Privacy Policy
Privacy Policy
Effective date: 16-10-2026 Version: 1.0
This Privacy Policy is provided in English as the official version. Any automatically generated translation is provided for convenience only. In the event of inconsistencies, the English version shall prevail.
1 Who we are
Get Lost with Lieke is operated by Lieke Verhoeven in Alpnach, Obwalden, Switzerland. Get Lost with Lieke is responsible for the personal data described in this Privacy Policy.
· Business address: Hostettlistrasse 18a 6055 Alpnach
· Privacy contact email: info@getlostwithlieke.com
· Website: www.getlostwithlieke.com
2 Scope of this Privacy Policy
This Privacy Policy explains how we collect, use, store and share personal data when you:
· visit or interact with our website;
· ask for information or request a quotation;
· book or participate in a guided day hike or multi-day trip;
· purchase travel-planning services or digital guides;
· participate in an online travel-planning or consultancy call;
· complete a participant, safety or dietary questionnaire;
· communicate with us by email, telephone, contact form or WhatsApp; or
· subscribe to marketing e-mails or provide separate permission for photographs or videos.
Third-party websites and services have their own privacy notices. This Privacy Policy does not control how those third parties use personal data for their own purposes.
3 Data we collect
3.1 Contact and identification data
We may collect your name, postal address, country of residence, email address, telephone number, preferred language and, where needed, the names and ages of other participants in your booking.
3.2 Booking and service data
We may collect booking details, selected services, dates, group composition, travel preferences, experience level, accommodation and dietary requirements, correspondence, changes, cancellations, complaints and information necessary to deliver a customised itinerary or digital product.
3.3 Health and safety data
For guided activities, we may ask for limited information about fitness, hiking experience, relevant medical conditions, allergies, medication, mobility limitations and an emergency contact. Health data is sensitive personal data. We request only information that is reasonably necessary to assess and manage participant safety or provide an agreed service.
3.4 Payment and transaction data
Payments are processed through Stripe. We normally receive confirmation of payment, the amount, currency, transaction reference and limited payment-method details. We do not intend to receive or store complete payment-card numbers.
3.5 Communications and content
We process messages, emails, call notes, feedback and other content you send to us. If you voluntarily provide a review, photograph or video, we process it for the purpose agreed with you.
3.6 Website and device data
When you use the website, our hosting and security providers may process IP address, device and browser information, access time, referring page, requested pages, cookie identifiers and technical logs. Optional analytics or advertising tools will only be activated and described when configured and, where required, after consent.
4 Where the data comes from
We usually receive personal data directly from you. We may also receive it from:
· the person who makes a booking on behalf of a group;
· another participant, parent or legal guardian;
· payment providers that confirm or reject a transaction; and
· our website, hosting and security systems when you use the website.
If you provide personal data about another person, you must be authorised to do so and should make this Privacy Policy available to that person.
5 Why and on what basis we use data
We process personal data in accordance with the Swiss Federal Act on Data Protection. Where the EU or UK General Data Protection Regulation applies, the legal bases shown below apply.
Activity
Purpos
GDPR basis where applicable
Enquiries and quotations
Respond, discuss requirements, prepare proposals and take steps before a contract
Pre-contract steps; legitimate interests
Bookings and services
Confirm, manage and deliver hikes, trips, planning services and digital products
Contract performance
Safety and emergencies
Assess suitability, plan reasonable precautions and respond to incidents
Explicit consent for health data; vital interests only in a genuine emergency where applicable
Payments and accounts
Process payments, refunds, invoices and accounting records
Contract; legal obligation
Service improvement and security
Maintain the website, prevent abuse, troubleshoot and improve operations
Legitimate interests; consent for optional cookies where required
Marketing
Send requested updates or similar offers where legally permitted
Consent or permitted legitimate interests; right to opt out
Legal matters
Meet legal duties and establish, exercise or defend claims
Legal obligation; legitimate interests
Our legitimate interests include operating a safe and reliable travel business, responding to customers, protecting our systems, preventing fraud and maintaining business records. We consider the impact on your rights before relying on these interests.
