Privacy Policy

GFVR GmbH ("We") is responsible, as data controller, for the collection and processing of your personal data in connection with its activities. Our task is to offer our customers a comprehensive range of travel services.

In this privacy policy, we explain how we process your personal data and how you can control and manage it. Our data processing may additionally be covered by further data protection notices, such as those contained in particular in the General (Travel) Terms and Conditions, or may arise from the circumstances or be governed by law.

This privacy policy complies with the requirements of Swiss data protection law as well as – where and to the extent applicable – the General Data Protection Regulation (GDPR) of the European Union.

Are you affected by this notice?
How can you control our processing of your personal data?
For what purpose and on what legal basis do we use your personal data?
What types of personal data do we collect?
From whom do we collect personal data?
To whom do we disclose your personal data, and why?
International transfer of personal data
How long do we retain your personal data?
Data security
How you can follow the development of this privacy policy

1. Are you affected by this notice?

This privacy policy applies to you if you:

are one of our customers or are in a contractual relationship with us;
are a fellow traveller of one of our customers.
are interested in our products or services and therefore provide us with your personal data (e.g. at an agency, on our websites and apps, or at events) so that we can contact you.

If you provide us with personal data of other persons, please ensure that you inform them about the disclosure of their personal data and ask them to read this privacy policy. We will ensure that we also do so ourselves whenever possible (e.g. where the contact details of the person concerned are available).

2. How can you control our processing of your personal data?

You have rights that allow you to effectively control your personal data and the manner in which we process it. Below, we explain your rights in connection with your personal data.

If you would like to exercise the rights listed below, please submit a request by e-mail to hallo@gfvr.ch or by post to the following address: GFVR, Konstanzerstrasse 51, 9500 Wil, Switzerland.

If you have any questions about the use of your personal data under this privacy policy, please direct them to the following address: hallo@gfvr.ch

2.1 You may request information about your personal data

If you would like information about your personal data, we will provide you with a copy of the personal data you have requested as well as information about its processing.

Your right to information may be restricted in cases provided for by law.

2.2 You may request the correction of your personal data

If you believe that your personal data is inaccurate or incomplete, you may request that this personal data be amended or completed accordingly. In some cases, the submission of supporting documents may be required.

2.3 You may request the deletion of your personal data

If you wish, you may request the deletion of your personal data, to the extent this is legally permissible.

2.4 You may object to the processing of your personal data based on legitimate interests

If you do not agree with processing based on a legitimate interest, you may object for reasons arising from your particular situation. In that case, please inform us in detail about the processing concerned and the reasons for your objection. We will discontinue the processing of your personal data unless there are compelling legitimate grounds, or the processing serves to assert, exercise, or defend legal claims.

2.5 You may object to the processing of your personal data for direct marketing purposes

You have the right to object at any time to the processing of your personal data for direct marketing purposes. This also applies to profiling, to the extent it is related to such direct marketing.

2.6 You may request the restriction of the processing of your personal data

If you dispute the accuracy of the personal data we use, or if you object to the processing of your personal data, we will review or revise your request. You may request that we restrict the processing of your personal data while we review your request.

2.7 You have rights against automated individual decision-making

You generally have the right not to be subject to a decision based solely on automated processing — including profiling — that produces legal effects concerning you or similarly significantly affects you. However, we may automate such a decision if it is necessary for entering into or performing a contract with us, is permitted under applicable law, or if you have given your consent.

In any case, you have the right to contest the decision, to express your point of view, and to request the intervention of a competent person to review the decision.

2.8 You may withdraw your consent

In those cases where processing is based on consent you have given, you may withdraw that consent at any time.

2.9 You may request the portability of part of your personal data

You may request a copy of the personal data you have provided to us in a structured, commonly used, and machine-readable format. Where technically feasible, you may request that we transmit this copy to a third party.

2.10 Complaint to the Federal Data Protection and Information Commissioner

In addition to the rights listed above, you may file a complaint with the competent supervisory authority. In Switzerland, this is the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern.

3. For what purpose and on what legal basis do we use your personal data?

3.1 Contract performance and legitimate interest

In this section, we explain for what purpose we process your personal data and on what legal basis this is done. Primarily, we use your personal data to perform a contract to which you are a party or to carry out pre-contractual measures at your request. We may, however, also process your personal data to fulfil our legitimate interest or that of third parties.

Your personal data is processed in particular where this is necessary for entering into or performing a contract, in order to:

enter into a (travel) contract with you. We may process personal data to register you as a new customer, to conclude a contract, and to perform it with you;
provide you with the products and services you have purchased under the respective contract;
carry out billing, invoicing, and debt collection;
provide you with services related to the preparation and execution of a trip;
for insurance purposes;
offer advisory services;
be able to provide assistance if needed in the event of difficulties during a trip;
provide you with access to our digital platforms. We may process personal data when you use our digital platforms for various purposes (e.g. to manage your personal information or to gain access to travel information);
grant access to our premises and facilities. We may process personal data when you visit us at our premises, in order to carry out appropriate access and security controls;
communicate with you. We may process personal data when you wish to get in touch with us, when you ask us for information about our company or our services, or when the contract needs to be updated;
respond to your enquiries and assist you;
manage the termination of the contract.

When we base a processing activity on a legitimate interest, we weigh that interest against your interests or fundamental rights and freedoms, to ensure that they are proportionate. As part of our business activity as a travel provider, we also use your personal data to:

further develop our products and services;
improve cybersecurity, manage our platforms and websites, and ensure business continuity;
implement the introduction of IT solutions;
carry out maintenance of IT systems during ongoing operations;
improve the automation and efficiency of our operational processes and our customer services (e.g. automatic completion of complaints, follow-up of your enquiries, and improvement of your satisfaction based on personal data collected during our interactions with you, e.g. call recordings, e-mails, or chats);
enable the assertion of legal claims and defence in connection with legal disputes and administrative proceedings;
organise competitions and promotions, and conduct opinion polls and customer satisfaction surveys.

