Privacy pOlicy

1.1 ACCESSING OUR WEBSITES

The Living Circle Group AG, respectively Hotel Winkelried AG, operates the Hotel Winkelried and is the operator of the websites

www.winkelried.ch

and is therefore responsible for the collection, processing and use of your personal data and for the compliance of the data processing with the applicable data protection law.

When you visit our website, our servers temporarily store each access in a log file. As with every connection to a web server, the following technical data is recorded and stored without any action on your part:

• the IP address of the requesting computer,
• the name of the holder of the IP address range (usually your internet access provider),
• the date and time of access,
• the website from which the access was made (referrer URL),
• possibly with the search term used,
• the name and URL of the file retrieved,
• the status code (e.g. error message),
• the operating system of your computer,
• the browser you use (type, version and language),
• the transmission protocol used (e.g. HTTP/1.1)
• and, if applicable, your user name from a registration/authentication.

After 90 days, we automatically anonymise the recorded IP addresses so that no conclusions can be drawn about individual users. This data is collected and processed for the purpose of enabling use of our website (establishing a connection), permanently ensuring system security and stability, enabling optimisation of our internet offering, and for internal statistical purposes. This constitutes our legitimate interest in the data processing within the meaning of Art. 6(1)(f) GDPR. The IP address is also evaluated, together with the other data, in the event of attacks on the network infrastructure or other unauthorised or abusive use of the website, for the purpose of clarification and defence, and may, where appropriate, be used in criminal proceedings to identify and take civil and criminal action against the users concerned. This constitutes our legitimate interest in the data processing within the meaning of Art. 6(1)(f) GDPR.

1.2 USE OF OUR CONTACT FORM

You have the option of using a contact form to get in touch with us. For this we require the following information (*mandatory):

• Title
• first and last name*,
• street,
• postcode and city,
• country,
• telephone,
• email address*,
• comment
• How did you hear about us?*

We use this data, as well as a telephone number you voluntarily provide, only to answer your contact request in the best possible and personalised way. The processing of this data is therefore necessary under Art. 6(1)(b) GDPR for the performance of pre-contractual measures or is in our legitimate interest pursuant to Art. 6(1)(f) GDPR.

1.3 SUBSCRIBING TO OUR NEWSLETTER

On our website you have the option to subscribe to our newsletter. Registration is required for this. The following data must be provided during registration (* mandatory):

• Title,
• first and last name*,
• email address*

You may also voluntarily provide further data. We use the double opt-in procedure. After you submit your registration, you will receive an email from us containing a confirmation link. To finally sign up for the newsletter, you must confirm this link. We use your data for sending the newsletter until you revoke your consent. You can revoke your consent at any time. In addition, every newsletter email contains an unsubscribe link.

Our newsletter may contain a web beacon (tracking pixel) or similar technical means. A web beacon is a 1x1 pixel, invisible graphic that is linked to the user ID of the respective newsletter subscriber. For each newsletter sent, we receive information about the address file used, the subject line and the number of newsletters sent. Furthermore, it can be seen which addresses have not yet received the newsletter, to which address it was sent and for which addresses the sending failed. It is also visible which addresses have opened the newsletter. Finally, we know which addresses have unsubscribed. We use this data for statistical purposes and to optimise the newsletter in terms of content and structure. This enables us to better align the information and offers in our newsletter with the individual interests of the recipients. The tracking pixel is deleted when you delete the newsletter. To prevent the use of the web beacon in our newsletter, please set your email program, if this is not already the default, so that no HTML is displayed in messages. On the following pages you will find instructions on how to make this setting in the most common email programs:

• Microsoft Outlook,
• Mail for Mac ("Load remote content in messages").

By registering, you give us your consent to process the stated data for the regular sending of the newsletter to the address you provided and for the statistical evaluation of usage behaviour and the optimisation of the newsletter. This consent constitutes our legal basis for processing the data for the newsletter within the meaning of Art. 6(1)(a) GDPR. We are entitled to engage third parties with the technical handling of advertising measures and are entitled to pass on your data for this purpose (see Section 4.0 below).

1.4 ROOM BOOKING ON THE WEBSITE, BY CORRESPONDENCE OR BY TELEPHONE

If you make bookings through our website, by correspondence (email or postal mail) or by telephone, we require the following data to process the contract (* mandatory):

• Title,
• first and last name*,
• postal address*,
• date of birth*,
• telephone number*,
• language*,
• credit card information*,
• email address*,
• expected arrival time,
• preferences,
• remarks,
• motor vehicle licence plate

We will only use this data to process the contract, unless otherwise stated in this Privacy Policy or unless you have separately consented. In particular, we process the data to record your booking as requested, to provide the booked services, to contact you in case of unclarities or problems, and to ensure correct payment.

For handling online bookings we use the service SimpleBooking from QNT S.r.l. a Socio Unico, Via Lucca, 52 – 50142 Florence, Italy. Further information on how SimpleBooking processes personal data can be found here. The legal basis for the data processing for this purpose is the performance of a contract under Art. 6(1)(b) GDPR.

