Privacy policy

Name: Swiss Holiday Park
Price range: $

1. responsible party and content of this privacy policy

We, Swiss Holiday Park AG, are the operator of the Hotel Swiss Holiday Park (Hotel) website and its subpages www.shp.ch, www.swissholidaypark.ch, unless otherwise stated in this privacy policy, responsible for the data processing listed in this privacy policy.

So that you know what personal data we collect from you and for what purposes we use it, please take note of the following information. In terms of data protection, we are primarily guided by the legal requirements of Swiss data protection law, in particular the Federal Act on Data Protection (FADP), as well as the GDPR, the provisions of which may be applicable in individual cases.

Please note that the following information is reviewed and amended from time to time. We therefore recommend that you consult this privacy policy on a regular basis. Furthermore, other companies are responsible or jointly responsible with us under data protection law for individual data processing operations listed below, so that in these cases the information provided by these providers is also authoritative.

2. contact person for data protection

If you have any questions about data protection or wish to exercise your rights, please get in touch with our data protection contact by sending an email to the following address: [email protected]

You can reach our EU Data Protection Representative at:

Swiss Holiday Park AG, Dorfstrasse 11, 6443 Morschach

[email protected]

3 Scope and purpose of the collection, processing and use of personal data

3.1 Data processing when contacting us

If you contact us via our contact addresses and channels (e.g. by e-mail, telephone or contact form), your personal data will be processed. The data that you have provided to us, such as your name, e-mail address or telephone number and your enquiry, will be processed. In addition, the time of receipt of the enquiry is documented. Mandatory information is marked with an asterisk (*) in contact forms. We process this data in order to fulfil your request (e.g. providing information about our hotel, assisting with contract processing such as questions about your booking, incorporating your feedback into the improvement of our services, etc.).

To send messages from forms, we use Postmark from the provider Wildbit LLC, 225 Chestnut St., Philadelphia, PA, 19106. Postmark is a service for sending messages. The emails sent via Postmark usually contain the data collected in the form (confirmation email). In order to be able to send the message, the e-mail address is forwarded to Postmark. The processing takes place on servers in the USA. Further information on the data protection standard of Wildbit LLC can be found here: https://postmarkapp.com/eu-privacy or https://wildbit.com/privacy-policy

3.2 Data processing when using our chat function

If you contact us via chat, your personal data will be processed. The data that you have provided to us will be processed, e.g. the name of your company, your name, your function, your e-mail address and your request. In addition, the time of receipt of the enquiry is documented. Mandatory information is marked with an asterisk (*). We process this data exclusively in order to fulfil your request (e.g. providing information about our hotel, support with contract processing such as questions about your booking, incorporating your feedback into the improvement of our services, etc.).

We use a software application from [Meta Platforms Inc, 1601 S California Ave, Palo Alto, CA 94304, USA, Privacy Policy] to handle communication via the chat function. Therefore, your data may be stored in a database of Meta Platforms Inc, which may allow Meta Platforms Inc to access your data if this is necessary for the provision of the software and for support in the use of the software. Information on the processing of data by third parties and any transfer abroad can be found in section 4 of this Privacy Policy.

The legal basis for this data processing is our legitimate interest within the meaning of Art. 6 para. 1 lit. f GDPR in the use of modern communication technologies or, if your enquiry is aimed at the conclusion or execution of a contract, in the implementation of the necessary measures within the meaning of Art. 6 para. 1 lit. b GDPR.

Meta Platforms Inc may wish to use some of this data for its own purposes (e.g. to send marketing emails or for statistical analyses). Meta Platforms Inc is the controller for this data processing and must ensure compliance with data protection laws in connection with this data processing. Information on data processing by Meta Platforms Inc can be found at Link.

3.3 Data processing when registering for a customer account

If you open a customer account on our website, we collect the following data, whereby mandatory information is marked with an asterisk (*) in the corresponding form:

Personal details:
- Salutation
- Surname
- First name
- Billing and, if applicable, delivery address
- Date of birth
- Company, company address and UID no. for corporate customers
Login data:
- E-mail address
- password
Further details:
- Languages
- Gender

We use the personal details to establish your identity and to check the requirements for registration. The e-mail address and password together serve as login data and thus ensure that the correct person is using the website under your details. We also need your e-mail address to verify and confirm the opening of your account and for future communication with you that is necessary to fulfil the contract. In addition, this data is stored in the customer account for future bookings or contract conclusions. For this purpose, we also allow you to store further details in the account (e.g. your preferred means of payment).

We also use the data to provide an overview of the bookings made and services purchased and a simple way to manage your personal data, to administer our website and the contractual relationships, i.e. to establish, organise the content of, process and amend the contracts concluded with you via your customer account (e.g. in connection with your booking with us).

