Privacy policy

1. General information

The protection of your personal data is important to us. We process personal data exclusively in accordance with the revised Swiss Data Protection Act (revDSG) and - where applicable - with the European Union's General Data Protection Regulation (GDPR).

In this privacy policy, we inform you about the relevant aspects of the processing of personal data and about your rights under data protection law in connection with our websites and the provision or possible purchase of services from Aqua-Spa-Resorts AG, in particular in the context of our spa, wellness and bathing services or other business relationships.

This privacy policy is not an exhaustive description of all data processing. Individual matters may be regulated in whole or in part by supplementary data protection notices.

Please ensure that you are authorised to pass on personal data of third parties to us and inform these persons of this data protection declaration.

2. Responsible body

Responsible for the processing of personal data is

Aqua-Spa-Resorts AG
Alley 1B
CH-6210 Sursee
Phone: +41 41 921 41 00
E-mail: info@aquaspa.ch

The controller decides alone or jointly with others on the purposes and means of processing personal data.

3 Applicable law

This privacy policy is primarily based on the revised Swiss Data Protection Act (revDSG).

Insofar as our offer is also aimed at persons in the European Economic Area (EEA) or corresponding data processing takes place, the provisions of the General Data Protection Regulation of the European Union (GDPR) also apply.

4. Types of personal data

We process personal data that we receive from you as a guest, customer, prospective customer, website visitor, applicant, supplier or in another business relationship, collect from you or create for these purposes.

In particular, this involves the following types of personal data:

• Contact and identification data (e.g. first and last name, address, telephone number, email address, login information)
• Contract data (e.g. details of services booked or purchased, invoice data, payment information)
• Communication data (e.g. electronic and written correspondence)
• Marketing data
• Meta, usage and technical data (e.g. IP address, device and browser information, cookies)

We may also receive personal data from third parties, e.g. contractual partners, service providers, public registers or authorities.

5. Purposes of data processing

We process personal data in particular for the following purposes:

• Provision, operation, maintenance and further development of our websites, platforms and services
• Booking, realisation and processing of spa services, products, packages and Vouchers
• Appointment organisation, customer care and communication
• Billing, accounting and administrative processes
• Advertising and marketing, unless you have objected to this
• Applicant management and personnel recruitment
• Assertion of legal claims and defence in legal disputes
• Ensuring IT, building and operational security
• Ensuring stable, secure and functional IT operations

6. legal basis for data processing

The processing of personal data takes place in particular on the following legal bases:

• your consent
• the fulfilment of a contract or pre-contractual measures
• legal obligations
• overriding legitimate interests of Aqua-Spa-Resorts AG, in particular in the operation, security, optimisation and economic continuity of our offers

You can revoke your consent at any time with effect for the future.

7. Duration of data processing

We only process and store personal data for as long as this is necessary for the stated purposes or for as long as statutory retention obligations exist. Once these periods have expired, the data is deleted or anonymised.

8. Supervisory authority

The competent data protection supervisory authority in Switzerland is the:Federal Data Protection and Information Commissioner (FDPIC)
https://edoeb.admin.ch

9. Data security

We take appropriate technical and organisational security measures to protect your personal data from unauthorised access, loss, misuse or manipulation. These measures are reviewed on an ongoing basis and adapted to the current state of the art.

Our website uses SSL or TLS encryption. However, we cannot guarantee complete protection during data transmission on the Internet.

10. Server log files

When you visit our website, our servers temporarily store every access in so-called server log files.

In particular, the following data is collected: IP address, date and time of access, name of the file accessed, access status, web browser used, operating system and other comparable technical information.

This data is processed for the technical provision of our website, to optimise our offers and to ensure the stability and security of our systems, in particular to clarify, defend against and prosecute cyber attacks and other illegal activities.

The data is deleted as soon as it is no longer required for these purposes, usually at the end of the respective session.

We may use service providers in Switzerland or abroad to host our website. Our website is currently operated exclusively by Swiss hosting providers on servers in Switzerland.

11. cookies and consent management

Our website uses cookies and similar technologies to provide functions, optimise content and analyse usage.

Session cookies are automatically deleted at the end of your visit. Persistent cookies remain stored on your end device until you delete them yourself.

You can control or deactivate cookies at any time via your browser settings or via our cookie consent tool. Analysis and marketing cookies are only set with your express consent. You can revoke this consent at any time.

Please note that individual functions of our website may be restricted if cookies are deactivated.

12. contact forms and registration

If you use contact forms or registration functions, we process the data you provide to process your enquiry or to carry out pre-contractual or contractual measures.

The data will be deleted as soon as the purpose of the processing no longer applies or you revoke your consent, provided there are no statutory retention obligations.

13. Google services

On our website, we use various services of Google LLC based in the USA or, if you have your habitual residence in the European Economic Area (EEA) or in Switzerland, of Google Ireland Ltd. based in Ireland ("Google").

