

Ceresio Travel Collection
Operated by Swiss Travel Collection SAGL
Via Tesserete 64
6900 Lugano
Switzerland
Privacy contact: info@ceresiotravelcollection.com
ceresiotravelcollection.com