Privacy policy

The Schloss Thun Foundation (hereinafter “we” or “Schloss Thun”) takes the protection of your personal data seriously. This privacy policy informs you about which personal data we process when you use our website schlossthun.ch and in the course of our services, for what purposes we do so, and what rights you have. The Swiss Federal Act on Data Protection (FADP) applies.

1. Controller

The controller responsible for the processing of personal data within the meaning of the FADP is:

Stiftung Schloss Thun (Schloss Thun Foundation)
Schlossberg 1, 3600 Thun, Switzerland
E-mail: info@schlossthun.ch
Telephone: +41 33 223 20 01

For questions about data protection and to exercise your rights, you may contact the above address at any time.

2. Principles of data processing

We process personal data in good faith, lawfully and proportionately. We collect personal data only for the purposes stated in this policy, process it only to the extent necessary for those purposes, and retain it only for as long as necessary. We take appropriate technical and organisational measures to protect your data.

3. What data we process

3.1 Data you provide to us

When you contact us or use our services, we process the data you provide, in particular in connection with:

• enquiries via the contact form or by e-mail;
• reservations and bookings of guided tours and the hire of rooms (e.g. the Knights’ Hall);
• orders and customer accounts in the online shop (see section 7);
• newsletter sign-up;
• participation in competitions or surveys.

Depending on the transaction, this includes details such as name, address, e-mail address, telephone number and other information required for processing.

3.2 Data processed automatically when you visit the website

When you access our website, our hosting provider (cyon GmbH, Basel) records data in server log files for technical reasons, namely the IP address, date and time of access, the page accessed, the browser and operating system used, and the previously visited page (referrer). This processing serves the secure and stable operation of the website.

4. Cookies

Our website uses cookies and similar technologies. Technically necessary cookies are required for the operation of the website. For audience measurement and statistics under section 5, in particular Google Analytics, further cookies are stored on your device when you access the website. You can object to this processing at any time by blocking or deleting cookies in your browser or by installing the Google Analytics opt-out browser add-on (tools.google.com/dlpage/gaoptout). The website remains fully usable. In the online shop (shop.schlossthun.ch), Google reCAPTCHA additionally sets a cookie used to distinguish humans from automated programs (see section 7).

5. Audience measurement and analytics

We use services to analyse the use of our website, which you can object to as described in section 4. Usage data – including the (full or truncated) IP address – may be transmitted to the respective providers:

• Google Analytics and Google Search Console, integrated via “Site Kit” (Google Ireland Limited; Google LLC, USA) – to analyse usage, reach and findability;
• Microsoft Clarity (Microsoft Ireland Operations Ltd., Ireland; Microsoft Corporation, USA) – heatmaps and recordings of user sessions to improve the website; entries in form fields are masked. In addition, the website transmits logs of page requests (IP address, browser identifier, requested address) to Microsoft Clarity so that automated access such as search and AI crawlers can be distinguished from visits;
• Jetpack (Automattic Inc., USA) – usage statistics and delivery of images via a content delivery network.

6. Contact, forms and newsletter

For forms on our website we use a form tool; to protect against spam we use filtering services (including Akismet, Automattic Inc., USA). We use the information submitted via forms to deal with your request.

For the newsletter we use the data provided at sign-up (in particular the e-mail address). Sign-up is by single opt-in. Dispatch is via SendGrid (Twilio Inc., USA). To improve our offering, we may evaluate the use of the newsletter (e.g. open and click rates). You can unsubscribe from the newsletter at any time via the unsubscribe link.

7. Tickets and reservations / online shop

For ticket purchases and, in part, for reservations we use a separate online shop (shop.schlossthun.ch, provider ntree). When you use it, the provider’s privacy terms apply in addition.

7.1 Protection against spam and abuse (Google reCAPTCHA)

To protect the forms in the online shop (e.g. order, customer account, contact, newsletter) against automated entries by bots, we use the Google reCAPTCHA service in the online shop (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Google LLC, USA). reCAPTCHA checks whether an entry is made by a human or by an automated program. For this purpose, when a protected form is opened, data is transmitted to Google, namely the IP address, information about the browser and device, the page accessed, the date and time of access and information about user behaviour (e.g. mouse movements and time spent); a cookie (“_GRECAPTCHA”) is also set. Where necessary, you will be asked to tick the “I’m not a robot” box or to solve a small task.

This processing serves our overriding interest in the secure and stable operation of the online shop and in preventing spam and abuse. Google processes this data as a processor in accordance with the Google Cloud data processing terms; data may be transferred to the USA in the process (see section 12). Further information can be found in Google’s privacy policy (policies.google.com/privacy) and Google’s terms of service (policies.google.com/terms).

8. Social media and embedded content

We are present on social networks (Facebook, Instagram, X/Twitter, YouTube) and embed some content (e.g. feeds or videos); we also link to review platforms such as TripAdvisor. When embedded content is accessed, data may be transmitted to the respective providers (in particular Meta, X and Google/YouTube). Their privacy terms apply in addition.

9. Maps

On the “Getting here & site map” page we embed a map based on OpenStreetMap. Your IP address may be transmitted to the map service.

10. Video surveillance

To protect our visitors, our staff, the collection and the building, we operate video surveillance in the castle and in the castle courtyard. The monitored areas are marked with signs. The recordings are used solely for this purpose; they are reviewed only in the event of a specific incident (e.g. theft, damage to property, accident) and, in such a case, passed on to the police or insurers where necessary. Access to the recordings is restricted to a small number of authorised persons. The recordings are deleted as soon as they are no longer needed for this purpose.

11. Disclosure to third parties and processors

We disclose personal data only to the extent necessary to fulfil the stated purposes, where you have consented, or where we are legally or officially required to do so. Service providers we engage (e.g. hosting, newsletter and e-mail dispatch, analytics) process personal data as processors in accordance with our instructions and are bound to comply with data protection requirements.

12. Disclosure abroad

Some service providers are based abroad, in particular in the USA (e.g. Google [Analytics, reCAPTCHA], Automattic, Twilio/SendGrid, Microsoft). Personal data is disclosed abroad only if adequate data protection is ensured – for example on the basis of a recognised adequacy decision (e.g. the Swiss-U.S. Data Privacy Framework for certified US companies) or standard contractual clauses –, on the basis of your consent, or on another legal basis under Art. 16 et seq. FADP.

13. Retention and deletion

We retain personal data only for as long as necessary for the respective purposes or as required by statutory retention obligations. The data is then deleted or anonymised.

14. Data security

Data is transmitted between your browser and our servers in encrypted form using the HTTPS/TLS protocol. We take appropriate technical and organisational security measures to protect your data against loss, misuse and unauthorised access.

15. Your rights

Under the applicable data protection law you have, in particular, the following rights:

• access to the personal data we process about you;
• rectification of inaccurate data;
• deletion or destruction of data;
• restriction of processing and objection to processing;
• receipt or transfer of your data (data portability);
• withdrawal of consent given, with effect for the future.

To exercise your rights, simply send a message to info@schlossthun.ch. We may request additional information to verify your identity.

16. Supervisory authority

You have the right to lodge a complaint or report with the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, Switzerland.

17. No automated individual decision-making

We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you.

18. Changes to this privacy policy

We may amend this privacy policy at any time. The version published on our website applies.

Last updated: November 2026