Legal
Privacy policy
This privacy policy is a translation of the German version. In case of doubt, the German version shall prevail.
1. Data controller
The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) of the European Union and the Swiss Federal Act on Data Protection (FADP, revised version of 1 September 2023) is:
J T Consulting LTD & EOOD
c/o Residenz Victoria
10 Viktoria Leyks Nort str./blvd.
Mestnost Kosharite Distr.
Pomorie, 8200 Bulgaria
Represented by the Resort Managers: Thomas Hippin, Petya Hippin
Email: info@residenz-victoria.ch
Phone: +41 79 899 44 33 (Switzerland)
Phone: +359 87 611 12 35 (Bulgaria)
Please address all requests under Art. 15–22 GDPR (access, rectification, erasure, restriction, objection, data portability) as well as complaints about the processing of your data exclusively to the controller named above.
External service providers: In the areas of marketing, online presence and sales initiation, the controller is supported by external service providers, namely Mr Jens Herbst. These service providers process personal data exclusively on the instructions and on behalf of J T Consulting LTD & EOOD (Art. 28 GDPR or as auxiliary persons within the meaning of the Swiss FADP) and are not independent controllers within the meaning of Art. 4(7) GDPR. Any separate data protection liability of these external service providers towards the data subjects is excluded; the party responsible for liability remains solely J T Consulting LTD & EOOD as named above.
2. Scope
This privacy policy applies to the website residenz-victoria.ch and all associated subpages. It explains the nature, scope and purpose of the collection and use of personal data.
As we address people in the DACH region (Germany, Austria, Switzerland), we are subject to both the EU GDPR and the Swiss FADP. The stricter rule in each case is applied.
For linked pages outside residenz-victoria.ch, such as the programme on RTL+, the privacy policy of the respective site applies. We serve the RTL logo from our own server, so loading a page does not transmit any data to RTL. Trademark and image rights are set out in the legal notice.
3. Principles of data processing
We process personal data in accordance with the following principles:
- Lawfulness, fairness and transparency (Art. 5(1)(a) GDPR / Art. 6(2) and (3) FADP)
- Purpose limitation (Art. 5(1)(b) GDPR / Art. 6(3) FADP)
- Data minimisation (Art. 5(1)(c) GDPR / Art. 6(2) FADP)
- Accuracy (Art. 5(1)(d) GDPR / Art. 6(5) FADP)
- Storage limitation (Art. 5(1)(e) GDPR / Art. 6(4) FADP)
- Integrity and confidentiality (Art. 5(1)(f) GDPR / Art. 8 FADP)
4. Legal bases for processing
Your personal data is processed on the following legal bases:
- Consent (Art. 6(1)(a) GDPR / Art. 31(1) FADP): You have given your consent for one or more specific purposes.
- Performance of a contract and pre-contractual measures (Art. 6(1)(b) GDPR / Art. 31(2)(a) FADP): The processing is necessary for the performance of a contract or for the implementation of pre-contractual measures.
- Legal obligation (Art. 6(1)(c) GDPR): The processing is necessary for compliance with a legal obligation.
- Legitimate interest (Art. 6(1)(f) GDPR / Art. 31(1) FADP): The processing is necessary to safeguard our legitimate interests, unless your interests or fundamental rights and freedoms override them.
5. Collection of personal data
a) Automatic data collection (server log files)
When you visit our website, your browser automatically transmits information to our server. This is stored in so-called server log files:
- Browser type and version
- Operating system used
- Referrer URL (previously visited page)
- Host name of the accessing computer
- Date and time of the server request
- IP address
This data is evaluated exclusively to ensure trouble-free operation of the website and to improve our offering. It is not combined with other data sources. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the security and optimisation of the website).