1.5 CONTACT OR BOOKING VIA CHAT FUNCTION

On our website you have the option to make a booking online or to contact the reservations department via live chat. The software of the chat function as well as that of the booking platform are provided by selected third-party providers. Depending on the service, various data is collected in this context (* mandatory):

• First and last name,
• address*,
• postcode and city*,
• country*,
• email*,
• telephone number,
• credit card number

Name, email, telephone number, language, integration from Facebook Messenger, navigation point on the Winkelried website, date/time, referral, IP address, Google location, audio file of the conversation

For handling online bookings we use the service SimpleBooking from QNT S.r.l. a Socio Unico, Via Lucca, 52 – 50142 Florence, Italy. Further information on how SimpleBooking processes personal data can be found here. For handling bookings via chat we use the service JivoSite from JivoSite Inc., 1013 Centre Rd, Suite 403-B, Wilmington, Delaware 19805, USA. Further information on how JivoSite processes personal data can be found here. The legal basis for the data processing for this purpose is the performance of pre-contractual measures and the performance of a contract under Art. 6(1)(b) GDPR.

1.6 CONTACT VIA EMAIL

On our website you have the option to get in touch with us and send us an email. For this we mandatorily collect your email address. We use your email address and other data you voluntarily provide (e.g. first and last name) only to answer your contact request in the best possible and personalised way. The processing of this data is therefore necessary under Art. 6(1)(b) GDPR for the performance of (pre-)contractual measures or is in our legitimate interest pursuant to Art. 6(1)(f) GDPR.

1.7 CONTACT VIA TELEPHONE

On our website you have the option to get in touch with us by telephone. We use your telephone number and other data you voluntarily provide (e.g. first and last name, email address) only to answer your contact request in the best possible and personalised way. The processing of this data is therefore necessary under Art. 6(1)(b) GDPR for the performance of (pre-)contractual measures or is in our legitimate interest pursuant to Art. 6(1)(f) GDPR.

1.8 ORDERING AND PURCHASING EVENT TICKETS AND VOUCHERS

On our website you have the option to place orders online for certain services or value vouchers. In this context the following data is collected (* mandatory):

• First and last name,
• address*,
• postcode and city*,
• country*,
• email*,
• telephone number,
• credit card number

The collection and processing of this data is carried out for the purpose of providing and delivering the service you have requested. The legal basis for the data processing for this purpose is the performance of a contract under Art. 6(1)(b) GDPR.

1.9 RESTAURANT RESERVATION

On our website you have the option to reserve a table. In this context the following data is collected (* mandatory):

• First and last name,
• email*,
• telephone number*

For handling table reservations we use the reservation system of aleno AG, Aegertenstrasse 6, 8003 Zurich, Switzerland. Further information on how aleno processes personal data can be found here. The collection and processing of this data is carried out for the purpose of reserving a table for a specific number of persons. The legal basis for the data processing for this purpose is the performance of pre-contractual measures and the performance of a contract under Art. 6(1)(b) GDPR.

1.10 APPLYING FOR A JOB VACANCY

On our website you have the option to apply for a job advertisement or to submit an unsolicited application. For this you must submit a complete application. The following data must be provided in the online form (* mandatory):

• Cover letter,
• CV, photo*,
• references*
• Salutation,
• first and last name*,
• postal address*,
• nationality*,
• marital status*,
• date of birth*,
• email address*,
• telephone number*

This data is used to process the application process. Unless you explicitly consent to further processing, the data will be deleted after the respective application procedure. For the online application we use the service Jacando from Jacando AG, Münchensteinerstrasse 41, 4052 Basel, Switzerland. Further information on how Jacando processes personal data can be found here. The legal basis for the data processing is therefore the performance of pre-contractual measures and our legitimate interest pursuant to Art. 6(1)(b) and (f) GDPR. For further data processing, the legal basis is the consent you have given pursuant to Art. 6(1)(a) GDPR.

1.11 COOKIES

Cookies help to make your visit to our website easier, more pleasant and more meaningful in many respects. Cookies are information files that your web browser automatically stores on the hard drive of your computer when you visit our website. We use cookies, for example, to temporarily store your selected services and entries when filling in a form on the website, so that you do not have to repeat the entry when calling up another subpage. Cookies may also be used to identify you as a registered user after registration on the website, without you having to log in again when calling up another subpage. Most internet browsers accept cookies automatically. However, you can configure your browser so that no cookies are stored on your computer or so that a notice always appears when you receive a new cookie. On the following pages you will find instructions on how to configure the processing of cookies in the most common browsers:

• Microsoft Windows Internet Explorer
• Microsoft Windows Internet Explorer Mobile
• Mozilla Firefox
• Google Chrome for desktop
• Google Chrome for mobile
• Apple Safari for desktop
• Apple Safari for mobile

Deactivating cookies may mean that you cannot use all functions of our website.

