Privacy Policy

1. Who is responsible

The controller responsible for your personal data is Alpenrose Chalets, —. For any privacy question or to exercise your rights, write to —.

2. Data we collect

• Contact details: name, email address, phone number and, for invoices, billing address.
• Enquiry and booking details: chalet, travel dates, number of guests, catering and contact preferences, and your messages to us.
• Guest account: username, full name, email and a securely encrypted password. We can never see your password.
• Security records: IP address, browser and device type, date and time of registration and sign-in, used to protect your account against misuse.
• Website visit statistics: pages viewed, date and time, IP address, approximate country/city, browser/device and the referring website. We record these ourselves (no advertising or third-party tracking cookies) to understand how our website is used and to keep it secure.
• Booking and accounting records: prices, invoices and payment status.

3. Why we use your data

• To answer your enquiries and check chalet availability.
• To prepare, confirm and manage your booking, contract and invoices.
• To give you access to your guest portal (My bookings).
• To organise services you request, such as chefs, transfers or ski passes.
• To keep the website secure and prevent spam and fraud.
• To meet our legal, tax and accounting obligations.

We process your data to carry out your booking (contract), to protect our website and guests (legitimate interest), to meet legal duties, and where you have given consent.

4. Who we share it with

We never sell your data. We share only what is needed with the chalet owner or their representative to arrange your stay, with providers of services you ask us to book, and with the technical providers that run this website. Confidentiality is part of our promise: nothing else is shared without your written permission, unless the law requires it.

5. Third-party services on this website

• Google Maps: maps on chalet and contact pages are provided by Google. Google may receive your IP address when a map loads. Chalet maps show the resort area only, never a private address.
• Cloudflare Turnstile: the "Verify you are human" check on our forms is provided by Cloudflare to block automated spam.
• WhatsApp: if you choose to contact us on WhatsApp, your conversation is handled by WhatsApp (Meta) under its own privacy policy.
• Hosting: Lovable (website and secure cloud database).

Some of these providers may process data outside Switzerland or the EU. Where this happens, transfers are protected by recognised safeguards such as standard contractual clauses.

6. Cookies

We use only cookies and browser storage that are needed for the website to work, such as keeping you signed in to your guest portal. We do not use advertising cookies. Google Maps and Cloudflare may set their own technical cookies when their services load.

7. How long we keep your data

• Enquiries that do not lead to a booking: up to 2 years.
• Booking records, contracts and invoices: 10 years, as required by accounting law.
• Guest accounts: until you ask us to close your account.
• Website visit statistics: up to 180 days.
• Security records: no longer than needed to protect the website.

8. Your rights

You may ask to see the data we hold about you, correct it, delete it, receive a copy, or object to or limit its use. Where we rely on your consent, you may withdraw it at any time. Write to —; we reply within 30 days. You may also complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC) or to the data protection authority in your EU country.

9. Security

Your data is stored in a protected database, connections are encrypted, passwords are encrypted so they can never be read, and only authorised staff can access booking information.

10. Changes to this policy

We may update this policy when our services or the law change. The date at the top of this page always shows the latest version.