We use the following Google services on our website:

• Google Tag Manager
• Google Analytics
• Google Marketing Platform
• Google Maps

Google uses technologies such as cookies, web storage and tracking pixels to analyse the use of our website. Data may be transmitted to Google servers in the USA or other countries. According to its own information, Google provides suitable guarantees such as standard contractual clauses.

13.1 Google Tag Manager

The Google Tag Manager is used to manage website tags. It does not set any cookies itself, but triggers other tags, which in turn can collect data. Google does not access this data.

13.2 Google Analytics

Google Analytics is used to analyse the use of our website. Processing takes place exclusively on the basis of your consent. IP anonymisation is activated.

Google analyses the use of our website, compiles reports on website activity and provides other services relating to website activity and internet usage. According to Google, your IP address will not be merged with other Google data.

13.3 Google Ads / Google Marketing Platform

The Google Marketing Platform enables the display of interest-based advertising and the measurement of conversions. Google may use cookies and establish a direct connection to its servers.

14. Meta pixel

We use the Meta Pixel from Meta Platforms Inc. and Meta Platforms Ireland Ltd. on our website.

The meta pixel makes it possible to define target groups for adverts, measure the effectiveness of adverts and create custom audiences and conversions. Extended comparisons can also be used if you have provided us with the relevant data.

Data transfers to countries outside the EEA take place on the basis of suitable guarantees such as standard contractual clauses.

15 Zoho services

Our website uses services provided by Zoho Corporation, in particular Zoho SalesIQ zoho.eu/salesiq, to analyse user behaviour. This involves collecting data about the use of the website in order to improve user-friendliness, provide support and organise our communication processes efficiently.

The following data can be recorded and processed:

• Pages visited and duration of use
• IP address (anonymised if necessary)
• Browser and device type
• Region of origin (country, city)
• Interactions (clicks, mouse movements, scrolling behaviour)
• Time of access
• Content of chat or contact forms, if you actively complete them

Data processing is carried out in accordance with the legal requirements of the EU General Data Protection Regulation (GDPR) and the revised Swiss Data Protection Act (revDSG).

Zoho processes all data exclusively in data centres within the EU. Further information on data processing by Zoho can be found at: zoho.eu. In addition to Zoho SalesIQ, other Zoho services (CRM, contact forms or e-mail communication) are used.

Legal bases:

• For users from the EU: Art. 6 para. 1 lit. a GDPR (consent) or Art. 6 para. 1 lit. f GDPR (legitimate interest)
• For users from Switzerland: Art. 6 revDSG (processing based on consent or overriding interest)

You have the right to access, rectification, erasure, restriction of processing and - where applicable - data portability. You can also withdraw your consent at any time or object to the processing of your data.

Simply contact us at the address given in this privacy policy.

The use of Zoho complies with data protection regulations and is hereby disclosed transparently. There is therefore no basis for liability claims against us as the website operator as long as we fulfil our information obligations and comply with the applicable data protection law.

Processing is carried out in accordance with revDSG and DSGVO.

16. newsletter

If you subscribe to our newsletter, we will only process your e-mail address on the basis of your consent. You can unsubscribe from the newsletter at any time using the unsubscribe link or by sending us a message.

After cancellation, your data will be deleted unless there are legal obligations to retain it.

17. social media

We operate social media profiles on Facebook, Instagram, LinkedIn, YouTube and TikTok.
The data you enter on our social media profiles will be published by the respective social media platform and will not be used or processed by us for any other purpose at any time. However, we reserve the right to delete content should this be necessary. If necessary, we will communicate with you via the respective social media platform.

Please note that the operators of the social media platforms use web tracking methods. This web tracking, over which we have no influence, can also take place regardless of whether you are logged in or registered with the respective social media platform.

You can find more detailed information on data processing and further information on your rights in this regard and setting options to protect your privacy as well as your right to object to the creation of user profiles by the respective provider in the data protection declarations of the corresponding platforms:

• Facebook
  Meta Platforms Inc (USA) / Meta Platforms Ireland Ltd (Ireland):
  Privacy policy
• Instagram
  Meta Platforms Inc (USA) / Meta Platforms Ireland Ltd (Ireland):
  Privacy policy
• LinkedIn
  LinkedIn Corporation (USA) / LinkedIn Ireland Unlimited Company (Ireland):
  Privacy Policy
• YouTube
  Google Ireland Limited (Ireland):
  Privacy Policy
• TikTok
  TikTok Technology Limited (Ireland) / TikTok Inc (USA):
  Privacy policy

18. job applications

If you apply to us, we will process your application data exclusively as part of the application process. This includes, in particular, personal details, education, work experience and application documents.

The data will be treated confidentially and deleted after completion of the application process, provided there are no statutory retention obligations.

19. Your rights

You have the right to information, rectification, erasure, restriction of processing, data portability, objection and withdrawal of consent.

To exercise your rights, please contact us at the address given in section 2. As a rule, proof of identity is required.

You also have the right to lodge a complaint with the competent data protection supervisory authority.

20. changes to the privacy policy

Aqua-Spa-Resorts AG reserves the right to amend this privacy policy at any time. The current version published on our website applies in each case.

Sursee, 28.01.2026