We process the information on language and gender in order to display offer suggestions on the website that are best tailored to your profile or your personal needs, to statistically record and evaluate the selected offers and thus to optimise our suggestions and offers.

The legal basis for the processing of your data for the aforementioned purpose is your consent in accordance with Art. 6 para. 1 lit. a GDPR. You can withdraw your consent at any time by removing the information from your customer account or deleting your customer account or having it deleted by sending us a message.

To avoid misuse, you should always treat your login data confidentially and log out after each session and delete the browser history, especially if you share the end device with others.

3.4 Data processing for orders via our online shop

You have the option of ordering products, services and vouchers on our website. We collect the following data for this purpose, whereby mandatory information is marked with an asterisk (*) during the ordering process:

Salutation
First name and surname
Company name
Billing and delivery address
Telephone number
e-mail address
Date of birth
Payment method
Shipping method
Information on subscription to marketing e-mails
Confirmation of the accuracy of the information provided
Confirmation that you have read and agree to the GTC and data protection provisions

We use the data to establish your identity before concluding a contract. We need your e-mail address to confirm your order and for future communication with you that is necessary to fulfil the contract. We store your data together with the order details (e.g. name, price and features of the products ordered), payment details (e.g. payment method selected, confirmation of payment and time; see also section 3.7.2) and information on the processing and fulfilment of the contract (e.g. receipt and handling of complaints) so that we can ensure correct order processing and contract fulfilment.

The legal basis for this data processing is the fulfilment of a contract with you in accordance with Art. 6 para. 1 lit. b GDPR.

The provision of data that is not labelled as mandatory is voluntary. We process this data in order to tailor our offer to your personal needs in the best possible way, to facilitate the processing of contracts, to contact you via an alternative communication channel if necessary with a view to fulfilling the contract or for statistical recording and evaluation to optimise our offers.

The legal basis for this data processing is your consent within the meaning of Art. 6 para. 1 lit. a GDPR. You can revoke your consent at any time by notifying us.

To provide the online shop, we use a software application from [Idea Creation GmbH, Walchestrasse 15, 8006 Zurich, Switzerland, Zucchetti Switzerland SA Centro San Martino, Via Moree 16, 6850 Mendrisio, Switzerland, TAC Informationstechnologie GmbH, Schildbach 211, 8230 Hartberg, Austria and ‍GiggleGmbH, Jahnstrasse 18, 6020 Innsbruck, Austria-EU. Therefore, your data may be stored in a database by the above-mentioned companies, which may enable the companies to access your data if this is necessary for the provision of the software and for support in the use of the software. Information on the processing of data by third parties and any transfer abroad can be found in section 4 of this privacy policy.

The legal basis for this data processing is the fulfilment of a contract with you in accordance with Art. 6 para. 1 lit. b GDPR.

3.5 Data processing for bookings

3.5.1 Booking via our website

You have the option of booking an overnight stay on our website. We collect the following data for this purpose, whereby mandatory information is marked with an asterisk (*) during the booking process

Salutation
First name
Surname
Billing address
Telephone number
E-mail address
Payment method
Booking details
Remarks
Confirmation of the accuracy of the information provided
Confirmation that you have read and agree to the terms and conditions and data protection regulations

We use the data to establish your identity before concluding a contract. We need your e-mail address to confirm your booking and for future communication with you that is necessary to fulfil the contract. We will store your data together with the general data of the booking (e.g. room category, period of stay as well as name, price and features of the services), the payment data (e.g. selected payment method, confirmation of payment and time; see also section 3.7.2) as well as the information on the processing and fulfilment of the contract (e.g. receipt and handling of complaints) so that we can ensure correct booking processing and contract fulfilment.

Insofar as this is necessary for the fulfilment of the contract, we will also pass on the required information to any third-party service providers (e.g. event organisers or transport companies).

The legal basis for this data processing is the fulfilment of a contract with you in accordance with Art. 6 para. 1 lit. b GDPR.

The legal basis for this data processing is your consent within the meaning of Art. 6 para. 1 lit. a GDPR. You can revoke your consent at any time by sending us a message.

We use a software application from Sabre GLBL Inc, 3150 Sabre Drive, Southlake, Texas, to process bookings via our website. Therefore, your data may be stored in a Sabre GLBL Inc database, which may allow Sabre GLBL Inc to access your data if this is necessary for the provision of the software and for support in the use of the software. Information on the processing of data by third parties and any transfer abroad can be found in section 4 of this Privacy Policy.

The legal basis for this data processing is the fulfilment of a contract with you in accordance with Art. 6 para. 1 lit. b GDPR.

