Privacy.

In short

We process your data sparingly, for specific purposes and transparently. We do not sell data and do not pass anything on to uninvolved third parties. In the EU, the EEA and the United Kingdom, we load optional cookies and external media only after your consent. This policy is based on the Swiss Data Protection Act (DSG) and, where applicable, the GDPR.

Last updated: 09/2026

Controller

The controller responsible for data processing on this website is:

You can reach us at this email address for all questions about data protection, for access requests and for withdrawing consent. We have not appointed a data protection officer because the legal requirements for doing so do not apply to us.

What data we process

Server log files

When you visit this website, technically necessary data is logged: truncated IP address, date and time, page accessed, status code, amount of data transferred, referrer and browser identifier. This processing is required for secure and stable operation and is based on our overriding legitimate interest (Art. 31 DSG, Art. 6(1)(f) GDPR).

Contacting us

If you write to us or call us, we process your name, your contact details and the content of your enquiry in order to respond to it (Art. 6(1)(b) or (f) GDPR).

Appointment booking and customer management (CRM)

If you book an appointment via our booking system, we process your name, email address, telephone number, preferred location, appointment time and your notes. This data flows into our own customer management system (CRM), which is operated on the same platform. There, we assign the booking to the responsible team member and to your guest profile so that we can welcome you well prepared at your appointment, plan follow-up appointments and issue invoices. The legal basis is the performance of a contract or the implementation of pre-contractual measures (Art. 6(1)(b) GDPR) as well as our legitimate interest in orderly guest care.

For online appointments, the meeting is conducted via Microsoft Teams; for this purpose, a calendar invitation is created via Microsoft 365 (Microsoft Privacy Statement). No data is passed on to uninvolved third parties.

Health-related information

If you voluntarily provide us with information about how you are feeling or with measurement values before or during a session, we treat this as particularly sensitive personal data (Art. 5(c) DSG) or as special categories of personal data (Art. 9 GDPR). We process it exclusively on the basis of your explicit consent and only to tailor your guidance accordingly. You can withdraw this consent at any time.

Retention periods

We store data only for as long as is necessary for the respective purpose or as required by law:

• Server log files: 14 days, then automatic deletion. In the event of a security-relevant incident, until that incident has been resolved.
• Contact enquiries: 12 months after the last contact, provided no contractual relationship arises from it.
• Booking and customer data (CRM): for the duration of the guest relationship and thereafter for as long as warranty or limitation periods are running.
• Invoice and accounting records: 10 years (Art. 958f of the Swiss Code of Obligations, statutory retention obligation).
• Health-related information: until you withdraw your consent, and at the latest at the end of the guest relationship.
• Consent cookie mp_consent: 180 days; after that, we ask for your selection again.
• Analytics cookies: depending on the cookie, up to 24 months, provided you have consented to analytics.

Cookies and the cookie banner

Cookies are small text files that store your website settings on your device. We distinguish three categories:

• Necessary: required for the operation of the site, including the cookie mp_consent, which stores your own cookie selection. This category cannot be switched off.
• Analytics: helps us understand how the site is used. Optional.
• External media: videos and maps from third-party providers (YouTube, Google Maps). Optional.

Our cookie banner appears on your first visit. Your selection applies to all optional categories and is stored exclusively in a first-party cookie on your device. You can change or withdraw it at any time on the Cookie Settings page; the withdrawal takes effect from the time of the change and does not affect the lawfulness of the processing carried out until then.

Opt-in or opt-out, depending on your region

Which regime applies depends on where you access the site from:

• Opt-in (EU, EEA, United Kingdom): Optional cookies and external media are only set or loaded after you have explicitly consented. Until then, everything optional remains off.
• Opt-out (Switzerland and other countries): Optional cookies are active until you object. We point this out with a banner, and you can switch them off at any time with one click.

Which regime applies depends on the country you are in. To determine it, the site queries its own endpoint on our server (/api/geo/consent). This endpoint assigns your IP address to a country using a locally installed geo database and responds exclusively with the country code, such as "CH". No coordinates, no location and no IP address are stored, logged or transmitted to third parties; the query takes place exclusively on our own server. If the endpoint is unavailable or your IP address cannot be assigned to a country, we derive the country from your browser's time zone instead. If that also yields no result, we apply the stricter opt-in regime. The legal basis for this assignment is our legitimate interest in showing you the legally applicable consent variant (Art. 31 DSG, Art. 6(1)(f) GDPR).

