Privacy policy

The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) of the European Union and the Swiss Federal Act on Data Protection (FADP, revised version of 1 September 2023) is:

Please address all requests under Art. 15–22 GDPR (access, rectification, erasure, restriction, objection, data portability) as well as complaints about the processing of your data exclusively to the controller named above.

External service providers: In the areas of marketing, online presence and sales initiation, the controller is supported by external service providers, namely Mr Jens Herbst. These service providers process personal data exclusively on the instructions and on behalf of J T Consulting LTD & EOOD (Art. 28 GDPR or as auxiliary persons within the meaning of the Swiss FADP) and are not independent controllers within the meaning of Art. 4(7) GDPR. Any separate data protection liability of these external service providers towards the data subjects is excluded; the party responsible for liability remains solely J T Consulting LTD & EOOD as named above.

This privacy policy applies to the website residenz-victoria.ch and all associated subpages. It explains the nature, scope and purpose of the collection and use of personal data.

As we address people in the DACH region (Germany, Austria, Switzerland), we are subject to both the EU GDPR and the Swiss FADP. The stricter rule in each case is applied.

For linked pages outside residenz-victoria.ch, such as the programme on RTL+, the privacy policy of the respective site applies. We serve the RTL logo from our own server, so loading a page does not transmit any data to RTL. Trademark and image rights are set out in the legal notice.

We process personal data in accordance with the following principles:

• Lawfulness, fairness and transparency (Art. 5(1)(a) GDPR / Art. 6(2) and (3) FADP)
• Purpose limitation (Art. 5(1)(b) GDPR / Art. 6(3) FADP)
• Data minimisation (Art. 5(1)(c) GDPR / Art. 6(2) FADP)
• Accuracy (Art. 5(1)(d) GDPR / Art. 6(5) FADP)
• Storage limitation (Art. 5(1)(e) GDPR / Art. 6(4) FADP)
• Integrity and confidentiality (Art. 5(1)(f) GDPR / Art. 8 FADP)

Your personal data is processed on the following legal bases:

• Consent (Art. 6(1)(a) GDPR / Art. 31(1) FADP): You have given your consent for one or more specific purposes.
• Performance of a contract and pre-contractual measures (Art. 6(1)(b) GDPR / Art. 31(2)(a) FADP): The processing is necessary for the performance of a contract or for the implementation of pre-contractual measures.
• Legal obligation (Art. 6(1)(c) GDPR): The processing is necessary for compliance with a legal obligation.
• Legitimate interest (Art. 6(1)(f) GDPR / Art. 31(1) FADP): The processing is necessary to safeguard our legitimate interests, unless your interests or fundamental rights and freedoms override them.

This website currently uses no statistics or marketing services, and no cookie banner is shown. Sections c) to i) describe the services we would only activate after your explicit consent; the banner would appear first.

We use cookies and similar technologies (e.g. localStorage, pixels, tags) on this website. For all technologies that are not strictly necessary, we obtain your explicit consent via our consent banner (Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDDG / Art. 31(1) FADP). As long as you have not given consent, only technically necessary cookies are set; all statistics and marketing tags remain deactivated via Google Consent Mode v2 (default setting “denied”).

You can withdraw or change your consent at any time with effect for the future, without giving reasons, via our Cookie settings page or via the corresponding link in our footer.

a) Categories

In the consent banner, you can decide for each category:

• Strictly necessary: always active (session cookie of the administration area, storage of your cookie choice, your language choice and your subtitle setting)
• Statistics & reach: Google Analytics 4, Microsoft Clarity
• Marketing & remarketing: Google Ads, Meta Pixel, LinkedIn Insight Tag
• Personalisation: personalised ad delivery in the advertising networks mentioned above

b) Technically necessary cookies

Legal basis: Art. 6(1)(f) GDPR and § 25(2) no. 2 TDDDG (strictly necessary).

Server-side proof of consent (Art. 7(1) GDPR): In addition to local storage, we log your cookie decision on our server (selected categories, timestamp, source of the decision, IP address, browser identifier, policy version), without your name or contact details. This serves solely to meet our obligation to provide proof. The IP address and browser identifier are removed automatically after 12 months; the decision itself is kept as proof. Effect of withdrawal: If you withdraw consent previously given for “Statistics”, “Marketing” or “Personalisation”, the page reloads automatically so that any trackers already loaded are reliably stopped.

c) Google Tag Manager (container)

We use Google Tag Manager of Google Ireland Ltd. (Gordon House, Barrow Street, Dublin 4, Ireland). The Tag Manager is itself a container without a tracking function; however, it loads the tags activated in the statistics and marketing categories. The container is loaded exclusively after your consent to at least one of these categories. Recipient: Google Ireland Ltd.; in the case of transfer to the USA: Google LLC under the EU-US Data Privacy Framework (DPF). Legal basis: Art. 6(1)(a) GDPR. More: policies.google.com/privacy.