1.12 TRACKING TOOLS

1.12.1 Google Analytics

For the purpose of designing our website to meet demand and continuously optimising it, we use the web analytics service Google Analytics. In this context, pseudonymised usage profiles are created and small text files stored on your computer ("cookies") are used. The information generated by the cookie about your use of this website is transmitted to the servers of the providers of these services, stored there and prepared for us. In addition to the data listed under Section 1.1, we may thereby receive the following information:

• Returning or new visitor
• Navigation path a visitor follows on the site,
• time spent on the website or subpage,
• the subpage on which the website is exited,
• the country, region or city from which access is made,
• end device (type, version, colour depth, resolution, width and height of the browser window)

The information is used to evaluate the use of the website, to compile reports on website activities and to provide further services associated with website and internet use for the purposes of market research and designing this website to meet demand. This information may also be transferred to third parties where required by law or where third parties process this data on our behalf. The provider of Google Analytics is Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA ("Google"). Before the data is transmitted to the provider, the IP address is shortened by activating IP anonymisation ("anonymizeIp) on this website within the member states of the European Union or in other contracting states of the Agreement on the European Economic Area. The anonymised IP address transmitted by your browser as part of Google Analytics is not merged with other Google data. Only in exceptional cases is the full IP address transferred to a Google server in the USA and shortened there. In these cases, we ensure through contractual guarantees that Google maintains an adequate level of data protection. According to Google, the IP address will in no case be associated with other data relating to the user. Users can prevent the collection of the data generated by the cookie and related to their use of the website (including the IP address) by Google, as well as the processing of this data by Google, by downloading and installing the browser plug-in available under the following link: here. Further information about the web analytics service used can be found here on Google's website. Instructions on how to prevent the processing of your data by the web analytics service can be found here. The legal basis for the aforementioned data processing is your consent (Art. 6(1)(a) GDPR). The consent given may be revoked at any time with effect for the future.

1.12.2 Microsoft Clarity

This website uses the web analytics service "Microsoft Clarity" provided by Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA ("Microsoft"), to analyse the use of our website. Clarity enables us to evaluate mouse movements, clicks and scrolling behaviour in order to gain insights for improving usability. Technical data such as browser information, device information, visit duration and pages visited is also recorded. Further information on data processing by Microsoft Clarity can be found at: https://privacy.microsoft.com/de-de/privacystatement

1.12.3 CREATION OF PSEUDONYMISED USAGE PROFILES

In order to provide you with personalised services and information on our website (on-site targeting), we use and analyse the data we collect about you when you visit the website. Where appropriate, cookies may be used in this processing. The analysis of your user behaviour may lead to the creation of a so-called usage profile. Usage data is only merged with pseudonymous data, never with non-pseudonymised personal data. The legal basis for processing data for this purpose is our legitimate interest pursuant to Art. 6(1)(f) GDPR in optimising and personalising our online offering and our advertising communication.

1.12.4 FACEBOOK CONNECT

On our website you can register or sign up to create a customer account using the social plug-in "Facebook Connect" of the social network Facebook, operated by Facebook Inc., Hacker Way, Menlo Park, CA 94025, USA ("Facebook"), within the so-called Single Sign-On technique, if you have a Facebook profile. The social plug-ins of "Facebook Connect" on our website can be recognised by the button with the Facebook logo and the wording "Connect with Facebook", "Log in with Facebook" or "Sign in with Facebook". When you access our website, which contains such a plug-in, your browser establishes a direct connection to Facebook's servers. The content of the plug-in is transmitted by Facebook directly to your browser and integrated into the page. Through this integration, Facebook receives the information that your browser has accessed the corresponding page of our website, even if you do not have a Facebook profile or are not currently logged in to Facebook. This information (including your IP address) is transmitted by your browser directly to a Facebook server in the USA and stored there. By using the "Facebook Connect" button on our website, you also have the option to log in or register using your Facebook user data. Only if you give your express consent under Art. 6(1)(a) GDPR before the sign-in process, on the basis of a corresponding notice about the exchange of data with Facebook, do we receive from Facebook, depending on your personal privacy settings on Facebook, the general and publicly accessible information stored in your profile. This includes the user ID, name, profile picture, age and gender. We point out that after changes to Facebook's data and terms of use, when consent is given, your profile pictures, the user IDs of your friends and the friend list may also be transferred if these were marked as "public" in your privacy settings on Facebook. The data transmitted by Facebook is stored and processed by us to create a user account with the necessary data, if you have released it on Facebook (salutation, first name, last name, address data, country, email address, date of birth). Conversely, on the basis of your consent, data (e.g. information on your browsing or purchasing behaviour) may be transferred from us to your Facebook profile. The consent given may be revoked at any time with effect for the future. For the purpose and scope of data collection and the further processing and use of the data by Facebook, as well as your rights and setting options to protect your privacy, please refer to Facebook's privacy notices here. If you do not want Facebook to directly assign the data collected via our website to your Facebook profile, you must log out of Facebook before visiting our website.