3.2 Advertising and marketing

If you are a customer and provided you do not object, we may send you offers for our products and services. We ensure that these commercial offers relate to products or services that are relevant to your needs and complement the offers you have already used. You may object to this at any time.

3.3 Consent

For certain processing of personal data, we will specifically inform you and ask for your consent. You may, of course, withdraw your consent at any time.

In particular, we ask for your consent for:

the disclosure of particularly sensitive personal data to third parties;
a tailored customisation of our offers and products or services based on a complex profile, in order to predict your needs and behaviour;
any electronic offers for products and services that are not similar to those you have purchased, or for products and services from our trusted partners.

Where necessary, we may ask you for further consent to the processing of your personal data, which, however, has no effect on data processing already carried out.

4. What types of personal data do we collect?

We collect and use your personal data, i.e. all information that identifies you or that makes it possible to identify you.

Depending on the type of product or service we offer you, and the interactions we have with you, we collect various types of personal data about you:

Contact information, (private or business) postal address, e-mail address, telephone number;
Personal details, e.g. gender, date of birth and age, marital status, nationality, passport details, etc.
Lifestyle, e.g. hobbies and interests, travel;
Travel-related details, such as travel dates, itinerary/destination, airline, hotel, price, customer preferences, information about your fellow travellers, frequent flyer programmes, etc.;
Health data, e.g. information about health-related special needs or illnesses and accidents during a trip;
Financial details, e.g. payment information, credit card number, account details;
Data on your habits and preferences regarding the use of our products and services (e.g. dietary preferences);
Data from our interactions with you, e.g. your comments, suggestions, needs collected during our exchanges with you in person at our locations and during telephone communication (call notes or call recordings), communication by e-mail, chat, chatbot, exchanges on our social media, and any complaints you may have made. Your connection and tracking data (e.g. collected via cookies for non-advertising or analytical purposes on our websites), online services, and other applications;
Data about your devices (mobile phone, computer, tablet, etc.), such as IP address, technical data, and unique identifiers;
Personalised login credentials or security features used to connect you to our website and apps.

5. From whom do we collect personal data?

We generally collect personal data directly from you. However, we may also collect it from other sources.

Sometimes we collect data from public sources:

publications/databases provided by official authorities or third parties (e.g. the Swiss Official Gazette of Commerce or the Commercial Register);
websites/social media presences of legal entities or corporate customers containing information you have disclosed (e.g. your own website or your presence on social media);
public information, e.g. information from the media.

We also collect personal data from third parties:

from our customers (e.g. as fellow travellers);
from our business partners (e.g. tour operators, service providers abroad);
from third parties such as credit reference agencies and fraud prevention agencies;
from address research service providers, who are themselves responsible for collecting the relevant information lawfully.

6. To whom do we disclose your personal data, and why?

In order to fulfil some of the purposes described in this privacy policy, in particular the execution of a trip, we may, where applicable, disclose your personal data to others. These may include the following:

Our service providers in the destination country (e.g. agencies, tour guides, hotel reservations, transfer and excursion services), transport providers (airline, rail, car rental, etc.), and accommodation operators (hotels, hostels, etc.);
Processors who provide services on our behalf (e.g. IT services, logistics, printing services, telecommunications, debt collection, consulting and sales, and marketing);
certain regulated professional groups such as lawyers, notaries, or auditors, where this is necessary under certain circumstances (legal disputes, auditing, etc.), as well as our insurers;
Partners for carrying out advertising, market, and opinion research;
Partners assisting with the investigation of criminal offences (e.g. fraud), and the assertion, exercise, or defence of legal claims;
Authorities and official bodies (e.g. tax authorities, embassies of the destination country) where there is a legal or regulatory obligation (e.g. retention obligations, obtaining visas, obtaining entry requirements).

7. International transfer of personal data

In the case of international transfers from Switzerland and the European Economic Area (EEA) to a non-EEA country (third country), your personal data may be transferred across borders. In particular, you should expect your data to be transferred to your travel destination countries. But also to countries in Europe, the USA, and worldwide, where the service providers and suppliers we use are located. Where the FDPIC or the European Commission has recognised that a third country offers an adequate level of data protection, your personal data may be transferred on that basis.

For transfers to a third country whose level of protection has not been recognised as adequate by the FDPIC and the European Commission, we rely either on an exception applicable to the specific situation (e.g. where the transfer is necessary for the performance of our contract with you) or apply one of the following appropriate safeguards to ensure the protection of your personal data:

standard contractual clauses approved by the FDPIC and the European Commission;
binding internal data protection rules.

To obtain a copy of these safeguards or information on where they are available, you may submit a written request in accordance with Section 2.

8. How long do we retain your personal data?

We will retain your personal data for as long as is necessary to fulfil our contractual obligations and to comply with applicable laws and regulations, or for another period in view of our legitimate business interests, such as proper bookkeeping and responding to legal claims or requests from authorities.

9. Data security

We use appropriate technical and organisational security measures to protect your personal data stored with us against manipulation, partial or complete loss, and unauthorised access by third parties (e.g. encryption of data transmission, access controls, etc.). Our security measures are continuously improved in line with technological developments.

We take reasonable precautions to protect your data. The transmission of information over the internet and other electronic means always carries certain security risks, and we cannot guarantee the security of information transmitted in this way.

10. How you can follow the development of this privacy policy

In a world where technologies are constantly evolving, we regularly review this privacy policy and update it as necessary.

The version published on our website at any given time applies. We recommend that you view the latest version of this document online. We will inform you of any changes via our website or through our usual communication channels.