Legal
Privacy Policy
Learn how Fewolike collects, uses and protects personal data when you browse the site, enquire about a stay or contact our team.
1. Scope
This policy explains how Fewolike processes personal data when you visit our website, contact us, request a holiday apartment or camper, or enquire about managing a property. Swiss data protection law applies. Where its territorial scope is met, the EU General Data Protection Regulation (GDPR) also applies.
This policy also covers the processing described below for the restricted internal team portal.
2. Controller and contact
The controller is Fewolike AG, Heldstrasse 5a, CH-9205 Waldkirch, Switzerland. Please use the following contact details for privacy questions and requests concerning your data.
3. Website delivery and security
The website and its database run on a Tube-Hosting VPS. Cloudflare is used for online services. Technical access data required for delivery and security is processed in this connection. The internal Mailcow service runs on the same VPS; Mailcow is self-operated software, not an additional external email delivery provider.
Delivering the website involves your IP address, request time, requested address and technical browser information needed to transmit pages and protect the service. Temporary request counters use the IP address to limit misuse and expire after one hour. IP addresses may appear in technical error logs. Fonts are served with the website rather than requested from Google Fonts.
4. Contact and enquiries
When you contact us through a form, by email or telephone, we process your information to answer and follow up. Form messages are queued for delivery to Fewolike and a confirmation to you. The email providers involved process delivery information and correspondence in our mailboxes.
Emails are sent and managed through our internal Mailcow service. Authorised personnel handle messages and attachments; delivery information supports reliable sending.
- Name, email address and optional telephone number
- Message, language and other information you provide
5. Booking requests and stays
A website booking request includes your contact details, the selected apartment or camper, arrival and departure dates, party size, extras and any message. We store the request, its time, status, price information and the requesting IP address to handle the enquiry, prevent misuse and retain a record of the request. A website request is not an automatic booking confirmation. The website does not collect payment-card details.
We obtain occupancy information from the calendar providers connected to our properties to show availability. When a stay is arranged, the information needed to organise it may be shared with the relevant property owner and service providers, such as cleaning or arrival teams.
6. Property management enquiries
For management enquiries we process your name, email address and property location, plus an optional telephone number, room count, property type and message. We use these details to answer, assess the property personally and prepare a possible working relationship.
7. Guest reviews
Published reviews may show a first name, a review date, a rating and review text. They help visitors assess our properties and service. Reviews form part of the website content and are stored with its version history on GitHub. Removing a review from the current website does not by itself erase earlier versions or backups. Please contact us if you wish to request correction or removal of a review concerning you.
8. Browser storage and cookies
Local browser storage remembers your language and explicit language choice. Session storage remembers your position during a language switch, the catalogue view and dismissal of short-notice offers for the current tab session. These settings do not create an advertising profile. You can clear them in your browser. Blocking storage does not prevent use of the functions, but your choice may not be remembered.
Local and session storage are distinct from cookies. Signing in to the internal team portal uses an essential session cookie. The website does not embed analytics tools, advertising pixels or a newsletter signup.
9. Maps
Opening the map loads map tiles from OpenStreetMap. Your browser then sends its IP address and technical request information, including the tiles needed for the area displayed, to the map service and its delivery network. The OpenStreetMap Foundation is an independent controller for its services. You can browse the accommodation list without opening the map.
10. External platforms and social links
Links to Booking.com, Airbnb, Instagram, LinkedIn and other external websites take you to the respective provider. They are ordinary links rather than embedded social feeds. After following a link, that provider processes data under its own policy, including any data you provide there or information associated with a logged-in account. Bookings made through an external platform are also subject to that platform’s data-processing arrangements.
11. Purposes, recipients and international processing
Purposes and grounds
We process data to provide and secure the website, answer enquiries, prepare and perform contracts, organise stays and comply with legal obligations. Where the GDPR applies, the relevant grounds are pre-contractual steps and contract performance, legal obligations, legitimate interests in reliable service and misuse prevention, or consent where a particular activity requires it. Consent can be withdrawn for the future.
Recipients
Recipients include authorised Fewolike personnel, hosting and email providers, property and service partners where needed for the request, and advisers or authorities where required for legal duties or claims. We do not sell personal data.
International processing
Fewolike processes data for its own business activities in Switzerland. Tube-Hosting operates the website, database and internal mail server in Eygelshoven, the Netherlands. GitHub is a US provider for content and its version history. Cloudflare is a US provider with a global network. The OpenStreetMap Foundation is based in the United Kingdom; map tiles are delivered through a global network. A provider’s location does not promise that all processing takes place there exclusively. Contact us for specific recipients, processing countries and safeguards used. Transfers to countries without recognised adequate protection require appropriate safeguards or a statutory exception.