1.12.5 DATA PROTECTION PROVISIONS ON THE USE OF GOOGLE REMARKETING

The Living Circle Group AG has integrated Google Remarketing services on this website. Google Remarketing is a feature of Google AdWords that enables a company to display advertising to internet users who have previously visited the company's website. The integration of Google Remarketing therefore allows a company to create user-related advertising and thus to show internet users advertisements relevant to their interests. The operating company of the Google Remarketing services is Google Inc., 1600 Amphitheatre Pkwy, Mountain View, CA 94043-1351, USA.

The purpose of Google Remarketing is the display of interest-relevant advertising. Google Remarketing enables us to have advertisements displayed via the Google advertising network or on other websites that are tailored to the individual needs and interests of internet users. Google Remarketing sets a cookie on the information technology system of the data subject. By setting the cookie, Google is enabled to recognise the visitor to our website when they subsequently visit websites that are also members of the Google advertising network. Each time a website is accessed on which the Google Remarketing service has been integrated, the data subject's internet browser automatically identifies itself to Google. As part of this technical process, Google receives knowledge of personal data, such as the IP address or the browsing behaviour of the user, which Google uses, among other things, to display interest-relevant advertising. The cookie stores personal information, for example the websites visited by the data subject. Each time our website is visited, personal data, including the IP address of the internet connection used by the data subject, is transmitted to Google in the United States of America. This personal data is stored by Google in the United States of America. Google may under certain circumstances pass on this personal data collected through the technical process to third parties. The data subject can at any time prevent the setting of cookies by our website, as described above, by means of a corresponding setting in the internet browser used, thereby permanently objecting to the setting of cookies. Such a setting of the internet browser would also prevent Google from setting a cookie on the data subject's information technology system. In addition, a cookie already set by Google Analytics can be deleted at any time via the internet browser or other software programs. Furthermore, the data subject has the option to object to interest-based advertising by Google. To do so, the data subject must access the link here from each of the internet browsers they use and make the desired settings there. Further information and Google's applicable data protection provisions can be retrieved here. The legal basis for the aforementioned data processing is our interest in personalised and interest-based promotion of our offering (Art. 6(1)(f) GDPR).

1.12.6 DATA PROTECTION PROVISIONS ON THE USE OF GOOGLE ADWORDS

The Living Circle Group AG has integrated Google AdWords on this website. Google AdWords is an online advertising service that allows advertisers to place advertisements both in Google's search engine results and in the Google advertising network. Google AdWords enables an advertiser to define specific keywords in advance, by means of which an advertisement is displayed in Google's search engine results only when the user retrieves a keyword-relevant search result. In the Google advertising network, advertisements are distributed to topically relevant websites by means of an automatic algorithm and in consideration of the previously defined keywords. The operating company of the Google AdWords services is Google Inc., 1600 Amphitheatre Pkwy, Mountain View, CA 94043-1351, USA.

The purpose of Google AdWords is to promote our website by displaying interest-relevant advertising on the websites of third-party companies and in the search results of the Google search engine, and to display third-party advertising on our website. If a data subject reaches our website via a Google advertisement, Google places a so-called conversion cookie on the data subject's information technology system. A conversion cookie loses its validity after thirty days and does not serve to identify the data subject. Through the conversion cookie, as long as the cookie has not yet expired, it is tracked whether certain subpages, for example the shopping cart of an online shop system, have been accessed on our website. Through the conversion cookie, both we and Google can understand whether a data subject who reached our website via an AdWords advertisement generated a sale, i.e. completed or abandoned a purchase. The data and information collected through the use of the conversion cookie are used by Google to compile visitor statistics for our website. These visitor statistics are in turn used by us to determine the total number of users who were referred to us via AdWords advertisements, i.e. to determine the success or failure of the respective AdWords advertisement and to optimise our AdWords advertisements for the future. Neither our company nor other advertising customers of Google AdWords receive information from Google that could be used to identify the data subject. The cookie stores personal information, for example the websites visited by the data subject. Each time our website is visited, personal data, including the IP address of the internet connection used by the data subject, is transmitted to Google in the United States of America. This personal data is stored by Google in the United States of America. Google may under certain circumstances pass on this personal data collected through the technical process to third parties. The data subject can at any time prevent the setting of cookies by our website, as described above, by means of a corresponding setting in the internet browser used, thereby permanently objecting to the setting of cookies. Such a setting would also prevent Google from setting a conversion cookie on the data subject's information technology system. In addition, a cookie already set by Google AdWords can be deleted at any time via the internet browser or other software programs. Furthermore, the data subject has the option to object to interest-based advertising by Google. To do so, the data subject must access the link here from each of the internet browsers they use and make the desired settings there. Further information and Google's applicable data protection provisions can be retrieved here. The legal basis for the aforementioned data processing is our interest in personalised and interest-based promotion of our offering (Art. 6(1)(f) GDPR).