b) Contact forms
Our website offers forms for brochure and contact enquiries, consultation appointments, press enquiries and reservation requests. We collect:
- Title, first and last name
- E-mail address
- Phone number (optional, mandatory for reservations)
- For reservations, additionally: postal address (street, postcode, city, country), desired unit, confirmation of the reservation terms
- Message / enquiry (for the contact form)
- Preferred date and time (for consultations)
- Technical metadata: IP address, browser identifier, timestamp of submission
- A random event ID and the page of the form, so that a retry after a network error does not create a second enquiry
- Origin of your visit: first page visited, campaign details from the address (utm parameters) and name of the referring website, without its exact address
- Your cookie choice at the moment of submission (consent ID, version, categories, time), as proof
- Only with consent to “Marketing”: the identifier from an ad click (such as gclid or fbclid) and the cookies _fbp and _fbc; we delete them after 90 days
We use this data to process your enquiry and, for reservations, to prepare a contract (Art. 6(1)(b) GDPR); optional details and the newsletter only with your consent (Art. 6(1)(a) GDPR). We evaluate the origin details only ourselves, to see which channels bring enquiries to us (legitimate interest, Art. 6(1)(f) GDPR). We do not pass the data on to third parties without your consent.
Matching with advertising platforms, only with consent to “Marketing”: If you had allowed marketing at the moment of submission, we transmit your e-mail address and phone number as a SHA-256 hash value (a pseudonymisation, not an anonymisation), the event ID, IP address and browser identifier as well as identifiers from cookies and from an ad click to Google and Meta, to measure whether an ad led to your enquiry and to show you relevant ads (section 6). Later we may also report the status of your enquiry there, with the date (for example consultation held, viewing, reservation, purchase contract). We never transmit names, addresses, messages, preferred dates or budgets, and press enquiries not at all. We do not upload customer lists and do not create lookalike audiences. Without marketing consent, none of this goes to an advertising platform; our server checks this for every transmission.
c) Newsletter / promotional communication
When using a form, you can optionally consent to receiving promotional messages about our property projects (newsletter, updates, invitations to online events). We log the following for this purpose:
- Your email address and, if provided, title and name
- Time of consent
- Source of consent (e.g. “brochure form”, “consultation pop-up”)
- In the event of later withdrawal: time of withdrawal
You can withdraw your consent at any time with effect for the future, informally by email to info@residenz-victoria.ch or via the unsubscribe link in every marketing email. Legal basis: Art. 6(1)(a) GDPR / Art. 31(1) FADP.
d) Contact by e-mail, telephone or WhatsApp
If you contact us by e-mail, telephone or WhatsApp, your details (name, contact details, content of the enquiry) are stored in order to process the enquiry and in case of follow-up questions. We do not pass this data on without your consent. Legal basis: Art. 6(1)(b) GDPR. Information on the use of WhatsApp can be found in section 9.
e) Reviews from our Google Business Profile
On this website we show selected reviews from our Google Business Profile “Residenz Victoria”: stars, text, month and year of the review and the name in shortened form (first name and first letter of the surname). We transfer this information ourselves; your browser does not connect to Google in the process, and no scripts, images or fonts are loaded from Google. Only when you click a link to Google does Google’s privacy policy apply.
Legal basis: Art. 6(1)(f) GDPR / Art. 31(1) FADP (legitimate interest in reproducing publicly submitted reviews of our services). If you wrote one of these reviews and no longer wish to appear here, write to us at info@residenz-victoria.ch; we will remove the quote.
Selected reviews from our Google Business Profile, quoted verbatim with shortened names. The average and the number are taken from Google and cover all reviews on the profile as of the date shown. We do not check ourselves whether the authors actually used our advice.
f) Our pages on Facebook and Instagram
We operate a page on Facebook and a profile on Instagram (Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, Ireland). When you visit them, Meta processes data about your use under its own terms and provides us with aggregated statistics (Insights), without us being able to identify individuals. We and Meta are joint controllers for the Insights (Art. 26 GDPR); under the agreement on this, Meta assumes primary responsibility and fulfils your rights. For our ads on Meta, we can have audiences created from people who have interacted with the page, the profile or our videos; Meta makes the selection, and we do not learn any names. Legal basis on our side: legitimate interest in a presence on social networks and in advertising our offering (Art. 6(1)(f) GDPR). More: Meta Privacy Policy.
g) Forms in our ads on Facebook and Instagram
If you fill in a form in one of our ads on Facebook or Instagram (instant form), Meta Platforms Ireland Ltd. (Merrion Road, Dublin 4, Ireland) transmits your details to us: first and last name, e-mail address, phone number and your answers to the questions in the form. We also receive the time, ad, campaign, form and platform (Facebook or Instagram) of your enquiry. Where available, Meta pre-fills your name and contact details from your account; you can change them before sending. Where your first name clearly indicates it, we use it to choose the form of address (Ms or Mr) in our reply.