3.5.2 Booking via a booking platform

If you make bookings via a third-party platform (i.e. via Booking, Hotel, Escapio, Expedia, Holidaycheck, Hotel Tonight, HRS, Kayak, Mr & Mrs Smith, Splendia, Tablet Hotels, Tripadvisor, Trivago, Weekend4Two etc.), we receive various personal data from the respective platform operator in connection with the booking made. This is generally the data listed in section 3.7.2 of this privacy policy. In addition, we may receive enquiries about your booking. We will process this data by name in order to record your booking as requested and to provide the booked services.
The legal basis for data processing for this purpose is the implementation of pre-contractual measures and the fulfilment of a contract in accordance with Art. 6 para. 1 lit. b GDPR.
Finally, we may exchange personal data with the platform operators in connection with disputes or complaints in connection with a booking, insofar as this is necessary to safeguard our legitimate interests. This may also include data relating to the booking process on the platform or data relating to the booking or processing of services and the stay with us. We process this data to safeguard our legitimate claims and interests in the processing and maintenance of our contractual relationships with the following platform operators:

- Booking Holdings Inc, 800 Connecticut Ave, Norwalk, CT 06854, USA.
  Further information on data processing in connection with Swiss Holiday Park AG can be found[Link]
- Expedia Group, 1111 Expedia Group Way West, Seattle WA 98119, USA
  Further information on data processing in connection with Swiss Holiday Park AG can be found[Link]
- HRS GmbH, Breslauer Platz 4, 50668 Cologne, Germany
  Further information on data processing in connection with Swiss Holiday Park AG can be found[Link]
- STC Switzerland Travel Centre AG, Binzstrasse 38, 8045 Zurich, Switzerland
  Further information on data processing in connection with Swiss Holiday Park AG can be found[Link]
- Invit Travel GmbH, Hardeggerstrasse 30, 3008 Bern, Switzerland
  Further information on data processing in connection with Swiss Holiday Park AG can be found[Link]
- trivago N.V., Kesselstrasse 5 - 7, 40221 Düsseldorf, Germany
  Further information on data processing in connection with Swiss Holiday Park AG can be found[Link]
- gruppenhaus.ch GmbH, Seestrasse 112, 8806 Bäch, Switzerland
  Further information on data processing in connection with Swiss Holiday Park AG can be found[Link]
- HolidayCheck AG, Bahnweg 8, 8598 Bottighofen, Switzerland
  HC Touristik GmbH, Neumarkter Strasse 61, 81673, Munich, Germany
  Further information on data processing in connection with Swiss Holiday Park AG can be found[Link]
- Airbnb Payments Luxembourg SA, 4 rue Henri Schnadt, L-2350 Luxembourg
  Further information on data processing in connection with Swiss Holiday Park AG can be found[Link]
- Landal GreenParks GmbH, Max-Planck-Straße 12, 54296 Trier, Germany
  Further information on data processing in connection with Swiss Holiday Park AG can be found[Link]
- Swiss Travel Fund, Neuengasse 15, 3001 Bern, Switzerland
  Further information on data processing in connection with Swiss Holiday Park AG can be found[Link]
- TouristDataShop AG (Tomas), rue du midi 3, 1860 Aigles, Switzerland
  Further information on data processing in connection with Swiss Holiday Park AG can be found[Link]

Your data is stored in the databases of the platform operators, which enables them to access your data. Information on the processing of data by third parties and any transfer abroad can be found in section 4 of this privacy policy.
The legal basis for data processing for this purpose is our legitimate interest within the meaning of Art. 6 para. 1 lit. f GDPR.

3.6 Data processing when booking a table

On our website, you have the option of reserving a table in a restaurant listed on our website. For this purpose, we collect the following data - depending on the respective offer - whereby mandatory information for reservations via the website is marked with an asterisk (*)

First name
Surname
Number of guests
e-mail address
Telephone number
Special diet
Comment
Date and time of reservation

We collect and process the data for processing the reservation, in particular to fulfil your reservation request according to your wishes and to contact you in the event of ambiguities or problems. We store your data together with the marginal data of the reservation (e.g. date and time of receipt, etc.), the reservation data (e.g. allocated table) and information on the processing and fulfilment of the contract (e.g. receipt and handling of complaints) so that we can guarantee correct reservation processing and contract fulfilment.

We use a software application from aleno AG, Aegertenstrasse 6, 8003 Zurich, Switzerland] to process table reservations. Your data may therefore be stored in an aleno AG database, which may allow aleno AG to access your data if this is necessary for the provision of the software and for support in the use of the software. Information on the processing of data by third parties and any transfer abroad can be found in section 4 of this privacy policy.

The legal basis for this data processing is the fulfilment of a contract with you in accordance with Art. 6 para. 1 lit. b GDPR.

aleno AG may wish to use some of this data for its own purposes (e.g. to send marketing emails or for statistical analyses). aleno AG is the controller for this data processing and must ensure compliance with data protection laws in connection with this data processing. Information on data processing by aleno AG can be found under Link.

