Privacy policy (Datenschutz)

1 Who is responsible

The controller responsible for your personal data is:

Stilea is a brand of KI Beratung Fankhauser. For all questions about data protection, write to [email protected].

2 Legal basis

We process personal data in accordance with the Swiss Federal Act on Data Protection (FADP, revDSG) and, where it applies, the EU General Data Protection Regulation (GDPR).

Where the GDPR applies, we rely on these legal bases:

• Contract (Art. 6(1)(b) GDPR): to handle your booking and payment.
• Consent (Art. 6(1)(a) GDPR): for the newsletter, “Notify me”, the ticket alert and photos in which you can be recognised. For health information you share with us, your explicit consent (Art. 9(2)(a) GDPR).
• Legal obligation (Art. 6(1)(c) GDPR): to keep accounting records.
• Legitimate interest (Art. 6(1)(f) GDPR): to run a secure and reliable website, to see how it is used (web analytics) and to measure whether our ads in Google Search, on Facebook, on Instagram and in ChatGPT work.

3 Visiting our website

Our website is hosted on Cloudflare Pages, and our forms are processed by Cloudflare Pages Functions. The provider is Cloudflare, Inc., USA.

When you visit stilea.ch, Cloudflare processes technical data such as your IP address, the page you request, the date and time of the request and information about your browser. This is necessary to deliver the website, keep it reliable and protect it against attacks. All connections to stilea.ch are encrypted (HTTPS).

The fonts are hosted on stilea.ch itself. Your browser does not send any requests to Google or other font services.

4 Cookies

Google Analytics sets cookies, see “Web analytics” below. If you come to us through one of our ads in Google Search, Google Analytics also keeps the click ID of the ad, see “Advertising with Google Ads”. Our ads on Facebook and Instagram do not set any cookies on our website, see “Advertising on Facebook and Instagram”. Apart from that, our website does not set any cookies. It uses your browser’s local storage for two things only: if you come to us through one of our ads in ChatGPT, it keeps the click reference of the ad for 30 days (see “Advertising in ChatGPT”), and after a booking it notes that the booking has been counted in Google Analytics, so that it is not counted twice. We do not use remarketing, advertising pixels of social networks (such as the Meta Pixel) or other tracking pixels.

If the form of the ticket alert is protected with Cloudflare Turnstile (see below), the Turnstile check is loaded from challenges.cloudflare.com and may keep technically necessary data in your browser to tell people from bots. It is not used for tracking or advertising.

5 Web analytics

Cloudflare Web Analytics. To count visits and measure how fast our pages load, we use Cloudflare Web Analytics, a service of Cloudflare, Inc., USA. It works without cookies and without your browser’s local storage. Cloudflare records which page is viewed, the website you came from, your browser and type of device, the country derived from your IP address and the loading times. Cloudflare does not use your IP address or any cookies to recognise you and does not create profiles of individual visitors. We only see statistics.

Google Analytics. To understand how visitors find and use stilea.ch, we use Google Analytics 4, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, together with Google LLC, USA. Google Analytics records, for example, which pages you view and for how long, the website or ad you came from, your device, browser and screen size, your approximate location (country, region, city), whether you sign up for the ticket alert or the newsletter and whether you start or complete a booking (with the room, the number of places and the amount, but without your name). For this, Google Analytics sets cookies (_ga and _ga_…) that store a random identifier for up to two years.

Google Analytics 4 does not store IP addresses: Google uses your IP address only to derive your approximate location and then discards it. We do not send names, email addresses or phone numbers to Google. In Google Analytics, data linked to cookies or identifiers is deleted after 14 months at the latest; reports that only contain totals are kept longer. Google may process data in the USA (see “Transfers abroad”).

You can stop Google Analytics by blocking cookies in your browser or by installing Google’s browser add-on: tools.google.com/dlpage/gaoptout. More information is in Google’s privacy policy.

6 Advertising with Google Ads

We advertise our retreats with text ads in Google Search (Google Ads), a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, together with Google LLC, USA. When you click one of our ads, Google adds a click ID (gclid) to the address of our page. Google Analytics keeps this click ID with your visit, in its cookies or in a cookie named _gcl_aw, for up to 90 days.