For these forms, Meta and we are each controllers (information from Meta). Meta stores the details on its servers and processes them in accordance with its privacy policy, for example to pre-fill future forms. We use them only to answer your enquiry, in the way you choose in the form. We confirm receipt of your enquiry by email to the address you provided, even if you choose a different way to be contacted. Legal basis: Art. 6(1)(b) GDPR. For any other purpose we will ask for your consent first; the details are never sold.
If you indicate in the form that you are looking for something to rent, the form closes and we receive no details from you. We download the details of all other forms from Meta and store them like enquiries from our contact forms (section 14); on transfers to the USA, see section 13.
If you choose WhatsApp in the form, you can start a chat with Thomas Hippin directly on the last page. WhatsApp's privacy policy also applies to this chat; we use your number and your messages only to answer your enquiry.
h) Appointment, appointment page and follow-up
After your enquiry, we arrange a conversation with Thomas Hippin; press enquiries and reservation requests are excluded. If you would like a call, we set a fixed appointment within the time slot you chose; otherwise we suggest one. If you do not reply, we follow up no more than twice, by e-mail or via the channel you chose. We remind you by e-mail before the appointment. If we cannot reach you at the appointment, we send you a link to choose a new time, followed by at most one further message. If we have to postpone an appointment, we book a new time for you straight away where possible and let you know; you can change it via the link. We schedule the first e-mail in advance with Resend; it stays there until it is sent, at most until the next morning (section 8).
We derive your time zone from the country code of your telephone number, otherwise from your language, so that all times are shown in your local time. If you write to us more than once with the same e-mail address or telephone number, we note the further enquiry with the ongoing one and do not write to you twice.
The personal link in our messages opens your appointment page. There you can confirm, reschedule or cancel the appointment and download it as a calendar file. The page shows your name and your appointment, but neither your address nor your telephone number, and it is excluded from search engines. The link is valid until 30 days after your last appointment, without an appointment until 30 days after our last e-mail; we store only a checksum of it. Changes you make there are recorded in the audit log (section 10).
So that we do not write to you again after you have replied, and so that your reply is not left unanswered, our service (section 11) checks only the sender, subject and date of the e-mails of the last 7 days in the mailbox info@residenz-victoria.ch; in the folder of sent e-mails it checks only the recipient and date, to see whether we have already replied to you. It does not retrieve the content and does not mark anything as read. If an e-mail comes from the address of an ongoing enquiry, the follow-up ends; we note this with the enquiry, and Thomas Hippin receives a short message with your name and the subject so that he can reply to you personally. We do not store other senders, recipients or subjects.
If you chose WhatsApp as your contact channel or write to Thomas Hippin on WhatsApp, you may receive messages about arranging an appointment from his WhatsApp Business number +359 87 611 12 35. For this, our service is connected to this number as a linked device. It only considers messages from numbers of an ongoing enquiry and sorts them in memory: a clear confirmation such as “Yes” books the suggested appointment. Any other reply, apart from a short thank-you or greeting, ends the automatic messages, and Thomas Hippin replies to you himself. We do not store the text of your messages, except such a confirmation. We do not write to you on WhatsApp on our own initiative before 9 a.m. your local time. To be able to write to you, the service asks WhatsApp for the technical identifier of your number and stores the keys needed for encryption until the business number is disconnected from the service. It sends no read receipts and does not read earlier chats; for messages from unknown senders and messages Thomas Hippin writes himself, it keeps only the identifier and time in memory for at most 24 hours, without decrypting the content. Thomas Hippin usually makes the arranged call via WhatsApp, otherwise as a normal phone call. WhatsApp’s privacy policy also applies (section 9); for transfers to the USA, see section 13.
