Privacy Policy

The controller responsible for data processing is:
Creative Tour DMC AG
Seestrasse 79
6052 Hergiswil NW, Switzerland
Email: office@creativetour.ch
Phone: +41 77 268 79 39

For any questions about data protection or to exercise your rights, please contact us at office@creativetour.ch.

• to answer your enquiry and to plan, run and invoice your tour (contract or pre-contractual measures, Art. 6(1)(b) GDPR)
• to communicate with you before, during and after the tour (Art. 6(1)(b) and (f) GDPR)
• to deliver your photos and videos (Art. 6(1)(b) GDPR)
• to operate the website securely and reliably (legitimate interest, Art. 6(1)(f) GDPR)
• to show our reviews on the website (legitimate interest, Art. 6(1)(f) GDPR)
• to compile statistics on how the website is used, only with your consent (Art. 6(1)(a) GDPR)
• to measure the success of our online advertising and to show you relevant ads on other websites, only with your consent (Art. 6(1)(a) GDPR)
• to meet legal obligations, in particular bookkeeping and record retention (Art. 6(1)(c) GDPR)

We do not sell your data and do not use it for third-party advertising. We only send newsletters if you have expressly agreed to receive them.

Photos and videos are an integral part of our tours. We take them in order to hand them over to you after the tour via an online gallery hosted by Pixieset (see section 7). We only publish images in which you can be recognised (e.g. on this website or on Instagram) with your express consent. You can withdraw this consent at any time; we will then remove the images from our channels as far as we are able to. When flying a drone, we take care not to deliberately film uninvolved people.

We only keep personal data for as long as it is needed for the purpose in question, for example to handle your enquiry, to run the tour and to answer any follow-up questions afterwards. After that, we delete or anonymise it. We only keep data longer where the law requires us to; under Swiss law, for example, booking and accounting records must be kept for ten years (Art. 958f of the Swiss Code of Obligations). The retention periods for cookies are listed in section 6.

Essential (no consent needed; stays in your browser and is not sent to us):

• ct_lang: your language choice
• ct_consent: your cookie choice
• ct_recent_tours: recently viewed tours shown on the home page

Statistics and enquiries (only with your consent, provided by HubSpot and Google Analytics):

• __hstc and hubspotutk (HubSpot): recognise your browser, 6 months
• __hssc (HubSpot): counts page views per visit, 30 minutes
• __hssrc (HubSpot): detects a new visit, until you close your browser
• _ga and _ga_<ID> (Google Analytics): distinguish visitors and visits, 2 years

These cookies show us how the website is used and which pages you viewed before sending an enquiry. Google Analytics does not store your IP address.

Marketing (only with your consent, provided by Google Ads):

• _gcl_au and _gcl_aw (Google Ads): measure whether an enquiry followed a click on one of our ads, 90 days

With this consent, Google may also use your visit to show you our ads on other websites (remarketing).

We use Google Consent Mode: Google services only load once you have given your consent. You can change or withdraw your consent at any time via “Cookie settings” in the footer of every page; the affected cookies are then deleted.

We work with carefully selected service providers who process data on our behalf and are contractually bound to protect it:

• Netlify (Netlify, Inc., USA): hosting of the website; processes the server log data when pages are requested.
• HubSpot (HubSpot, Inc., USA, and HubSpot Ireland Ltd.; data stored in a data centre in the EU): customer management (CRM), receipt of form submissions, email communication and, with your consent, website statistics.
• bexio (bexio AG, Switzerland): accounting, quotes and invoices.
• Stripe (Stripe Payments Europe Ltd., Ireland, and Stripe, Inc., USA): processing of payments via the payment link. Stripe also processes your payment data under its own responsibility, for example to prevent fraud.
• Elfsight: displays our Google and Tripadvisor reviews on the home page. Your IP address and technical browser data are transmitted to Elfsight and to Tripadvisor (for the reviewers’ profile pictures). According to our checks, the widget does not set any cookies on our website.
• Google (Google Ireland Limited, Ireland, and Google LLC, USA): email (Gmail) and file storage (Google Drive) via Google Workspace, website statistics (Google Analytics) and advertising (Google Ads), the latter two only with your consent; our reviews also come from our Google Business Profile.
• Pixieset (Pixieset Media Inc., Canada): online galleries through which we deliver your photos and videos.
• AI services such as Anthropic (Anthropic PBC, USA) and OpenAI (OpenAI Ireland Ltd. or OpenAI, L.L.C., USA): we use AI tools for tasks such as translations, drafting texts and planning tours. We only enter personal data where this is necessary for the purpose, and we use accounts under which inputs are not used to train the models. Decisions about you are always made by a person.
• WhatsApp (WhatsApp Ireland Ltd., Meta group): only if you choose WhatsApp as your contact method or message us there.

Beyond this, we only share data where it is needed for your tour, for example with service partners such as mountain railways, restaurants or boat operators (usually your name and group size for a reservation), with our fiduciary, or where we are legally obliged to do so.

Some of our service providers are based, or store data, outside Switzerland, mainly in the EU, Canada and the USA. Under Swiss law, EU and EEA countries as well as Canada provide an adequate level of data protection. For the USA, we rely on the Swiss-U.S. and EU-U.S. Data Privacy Framework where the recipient is certified under it, and otherwise on the European Commission’s standard contractual clauses, which are also recognised by the Swiss Federal Data Protection and Information Commissioner (FDPIC).

Our website links to our Instagram profile. This is a simple link: only when you click on it are you taken to Instagram (Meta Platforms Ireland Ltd.), where Instagram’s privacy policy applies.

The website is encrypted throughout (HTTPS). Within our company, only the people who need your data for their work have access to it. We take appropriate technical and organisational measures to protect your data against loss and unauthorised access.

You have the right to

• obtain information about the data we hold about you,
• have incorrect data corrected,
• request the deletion of your data or the restriction of its processing,
• object to the processing,
• receive your data in a common format or have it transferred, and
• withdraw any consent you have given at any time, with effect for the future.

To do so, write to us at office@creativetour.ch. To make sure we do not disclose your data to unauthorised persons, we may ask you to verify your identity. Legal retention obligations may prevent us from deleting certain data.

You also have the right to lodge a complaint with a supervisory authority: in Switzerland with the Federal Data Protection and Information Commissioner (FDPIC, edoeb.admin.ch), in the EU with the data protection authority of your country of residence.

We need the information marked as required in our forms to handle your enquiry; without it, we cannot make you an offer. You can use the website without restriction without consenting to statistics cookies. We do not make automated individual decisions or carry out profiling with legal or similarly significant effects.

We update this privacy policy when our data processing or the legal situation changes. The current version on this page applies.