If you then confirm your ticket alert or, once the sale is open, book a retreat, Google Analytics passes this conversion on to our Google Ads account. This tells us how many people who clicked an ad signed up or booked, and what the ads cost per sign-up. We only see totals and never who you are.

We do not use the Google Ads tag on our website, we do not use remarketing (ads that follow you to other websites) and we do not pass names, email addresses or phone numbers to Google. Google processes your search and your click on the ad under its own privacy policy. You can manage personalised ads in My Ad Center.

7 Advertising on Facebook and Instagram

We also advertise our retreats with ads on Facebook and Instagram, services of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland, together with Meta Platforms, Inc., USA. We decide who sees our ads only with general criteria: people in Switzerland, women in an age range we choose, their language and interests such as yoga or wellness. Meta applies these criteria with the data it holds about its users. We do not upload any lists of customers or contacts to Meta.

When you click one of our ads, Meta adds a click ID (fbclid) to the address of our page, and we add campaign parameters (utm_source, utm_medium, utm_campaign and utm_content) that name the platform, the campaign and the ad. Google Analytics records the address of the page, including these parameters, with your visit (see “Web analytics”). This tells us how many visits, sign-ups and bookings came from which ad.

We do not use the Meta Pixel or the Meta Conversions API, we do not use remarketing and we do not pass names, email addresses, phone numbers or bookings to Meta. Meta therefore does not learn from us what you do on stilea.ch. In Meta’s ads manager we only see totals, for example how often an ad was shown and clicked. Meta processes your use of Facebook and Instagram and your click on the ad under its own privacy policy. You can manage which ads you see in the ad preferences of your Meta account.

8 Advertising in ChatGPT

We also advertise our retreats with ads in ChatGPT, a service of OpenAI Ireland Limited, 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland, together with OpenAI OpCo, LLC, USA. We decide where our ads may appear only with general criteria: people in Switzerland and the topics of a conversation, such as yoga retreats or wellness weekends. We do not upload any lists of customers or contacts to OpenAI.

When you click one of our ads, OpenAI adds a click reference (oppref) to the address of our page, and we add campaign parameters (utm_source, utm_medium, utm_campaign and utm_content) that name the platform, the campaign and the ad. Google Analytics records the address of the page, including these parameters, with your visit (see “Web analytics”). Our website also keeps the click reference in your browser’s local storage for 30 days.

If, within these 30 days, you continue to the payment of a booking, hold a ticket or book and pay, our server reports this to OpenAI: what you did (payment started, ticket held or booking), the click reference, the time and the page on stilea.ch, and for a payment or a booking also the room, the number of places and the price of the booking. If you hold a ticket, we keep the click reference with it, so that your booking of this ticket can be reported even if you book on another device. This tells us how many people who clicked an ad held a ticket or booked, and what the ads cost per booking.

We do not send names, email addresses, phone numbers or IP addresses to OpenAI, and we do not use OpenAI’s measurement pixel or any other OpenAI script on our website. We ask OpenAI not to use these reports for personalised advertising. OpenAI receives them as an independent controller and, according to its terms, may also use them to provide and improve its products and services. OpenAI does not tell us who clicked an ad: in OpenAI’s ads manager we see how often our ads were shown and clicked, and how many of these clicks led to a payment, a held ticket or a booking. OpenAI processes your use of ChatGPT and your click on the ad under its own privacy policy.

9 Newsletter and “Notify me”

You can join our list (newsletter), or ask us to write to you when reservations for one of the 2027 retreats open (“Notify me”). For this we store:

• Your email address
• The list you joined, or the retreat you want to hear about
• The date and time of your sign-up
• The country from which you signed up, which Cloudflare derives from your IP address. We do not store the IP address itself.

We use this data only to send you news about Stilea retreats, or to tell you when reservations for the retreat you chose open. The data is stored in Cloudflare Workers KV. You can unsubscribe at any time by email to [email protected].