For each enquiry, we record which messages we have sent you by e-mail and WhatsApp: text, time, delivery and, if you have read receipts switched on, whether they were read. This includes the calendar invitation to Thomas Hippin with your name, your phone number and the details of your enquiry. Of your replies and of messages Thomas Hippin writes to you himself, we only record the time and direction, and for a confirmation such as “Yes” also the confirmation itself. We store the personal links in these messages only in unrecognisable form. This lets us see what you have received from us. We delete this information together with your enquiry (section 14).
The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures at your request), and for the follow-up, the mailbox check, the WhatsApp messages and the record of the messages sent Art. 6(1)(f) GDPR (legitimate interest in reliably turning your enquiry into a conversation, in not writing to you again after you have replied and in being able to trace what you have received from us). If you do not want any further messages, a short reply or cancelling on the appointment page is enough.
7. Video tour (Vimeo)
For the video tour of the development, we embed a video from the Vimeo service (Vimeo.com, Inc., 330 West 34th Street, New York, NY 10001, USA). The player is only loaded when you expressly start the video tour; before that, there is no connection to Vimeo.
When the video starts, your browser transmits technical data to Vimeo, in particular your IP address, browser and device details and the page visited. We embed the player with the “dnt” (Do Not Track) parameter: Vimeo then sets no tracking cookies and does not analyse playback for advertising purposes.
The legal basis is your consent by starting the video (Art. 6(1)(a) GDPR). We provide the subtitles ourselves; they are not loaded from Vimeo.
Data transfer to the USA: Vimeo is certified under the EU-US Data Privacy Framework. Further information: Vimeo privacy policy.
8. Sending e-mails (Resend, USA)
For the reliable sending of transactional e-mails (confirmation e-mails, brochure dispatch, reservation confirmations, newsletters) and for internal notification e-mails to our team, we use the Resend service of Resend Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA.
In this process, the following data is transmitted to Resend and processed there:
- E-mail address, title and name of the recipient
- Content of the respective e-mail
- Time of sending and technical delivery statistics (delivery, opening, bounce, spam complaints)
Resend is used solely to deliver the e-mails you have triggered or consented to. There is no further profiling, no advertising and no disclosure to third parties.
Processing on our behalf: We have concluded a data processing agreement (DPA) with Resend in accordance with Art. 28 GDPR.
Data transfer to the USA: Resend Inc. is certified under the EU-US Data Privacy Framework (active status can be verified in the official directory). This provides a level of data protection recognised by an adequacy decision of the EU Commission. In addition, we rely on EU standard contractual clauses.
Legal basis: Art. 6(1)(b) GDPR (performance of a contract) for transactional e-mails, Art. 6(1)(a) GDPR (consent) for promotional e-mails and Art. 6(1)(f) GDPR (legitimate interest) for internal notifications.
Further information: Resend privacy policy · Resend DPA.
9. WhatsApp contact (optional)
We optionally offer you the opportunity to contact us via WhatsApp (provider: WhatsApp Ireland Ltd., 4 Grand Canal Square, Dublin, Ireland; parent group: Meta Platforms Ireland Ltd., based in Ireland, and Meta Platforms, Inc. in the USA). On our website you will find “click-to-chat” links for this purpose following the pattern https://wa.me/....
Important: The WhatsApp links only transmit data to WhatsApp when you click a link yourself. With your consent to “Marketing”, the Meta Pixel is embedded on our website (section 6); it then reports a click on a WhatsApp link to Meta as a contact event without content. We do not embed any social media plugin.
As soon as you contact us via WhatsApp, the privacy provisions of WhatsApp/Meta apply. In particular, the following is processed: telephone number, profile name, where applicable profile picture, content of the messages, timestamps and technical connection data. This processing lies outside our sphere of influence.
Data transfer to the USA: Meta Platforms, Inc. is certified under the EU-US Data Privacy Framework. We recommend reading the WhatsApp privacy policy before contacting us via WhatsApp.