1.12.7 PRIVACY POLICY TEMPLATE (COOKIE TEMPLATE)

This website uses Mouseflow, a web analytics tool of Mouseflow ApS, Flaesketorvet 68, 1711 Copenhagen, Denmark. The data processing serves the purpose of analysing this website and its visitors. For this purpose, data is collected and stored for marketing and optimisation purposes. Usage profiles can be created from this data under a pseudonym. Cookies may be used for this purpose. With the web analytics tool Mouseflow, randomly selected individual visits (only with anonymised IP address) are recorded. This creates a log of mouse movements and clicks with the intention of replaying individual website visits on a sample basis and deriving potential improvements for the website. The data collected with Mouseflow is not used to personally identify the visitor to this website without the separately given consent of the data subject, and is not merged with personal data about the bearer of the pseudonym. The processing is based on Art. 6(1)(f) GDPR, on the basis of the legitimate interest in direct customer communication and in designing the website to meet demand. You have the right, for reasons arising from your particular situation, to object at any time to this processing of personal data relating to you based on Art. 6(1)(f) GDPR. To do so, you can deactivate recording on all websites that use Mouseflow globally for your currently used browser under the following link: https://mouseflow.de/opt-out/. If you are interested in a data processing agreement, you can conclude it directly with us via RightSignature online: https://mouseflow.de/gdpr/.

2.1 DATA PROCESSING TO FULFIL STATUTORY REPORTING OBLIGATIONS

On arrival at our hotel, we require the following information from you and your companions (*mandatory):

• First and last name*,
• postal address and canton*,
• date of birth*,
• place of birth*, 
• nationality*,
• official identification document and number*,
• arrival and departure date

We collect this information to fulfil statutory reporting obligations arising in particular from hospitality or police law. Where we are obliged to do so under the applicable regulations, we forward this information to the competent police authority. In fulfilling the legal requirements, our legitimate interest within the meaning of Art. 6(1)(f) GDPR exists.

2.2 RECORDING OF RELATED SERVICES

If you use additional services during your stay (e.g. restaurant visits, use of the minibar or the pay-TV offering, etc.), the subject of the service as well as the time of use are recorded by us for billing purposes. The processing of this data is necessary under Art. 6(1)(b) GDPR for the performance of the contract with us.

2.3 WI-FI USE

In order to provide you with access to the internet via our WLAN network, we collect and use the following data from you when you log in and use our WLAN network: So-called inventory data (* mandatory):

• Your first and last name including title and salutation*,
• the email address you provided*,
• your mobile telephone number

We need this inventory data for your general registration for our WLAN offering. The legal basis for the data processing for this purpose is the performance and fulfilment of a contract under Art. 6(1)(b) GDPR.

In addition, we collect so-called traffic data:

• The type of your device with which you use our WLAN network;
• various device identifications, namely the WLAN MAC address;
• the login assigned to you;
• the IP address assigned to you;
• date and time of your WLAN connections and connections to the internet;
• certain location data: this is the location of the nearest WLAN access point to which you are connected by WLAN, including a time stamp. Through the location of this access point, we generally know in which room you are with your device at what time in our hotel. A more precise location of your actual position does not take place. We need the traffic data to technically establish a connection between your terminal device and our WLAN network and to then provide and technically handle internet access. The location data serves the purpose of connecting you to the WLAN access point with the strongest signal. Our legitimate interest in the data processing within the meaning of Art. 6(1)(f) GDPR exists here. The IP address is also evaluated, together with the other data, in the event of attacks on the network infrastructure or other unauthorised or abusive WLAN uses, for the purpose of clarification and defence, and may, where appropriate, be used in criminal proceedings to identify and take civil and criminal action against the users concerned. Our legitimate interest in the data processing within the meaning of Art. 6(1)(f) GDPR exists here.
• On the basis of your consent, we also use your data for further purposes, as described below. We combine your above-mentioned data with the data stored about you from the accommodation relationship, and use this combined data together for the following purposes:
• To send you general information and offers tailored to you and your interests, based on the data we hold about you, regarding products and services of our hotel by email, during or after your stay. The information and offers you receive may also depend on your previous and current location within our hotel, for example when you enter one of our restaurants or have frequently visited our fitness studio. If you have also provided us with your mobile phone number, we use it to additionally send you such information and offers by SMS to your mobile device. To improve our service, we would like to support our employees in being able to address you personally by your name whenever they have contact with you. For this purpose, we may use your name and the location data described above to inform our employees in a particular room of the hotel who is currently in that room, so that our employees can address you more easily by name. For statistical evaluations, for example on how our guests respond to our marketing measures, which offers our guests use particularly frequently within the hotel, how our guests prefer to move around our hotel, and which WLAN areas have good coverage.
• The legal basis for these data processing activities is the consent you have given pursuant to Art. 6(1)(a) GDPR. You can revoke your consent at any time with effect for the future.