3.7 Data processing during payment processing

3.7.1 Payment processing in the hotel

If you purchase products, obtain services or pay for your stay in our hotel using electronic payment methods, the processing of personal data is required. By using the payment terminals, you transmit the information stored in your means of payment, such as the name of the cardholder and the card number, to the payment service providers involved (e.g. providers of payment solutions, credit card issuers and credit card acquirers). They also receive the information that the payment method was used in our hotel, the amount and the time of the transaction. Conversely, we only receive the credit of the amount of the payment made at the relevant time, which we can assign to the relevant receipt number, or information that the transaction was not possible or was cancelled. Please always note the information provided by the respective company, in particular the privacy policy and general terms and conditions.

We use a software application from Worldline Schweiz AG, Hardturmstrasse 201, 8051 Zurich, Switzerland, to process payments via the contact form. Therefore, your data may be stored in a database of Worldline Schweiz AG, which may allow Worldline Schweiz AG to access your data if this is necessary for the provision of the software and for support in the use of the software. Information on the processing of data by third parties and any transfer abroad can be found in section 4 of this privacy policy.

The legal basis for our data processing is the fulfilment of a contract with you in accordance with Art. 6 para. 1 lit. b GDPR.

Worldline Schweiz AG may wish to use some of this data for its own purposes (e.g. to send marketing emails or for statistical analyses). Worldline Schweiz AG is responsible for this data processing and must ensure compliance with data protection laws in connection with this data processing. Information on data processing by Worldline Schweiz AG can be found at Link.

3.7.2 Online payment processing

If you make chargeable bookings on our website or order services or products, depending on the product or service and the desired payment method - in addition to the information mentioned in section 3.5.1 - you may be required to provide further data, such as your credit card information or the login to your payment service provider. This information and the fact that you have purchased a service from us at the relevant amount and time will be forwarded to the respective payment service providers (e.g. providers of payment solutions, credit card issuers and credit card acquirers). Please always refer to the information provided by the respective company, in particular the privacy policy and general terms and conditions.

The legal basis for our data processing is the fulfilment of a contract in accordance with Art. 6 para. 1 lit. b GDPR.

We reserve the right to store a copy of the credit card information as security. In order to avoid payment cases, the necessary data, in particular your personal details, may also be transmitted to a credit agency for an automated assessment of your creditworthiness. In this context, the credit agency can assign you a so-called score value. This is an estimate of the future risk of a payment default, e.g. based on a percentage. The value is calculated using mathematical-statistical procedures and taking into account credit agency data from other sources. We reserve the right not to offer you the payment method "invoice" in accordance with the information received.

The legal basis for this data processing is our legitimate interest pursuant to Art. 6 para. 1 lit. f. GDPR in the avoidance of payment defaults.

We use a software application from Worldline Schweiz AG, Hardturmstrasse 201, 8051 Zurich, Switzerland, to check creditworthiness using the contact form. Therefore, your data may be stored in a database of Worldline Schweiz AG, which may allow Worldline Schweiz AG to access your data if this is necessary for the provision of the software and for support in the use of the software. Information on the processing of data by third parties and any transfer abroad can be found in section 4 of this privacy policy.

The legal basis for this data processing is our legitimate interest pursuant to Art. 6 para. 1 lit. f. GDPR in the avoidance of payment defaults.

3.8 Data processing for the recording and billing of purchased services

If you purchase services during your stay (e.g. additional overnight stays, wellness, restaurant, activities), we will collect and process - in addition to your contract data - the data relating to the booking (e.g. time and comments) and the data relating to the booked and purchased service (e.g. subject matter of the service, price and time of purchase of the service) in order to process the service, as described in sections 3.5 and 3.6.

The legal basis for our data processing is the fulfilment of a contract in accordance with Art. 6 para. 1 lit. b GDPR.

3.9 Data processing for email marketing

If you register for our marketing emails (e.g. when you open your customer account or as part of an order, booking or reservation), the following data will be collected. Mandatory information is marked with an asterisk (*) during registration:

E-mail address
Salutation
First name and surname
Date of birth
Country

To avoid misuse and to ensure that the owner of an e-mail address has actually given their consent to receive marketing e-mails, we use the so-called double opt-in for registration. After sending the registration, you will receive an e-mail from us with a confirmation link. You must click on this link to definitively register for the marketing e-mails. If you do not confirm your e-mail address using the confirmation link within the specified period, your data will be deleted and our marketing e-mails will not be sent to this address.

By registering, you consent to the processing of this data in order to receive marketing emails from us about our hotel and related information on products and services. These marketing emails may also include invitations to take part in competitions, to provide feedback or to rate our products and services. The collection of the salutation and first and last name allows us to assign the registration to any existing customer account and thereby personalise the content of the marketing emails. The link to a customer account allows us to make the offers and content contained in the marketing emails more relevant to you and better customise them to your potential needs.