Legal basis for providing the click-to-chat links: Art. 6(1)(f) GDPR (legitimate interest in a low-threshold contact channel). If you do not wish to use WhatsApp, e-mail and telephone are available to you as equivalent alternatives.
10. Audit log (activity logging)
For reasons of IT security, verifiability pursuant to Art. 5(2) GDPR (accountability) and protection against abuse, we operate an internal audit log. The following events are documented in it automatically and in an audit-proof manner:
- Creation, modification and deletion of enquiries and reservations (with before/after comparison of the changed fields)
- Granting, withdrawal and renewed granting of newsletter consents (with source and timestamp)
- Sending and failed attempts of each individual e-mail (with recipient, subject and Resend message ID)
- Logins, logouts and failed login attempts in the internal admin area
- Changes to system settings as well as GDPR access requests and erasures
For each entry, the date, time, IP address and browser identifier of the acting party are also stored.
Retention period / anonymisation: Audit entries are stored for a maximum of 12 months with IP address and browser identifier. After this period, the IP and browser are anonymised; the business transaction history is retained in anonymised form for evidentiary purposes. In the event of a GDPR erasure (see section 16, right to erasure), all data identifying the data subject in the associated audit entries is also anonymised immediately.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in IT security, prevention of abuse and fulfilment of the accountability obligation) and Art. 6(1)(c) GDPR in conjunction with Art. 5(2) GDPR.
11. Hosting
This website is hosted by Vercel Inc. (440 N Barranca Ave #4133, Covina, CA 91723, USA). The pages are delivered via Vercel's global delivery network; the server functions that process your enquiries run in the Frankfurt am Main data centre.
We store enquiries and reservation requests in a database at Neon Inc. (USA), in an Amazon Web Services data centre in Frankfurt am Main. Both providers process the data on our behalf under their data processing terms (Art. 28 GDPR).
Time-controlled reminders, the follow-up, notifications to our team, WhatsApp messages and the check of our mailbox are handled by our own service at Fly.io, Inc. (USA) on a server in Frankfurt am Main. For this it receives your name, telephone number, e-mail address, the details of your enquiry and your appointments and keeps them in working memory; whatever it has to retain, it stores in our database at Neon. Our mailbox info@residenz-victoria.ch is hosted by Infomaniak Network SA in Switzerland; what the service checks there is described in section 5 h. These two providers also process the data on our behalf (Art. 28 GDPR).
They are used in the interest of providing our online services securely, quickly and efficiently. Legal basis: Art. 6(1)(f) GDPR (legitimate interest).
12. SSL/TLS encryption
For security reasons and to protect the transmission of confidential content, this website uses SSL or TLS encryption. You can recognise an encrypted connection by the fact that the address bar of the browser changes from “http://” to “https://” and by the padlock symbol in your browser bar. When encryption is activated, the data you transmit to us cannot be read by third parties.
13. Disclosure of data to third parties / third countries
Your personal data is only transferred to third parties if:
- you have given your express consent (Art. 6(1)(a) GDPR / Art. 31(1) FADP)
- the disclosure is necessary for the performance of the contract (Art. 6(1)(b) GDPR)
- there is a legal obligation (Art. 6(1)(c) GDPR)
- the disclosure is necessary to safeguard legitimate interests and there is no reason to assume that your interest worthy of protection in non-disclosure prevails (Art. 6(1)(f) GDPR)
We also forward enquiries and reservation requests internally by WhatsApp to the business number of the responsible advisor (name, contact details and the information you provided) so that he can get back to you quickly; the provider is WhatsApp Ireland Ltd. together with Meta Platforms, Inc. (USA), legal basis Art. 6(1)(b) and (f) GDPR. Once an appointment is set, he receives it there with these details, along with reminders and short overviews, and additionally as a calendar invitation by e-mail (section 8).