d) Google Analytics 4 (statistics)

If you consent to “Statistics”, we use Google Analytics 4 of Google Ireland Ltd. for pseudonymised analysis of reach and usage. We activate IP anonymisation as well as the Google Consent Mode default settings ads_data_redaction=true and url_passthrough=true. Data processed: IP address (truncated), device and browser information, pages visited, dwell time, approximate location (country/region). Retention period of the cookies (_ga, _ga_*): 14 months. US transfer: Google LLC under the EU-US DPF. Legal basis: Art. 6(1)(a) GDPR.

e) Microsoft Clarity (statistics)

If you consent to “Statistics”, we use Microsoft Clarity of Microsoft Ireland Operations Ltd. (One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland) to create heatmaps and (anonymised) session recordings. Entries in form fields are masked by default. Retention period of the cookies (_clck, _clsk): up to 12 months. US transfer: Microsoft Corporation under the EU-US DPF. Legal basis: Art. 6(1)(a) GDPR. More: privacy.microsoft.com.

f) Google Ads: conversion tracking & remarketing (marketing)

If you consent to “Marketing”, we use Google Ads of Google Ireland Ltd. to measure the effectiveness of our advertisements (conversion tracking) and to reach website visitors again on advertising networks (remarketing). Cookies (_gcl_*, NID, IDE): up to 13 months (EU/EEA). Recipient: Google Ireland Ltd., in the case of US transfer Google LLC under the EU-US DPF. Legal basis: Art. 6(1)(a) GDPR.

g) Meta Pixel (Facebook/Instagram, marketing)

If you consent to “Marketing”, we use the Meta Pixel of Meta Platforms Ireland Ltd. (Merrion Road, Dublin 4, Ireland). The data processed includes the pixel ID, IP address, browser/device information, the page visited, conversion events and, where applicable, a pseudonymous Meta user ID. This data is used to measure advertising success and to create custom/lookalike audiences on the Meta platforms (Facebook, Instagram). Joint controllership exists for the collection and transmission of the data in accordance with Meta's joint controller agreement. Cookies (_fbp): up to 90 days. US transfer: Meta Platforms, Inc. under the EU-US DPF. Legal basis: Art. 6(1)(a) GDPR. More: facebook.com/policy.php.

h) LinkedIn Insight Tag (marketing)

If you consent to “Marketing”, we use the LinkedIn Insight Tag of LinkedIn Ireland Unlimited Company (Wilton Plaza, Wilton Place, Dublin 2, Ireland) for conversion tracking, retargeting and audience building on LinkedIn. The data processed includes the IP address, device/browser information, pages visited, timestamp and a cookie (li_sugr, UserMatchHistory): up to 90 days. US transfer: LinkedIn Corporation under the EU-US DPF. Legal basis: Art. 6(1)(a) GDPR.

i) Personalisation

If you additionally consent to “Personalisation”, we activate ad_personalization=granted and personalization_storage=granted in the Google services. This allows personalised ad delivery and recommendations based on your usage behaviour.

j) Note on transfers to third countries

The US services mentioned involve a transfer of data to the USA. All the providers listed are certified under the EU-US Data Privacy Framework (DPF); in addition, EU standard contractual clauses (SCC) and company-side protective measures are in place. Nevertheless, a residual risk remains with regard to access by US authorities without a comparable level of legal protection. By consenting to “Statistics”, “Marketing” or “Personalisation”, you also expressly agree to this third-country transfer pursuant to Art. 49(1)(a) GDPR.

For the video tour of the development, we embed a video from the Vimeo service (Vimeo.com, Inc., 330 West 34th Street, New York, NY 10001, USA). The player is only loaded when you expressly start the video tour; before that, there is no connection to Vimeo.

When the video starts, your browser transmits technical data to Vimeo, in particular your IP address, browser and device details and the page visited. We embed the player with the “dnt” (Do Not Track) parameter: Vimeo then sets no tracking cookies and does not analyse playback for advertising purposes.

The legal basis is your consent by starting the video (Art. 6(1)(a) GDPR). We provide the subtitles ourselves; they are not loaded from Vimeo.

Data transfer to the USA: Vimeo is certified under the EU-US Data Privacy Framework. Further information: Vimeo privacy policy.

For the reliable sending of transactional e-mails (confirmation e-mails, brochure dispatch, reservation confirmations, newsletters) and for internal notification e-mails to our team, we use the Resend service of Resend Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA.

In this process, the following data is transmitted to Resend and processed there:

• E-mail address, title and name of the recipient
• Content of the respective e-mail
• Time of sending and technical delivery statistics (delivery, opening, bounce, spam complaints)

Resend is used solely to deliver the e-mails you have triggered or consented to. There is no further profiling, no advertising and no disclosure to third parties.