We use your data for sending marketing emails until you withdraw your consent. Withdrawal is possible at any time, in particular via the unsubscribe link contained in all marketing emails.

Our marketing emails may contain a so-called web beacon, 1x1 pixel (tracking pixel) or similar technical aids. A web beacon is an invisible graphic that is linked to the user ID of the respective subscriber. For each marketing email sent, we receive information on which email addresses it was successfully sent to, which email addresses have not yet received the marketing email and which email addresses failed to receive it. We also see which email addresses have opened the marketing email, for how long and which links have been clicked on. Finally, we also receive information about which subscribers have unsubscribed from the mailing list. We use this data for statistical purposes and to optimise the marketing e-mails in terms of frequency and time of sending as well as the structure and content of the marketing e-mails. This enables us to better tailor the information and offers in our marketing emails to the individual interests of the recipients.

The web beacon is deleted when you delete the marketing email. You can prevent the use of web beacons in our marketing emails by setting the parameters of your email programme so that HTML is not displayed in messages. You can find information on how to configure this setting in the help section of your email software application, e.g. here for Microsoft Outlook.

By subscribing to the marketing emails, you also consent to the statistical analysis of user behaviour for the purpose of optimising and adapting the marketing emails.

We use a software application from [The Rocket Science Group, LLC, 675 Ponce de Leon Ave NE, Suite 5000, Atlanta, GA 30308 USA] to provide marketing emails. Therefore, your data may be stored in a database of The Rocket Science Group, LLC, which may allow The Rocket Science Group, LLC to access your data if this is necessary for the provision of the software and for support in the use of the software. Information on the processing of data by third parties and any transfer abroad can be found in section 4 of this privacy policy.

Your consent constitutes the legal basis for the processing of data within the meaning of Art. 6 para. 1 lit. a GDPR. You can revoke your consent at any time for the future.

3.10 Data processing when submitting reviews

To help other users with their decision and to support our quality management (in particular when processing negative feedback), you have the opportunity to rate your stay with us on our website. The data that you have made available to us will be processed and published on the website, i.e. in addition to your rating and the time of your rating, possibly also a comment that you have added to your rating or the name you have given.

The legal basis for data processing is your consent within the meaning of Art. 6 para. 1 lit a GDPR. You can revoke your consent at any time and request the anonymisation of your rating.

We reserve the right to delete unlawful reviews and to contact you in the event of suspicion and ask you to comment.

The legal basis for this processing is our legitimate interest within the meaning of Art. 6 para. 1 lit. f GDPR in the provision of a lawful and unbiased comment and rating function and the prevention of abuse when using it.

3.11 Data processing when submitting guest feedback

During your stay or afterwards, you have the opportunity to give us feedback (e.g. praise, criticism and suggestions for improvement) using a form. We collect the following data for this - depending on the - whereby mandatory information is marked with an asterisk (*) in the corresponding form:

First name and surname
age
Nationality
Duration of stay
Feedback

Your data is processed as part of our quality management and therefore ultimately for the purpose of better tailoring our services and products to the needs of our guests. Specifically, your data is processed for the following purposes:

Clarification of your request, i.e. e.g. obtaining comments from employees and supervisors contacted or obtaining queries from you, etc.;
Evaluating and analysing your information, e.g. compiling satisfaction statistics, comparing individual services, etc.; or
Taking organisational measures in accordance with the findings obtained, e.g. rectifying shortcomings/deficiencies/misconduct, for example by repairing defective equipment, instructing, praising or admonishing employees.

In connection with guest feedback, we use a software application from IRC-Swiss GmbH, Rainweg 8 4496 Kilchberg, Switzerland. Your data may therefore be stored in a database of IRC-Swiss GmbH, which may allow IRC-Swiss GmbH to access your data if this is necessary for the provision of the software and for support in the use of the software. Information on the processing of data by third parties and any transfer abroad can be found in section 4 of this privacy policy.

The legal basis for this processing is your consent in accordance with Art. 6 para. 1 lit. a GDPR. You can revoke this consent at any time for the future.

3.12 Data processing for video surveillance

To protect our guests and employees as well as our property and to prevent and punish unlawful behaviour (in particular theft and damage to property), the entrance area and the publicly accessible areas of our hotel, with the exception of the sanitary facilities, may be monitored by cameras. The image data will only be viewed if there is a suspicion of unlawful behaviour. Otherwise, the images are automatically deleted after [72] hours.