Overview of third-country transfers:
| Recipient | Country | Purpose | Safeguard |
|---|---|---|---|
| Resend Inc. | USA | E-mail sending (section 8) | EU-US DPF + DPA + SCC |
| Vercel Inc. | USA | Hosting and delivery (section 11) | EU-US DPF + DPA |
| Neon Inc. | USA (data in Frankfurt) | Database for enquiries (section 11) | DPA + SCC |
| Fly.io, Inc. | USA (server in Frankfurt) | Reminders, follow-up and WhatsApp service (section 11) | EU-US and Swiss-US DPF + DPA |
| Infomaniak Network SA | Switzerland | Mailbox info@residenz-victoria.ch (section 11) | Adequacy decision of the EU Commission |
| Vimeo.com, Inc. | USA | Video tour, only after a click (section 7) | EU-US DPF |
| WhatsApp Ireland Ltd. / Meta Platforms, Inc. | IE / USA | Only when contact is actively initiated by clicking (section 9) | EU-US DPF |
| WhatsApp Ireland Ltd. / Meta Platforms, Inc. | IE / USA | Internal forwarding of enquiries to the advisor (section 13) | EU-US DPF |
| WhatsApp Ireland Ltd. / Meta Platforms, Inc. | IE / USA | Messages about arranging appointments from the advisor’s number (section 5 h) | EU-US DPF |
| Meta Platforms Ireland Ltd. / Meta Platforms, Inc. | IE / USA | Forms in our ads (section 5 g) | EU-US DPF |
| Google Ireland Ltd. / Google LLC | IE / USA | Statistics and advertising, only with consent (section 6) | EU-US and Swiss-US DPF + SCC |
| Meta Platforms Ireland Ltd. / Meta Platforms, Inc. | IE / USA | Advertising, only with consent (section 6) | EU-US and Swiss-US DPF + SCC |
Switzerland: The recipients in the table are based in Switzerland, in the EU or in the USA. According to Annex 1 of the Data Protection Ordinance, the EU states and, for companies certified under the Swiss-US Data Privacy Framework, the USA ensure an adequate level of data protection (Art. 16(1) FADP); for the other recipients in the USA we rely on standard data protection clauses (Art. 16(2)(d) FADP).
14. Retention period
Personal data is stored only for as long as is necessary for the respective purpose of processing:
| Data category | Retention period |
|---|---|
| Enquiries from contact forms, without follow-up business | Until processed, then max. 6 months |
| Internal WhatsApp notification to the advisor | Text in our database for at most 90 days, cleared immediately together with the enquiry; the copy in the advisor’s WhatsApp stays with him until he deletes it |
| Appointments and follow-up for an enquiry | Like the enquiry and deleted with it; the handover to our service at Fly.io 14 days after delivery, undelivered ones after 72 hours |
| Messages sent about an enquiry (e-mail and WhatsApp) | Like the enquiry, deleted with it |
| Keys for the encrypted WhatsApp connection to your number | Until the business number is disconnected from the service |
| Calendar invitation to the advisor | Stays in his calendar until he deletes it |
| Reservations and contract data | Duration of the business relationship + statutory retention (usually 6 to 10 years under the German Commercial Code (HGB) and Fiscal Code (AO)) |
| Newsletter consents and withdrawals | Until withdrawal; proof of withdrawal beyond that for evidentiary purposes |
| Server log files | Max. 30 days |
| Audit log with IP/browser | 12 months, then anonymisation |
| Audit log, business transaction history (anonymised) | As long as necessary to fulfil the accountability obligation |
| Your cookie choice in the browser (rv-consent-v2) | 12 months if you consent, 6 months if you reject all |
| Proof of consent on our server (without IP address) | As long as the consent is valid, thereafter until the limitation periods expire |
| Identifier from an ad click and cookies _fbp, _fbc attached to an enquiry; identifier of the last ad click in the browser (rv-klick) | 90 days |
| Google Analytics: cookies _ga, _ga_<ID> / data at Google | 12 months / 14 months |
| Google Ads: cookies _gcl_au, _gcl_aw / our audiences | 90 days / no more than 365 days |
| Meta: cookies _fbp, _fbc / event data at Meta / our audiences | 90 days / up to two years / no more than 180 days |
After the respective period has expired, the data is routinely deleted or anonymised.
