CampOne GmbH, Grondia
Annex 5 to the Order Form
1. Purpose and scope
1.1 This Acceptable Use Policy (“AUP”) applies to every use of the Grondia services provided by CampOne GmbH (“Grondia”), including the property management system, the booking engine, Hosted Websites, the POS, the self check-in kiosk, Grondia Pay, the channel manager and AI Features (together the “Services”). Grondia is a brand of CampOne GmbH. Capitalised terms not defined here have the meaning given in the Grondia General Terms of Service (the “General Terms”).
1.2 This AUP binds the Customer. The Customer ensures that its staff, contractors, agencies and anyone else to whom it gives access to the Services (“Users”) comply with it.
1.3 “Customer Content” has the meaning given in the General Terms. In this AUP it also includes reviews, documents and messages that the Customer or its Users send to Guests through the Services.
1.4 This AUP is part of Grondia’s terms and conditions for the purposes of Art. 14 of the EU Digital Services Act (Regulation (EU) 2022/2065, “DSA”). Grondia publishes it on its website in a machine-readable format.
2. General use of the Services
2.1 The Customer and its Users must not:
(a) use the Services in breach of applicable law or of the rights of others;
(b) use the Services for any business other than the campground and accommodation business named in the Order Form, or let third parties use them, unless the Order Form allows it;
(c) resell, sublicense or otherwise provide the Services to third parties without Grondia’s written consent;
(d) copy, modify, decompile or reverse engineer the software, except to the extent mandatory law allows it;
(e) circumvent access controls, usage limits or rate limits, or access the Services by automated means other than the interfaces Grondia documents for that purpose;
(f) put an unreasonable load on the Services, including by load tests or bulk requests without Grondia’s prior consent;
(g) upload or transmit malware, or use the Services to attack any system;
(h) share login credentials, use another person’s account, or keep accounts of former staff active;
(i) use the Services to build a competing product, or copy features, designs or documentation for that purpose; or
(j) give false information about the Customer’s identity, legal form, ownership or business, including during onboarding for Grondia Pay.
2.2 The Customer must use multi-factor authentication where Grondia offers it, and must tell Grondia without delay if it suspects that an account has been compromised.
3. Security testing
3.1 The Customer and its Users must not, without Grondia’s prior written consent:
(a) run penetration tests, vulnerability scans or other security tests against the Services or Grondia’s infrastructure;
(b) run denial-of-service or load tests;
(c) try to access data of other customers or to escalate privileges; or
(d) use social engineering against Grondia staff or vendors.
3.2 No penetration testing unless agreed in writing. Penetration tests and other security tests by or for the Customer are permitted only if Grondia has agreed to them in writing beforehand. Grondia is not obliged to agree. Where Grondia agrees, the written agreement sets out the scope, timing, test accounts, testers and the handling of results before any test starts. The Customer bears the cost of the test, and the results are Grondia’s Confidential Information.
3.3 Reporting vulnerabilities. Anyone who finds a vulnerability reports it to hello@grondia.com with enough detail to reproduce it, and gives Grondia reasonable time to fix it before disclosing it.
4. Content on Hosted Websites and Booking Pages
4.1 Responsibility. The Customer is responsible for all Customer Content, including content on Hosted Websites and Booking Pages. Grondia does not check Customer Content before publication. Grondia may store, copy, adapt (for example resize images) and display Customer Content to the extent needed to provide the Services.
4.2 Prohibited content. Customer Content must not:
(a) be illegal under the law of Switzerland, the European Union or a member state, or the law of any other country where it is targeted;
(b) infringe copyright, trademarks, design rights, personality rights or other rights of third parties, including photos, maps, fonts and texts taken from other websites without a licence;
(c) contain or link to child sexual abuse material, terrorist content, content inciting violence or hatred, or content that glorifies violence;
(d) be defamatory, threatening or harassing;
(e) contain malware, phishing pages or deceptive redirects;
(f) publish personal data of Guests, staff or other people without a legal basis, including photos or names of Guests without consent;
(g) contain fake, purchased or manipulated reviews or ratings, or present reviews as verified without having taken reasonable steps to check that they come from real Guests;
(h) claim classifications, star ratings, quality labels, awards, memberships or certifications that the Customer does not hold; or
(i) advertise or sell goods or services that the Customer may not lawfully offer.