10 Ticket alert

Before the ticket sale for Women’s Alpine Reset opens, you can join our ticket alert. We then let you know by email and by WhatsApp or SMS as soon as tickets are available. For this we store:

• Your first and last name, your email address and your mobile number
• Your consent to be contacted by email and by WhatsApp or SMS about this retreat, with the date and time and the version of the consent text
• Whether and when your mobile number and your email address were verified
• The date and time of your sign-up and of later changes, and the country from which you signed up, which Cloudflare derives from your IP address. We do not store the IP address itself.

Verification. To make sure that the mobile number and the email address are yours, we send a 6-digit code by SMS to your mobile number and then a confirmation link to your email address. The link is valid for 7 days. The SMS code is created and checked by Twilio. We do not see or store it.

Protection against abuse. To limit the number of sign-ups and text messages, we keep a counter per mobile number and per IP address for one hour. The IP address is only kept as a pseudonymised value (a keyed hash), never as the address itself.

Purpose and legal basis. We use this data only to tell you when the ticket sale starts and to send you information about this retreat. The legal basis is your consent (FADP; Art. 6(1)(a) GDPR). You can withdraw it at any time by email to [email protected] or by replying to one of our messages.

Service providers. The data is stored in Cloudflare Workers KV. For the ticket alert we also work with these providers:

• Twilio (Twilio Inc., USA) sends the SMS code and checks it. Twilio receives your mobile number.
• Resend (Plus Five Five, Inc., USA) sends our emails for the ticket alert, starting with the confirmation email. Resend receives your email address and your first name. If we keep our list of contacts with Resend, your first and last name and your email address are also stored there.
• Cloudflare Turnstile (Cloudflare, Inc., USA), if it is active on the form, checks that the form is filled in by a person and not by a bot. For this, Cloudflare processes technical data such as your IP address and information about your browser.
• WhatsApp (Meta): if we write to you on WhatsApp, WhatsApp processes your mobile number and our messages under its own privacy policy.

Notification to our team. When your mobile number is confirmed, we send an email with your name, email address, mobile number, country and the time of your sign-up to our own team mailboxes, so that we can reply to you personally. These mailboxes are hosted by Hostpoint AG in Switzerland and by Google (Google Workspace).

11 Holding a ticket

You can hold a ticket for Women’s Alpine Reset for 48 hours, free of charge and without obligation. For this we store:

• The ticket you choose, your first and last name, your email address and your mobile number
• Whether and when your mobile number was confirmed, when the hold starts and ends, and whether you booked
• The date and time of your hold and the country from which you sent it, which Cloudflare derives from your IP address. We do not store the IP address itself.
• If you came to us through one of our ads in ChatGPT, the click reference of the ad (see section 8)

Verification. We confirm your mobile number with a 6-digit code by SMS, as for the ticket alert. The code is created and checked by Twilio. We do not see or store it. The same counters against abuse apply (see section 10).

Purpose and legal basis. We use this data to hold your ticket, to send you the details with your booking link and one reminder before the hold ends, and to get in touch with you about your booking by email, phone, WhatsApp or SMS. We do not use it for newsletters or other advertising. The legal basis is your request before a possible contract (FADP; Art. 6(1)(b) GDPR).

Service providers. The data is stored in Cloudflare Workers KV. Twilio sends and checks the SMS code and receives your mobile number. Resend sends the email with the details right away and the reminder at its time; until then, Resend keeps the reminder with your first name and email address. When you book and pay, we ask Stripe whether the payment is complete and then cancel the reminder, so that you do not receive it.

Notification to our team. When you hold a ticket, we send an email with your name, email address, mobile number, ticket and the end of the hold to our own team mailboxes, so that we can reply to you personally. These mailboxes are hosted by Hostpoint AG in Switzerland and by Google (Google Workspace).

12 Reservations and bookings

When you reserve a place, we store:

• Your first and last name and your email address
• Your mobile number, if you give it
• The room and payment option you choose, the ticket price, the amount due at booking and the balance
• Your notes, if you write any, for example about dietary needs, injuries or a friend you would like to share a room with
• The date and time of your reservation, the country from which you sent it (derived by Cloudflare from your IP address), the status of your booking and the reference of your payment at Stripe
• If you came to us through one of our ads in ChatGPT, the click reference of the ad (see section 8)

We use this data to handle your booking and payment, to send you invoices and information about the retreat, and to organise the retreat. The data is stored in Cloudflare Workers KV.