For the provision of the video surveillance system, we rely on a service provider Tyco Integrated Fire & Security (Schweiz) AG, Bahnweg 11 - 8808 Pfäffikon/, SwitzerlandTyco Integrated Fire & Security (Schweiz) AG has access to the data insofar as this is necessary for the provision of the system. If the suspicion of unlawful behaviour is substantiated, the data may be passed on to the extent necessary for the enforcement of claims or for the filing of charges to consulting firms (in particular to a law firm) and authorities. Information on the processing of data by third parties and any transfer abroad can be found in section 4 of this privacy policy. Further information on data processing in connection with Tyco Integrated Fire & Security (Schweiz) AG can be found here.

The legal basis is our legitimate interest within the meaning of Art. 6 para. 1 lit. f GDPR in the protection of our guests, our employees and our property as well as in the protection and enforcement of our rights.

3.13 Data processing when using our WiFi network

In our hotel, you have the option of using the WiFi network operated by Swisscom (Switzerland) Ltd, Alte Tiefenaustrasse 6, 3050 Bern, Switzerland, free of charge. Prior registration is required to prevent misuse and to punish unlawful behaviour. In doing so, you transmit the following data to Swisscom (Switzerland) Ltd:

Option Free SMS Login

Mobile phone number
MAC address of the end device (automatic)

Option Free Voucher Login

Payment method
Email address
MAC address of the end device (automatic)

Hotel Login option

Room number
Guest name
MAC address of the end device (automatic)

In addition to the above data, data on the time and date of use, the network used and the end device are recorded each time the WiFi network is used. The legal basis for this processing is your consent within the meaning of Art. 6 para. 1 lit. a GDPR. You can revoke this consent at any time for the future.

Swisscom (Switzerland) Ltd is responsible for this data processing. As part of the registration process, you give your consent to Swisscom (Switzerland) Ltd and must accept the Terms of Use and the Privacy Policy of Swisscom (Switzerland) Ltd.

The legal basis for this processing is our legitimate interest within the meaning of Art. 6 para. 1 lit. f GDPR in the provision of a Wi-Fi network in compliance with the applicable legal provisions.

3.14 Data processing for the fulfilment of statutory reporting obligations

Upon arrival at our hotel, we may require the following information from you and your accompanying persons, whereby mandatory information is marked with an asterisk (*) in the corresponding form:

Salutation
First name and surname
Billing address
Date of birth
Nationality
Identity card or passport for foreign guests only
Date of arrival and departure

We collect this information to fulfil legal reporting obligations, in particular those arising from hospitality or police law. If we are obliged to do so under the applicable regulations, we forward this information to the competent authority.

The legal basis for processing this data is our legitimate interest within the meaning of Art. 6 para. 1 lit. c GDPR in complying with our legal obligations.

3.15 Data processing for job applications

You have the opportunity to apply for a job in our company either spontaneously or in response to a specific job advertisement. In doing so, we process the personal data provided by you.

We use the data you provide to check your application and suitability for employment. Application documents of unsuccessful applicants will be deleted at the end of the application process, unless you explicitly agree to a longer retention period or we are legally obliged to retain them for a longer period.

We use a software application from New Work SE (Onlyfy), Am Strandkai 1 20457 Hamburg Germany, to process applications. Therefore, your data may be stored in a database of New Work SE, which may enable New Work SE to access your data if this is necessary for the provision of the software and for support in the use of the software. Information on the processing of data by third parties and any transfer abroad can be found in section 4 of this privacy policy.

The legal basis for the processing of your data for this purpose is the performance of a contract (pre-contractual phase) in accordance with Art. 6 para. 1 lit. b GDPR.

4 Disclosure and transfer abroad
4.1 Disclosure to third parties and access by third parties

Without the support of other companies, we would not be able to provide our services in the desired form. In order for us to be able to use the services of these companies, it is also necessary to pass on your personal data to these companies to a certain extent. Your data will be passed on to selected third-party service providers and only to the extent necessary to optimise the provision of our services.

Various third-party service providers are already explicitly mentioned in this privacy policy. These are the following service providers:

[Idea Creation GmbH, Walchestrasse 15, 8006 Zurich, Switzerland]. Further information on data processing in connection with Swiss Holiday Park AG can be found at www.e-guma.ch/datenschutz/
Unifocus, 10 John St. London WC1N 2EB, United Kingdom.
BLENT Sàrlc/o, Ecole hôtelière de Lausanne, Route de Cojonnex, 181000 Lausanne Switzerland
Aleno, Werstrasse 21, 8004 Zurich, Further information on data processing in connection with aleno can be found here: www.aleno.me

The legal basis for these transfers is the necessity for the fulfilment of a contract within the meaning of Art. 6 para. 1 lit. b GDPR.