3.1 SOCIAL MEDIA PLUG-INS

On our website we provide you with certain social media functionalities, in particular sharing on Facebook, tweeting, etc. The relevant functionalities can be found on the individual pages under the "Share" section. We provide you with social media functionalities of the following social networks:

• Facebook Inc., 1601 S. California Ave, Palo Alto, CA 94304, USA;
• Instagram Inc., 1601 Willow Road, Menlo Park, California 94025, USA;
• and Twitter Inc., 1355 Market Street, Suite 900, San Francisco, CA 94103, USA.

When you click the icons of the social networks, you are linked to the respective social network in order to use the selected functionality, e.g. to share content on Facebook or to tweet on Twitter. For this you must log in to your corresponding user account or already be logged in. When you select one of the functionalities provided and click the icon of the respective social network, a direct connection is established between your browser and the server of the respective social network. As a result, the network receives the information that you have visited our website with your IP address and have accessed the link. If you access a link to a network while you are logged in to your account with that network, the contents of our page may be linked to your profile with the network, which means the network can directly assign your visit to our website to your user account. If you want to prevent this, you should log out before clicking the relevant links. An assignment definitely takes place if you log in to the respective network after clicking the link.

3.2 LINKS TO OUR OWN SOCIAL MEDIA PRESENCES

On our website we have included links to our social media profiles on the following social networks:

• Facebook Inc., 1601 S. California Ave, Palo Alto, CA 94304, USA,
• Instagram Inc., 1601 Willow Road, Menlo Park, California 94025, USA; und
• Twitter Inc.,1355 Market Street, Suite 900, San Francisco, CA 94103, USA.

When you click the icons of the social networks, you are automatically redirected to our profile with the respective network. To use the functions of the respective network there, you may have to log in to your user account with that network.

When you access a link to one of our social media profiles, a direct connection is established between your browser and the server of the respective social network. As a result, the network receives the information that you have visited our website with your IP address and have accessed the link. If you access a link to a network while you are logged in to your account with that network, the contents of our page may be linked to your profile with the network, which means the network can directly assign your visit to our website to your user account. If you want to prevent this, you should log out before clicking the relevant links. An assignment definitely takes place if you log in to the respective network after clicking the link.

3.3 YOUTUBE PLUG-IN

On our website we integrate plug-ins of the video portal YouTube, operated by YouTube LLC, 901 Cherry Ave., San Bruno, CA 94066, USA ("YouTube"). YouTube is a subsidiary of Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Each time a page offering one or more YouTube video clips is accessed, a direct connection is established between your browser and a YouTube server in the USA. Information about your visit and your IP address are stored in the process. Through interactions with the YouTube plug-ins (e.g. clicking the start button), this information is also transmitted to YouTube and stored by YouTube. For more information on the collection and use of your data by YouTube, please refer to YouTube's privacy policy or that of Google here. The legal basis for processing data for this purpose is our legitimate interest pursuant to Art. 6(1)(f) GDPR. If you have a YouTube user account and do not want YouTube to collect data about you via this website and link it with your membership data stored at YouTube, you must log out of YouTube before visiting this website. In addition, YouTube calls up the analysis tool Google Analytics via an iFrame in which the video is displayed. This is a separate tracking by YouTube, to which we have no access. You can prevent tracking by Google Analytics by using the deactivation tools that Google offers for some internet browsers.

3.4 GOOGLE MAPS

On our website we use the Google Maps API (Application Programming Interface, "Google Maps") from Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, to visually display geographic information (site plans). By using Google Maps, information about your use of our website, including your IP address, is transmitted to and stored on a Google server in the USA. The legal basis for processing data for this purpose is our legitimate interest pursuant to Art. 6(1)(f) GDPR. It is possible to deactivate the Google Maps service and prevent data transfer to Google by disabling JavaScript in your browser. However, please note that in this case you will not be able to use the map display. For more information on the collection, processing and use of your data by Google and your related rights, please refer to Google's privacy policy here, as well as the additional terms of use for Google Maps or Google Earth here.

4.1 BOOKING PLATFORMS

If you make bookings through a third-party platform, we receive various personal information from the respective platform operator. This is generally the data listed in Section 1.4 of this Privacy Policy. In addition, requests regarding your booking may be forwarded to us. We process this data in particular to record your booking as requested and to provide the booked services. The legal basis for the data processing for this purpose is the performance of a contract under Art. 6(1)(b) GDPR. Finally, we may be informed by the platform operators about disputes in connection with a booking. In this case, we may also receive data about the booking process, which may include a copy of the booking confirmation as proof of the completion of the booking. We process this data to safeguard and enforce our claims. This constitutes our legitimate interest within the meaning of Art. 6(1)(f) GDPR. Please also note the data protection information of the respective provider.