Health information. If you tell us about health matters, for example a pregnancy, an injury or a reason to avoid cacao or intensive breathing, we use this information only to prepare and run the retreat safely. Within the retreat team (host and teacher), we share it only as far as needed for this purpose.

13 Payments with Stripe

Online payments are processed by Stripe (Stripe Payments Europe Ltd., Ireland, and Stripe, Inc., USA). You enter your payment details directly on Stripe’s payment page. We do not see your full card details.

So that we can match your payment to your booking, we pass the following data to Stripe: your name, email address and mobile number, the room, the payment option and the amounts, and the click reference if you came through one of our ads in ChatGPT. Your notes stay with us and are not passed to Stripe. Stripe creates a customer record for you and sends you a receipt by email. If you reserve with a deposit, we also use Stripe to send you the invoice for the balance.

Stripe processes this data under its own privacy policy: stripe.com/privacy. If you choose a payment method such as Klarna or Apple Pay, its provider also processes your data under its own privacy policy.

14 Email

Our email address [email protected] is hosted by Hostpoint AG in Switzerland. When you write to us, your message and your contact details are stored there. We use them to answer you and, if you book, to handle your booking.

15 Room booking at the hotel

For the room booking, we pass the names of the guests, the room type and dietary requirements to the Bürgenstock Resort.

16 Photos at the retreat

On Sunday, a photographer takes pictures at the retreat, including a group photo. We use photos in which you can be recognised on Stilea’s website or social media only with your consent. You can object at any time by email to [email protected].

17 Links to Instagram

Our website links to Stilea’s profile on Instagram (@stilea_yoga_retreats). We do not embed any content from Instagram, so Instagram receives no data when you visit our pages. If you follow the link, Instagram (Meta) processes your data under its own privacy policy.

18 Transfers abroad

Some of our providers are based in the USA: Cloudflare, Inc., Stripe, Inc., Twilio Inc., Plus Five Five, Inc. (Resend), Google LLC (Google Workspace, Google Analytics, Google Ads), Meta Platforms, Inc. (ads on Facebook and Instagram) and OpenAI OpCo, LLC (ads in ChatGPT). Personal data is transferred to the USA under the Swiss-US Data Privacy Framework or on the basis of standard contractual clauses.

19 How long we keep your data

• Bookings and accounting: as long as the law requires. Accounting records are kept for 10 years (Art. 958f of the Swiss Code of Obligations).
• Newsletter: until you unsubscribe.
• “Notify me”: until the retreat is published for booking, or earlier if you ask us to delete your data.
• Ticket alert: until we have told you about the ticket sale, at the latest 12 months after your sign-up, or earlier if you withdraw your consent. Confirmation links expire after 7 days, the counters against abuse after one hour.
• Holding a ticket: unconfirmed holds after 2 hours, held tickets 30 days after the hold ends. If you book, we keep your booking as described above.
• Web analytics: Google Analytics deletes data linked to cookies or identifiers after 14 months at the latest. Cloudflare Web Analytics only gives us statistics without data that identifies you.
• Google Ads: the click ID of an ad is kept for up to 90 days. In Google Ads we only see totals.
• Ads on Facebook and Instagram: the campaign parameters are kept in Google Analytics with your visit, as described under web analytics. In Meta’s ads manager we only see totals.
• Ads in ChatGPT: your browser keeps the click reference of the ad for 30 days. If you hold a ticket or book, we keep it with the hold or the booking for as long as we keep these. OpenAI keeps the reports under its own privacy policy.

20 Your rights

You have the following rights:

• Access: you can ask which personal data we hold about you.
• Correction: you can have incorrect data corrected.
• Deletion: you can have your data deleted.
• Objection: you can object to the processing of your data.
• Data portability: you can receive your data in a common electronic format.
• Withdrawal of consent: you can withdraw your consent at any time, with effect for the future.

Where the law requires us to keep data, for example accounting records, we can only delete it after that period.

To exercise your rights, write to [email protected]. You can also lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC, EDÖB, edoeb.admin.ch). Where the GDPR applies, you can also complain to a data protection authority in the EU or EEA.