Your data will also be passed on if this is necessary to fulfil the services you have requested, e.g. to restaurants or providers of other services for which you have made a reservation through us. The legal basis for these transfers is the necessity for the fulfilment of a contract within the meaning of Art. 6 para. 1 lit. b GDPR. The third-party service providers are responsible for this data processing within the meaning of the Data Protection Act and not us. It is the responsibility of these third-party service providers to inform you about their own data processing - beyond the transfer of data for the provision of services - and to comply with data protection laws.

In addition, your data may be passed on, in particular to authorities, legal advisors or debt collection agencies, if we are legally obliged to do so or if this is necessary to protect our rights, in particular to enforce claims arising from the relationship with you. Data may also be disclosed if another company intends to acquire our company or parts thereof and such disclosure is necessary to carry out a due diligence review or to complete the transaction.

The legal basis for this data processing is our legitimate interest within the meaning of Art. 6 para. 1 lit. f GDPR in the protection of our rights and fulfilment of our obligations or the sale of our company or parts thereof.

4.2 Transfer of personal data abroad

We are authorised to transfer your personal data to third parties abroad if this is necessary to carry out the data processing mentioned in this privacy policy. Individual data transfers have been mentioned above in section 3. It goes without saying that the statutory provisions on the disclosure of personal data to third parties are complied with. The countries to which data is transferred include those that the Federal Council and the EU Commission have decided have an adequate level of data protection (such as the member states of the EEA or, from the EU's point of view, Switzerland), but also countries (such as the USA) whose level of data protection is not considered adequate (see Annex 1 of the General Data Protection Regulation (GDPR) and the EU Commission's website). If the country in question does not have an adequate level of data protection, we ensure that your data is adequately protected by these companies by means of suitable guarantees, unless an exception is specified for individual data processing (see Art. 49 GDPR). Unless otherwise stated, these are standard contractual clauses within the meaning of Art. 46 para. 2 lit. c GDPR, which can be found on the websites of the Federal Data Protection and Information Commissioner (FDPIC) and the EU Commission. If you have any questions about the measures taken, please get in touch with our contact person for data protection (see section 2).

4.3 Information on data transfers to the USA

Some of the third-party service providers mentioned in this privacy policy are based in the USA. For the sake of completeness, we would like to point out to users resident or domiciled in Switzerland or the EU that there are monitoring measures in place in the USA by US authorities that generally enable the storage of all personal data of all persons whose data has been transferred from Switzerland or the EU to the USA. This is done without differentiation, restriction or exception based on the objective pursued and without an objective criterion that makes it possible to restrict the US authorities' access to the data and its subsequent use to very specific, strictly limited purposes that justify the interference associated with both access to this data and its use. In addition, we would like to point out that in the USA there are no legal remedies or effective legal protection for data subjects from Switzerland or the EU against general access rights of US authorities that would allow them to obtain access to the data concerning them and to obtain its correction or deletion. We explicitly draw your attention to this legal and factual situation in order to enable you to make an appropriately informed decision to consent to the use of your data.

We would also like to point out to users residing in Switzerland or a member state of the EU that the USA does not have an adequate level of data protection from the perspective of the European Union and Switzerland - partly due to the statements made in this section. Insofar as we have explained in this privacy policy that recipients of data (such as Google) are based in the USA, we will ensure that your data is adequately protected by our third-party service providers through contractual arrangements with these companies and any additional appropriate guarantees that may be required.

5 Background data processing on our website
5.1 Data processing when visiting our website (log file data)

When you visit our website, the servers of our hosting provider [METANET AG, Josefstrasse 218, CH-8005 Zurich] temporarily store every access in a log file. The following data is recorded without any action on your part and stored by us until it is automatically deleted:

IP address of the requesting computer;
Date and time of access;
Name and URL of the retrieved file;
Website from which the access was made, if applicable with the search term used;
Operating system of your computer and the browser you are using (incl. type, version and language setting);
Device type in the case of access from mobile phones;
City or region from where the access was made; and
Name of your internet access provider.

This data is collected and processed for the purpose of enabling the use of our website (connection establishment), ensuring system security and stability in the long term, enabling error and performance analysis and optimisation of our website (see also section 5.4 for the last points).

In the event of an attack on the website's network infrastructure or if there is a suspicion of other unauthorised or improper use of the website, the IP address and other data will be evaluated for clarification and defence purposes and, if necessary, used to identify the user concerned in the context of civil or criminal proceedings.

The purposes described above constitute our legitimate interest within the meaning of Art. 6 para. 1 lit. f GDPR and thus the legal basis for data processing.

Finally, when you visit our website, we use cookies as well as applications and tools that are based on the use of cookies. The data described here may also be processed in this context. You will find more detailed information on this in the following sections of this privacy policy, in particular section 5.2 below.

5.2 Cookies

Cookies are information files that your web browser stores on your computer's hard drive or memory when you visit our website. Cookies are assigned identification numbers that identify your browser and allow the information contained in the cookie to be read.