Services and data recipients
| Service or recipient | Purpose | Data involved | Privacy |
|---|---|---|---|
| Fewolike and authorised partners | Enquiries, stays and service | Contact details, messages and necessary trip or property information | Privacy |
| Tube-Hosting (Eygelshoven, Netherlands) | Server operation for the website, database and internal Mailcow service | Technical access data and enquiries and emails stored on the server | Privacy |
| Cloudflare (United States) | Delivery and protection of online services | IP address, technical connection data and, depending on the service used, transmitted content | Privacy |
| Fewolike, internal Mailcow service (Eygelshoven, Netherlands) | Send and manage emails under our own responsibility | Email addresses, messages, attachments and delivery information | Privacy |
| GitHub (United States) | Website content and publication | Published reviews and content history; internal publication is performed by authorised employees | Privacy |
| OpenStreetMap Foundation (United Kingdom) | Maps on request | IP address and technical tile requests when the map is opened | Privacy |
Recipients receive only the data needed for the relevant service. Please use the privacy contact to ask about a particular disclosure.
12. Retention
We delete or anonymise data once its purpose ends and no legal duties or necessary preservation of claims prevent this. The following guidelines distinguish regular manual review from technically configured expiry periods.
Authorised personnel review closed enquiries at least quarterly, covering the database, mailboxes and exports. Failed deliveries are reviewed regularly; after resolution, we assess whether the queue copy is still needed. Legal retention and ongoing claims are checked before deletion. Reviews require separate handling of current content, previous versions and backups. After a restoration, documented deletions are reapplied before the data is used for business operations.
| Data category | Purpose | Retention or deletion criterion |
|---|---|---|
| Request counters | Limit misuse | Public form counters expire after one hour; team login counters after 15 minutes. |
| Sent email queue | Reliably deliver form emails | The application removes successfully sent entries after 90 days by default. This is a configurable default, not a confirmed period for all emails. Failed entries remain until resolution or removal. |
| Closed enquiries without a contract | Contact and follow-up | Deletion guideline: twelve months after the last contact is concluded. Database and mailbox enquiries are reviewed manually at regular intervals; booking requests are not automatically deleted. |
| Contract and accounting records | Contract performance and statutory records | Accounting records generally ten years from the end of the financial year. Other contract data only while necessary for the contract, legal duties or specific claims. |
| Technical logs | Operation and security | Guideline for regular deletion review: 30 days. Data concerning a specific security incident may be needed until it is resolved. The existing log-size limit does not replace timed deletion. |
| Backups | Recovery after failures | Website database: daily backups retained for 14 days. Mailcow: seven daily and four weekly snapshots. Deleted data may remain until the relevant backup cycle is pruned; deletions must be reapplied before restored data is used in production. |
| Reviews | Publish guest experiences | While published; older content versions and backups are handled separately. |
| Browser settings | Remember language and display | Language until cleared in the browser. Position removed when read; other session settings end with the tab session. |
| Team access | Enable authorised login | Sessions at most twelve hours, invitations 24 hours, two-factor challenges five minutes. Account data needs a separate review. |
13. Your choices and rights
You may contact us to request information about your data, correction of inaccurate information or deletion of data that is no longer lawfully needed. Depending on the applicable law and conditions, you may also request restriction or portability and object to processing. In particular, where the GDPR applies, you may object to processing based on legitimate interests on grounds relating to your situation. We may need information to verify your identity and may limit a request where legal duties or the rights of others require it.
You may raise a concern with the Swiss Federal Data Protection and Information Commissioner (FDPIC) and, where the GDPR applies, the competent supervisory authority. Providing optional information is voluntary; without the contact or booking details needed for your request, we may be unable to answer or arrange the requested service. Please avoid sending sensitive information that is not needed for the enquiry.
14. Security and automated decisions
We use encrypted website connections and technical and organisational controls intended to restrict access and protect data. No transmission or storage system can guarantee absolute security. Our website does not make decisions with legal or similarly significant effects solely through automated processing, and it does not use advertising profiling. Availability checks and price calculations assist enquiries; a stay requires confirmation.
15. Changes to this policy
We update this policy when the website, our processing activities or applicable requirements change. The date above identifies the current version. Please contact Fewolike if you need clarification about a particular processing activity.
16. Internal team portal
For authorised employees we process names, email addresses, roles, permissions, account status and login times to manage and secure access. An optional profile image is accessible only after authentication.
Passwords are stored as protected verification values. If two-factor authentication is enabled, we store an encrypted authenticator secret and verification values for recovery codes. Invitations, authentication challenges and sessions have time limits. The session cookie lasts no longer than twelve hours; logout or revocation can end access earlier.
Only authorised people can access enquiries and content. Disabling an account revokes its sessions but does not automatically erase all account data or business records previously handled.
When access is no longer authorised, the account and sessions are disabled. Unnecessary profile and authentication data is removed after review; necessary business records are retained separately. Legal retention obligations and outstanding claims are considered.