4.2 CENTRAL STORAGE AND LINKING OF DATA

We store the data specified in Sections 1.1 to 1.10 and 2.1 to 2.3 in a central electronic data processing system (CRM). Your data is recorded and linked systematically in order to process your bookings and handle contractual services, or based on your consent. For this purpose we use software from the company "protel hotelsoftware GmbH" in DE-44269 Dortmund. The processing of personal data within a CRM programme takes place in the software of the company "Toedt, Dr. Selk & Coll. GmbH" in DE-80333 Munich. We base the processing of this data within the software on our legitimate interest within the meaning of Art. 6(1)(f) GDPR in customer-friendly and efficient customer data management, and on the performance of contractual measures pursuant to Art. 6(1)(b) GDPR. Based on your consent, we use your data for further purposes, as described below. In doing so, we combine your data with the data stored about you from the accommodation relationship, from restaurant, spa and internet visits, and use this combined data to send you, during or after your stay, general information and offers tailored to you and your interests regarding products and services of our hotel by email, SMS or post. The legal basis for these data processing activities is the consent you have given pursuant to Art. 6(1)(a) GDPR. You can revoke your consent at any time with effect for the future by email ([email protected]).

4.3 RETENTION PERIOD

We store personal data only for as long as necessary to use the tracking services mentioned above and the other processing activities within the scope of our legitimate interest. Contract data is retained by us for longer, as this is required by statutory retention obligations. Retention obligations that require us to keep data arise from regulations on registration law, on accounting and from tax law. According to these regulations, business communication, concluded contracts and booking records must be kept for up to 10 years. Where we no longer need this data to perform services for you, the data is blocked. This means that the data may then only be used for accounting and tax purposes.

4.4 DISCLOSURE OF DATA TO THIRD PARTIES

We only pass on your personal data if you have expressly consented, if there is a legal obligation to do so, or if this is necessary to enforce our rights, in particular to enforce claims arising from the contractual relationship. Furthermore, we pass on your data to third parties to the extent necessary in connection with the use of the website and the contract processing (also outside the website), in particular the processing of your bookings. Please also note the information on disclosure of data to third parties in the preceding sections of this Privacy Policy. We may pass on your personal data to all members of our group, provided that they use it for the same original purposes as set out in this Privacy Policy. These are in particular:

Widder Hotel AG
Rennweg 7
8001 Zürich

Hotel Alex Management AG
Seestrasse 182
8800 Thalwil

Terreni alla Maggia SA
Via Muraccio 105
6612 Ascona 

Castello del Sole - Terreni alla Maggia SA
Via Muraccio 142
6612 Ascona

Sammlung E.G. Bührle
Rämistrasse 46
8001 Zürich

Géza Anda-Stiftung
Bleicherweg 18
8002 Zürich

Dozière SA
c/o Etude Brêchet
Promenade Iris-de-Roten 1
2800 Delémont

Hotel Bergwelt AG
Bergwelt 4
3818 Grindelwald

Hotel Winkelried AG
Dorfplatz 5
6362 Stansstad

Below you will find an overview of third parties we use:

4.4.2 WEB MASTERS

To operate, maintain and guarantee the contractual offerings on our website, we work with our technical partners, as a result of which personal data is passed on or they may have access to it:

• Positioner SA, Via Stazione 32, 6592 S. Antonino, Switzerland, www.positioner.com
• pdc salespitcher ag, Schwimmbadstrasse 45, 5430 Wettingen, Switzerland, www.salespitcher.ch

The websites are hosted on servers in Switzerland. The data is passed on for the purpose of providing and maintaining the functionalities of our website. This constitutes our legitimate interest within the meaning of Art. 6(1)(f) GDPR.

4.4.3 ROOM RESERVATION SYSTEMS

Personal data for room bookings on the website is collected and transmitted to us by QNT S.r.l. a Socio Unico, Via Lucca, 52 – 50142 Florence, Italy, www.simplebooking.it.

4.4.4 CENTRAL STORAGE AND LINKING OF DATA

Personal data is consolidated by means of a CRM to further develop and improve our guest service. The data is delivered to and processed by Toedt, Dr. Selk & Coll. GmbH, Augustenstr. 79, 80333 Munich, [email protected].

4.4.5 RESTAURANT RESERVATIONS

Personal data for restaurant reservations on the website is collected and processed by aleno AG, Aegertenstrasse 6, 8003 Zurich, Switzerland, +41 43 508 24 65, www.aleno.me.

4.4.6 EVENT TICKETS AND VOUCHERS

Personal data for purchases of event tickets and vouchers on the website is collected, processed and delivered by pdc salespitcher ag, Schwimmbadstrasse 45, 5430 Wettingen, Switzerland, www.salespitcher.ch, and Idea Creation GmbH, Walchestrasse 15, 8006 Zurich, Switzerland, www.e-guma.ch.

