Privacy & Cookie Policy – goswiss.ch

Last updated: 4 September 2026

1. Introduction and data controller

This Privacy & Cookie Policy explains how personal data is collected and processed when you visit https://goswiss.ch (the “Portal”), submit an enquiry, create an account or make a booking.

The data controller responsible for the Portal is:

Zwiss GmbH
c/o Linda Narayanan-Schwander
Undere Waldmattenstrasse 11
3778 Schönried, Switzerland
Company/VAT number: CHE-444.407.337
Email: [email protected]
Phone: +41 79 815 10 00

We process personal data in accordance with the Swiss Federal Act on Data Protection (“FADP”) and, where it applies, the EU General Data Protection Regulation (“GDPR”).

2. Personal data we collect

Depending on how you use the Portal and the service you book, we may collect:

• Identity and contact data, including your name, postal address, country of residence, email address and telephone number.
• Passenger and participant data, including names, dates of birth, ages, nationality, travel-document information, discount or travel-card details and information required to issue a ticket or provide a service.
• Booking data, including selected products, destinations, dates, times, routes, travel class, accommodation details, participant numbers, preferences, special requests, tickets, vouchers and booking references.
• Payment and transaction data, including the payment amount, currency, payment status, transaction reference and limited payment-method information supplied by Stripe. Zwiss GmbH does not receive or store your complete payment-card number or card security code.
• Account data, including login details, account preferences and booking history.
• Communication and support data, including enquiries, emails, telephone or messaging correspondence, complaints and feedback.
• Technical data, including IP address, browser and device information, operating system, timestamps, referring pages, security logs and identifiers associated with cookies or similar technologies.
• Usage data, including pages viewed, actions taken and interactions with the Portal, where the relevant technology is enabled.
• Marketing data, including newsletter registration, communication preferences and records of consent or withdrawal.

Please do not provide health information, accessibility requirements, dietary information or other sensitive personal data unless it is relevant to a requested service. Where you provide such information, we use it only as necessary to handle your request or booking and in accordance with applicable law.

If you provide personal data about another traveller or participant, you confirm that you are authorised to do so and that you have informed that person about this Policy.

3. How we collect personal data

We collect personal data:

• directly from you when you browse the Portal, open an account, make a booking, subscribe to communications or contact us;
• from a person making a booking on your behalf;
• from Providers, transport operators and other booking partners when they confirm, amend or perform a service;
• from Stripe, banks and payment participants in connection with payments, refunds and fraud prevention;
• automatically through server logs, cookies and similar technologies; and
• from public authorities or other parties where permitted or required by law.

4. Purposes of processing

We may process personal data to:

• respond to enquiries and provide requested information;
• create and manage accounts;
• process bookings and transmit necessary information to the relevant Provider;
• issue confirmations, tickets and vouchers;
• process payments and refunds through Stripe;
• verify transactions and prevent fraud, abuse and security incidents;
• communicate service updates, changes, disruptions or safety information;
• provide customer support and handle complaints or legal claims;
• operate, secure, maintain and improve the Portal;
• analyse Portal performance and usage where permitted and, where required, with consent;
• send newsletters or promotional messages where permitted and, where required, with consent;
• maintain business, accounting and tax records; and
• comply with legal and regulatory obligations and enforce our contractual rights.

5. Legal grounds under the GDPR

Where the GDPR applies, we rely on one or more of the following legal grounds:

• Contractual necessity: processing required to take steps at your request, complete a booking or perform a contract.
• Legal obligation: processing required for accounting, taxation, regulatory, sanctions or other legal duties.
• Legitimate interests: operating and securing the Portal, preventing fraud, providing customer support, improving services, managing business records and establishing or defending legal claims, provided your interests and fundamental rights do not override those interests.
• Consent: for non-essential cookies, certain analytics or marketing communications where consent is required. You may withdraw consent at any time without affecting processing carried out before withdrawal.
• Protection of vital interests: processing necessary in a genuine emergency involving a traveller or participant.

6. Payments through Stripe

Online payments are processed by Stripe. When you pay, payment and device information is transmitted directly to Stripe and the financial institutions involved in the transaction. Stripe processes data for payment authorisation, settlement, fraud prevention, security and regulatory compliance in accordance with its own privacy notice.

Zwiss GmbH receives information such as the payer’s name, contact details, transaction identifier, payment status, amount, currency and limited payment-method details. We do not store your complete card number or card security code.

Stripe may process personal data in Switzerland, the European Economic Area, the United Kingdom, the United States and other countries, subject to the safeguards described in Stripe’s privacy documentation.

7. Disclosure of personal data

We disclose personal data only where reasonably necessary, including to:

• Providers and booking partners, such as transport operators, excursion operators, attractions, accommodation providers, guides or event partners, to request, confirm and perform your booking;
• Stripe, banks and payment participants, to process payments, refunds and fraud checks;
• technology and service providers, including website hosting, cloud storage, email, customer support, analytics, security and content-delivery providers;
• professional advisers, such as accountants, auditors, insurers and legal advisers;
• public authorities, courts and regulators, where required by law or necessary to protect legal rights; and
• parties involved in a business reorganisation, subject to appropriate confidentiality and legal safeguards.

Some Providers act as independent data controllers and process your data under their own privacy notices. Zwiss GmbH does not sell personal data.

