Privacy notice

Who handles your data

The data controller is Fondazione Curzútt-San Barnárd, 6513 Monte Carasso, Ticino, Switzerland.

For any question about this notice, write to fondazione@curzutt.ch or call +41 91 835 57 30.

What we collect

When you book a stay we collect:

• first and last name, email address and phone number
• date of birth, nationality and home address
• stay dates, chosen accommodation, number of guests and meals booked
• a copy of an identity document, if you upload one when booking

If you write to our virtual assistant, the text of your messages is sent to the service provider to generate the reply. We advise against entering personal or sensitive details in the chat.

We do not collect browsing data for statistics or advertising: the site uses no analytics tools and no third-party trackers.

Why we process it

• To carry out your booking: without this data we cannot confirm your stay, prepare your meals or reach you if something comes up.
• Because the law requires it: Ticino cantonal law on accommodation obliges us to report guests to the police authority. That is why we ask for date of birth, nationality, address and a document.
• For accounting: Swiss law requires us to keep records of transactions.

Who we share it with

We do not sell or pass on your data to anyone for commercial purposes. We share it only with those we need in order to provide the service:

• Cantonal police authority, for the guest reporting obligation
• Stripe, to take payment. Your card details go straight to Stripe and never pass through or rest on our systems
• Resend, to send confirmation and service emails
• OpenAI, to generate the virtual assistant's replies, limited to the text you write to it
• Supabase and Linode, which host the database and the website respectively

Where it is kept

The website runs on a server in Amsterdam, the Netherlands. The database and uploaded documents are held on infrastructure located in the European Union.

Stripe, Resend and OpenAI are based in the United States: data concerning them may also be processed there, under the contractual safeguards required by applicable law.

For how long

• Identity documents are kept for as long as the reporting obligation requires, then deleted.
• Booking data and accounting records are kept for ten years, as Swiss accounting law requires.
• Conversations with the virtual assistant are not stored on our systems.

How we protect identity documents

Copies of documents are held in a restricted store, separate from the site's public images. They cannot be reached through a web address: authorised staff open them through temporary links that expire after a few minutes.

Your rights

You may ask us at any time to access your data, correct it, delete it, receive a copy, or object to processing. Write to fondazione@curzutt.ch and we will reply within thirty days.

Some data we cannot delete on request, where the law obliges us to keep it — accounting records and reports already sent to the authorities fall into this category.

If you believe the processing does not comply, you may contact the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern.

Cookies

The site uses technical cookies only, to keep the session of staff signing in to the restricted area. We use no profiling, advertising or analytics cookies.

That is why we show you no consent banner: there is nothing to consent to.