15. No automated decisions
We do not make decisions based solely on automated processing (Art. 22 GDPR / Art. 21 FADP). All decisions on reservations and the conclusion of contracts are made personally by our staff; only the scheduling of appointments, reminders and the follow-up on your enquiry run automatically (section 5 h). With your consent to “Marketing”, profiles are created at Google and Meta for the selection of ads (section 6); no decision with legal effect for you results from this.
16. Your rights as a data subject
Under the EU GDPR (Art. 15–22) and the Swiss FADP (Art. 25–29), you have the following rights with regard to your personal data:
Right of access (Art. 15 GDPR / Art. 25 FADP)
You can request information at any time, free of charge, about your personal data stored by us, its origin, recipients and the purpose of the data processing. On request, we will provide you with a machine-readable file (JSON) containing all data stored about you and the complete processing history from the audit log.
Right to rectification (Art. 16 GDPR / Art. 32(1) FADP)
You have the right to request the rectification of inaccurate data or the completion of incomplete data.
Right to erasure (Art. 17 GDPR / “right to be forgotten” / Art. 32(2)(c) FADP)
You can request the immediate erasure of your data, provided that no statutory retention obligations or overriding legitimate interests of the controller stand in the way. When you exercise this right, all data identifying you in our audit log is also anonymised immediately.
Right to restriction of processing (Art. 18 GDPR)
You can request the restriction of processing, e.g. if the accuracy of the data is contested.
Right to data portability (Art. 20 GDPR / Art. 28 FADP)
You have the right to receive your data in a structured, commonly used and machine-readable format or to request its transmission to another controller.
Right to object (Art. 21 GDPR)
You can object to the processing of your data at any time if the processing is based on a legitimate interest (Art. 6(1)(f) GDPR). In the event of an objection, we will cease the processing unless we can demonstrate compelling legitimate grounds.
Right to withdraw consent (Art. 7(3) GDPR / Art. 31(3) FADP)
You can withdraw consent you have given at any time with effect for the future. The lawfulness of the processing carried out until the withdrawal remains unaffected.
Withdrawing cookie consent
You can withdraw cookie consent on the Cookie settings page (link in the footer of every page) or by e-mail to info@residenz-victoria.ch. The withdrawal also applies to any future transmission from our server, such as later reports on the status of your enquiry.
Objection to direct marketing (Art. 21(2) GDPR)
You can object at any time to the use of your data for direct marketing, for example for our newsletter, including any related profiling. We will then no longer use the data for this purpose (Art. 21(3) GDPR). An informal message to info@residenz-victoria.ch or the unsubscribe link in any marketing e-mail is sufficient.
Response time: We process your request within the statutory period of one month (Art. 12(3) GDPR). An informal message is sufficient to exercise your rights: info@residenz-victoria.ch. We may request suitable proof to verify your identity.
17. Right to lodge a complaint with a supervisory authority
If you believe that the processing of your data infringes data protection law, you can lodge a complaint with any supervisory authority, in particular in the EU member state of your habitual residence, your place of work or the place of the alleged infringement (Art. 77 GDPR), and in Switzerland with the FDPIC (Art. 49 FADP). The lead supervisory authority is the one in Bulgaria, where the controller has its registered office.
Bulgaria (seat of the controller, lead supervisory authority)
Commission for Personal Data Protection (CPDP)
2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia
Switzerland
Federal Data Protection and Information Commissioner (FDPIC)
Feldeggweg 1, 3003 Bern
Germany / Austria
The competent data protection supervisory authority of your federal state or the Austrian Data Protection Authority (www.dsb.gv.at).
18. Objection to advertising e-mails
The use of contact data published within the scope of the legal notice obligation for sending advertising and information materials that have not been expressly requested is hereby expressly objected to. The operators of the pages expressly reserve the right to take legal action in the event of the unsolicited sending of advertising information, for example by spam e-mails.
19. Changes to this privacy policy
We reserve the right to amend this privacy policy at any time so that it always complies with current legal requirements or to reflect changes to our services in the privacy policy. The privacy policy in force at the time will then apply to your next visit.
As of: October 2026