If you have already made a selection, your decision always applies. It is then no longer overridden by the country-based default.

Analytics and reach measurement

If you have consented to the Analytics category, we use Google Analytics 4 to analyse usage behaviour. The analytics script is only loaded after your consent; no transmission takes place before that. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Data may be transferred to the USA in the process; Google relies on the standard contractual clauses of the EU Commission for this and is certified under the EU-US Data Privacy Framework. The legal basis is your consent (Art. 6(1)(a) GDPR, Art. 31 DSG). Google Privacy Policy

Location suggestion based on your IP address

So that we can suggest the location nearest to you, we determine an approximate geographic region from your IP address (usually accurate to the level of a city or canton). This happens exclusively on our own server using a locally stored database. No third-party service is called, your IP address does not leave our server, and we do not request location access from your browser or device.

Your IP address and the result of the lookup are processed only in memory for the duration of the page visit and are neither stored nor linked to you as a person or to a profile. The result is purely a display aid: you still choose your location yourself. The legal basis is our legitimate interest in presenting our offering in an understandable way (Art. 6(1)(f) GDPR, Art. 31 DSG). The assignment is approximate and can be significantly off, for example on mobile networks or via VPN.

External media: YouTube and Google Maps

We embed videos and maps via a preview. Only when you click a preview or generally allow external media is the content loaded from the provider. In doing so, the provider learns your IP address and further technical data about your device. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; for YouTube we use the youtube-nocookie.com variant. The legal basis is your consent (Art. 6(1)(a) GDPR). Without your consent, no content is loaded from Google. Google Privacy Policy

Hosting and processors

This website and the platform behind it are hosted at lima-city. lima-city is a service of:

TrafficPlex GmbH acts as a processor on our behalf (Art. 9 DSG, Art. 28 GDPR). It processes data exclusively according to our instructions and on the basis of a data processing agreement. The servers are located in Germany, i.e. within the EEA.

We use further processors for appointment confirmations by email and for online appointments (Microsoft Ireland Operations Limited for Microsoft 365 and Teams). We will provide you with a complete, up-to-date list of our processors on request.

Disclosure abroad

As a rule, your data is processed in Switzerland and in the EEA. Where data reaches countries without an adequate level of data protection, such as the USA, we rely on the standard contractual clauses of the EU Commission in conjunction with the requirements of the Swiss Federal Data Protection and Information Commissioner (FDPIC) or on your explicit consent.

Your rights

Under the Swiss Data Protection Act (DSG) and, where applicable, the GDPR, you have the following rights:

• Access: You can find out whether and what data we process about you (Art. 25 DSG, Art. 15 GDPR).
• Rectification: We will correct inaccurate data when you point it out to us (Art. 32 DSG, Art. 16 GDPR).
• Erasure and the right to be forgotten: You can request the deletion of your data as soon as the purpose no longer applies, you have withdrawn consent or the processing was unlawful. We then also delete from our backups as soon as they are routinely overwritten. We cannot delete data that is subject to a statutory retention obligation, such as invoice records; instead, we block such data from further use (Art. 32 DSG, Art. 17 GDPR).
• Restriction of processing: You can request that we merely store data for the time being (Art. 18 GDPR).
• Data portability: You will receive the data you have given us in a common electronic format (Art. 28 DSG, Art. 20 GDPR).
• Objection: You can object to processing that we base on a legitimate interest (Art. 30 DSG, Art. 21 GDPR).
• Withdrawal of consent: You can withdraw consent you have given at any time with effect for the future, without suffering any disadvantage as a result.

Simply write to us at hello@magic-places.com. We usually respond within 30 days. To protect your data, we may verify your identity before providing access or deleting data.

Right to lodge a complaint

If you do not agree with our response, you can contact a supervisory authority. In Switzerland, this is the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern. Within the EU, you can contact the data protection authority of your country of residence (Art. 77 GDPR).

Data security

This website is transmitted encrypted via TLS. Access to booking and customer data is restricted on a role basis: each team member sees only the data they need for their task. Access to guest data is logged.

Automated decision-making

No automated decision-making, including profiling, that produces legal effects concerning you takes place.

Changes to this policy

We adapt this privacy policy when our offerings or the legal situation change. The version published here applies in each case.