4.4.7 CREDIT CARD PAYMENT

When paying by credit card on the website, we pass your credit card information on to your card issuer and to the card acquirer. For this we work with the software platform "Stripe" from Stripe Inc., 510 Townsend Street, San Francisco, CA 94107, USA, and Concardis GmbH, Helfmann-Park 7, 65760 Eschborn, Germany.

If you choose to pay by credit card, you will be asked to enter all mandatory information each time. The legal basis for passing on the data is the performance of a contract under Art. 6(1)(b) GDPR. Regarding the processing of your credit card information by these third parties, we ask you to also read the General Terms and Conditions and the privacy policy of your card issuer.

4.4.8 CHAT

Personal data for use of the chat tool on the website is collected and processed by JivoSite Inc., 1013 Centre Rd, Suite 403-B, Wilmington, Delaware 19805, USA, [email protected].

4.4.9 APPLICATION TOOL

Personal data for use of the application tool on the website is collected and processed by Jacando AG, Münchensteinerstrasse 41, 4052 Basel, Switzerland.

4.4.10 WI-FI PROVIDER

Personal data for use of the Wi-Fi in the hotel is collected and processed by Monzoon Networks AG, Spinnerei-Lettenstrasse, Riverside, CH-8192 Zweidlen.

4.5 TRANSFER OF PERSONAL DATA ABROAD

We are entitled to transfer your personal data for the purposes of the data processing described in this Privacy Policy also to third-party companies (commissioned service providers) abroad. These are obliged to protect data to the same extent as we are. If the level of data protection in a country does not correspond to the Swiss or European level, we contractually ensure that the protection of your personal data corresponds at all times to that in Switzerland or the EU.

4.5.1 NOTICE REGARDING DATA TRANSFERS TO THE USA

For the sake of completeness, we point out to users resident or domiciled in the EU or Switzerland that in the USA there are surveillance measures by US authorities that generally permit the storage of all personal data of all persons whose data has been transferred from Switzerland or the EU to the USA. This happens without differentiation, limitation or exception based on the purpose pursued and without an objective criterion that would make it possible to limit US authorities' access to the data and its subsequent use to very specific, strictly limited purposes that could justify the interference associated with both access to and use of this data. Furthermore, we point out that in the USA there are no legal remedies available to data subjects from Switzerland and the EU that would allow them to obtain access to data concerning them and to have it corrected or deleted, nor is there effective judicial protection against general access rights of US authorities. We explicitly point out this legal and factual situation to the data subjects so that they can make an appropriately informed decision on consenting to the use of their data. We point out to users resident in a member state of the EU that, from the perspective of the European Union, the USA does not have an adequate level of data protection, among other reasons due to the topics mentioned in this section. Insofar as we have explained in this Privacy Policy that recipients of data (such as Google) are based in the USA, we will ensure, either through contractual arrangements with these companies or by ensuring the certification of these companies under the EU or Swiss-US Privacy Shield, that your data is protected with our partners at an adequate level.

5.1 RIGHT OF ACCESS, RECTIFICATION, ERASURE AND RESTRICTION OF PROCESSING; RIGHT TO DATA PORTABILITY

You may object to data processing at any time, in particular to data processing in connection with direct marketing (e.g. against promotional emails). You also have the following rights:

• Right of access: You have the right to inspect, free of charge and at any time, the personal data we hold about you when we process it. This gives you the opportunity to check which personal data we process about you and that we use it in accordance with applicable data protection rules.
• Right to rectification: You have the right to have inaccurate or incomplete personal data corrected and to be informed of the correction. In this case, we will inform the recipients of the affected data about the adjustments made, unless this is impossible or involves disproportionate effort.
• Right to erasure: You have the right to have your personal data deleted under certain circumstances. In individual cases, the right to erasure may be excluded.
• Right to restriction of processing: Under certain conditions you have the right to request that the processing of your personal data be restricted.
• Right to data portability: Users outside Switzerland have the right, under certain circumstances, to receive from us the personal data you have provided to us, free of charge and in a readable format.
• Right to lodge a complaint: You have the right to lodge a complaint with a competent supervisory authority regarding the manner in which your personal data is processed.
• Right to withdraw consent: In principle, you have the right to withdraw a given consent at any time. However, processing activities previously based on your consent do not become unlawful as a result of your withdrawal.

5.2 DATA SECURITY

We use suitable technical and organisational security measures to protect the personal data stored with us against manipulation, partial or complete loss, and unauthorised access by third parties. Our security measures are continuously improved in line with technological developments. You should always treat your access data confidentially and close the browser window when you have finished communicating with us, especially if you share the computer with others. We also take internal data protection very seriously. Our employees and the service companies we commission have been obliged by us to maintain confidentiality and to comply with data protection provisions.

5.3 CONTACT PERSON

You have the right to lodge a complaint with a data protection supervisory authority at any time.

Contact details of our data protection officer: Email: [email protected]

03 October 2019

↑ GO TO TOP