4.3 Consumer law on Booking Pages. The Customer is the provider of the accommodation and contracts with its Guests. The Customer is responsible for ensuring that its offers, prices and booking terms on Hosted Websites and Booking Pages comply with consumer law and price indication law where its Guests are located. In particular, the Customer:
(a) configures prices so that the price shown is the total price including mandatory taxes, tourist taxes and mandatory fees, as far as the applicable law requires;
(b) provides its own legal notice (imprint), booking terms, cancellation terms and privacy notice, and uses any templates that Grondia provides only as a starting point;
(c) states clearly the main characteristics of each offer, including what is included and what costs extra; and
(d) keeps availability, prices and descriptions accurate and up to date.
Grondia provides the technical functions for this but does not review the Customer’s offers.
4.4 Cookies and tracking. If the Customer adds analytics, advertising or other tracking tools to a Hosted Website or Booking Page, the Customer is responsible for having a legal basis and for configuring consent where required. Grondia may refuse or remove scripts that create a security risk.
4.5 Domain names. The Customer must have the right to use every domain name it connects to the Services.
5. Messages to Guests
5.1 The Services allow the Customer to send messages to Guests, such as booking confirmations, pre-arrival information, payment requests, review requests and newsletters. The Customer is the sender and is responsible for every message.
5.2 Service messages. The Customer may send messages that are needed to perform the booking (confirmations, arrival information, invoices, payment requests). These must not contain advertising beyond a brief, incidental reference.
5.3 Marketing messages. The Customer sends advertising by email, SMS or messaging services only:
(a) to recipients who have given prior consent; or
(b) to its own Guests, using contact details obtained in connection with a booking, to promote its own similar services, where the Guest was clearly told at collection that they can object at any time free of charge, has not objected, and is reminded of that right in every message.
This summarises the rules in Switzerland (Art. 3 para. 1 let. o of the Federal Act against Unfair Competition, UWG), the European Union (Directive 2002/58/EC, Art. 13(1) and (2)) and Germany (§ 7 para. 2 no. 2 and para. 3 UWG). Local law may be stricter and then prevails.
5.4 Every marketing message must name the Customer as sender, contain a working unsubscribe link, and must not hide or misstate its commercial nature. The Customer must honour unsubscribe requests without delay. Grondia’s suppression list blocks further marketing to unsubscribed addresses, and the Customer must not work around it.
5.5 The Customer must not import or use purchased, rented or scraped address lists, and must not send messages to addresses obtained without a legal basis.
5.6 Review requests must not offer incentives for positive reviews only, and must not be sent to people who have not stayed with the Customer.
5.7 Protecting deliverability. Messages are sent through infrastructure that Grondia shares across customers. Grondia may set sending limits and may pause a Customer’s messaging if complaint, bounce or spam rates threaten the deliverability of other customers’ messages. Grondia tells the Customer and helps restore sending once the cause is fixed.
5.8 Identity documents and registration data. Data collected for guest registration, police reporting, tourist tax or at the self check-in kiosk may be used only for those purposes and to perform the booking. It must not be used for marketing.
6. AI Features
6.1 When the Customer uses AI Features, it must not:
(a) disable or hide the notices that tell Guests that they are dealing with an AI system or that content was generated by AI, where Grondia provides such notices;
(b) use AI output to make decisions with legal or similarly significant effects on Guests or staff without review by a person;
(c) enter special categories of personal data or identity document data into AI Features unless the feature is designed for it;
(d) try to extract system prompts, bypass safety measures or make the feature produce illegal content; or
(e) publish AI-generated content without checking that it is accurate and lawful.
6.2 Phone recording and AI voice features may only be used with the notices and consent steps that Grondia builds into them.
7. Grondia Pay
7.1 This section 7 applies where the Customer uses Grondia Pay. Grondia Pay may be used only for payments by the Customer’s Guests for the Customer’s own accommodation and directly related goods and services, in the Customer’s own name.
7.2 The Customer must not use Grondia Pay:
(a) for a business or product that the Grondia Pay Terms, the payment service provider or the card schemes prohibit;
(b) to accept payments on behalf of third parties, to process payments for other businesses, or to disguise the nature of a transaction;
(c) to split a transaction to avoid limits, or to offer cash advances or cash back;
(d) to charge a stored card except as the Guest agreed when the card was stored; or
(e) in breach of the Grondia Pay Terms, card scheme rules or applicable law, including sanctions law.
7.3 Grondia may suspend Grondia Pay under the Grondia Pay Terms. The payment service provider may restrict the Customer’s account with the payment service provider under its own terms.
8. Sanctions
The Customer must not use the Services in, or for the benefit of a person in, a country or territory subject to comprehensive sanctions, or for or with a person on a sanctions list that applies to Grondia, the Customer or the payment service provider.