Processing on our behalf: We have concluded a data processing agreement (DPA) with Resend in accordance with Art. 28 GDPR.

Data transfer to the USA: Resend Inc. is certified under the EU-US Data Privacy Framework (active status can be verified in the official directory). This provides a level of data protection recognised by an adequacy decision of the EU Commission. In addition, we rely on EU standard contractual clauses.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract) for transactional e-mails, Art. 6(1)(a) GDPR (consent) for promotional e-mails and Art. 6(1)(f) GDPR (legitimate interest) for internal notifications.

Further information: Resend privacy policy · Resend DPA.

We optionally offer you the opportunity to contact us via WhatsApp (provider: WhatsApp Ireland Ltd., 4 Grand Canal Square, Dublin, Ireland; parent group: Meta Platforms Ireland Ltd., based in Ireland, and Meta Platforms, Inc. in the USA). On our website you will find “click-to-chat” links for this purpose following the pattern https://wa.me/....

Important: No WhatsApp/Meta pixel and no social media plug-in is integrated on our website. No data is transferred to Meta unless you yourself click on a WhatsApp link. Only through your active click does your browser or the WhatsApp app open a conversation with us.

As soon as you contact us via WhatsApp, the privacy provisions of WhatsApp/Meta apply. In particular, the following is processed: telephone number, profile name, where applicable profile picture, content of the messages, timestamps and technical connection data. This processing lies outside our sphere of influence.

Data transfer to the USA: Meta Platforms, Inc. is certified under the EU-US Data Privacy Framework. We recommend reading the WhatsApp privacy policy before contacting us via WhatsApp.

Legal basis for providing the click-to-chat links: Art. 6(1)(f) GDPR (legitimate interest in a low-threshold contact channel). If you do not wish to use WhatsApp, e-mail and telephone are available to you as equivalent alternatives.

For reasons of IT security, verifiability pursuant to Art. 5(2) GDPR (accountability) and protection against abuse, we operate an internal audit log. The following events are documented in it automatically and in an audit-proof manner:

• Creation, modification and deletion of enquiries and reservations (with before/after comparison of the changed fields)
• Granting, withdrawal and renewed granting of newsletter consents (with source and timestamp)
• Sending and failed attempts of each individual e-mail (with recipient, subject and Resend message ID)
• Logins, logouts and failed login attempts in the internal admin area
• Changes to system settings as well as GDPR access requests and erasures

For each entry, the date, time, IP address and browser identifier of the acting party are also stored.

Retention period / anonymisation: Audit entries are stored for a maximum of 12 months with IP address and browser identifier. After this period, the IP and browser are anonymised; the business transaction history is retained in anonymised form for evidentiary purposes. In the event of a GDPR erasure (see section 16, right to erasure), all data identifying the data subject in the associated audit entries is also anonymised immediately.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in IT security, prevention of abuse and fulfilment of the accountability obligation) and Art. 6(1)(c) GDPR in conjunction with Art. 5(2) GDPR.

This website is hosted by Vercel Inc. (440 N Barranca Ave #4133, Covina, CA 91723, USA). The pages are delivered via Vercel's global delivery network; the server functions that process your enquiries run in the Frankfurt am Main data centre.

We store enquiries and reservation requests in a database at Neon Inc. (USA), in an Amazon Web Services data centre in Frankfurt am Main. Both providers process the data on our behalf under their data processing terms (Art. 28 GDPR).

They are used in the interest of providing our online services securely, quickly and efficiently. Legal basis: Art. 6(1)(f) GDPR (legitimate interest).

Your personal data is only transferred to third parties if:

• you have given your express consent (Art. 6(1)(a) GDPR / Art. 31(1) FADP)
• the disclosure is necessary for the performance of the contract (Art. 6(1)(b) GDPR)
• there is a legal obligation (Art. 6(1)(c) GDPR)
• the disclosure is necessary to safeguard legitimate interests and there is no reason to assume that your interest worthy of protection in non-disclosure prevails (Art. 6(1)(f) GDPR)

Overview of third-country transfers:

Switzerland: The EU Commission has issued an adequacy decision for Switzerland. No transfer beyond this to third countries without an adequate level of data protection takes place.

Personal data is stored only for as long as is necessary for the respective purpose of processing:

After the respective period has expired, the data is routinely deleted or anonymised.

Under the EU GDPR (Art. 15–22) and the Swiss FADP (Art. 25–29), you have the following rights with regard to your personal data:

Response time: We process your request within the statutory period of one month (Art. 12(3) GDPR). An informal message is sufficient to exercise your rights: info@residenz-victoria.ch. We may request suitable proof to verify your identity.

If you believe that the processing of your personal data violates data protection provisions, you have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR / Art. 49 FADP):