8. International data transfers

Some recipients may be located outside Switzerland or the country in which you live. Where personal data is transferred to a country that is not recognised as providing adequate protection, we use an appropriate legal safeguard where required, such as recognised standard contractual clauses, or rely on another lawful exception. You may contact us for further information about the safeguards relevant to your data.

Customers should be aware that a booking outside Switzerland may require us to send necessary passenger or booking data to a Provider in the destination country.

9. Data retention

We retain personal data only for as long as reasonably necessary for the relevant purpose and applicable legal requirements. Typical periods are:

• Booking, contract, invoice and accounting records: generally 10 years after the relevant financial year or transaction, where required for Swiss record-keeping obligations.
• Customer account data: while the account remains active and for a reasonable period afterwards, unless earlier deletion is appropriate or longer retention is required.
• Enquiries, support correspondence and complaints: generally up to five years after the matter is closed, and longer where needed for an ongoing claim or legal obligation.
• Marketing records: until you unsubscribe or withdraw consent, with limited suppression information retained to respect your preference.
• Security and technical logs: for a limited period appropriate to security, troubleshooting and fraud-prevention needs.
• Cookies and similar identifiers: for the periods described in the cookie settings or table below.

Data may be anonymised instead of deleted. Statutory, contractual, evidentiary or security requirements may justify a longer or shorter retention period in individual cases.

10. Your rights

Subject to applicable law and its conditions, you may have the right to:

• request information about and access to your personal data;
• have inaccurate or incomplete data corrected;
• request deletion or destruction of personal data;
• object to or request restriction of certain processing;
• withdraw consent at any time;
• receive certain personal data in a portable format;
• object to direct marketing; and
• request review of a decision based solely on automated processing where such a decision produces legal or similarly significant effects.

These rights are not absolute. For example, we may retain information where required by law or necessary to establish, exercise or defend legal claims.

To exercise a right, contact [email protected]. We may request reasonable proof of identity. We will respond within the period required by applicable law.

You may also contact the Swiss Federal Data Protection and Information Commissioner (“FDPIC”). If the GDPR applies to you, you may have the right to complain to the competent data-protection authority in your country of residence or work, or where an alleged infringement occurred.

11. Cookies and similar technologies

11.1 What are cookies?

Cookies are small files stored on your device. We may also use similar technologies, such as local storage, pixels or tags. They support functions including website security, session management, language settings, checkout, analytics and, if enabled with consent, advertising measurement.

11.2 Cookie categories

• Essential cookies are necessary for core website, security, booking and checkout functions. They cannot generally be disabled through our preference tool.
• Functional cookies remember choices such as language or display preferences.
• Analytics cookies help us understand Portal usage and performance.
• Marketing cookies may measure campaigns or support advertising and remarketing.

Where required, functional, analytics and marketing cookies are used only after you give consent. Refusing non-essential cookies does not prevent you from using essential booking functions, although some optional features may not work.

11.3 Cookies and services currently relevant to the Portal

The exact cookie name and duration can vary according to browser, configuration and provider updates. The Portal’s cookie settings should display the current cookies detected in your session.

Google Analytics, Google Ads, Meta, LinkedIn and YouTube cookies must be listed here and blocked until consent where legally required only if the corresponding technology is actually installed or embedded on the Portal. They should not be represented as active merely because they may be used in the future.

11.4 Managing your choices

On your first visit, where required, you can accept all cookies, reject non-essential cookies or choose individual categories. You can change your decision at any time through the Cookie Settings link on the Portal.

You may also block or delete cookies through your browser. Browser-level blocking may affect checkout, login or other Portal functions. Withdrawing consent does not affect processing that occurred before withdrawal.

11.5 Keeping the cookie information accurate

The technologies used by the Portal may change. Zwiss GmbH will update the cookie information when providers or configurations change. A technical cookie scan should be carried out before this Policy is published and after material website or marketing changes so that the cookie banner and table accurately reflect the technologies in use.

12. Marketing communications

We send promotional emails or newsletters only where permitted by law. You can unsubscribe at any time using the link in the message or by contacting [email protected]. Service messages relating to an existing enquiry or booking are not marketing and may still be sent where necessary.

13. Data security

We use appropriate technical and organisational measures designed to protect personal data against accidental or unlawful loss, alteration, disclosure, access or misuse. Measures may include encryption in transit, access controls, authentication, backups, logging and service-provider reviews.

Payments are processed through Stripe. No method of transmission or storage is completely secure, and absolute security cannot be guaranteed.

14. Children’s data

The Portal is intended for bookings made by adults. We may process information about children where an adult includes them in a booking and the information is necessary to issue a ticket or provide the service. The adult making the booking is responsible for having authority to provide that information.

15. Third-party websites

The Portal may link to Provider or other third-party websites. Their processing of personal data is governed by their own privacy policies. Zwiss GmbH is not responsible for the privacy practices of independently operated websites.

16. Changes to this Policy

We may amend this Policy to reflect changes in the Portal, service providers, business practices or applicable law. The current version will be published on this page with its effective date. Material changes will be communicated where required.

17. Contact

For privacy enquiries or requests, contact:

Zwiss GmbH – goswiss.ch
c/o Linda Narayanan-Schwander
Undere Waldmattenstrasse 11
3778 Schönried, Switzerland
Company/VAT number: CHE-444.407.337
Email: [email protected]
Phone: +41 79 815 10 00