9. Reporting illegal content (notice and action)
9.1 How to report. Anyone may report content on a Hosted Website or Booking Page that they consider illegal by email to hello@grondia.com. Notices are accepted electronically only.
9.2 What a notice should contain. To allow Grondia to act, a notice should contain:
(a) an explanation of why the content is considered illegal;
(b) the exact location of the content, such as the URL;
(c) the name and email address of the person or entity reporting, except for reports of child sexual abuse material; and
(d) a statement that the information and allegations in the notice are accurate and complete to the best of the reporter’s knowledge.
9.3 What Grondia does. Grondia confirms receipt without undue delay where the notice gives contact details. A trained member of Grondia’s staff reviews each notice in a timely, diligent, non-arbitrary and objective manner and decides what to do. Grondia does not currently use automated tools to detect or decide on content; if it introduces such tools, it will say so in this AUP and in its notifications. Grondia informs the reporter of its decision and of the available redress without undue delay.
9.4 Customer cooperation. Grondia may forward a notice to the Customer, without the reporter’s identity unless it is needed, and ask the Customer to respond or remove the content within a set time. The Customer responds within that time.
9.5 Threats to life or safety. If Grondia becomes aware of information giving rise to a suspicion that a criminal offence involving a threat to the life or safety of persons has taken place, is taking place or is likely to take place, it informs the competent law enforcement or judicial authorities and gives them the relevant information available (DSA Art. 18).
9.6 Orders from authorities. Grondia complies with valid orders to act against illegal content or to provide information, and informs the Customer where the law allows.
10. Enforcement
10.1 Proportionate measures. If Customer Content or the Customer’s use of the Services breaches this AUP, Grondia may take the measures below. Grondia chooses the least severe measure that is effective, taking into account the seriousness of the breach, whether it is repeated, the impact on Guests and third parties, and the rights and legitimate interests of all parties, including freedom of expression:
(a) ask the Customer to fix the breach within a reasonable time;
(b) remove or disable access to specific content;
(c) pause a specific function, such as messaging, a website or a page;
(d) where the Customer uses Grondia Pay, suspend Grondia Pay under the Grondia Pay Terms;
(e) suspend the Customer’s account, in whole or in part; or
(f) terminate the Agreement under the General Terms.
10.2 Acting without prior notice. Grondia may act without first asking the Customer if the content is manifestly illegal, if there is a security risk, if Guests or third parties may otherwise suffer serious harm, if fraud is suspected, or if a court or authority requires it. Grondia then informs the Customer without delay.
10.3 Statement of reasons. When Grondia removes, disables or restricts Customer Content, suspends or restricts payments, or suspends or terminates the Services or the Customer’s account because content is illegal or breaches this AUP, it gives the Customer a clear and specific statement of reasons (DSA Art. 17). The statement says what measure was taken, its scope and duration; the facts relied on, including whether Grondia acted on a notice or on its own initiative; whether automated means were used; the legal or contractual ground and why the content falls under it; and how the Customer can seek redress.
10.4 Restoring. Grondia lifts a measure as soon as the reason for it no longer exists.
10.5 Measures under this section 10 do not release the Customer from paying fees, unless the measure turns out to have been unjustified.
11. Complaints and redress
11.1 The Customer may contest a decision under section 10, and a person who submitted a notice may contest Grondia’s decision on it, by writing to hello@grondia.com within 6 months after being informed of the decision. The complaint states the decision, the reasons why it is wrong, and any supporting information.
11.2 Where Grondia’s size allows it, a person at Grondia who was not involved in the original decision reviews the complaint. Grondia decides in a timely, diligent and objective manner and informs the complainant of the outcome and the reasons. Grondia reverses a decision without undue delay if the complaint shows that it was wrong.
11.3 This procedure does not limit the right to go to court under the General Terms or under mandatory law.
12. Points of contact
12.1 Grondia’s single point of contact for authorities of the EU member states, the European Commission and the European Board for Digital Services (DSA Art. 11), and for recipients of the Services (DSA Art. 12), is hello@grondia.com. Communication is possible in German and English.
13. Changes
13.1 Grondia may change this AUP to reflect changes in the law, in the Services or in risks, under the procedure for changes set out in the General Terms. Grondia informs the Customer of significant changes in writing before they take effect. Changes needed to comply with the law or to address a security risk may take effect earlier where the General Terms allow it.
13.2 The current version of this AUP, with its version number and date, is always available on Grondia’s website.