Why the question got sharper
The revised Federal Act on Data Protection — the nDSG, in force since September 2023 — raised the bar for how Swiss businesses handle personal data. It expects a lawful basis for processing, transparency about what is collected and why, data minimisation, security appropriate to the risk, and real mechanisms for access, correction and erasure. The EU’s GDPR is closely aligned, though the two are not identical.
A campsite sits squarely inside this. You gather names, addresses, dates of birth, vehicle details and identity information — for the booking, for the Meldeschein, for HESTA, for Kurtaxe, and sometimes for marketing. That is a meaningful amount of personal data about a lot of people, and the operator, not the vendor, is the one answerable for it.
Which makes "where is it stored, and who else can reach it" a question worth being able to answer without a phone call to a support desk.
Swiss data centres, with no exceptions
Every byte — the databases, the backups, the file storage — lives in ISO 27001-certified data centres inside Switzerland. Nothing is replicated abroad.
That phrasing is deliberate, because the usual answer in this category has an asterisk on it. There is no US sub-processor holding a copy. There is no EU fallback region that traffic spills into under load. There is no backup bucket quietly sitting in another jurisdiction because it was cheaper. Guest data does not leave the country.
The operating company is domiciled in Switzerland and operates under Swiss jurisdiction, including the nDSG itself — so the legal entity and the data are in the same place, which is not always true of vendors who advertise Swiss hosting.
Encryption in transit and at rest
All traffic runs over TLS 1.3, with HSTS enforced — there is no unencrypted path to your data, including no downgrade path.
Databases and backups are encrypted at rest with AES-256, and backup media is encrypted independently of the live store, so compromising one does not hand over the other. Backups run daily, automatically, with point-in-time recovery and tested restores, retained for 30 days — all inside Switzerland, like everything else.
Card data is a special case and is handled the way it should be: tokenised and processed by a PCI DSS Level 1 provider. Raw card numbers never touch Grondia’s servers at all.
Minimisation, access and the audit log
nFADP compliance is not a document produced once and filed. In Grondia it is expressed in how the product behaves.
Collection is minimised: the fields asked for are the ones a booking and a legal HESTA record require, and optional fields stay optional. Guests can see why each field is being asked for, and marketing consent is separate, explicit and revocable rather than bundled into the booking.
Access is role-based. Reception, finance and owner permissions are distinct, staff see only what their role needs, and every account is individually revocable. And every access to guest data is logged with the user, the timestamp and the action — a complete, tamper-evident trail. If you need to show who looked at what, the answer is a query, not an investigation.
Deletion is enforced, not remembered
Retention is where good intentions usually fail: the law says keep it for a period and then delete it, and in practice nobody deletes anything, because deleting things is a task and tasks get postponed.
Grondia enforces retention automatically. Records are held for the legally required period and then deleted on schedule, without anyone remembering to do it. Guests can request erasure at any time and that right is honoured. Every retention action lands in the same audit log as everything else, so the deletion is provable rather than assumed.