6 Health fitness dietary and emergency information
Information relevant to a participant's health or physical ability may be necessary for safe route, pace and group decisions. We use this information only for activity preparation, participant safety, dietary arrangements and emergency response.
· We request express consent before routinely processing health data where consent is required.
· We limit access to Lieke Verhoeven and, where necessary, an assigned guide or relevant supplier.
· We share only the minimum needed. For example, an accommodation may receive a dietary or allergy requirement without receiving unrelated medical history.
· Health information should not be posted in participant WhatsApp groups. It should be provided through the designated private intake channel.
· If necessary safety information is not provided, we may be unable to confirm participation or may need to adjust the service.
You may withdraw consent for future processing. Withdrawal does not affect processing that was lawful before withdrawal and may affect our ability to provide a guided activity safely.
7 Who receives personal data
We do not sell personal data. We may disclose limited personal data to the following recipients when necessary for the stated purposes:
Recipient
Reason for access
Typical role
Hostinger
Website hosting, forms, email or website infrastructure, depending on the services configured
Service provider / processor
Stripe
Payment processing, transaction confirmation, refunds and fraud prevention
Payment provider; may act as processor or independent controller for parts of its service
Microsoft Teams
Providing online travel- planning and consultancy calls
Communication and video-conferencing provider
WhatsApp or WhatsApp Business
Customer communication when you choose or agree to use this channel
Communication provider
Hotels huts and activity suppliers
Reservations, dietary arrangements and delivery of booked travel services
Supplier; may be an independent controller
Additional guides or contractors
Delivery of the booked activity and necessary safety planning
Authorised service provider
Professional advisers and insurers
Legal, accounting, insurance, incident or claim handling
Professional recipient
Public authorities
Compliance with valid legal duties, orders or emergency requests
Legally authorised recipient
Each accommodation, payment provider, communication platform or other independent provider may also process data under its own privacy notice.
8 Payments through Stripe
We use Stripe for payment, analytics, and other business services. Stripe collects identifying information about the devices that connect to its services. Stripe uses this information to operate and improve the services it provides to us, including for fraud detection. You can learn more about Stripe and read its privacy policy at https://stripe.com/privacy.[LV3]
9 Website hosting forms and cookies
Our website is hosted by Hostinger. Website content and technical data may be stored and delivered through Hostinger’s hosting and content-delivery infrastructure, including servers located in the European Economic Area and other countries where Hostinger operates.
Contact-form data is processed by our website and hosting providers for the purpose of responding to enquiries. Where personal data is transferred outside the European Economic Area, we rely on an applicable GDPR transfer mechanism, such as an adequacy decision or Standard Contractual Clauses, and apply appropriate safeguards.[LV4]
The website may use essential cookies required for security, preferences, booking or checkout. Optional analytics and advertising cookies will not be activated unless they are added to the website and the required consent mechanism is in place. Current cookie details should be available through the website's cookie settings or cookie notice.
10 Communication through WhatsApp
If you communicate with us through WhatsApp, your telephone number, profile information, message metadata and message content are processed through WhatsApp's systems. Personal messages are described by WhatsApp as end-to-end encrypted, but WhatsApp and Meta process other account and usage information under their own privacy terms. You may always request communication by email instead.
Participant groups are optional. Group members can normally see other members' names, telephone numbers, profile pictures and messages. We will obtain agreement before adding you to a group and will not use the group for confidential health information.
11 Online consultancy calls
I may conduct travel-planning and consultancy calls using Microsoft Teams. When you participate in an online call, the platform provider may process information such as your name, email address, IP address, device information and meeting metadata.
I may keep written notes from the call where necessary to prepare or deliver the requested service. These notes are treated as part of your customer record and are not shared with third parties unless this is necessary to provide the agreed service or comply with a legal obligation.
Online calls are not recorded. If I ever wish to record a call, I will inform you in advance, explain the purpose and request your explicit consent
12 International data transfers
Get Lost with Lieke is based in Switzerland, but some service providers may process personal data in the European Economic Area, the United Kingdom, the United States or other countries in which they or their subcontractors operate.
Where personal data is transferred to a country without legally recognised adequate protection, we use or require an available safeguard, such as recognised standard contractual clauses, a recognised data privacy framework certification or another lawful mechanism. The exact countries and safeguards depend on the provider and account configuration. You may contact us for further information about a relevant transfer.
