Privacy Policy

1. Who we are and who controls your data

The data controller for the purposes of the EU General Data Protection Regulation (GDPR), the Swiss Federal Act on Data Protection (FADP) and the UK GDPR is Lanternhaus Editorial GmbH, a company registered in Switzerland under company number CHE-418.772.905, with its registered office at Seefeldstrasse 214, 8008 Zürich, Switzerland. We publish independent editorial coverage of hotels in Switzerland. We are not a travel agency, a booking platform or a reservation intermediary, and we do not process payments of any kind.

Questions about this policy, or about how we handle your information, should be sent to [email protected] or by post to the registered address above, marked for the attention of the Data Protection Officer.

2. The personal data we collect

We deliberately collect as little personal data as possible. The categories below represent the complete set of information we may hold about you.

2.1 Information you provide voluntarily

• Contact form submissions: your name, email address, the subject category you select, optional travel dates, an optional hotel preference and the free-text content of your message.
• Direct correspondence: anything you choose to include when writing to us by email or post, including any attachments.
• Press and partnership enquiries: your name, organisation, role and contact details.

2.2 Information collected automatically

• Server log data: truncated IP address, user-agent string, requested URL, referring URL, HTTP status code, response size and timestamp. These logs are generated by our hosting provider for security and diagnostic purposes.
• Consent records: the choice you make in our cookie banner, stored locally in your browser via localStorage under the keys cookieConsent, cookieConsentChoice, cookieConsentDate and cookieConsentPrefs.
• Analytics data (only with consent): aggregated, pseudonymised page-view counts, approximate country-level location derived from a truncated IP address, device type and referral source.

2.3 Data we never collect

We do not collect payment card data, passport or identity document data, health data, biometric data, precise geolocation, or any special category data as defined in Article 9 GDPR. We do not operate user accounts, and we do not maintain a marketing mailing list.

3. Legal bases for processing

Under Article 6(1) GDPR, and the corresponding provisions of the Swiss FADP, we rely on the following legal bases:

4. Cookies and similar technologies

We use a minimal cookie set. Strictly necessary items cannot be disabled because the site cannot function securely without them. Analytics and functional items are off by default and are only activated if you opt in through the consent banner. You may change or withdraw your choice at any time by clearing your browser storage for this domain, after which the banner will reappear on your next visit. Our Cookie Policy sets out each item in a detailed table, including provider, duration and purpose.

5. Third-party processors and recipients

We keep our supply chain deliberately short. The following categories of processor may handle personal data on our behalf, each under a written data processing agreement containing GDPR Article 28 obligations:

• Hosting and content delivery: a European infrastructure provider operating data centres within Switzerland and the European Economic Area, processing server logs and delivering site assets.
• Email infrastructure: a business email provider hosted in the EEA, used to receive and reply to enquiries submitted through the contact form.
• Privacy-first analytics: a cookieless or consent-gated analytics service that aggregates page statistics and does not build cross-site profiles.
• Font and asset delivery: web fonts and photographic assets may be served by third-party content delivery networks; requesting these resources discloses your IP address and user-agent to the relevant provider.

We do not sell, rent, licence or otherwise trade personal data. We do not share your enquiry with the hotels we write about unless you explicitly ask us to make an introduction and confirm that request in writing.

6. International transfers

Switzerland is recognised by the European Commission as providing an adequate level of data protection. Where a processor operates outside Switzerland or the EEA, we rely on the European Commission's Standard Contractual Clauses, the Swiss addendum published by the Federal Data Protection and Information Commissioner, or an applicable adequacy decision. A copy of the safeguards applicable to any specific transfer is available on request.

7. Retention periods

• Contact form and email correspondence: twelve months after the matter is resolved, then permanently deleted.
• Press and partnership correspondence: twenty-four months, to maintain continuity of professional relationships.
• Server logs: thirty days in identifiable form, then aggregated or deleted.
• Analytics data: fourteen months in aggregated form.
• Consent records: stored in your browser until you clear site data; server-side records of consent, where kept, are retained for twelve months.

8. Your rights

Depending on your location, you may exercise some or all of the following rights free of charge:

1. Access — obtain confirmation of whether we process your data and receive a copy of it.
2. Rectification — have inaccurate or incomplete data corrected.
3. Erasure — request deletion where there is no overriding legal reason to retain the data.
4. Restriction — ask us to pause processing while a dispute over accuracy or lawfulness is resolved.
5. Portability — receive data you provided in a structured, commonly used, machine-readable format.
6. Objection — object to processing based on legitimate interests, including any profiling.
7. Withdraw consent — at any time, without affecting the lawfulness of prior processing.
8. Complain — to a supervisory authority, as set out in section 10.

Residents of California may additionally request disclosure of the categories of personal information collected, request deletion, and opt out of any "sale" or "sharing" of personal information. We do not sell or share personal information as those terms are defined under the CCPA/CPRA, and we do not discriminate against anyone exercising their privacy rights.

To exercise any right, email [email protected] with the subject line "Data Subject Request". We respond within thirty calendar days and may ask a limited question to verify that the request comes from you.

9. Security measures

All traffic to this site is encrypted in transit using TLS. Administrative access to the content management environment is restricted to named individuals, protected by multi-factor authentication and reviewed quarterly. Enquiry data is stored on encrypted volumes, backed up to encrypted storage within Switzerland or the EEA, and accessible only to editorial staff who need it to answer your message. We maintain an internal incident response procedure and will notify the competent supervisory authority, and affected individuals where required, within seventy-two hours of becoming aware of a qualifying personal data breach.

10. Supervisory authorities and complaints

We would prefer to resolve any concern directly, so please contact us first. You retain the right to complain to the Federal Data Protection and Information Commissioner (FDPIC) in Bern, to the supervisory authority of the EU or EEA member state in which you reside or work, or to the UK Information Commissioner's Office if you are in the United Kingdom.

11. Children

This website is intended for an adult audience and is not directed at children under sixteen. We do not knowingly collect personal data from children. If you believe a child has submitted data to us, contact [email protected] and we will delete it promptly.

12. External links

Our hotel profiles link to official hotel websites and other third-party resources. Once you follow such a link you are subject to that organisation's own privacy practices, over which we have no control and for which we accept no responsibility. We encourage you to read their policies before submitting any information.

13. Changes to this policy

We review this policy at least annually and whenever our processing activities change materially. Revisions are published on this page with an updated effective date. Where a change significantly affects your rights, we will display a prominent notice on the site for at least thirty days.