13 How long we keep data
We retain personal data only for as long as reasonably necessary for the stated purpose, legal duties, accounting requirements and the establishment or defence of legal claims. The following periods are the intended starting points and may be extended where an incident, dispute or legal hold applies:
Record
Retention period
Enquiries not resulting in a booking
Up to 12 months after the enquiry is closed
Contracts invoices payments and core booking records
Generally 10 years where required for accounting tax or legal records
Routine participant health and safety intake
Target: delete or anonymise within 90 days after the activity if no incident or dispute occurred
Emergency contact details
Target: delete within 30 days after the activity if no incident occurred
Incident and claim records
Until the matter and applicable legal retention or limitation period have ended
Marketing records
Until consent is withdrawn or you object; limited suppression data may be retained to respect the opt-out
Website security logs
For the period configured with the hosting provider and no longer than reasonably necessary for security
Photographs and testimonials
For the agreed use period or until consent is withdrawn for future use[LV5]
14 Photographs videos reviews and testimonials
We do not rely on acceptance of general booking terms as permission to use an identifiable participant's image for marketing. We request separate permission and explain the intended channels and use. You may withdraw permission for future use by contacting us. Withdrawal does not automatically make earlier lawful use unlawful, but we will take reasonable steps regarding content on channels we control.
15 Marketing communications
We send marketing emails only when you have requested them or when another legal permission applies. Every marketing email will provide a simple way to unsubscribe. Service messages about an existing booking are not marketing and may still be sent when needed to perform the contract.
16 Data security
We use reasonable technical and organisational measures appropriate to the nature of the data and the size of the business. These measures include limiting access, using reputable service providers, protecting accounts and devices, and separating short-lived safety information from records that must be retained. No online service can guarantee absolute security.
17 Your rights
Subject to applicable law and relevant exceptions, you may ask us to:
· confirm whether we process your personal data and provide access to it;
· correct inaccurate or incomplete data;
· delete personal data that is no longer needed;
· restrict or object to certain processing;
· provide certain data in a portable format;
· withdraw consent for future processing; and
· explain relevant safeguards for an international transfer.
To exercise a right, contact us using the details in section 1. We may ask for information needed to verify your identity. Rights are not absolute, and we may need to retain information to meet legal obligations or protect legal claims.
You may also contact the Swiss Federal Data Protection and Information Commissioner. If the GDPR applies, you may lodge a complaint with the competent supervisory authority in the country where you live or work.
18 Automated decisions
We do not currently make decisions based solely on automated processing that produce legal or similarly significant effects for customers. Payment providers may independently use automated systems to prevent fraud or comply with financial rules.
19 Children and young participants
Our services are not intended to be booked independently by children. When a minor participates, booking and safety information should be provided by a parent, guardian or authorised adult. Any consent required for a minor's health information or image must be provided by the appropriate adult.
20 Changes to this Privacy Policy
We may update this Privacy Policy when our services, providers or legal obligations change. The latest version will be published on the website with its effective date. Material changes will be highlighted where appropriate.
21 Contact
Questions or requests concerning personal data can be sent to:
· Lieke Verhoeven, Get Lost with Lieke
· Hostettlistrasse 18a 6055 Alpnach Dorf, Switzerland
Suggested health data consent text
I expressly consent to Get Lost with Lieke processing the health, fitness, allergy and medication information I provide for participant assessment, activity preparation, safety management and emergency response. I understand that relevant information may be shared only with the assigned guide or supplier when necessary for these purposes. I may withdraw consent for future processing, but this may mean that my participation cannot be confirmed or safely continued.[LV6]
[LV1]At the moment I am they only one behind GLWL, however I can imagine that i will expand in the future. Should I keep the entire policy in we-form other would you suggest to write it in I-form.
[LV2]Do I need to incude bookings via external website i.e. getyourguide or airbnb. This would be only applicable for day hikes
[LV3]Text provided by Stripe
[LV4]Text provided by Hostinger
[LV5]Are all mentioned retention periods correct and/or is anything missing?
[LV6]Is this needed to have the consent separately when it’s already written in the privacy statement?