Among other things, cookies help to make your visit to our website easier, more pleasant and more useful. We use cookies for various purposes that are required for your desired use of the website, i.e. are "technically necessary". For example, we use cookies to be able to identify you as a registered user after you have logged in without you having to log in again each time you navigate through the various subpages. The provision of the ordering and booking functions is also based on the use of cookies. Cookies also perform other technical functions required for the operation of the website, such as load balancing, i.e. the distribution of the performance load of the site to different web servers in order to reduce the load on the servers. Cookies are also used for security purposes, e.g. to prevent the unauthorised posting of content. Finally, we also use cookies as part of the design and programming of our website, e.g. to enable the uploading of scripts or codes.

The legal basis for this data processing is our legitimate interest within the meaning of Art. 6 para. 1 lit. f GDPR in providing a user-friendly and up-to-date website.

Most Internet browsers accept cookies automatically. However, when accessing our website, we ask for your consent to the cookies we use that are not technically necessary, in particular when using cookies from third-party providers for marketing purposes. You can make your desired settings using the corresponding buttons in the cookie banner. Details on the services and data processing associated with the individual cookies can be found within the cookie banner and in the following sections of this privacy policy.

You may also be able to configure your browser so that no cookies are stored on your computer or so that a message always appears when you receive a new cookie. On the following pages you will find explanations of how you can configure the processing of cookies in selected browsers.

Deactivating cookies may mean that you cannot use all the functions of our website.

5.3 Tracking and web analysis tools

5.3.1 General information on tracking

We use the web analysis services listed below for the purpose of designing and continuously optimising our website to meet your needs. In this context, pseudonymised user profiles are created and cookies are used (please also refer to section 5.2). The information generated by the cookie about your use of this website is usually transferred to a server of the service provider together with the log file data listed under section 5.1, where it is stored and processed. This may also involve a transfer to servers abroad, e.g. in the USA (see, in particular, the lack of an adequate level of data protection and the guarantees provided, sections 4.2 and 4.3).

By processing the data, we receive the following information, among other things

Navigation path taken by a visitor on the site (incl. content viewed and products selected or purchased or services booked);
Time spent on the website or subpage;
Subpage on which the website is left;
Country, region or city from which access is made;
end device (type, version, colour depth, resolution, width and height of the browser window); and
returning or new visitors.

The provider will use this information on our behalf to analyse the use of the website, in particular to compile website activities and to provide further services associated with the use of the website and the Internet for the purposes of market research and the needs-based design of these websites. We and the providers can be regarded as joint controllers under data protection law for this processing up to a certain extent.

The legal basis for this data processing with the following services is your consent within the meaning of Art. 6 para. 1 lit. a GDPR. You can withdraw your consent or refuse processing at any time by rejecting or switching off the relevant cookies in the settings of your web browser (see section 5.2) or by making use of the service-specific options described below.

For further processing of the data by the respective provider as the (sole) controller under data protection law, in particular any disclosure of this information to third parties, e.g. to authorities due to national legal regulations, please refer to the respective data protection information of the provider.

5.3.2 Google Analytics

We use the web analysis service Google Analytics from Google Ireland Limited (Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland) or Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (Google).

Contrary to the description in section 5.4.1, IP addresses are not logged or stored in Google Analytics (in the "Google Analytics 4" version used here). In the case of access originating from the EU, IP address data is only used to derive location data and then deleted immediately. When collecting measurement data in Google Analytics, all IP searches are carried out on EU-based servers before the traffic is forwarded to Analytics servers for processing. Regional data centres are used in Google Analytics. If a connection is established in Google Analytics to the nearest available Google data centre, the measurement data is sent to Analytics via an encrypted HTTPS connection. In these centres, the data is further encrypted before it is forwarded to the Analytics processing servers and made available on the platform. The most suitable local data centre is determined based on the IP addresses. This may also result in data being transferred to servers abroad, e.g. in the USA (see section 4.2, in particular on the lack of an adequate level of data protection and the guarantees provided).

We also use the technical extension "Google Signals", which enables cross-device tracking. This allows an individual website visitor to be assigned to different end devices. However, this only happens if the visitor has logged into a Google service when visiting the website and has also activated the "personalised advertising" option in their Google account settings. Even then, however, no personal data or user profiles are made available to us; they remain anonymous to us. If you do not wish to use "Google Signals", you can deactivate the "personalised advertising" option in your Google account settings.

Users can prevent Google from collecting the data generated by the cookie and relating to the use of the website by the user concerned (including the IP address) and from processing this data by Google by downloading and installing the browser plug-in available at the following link: http://tools.google.com/dlpage/gaoptout?hl=de.

As an alternative to the browser plugin, users can click this link to prevent Google Analytics from collecting data on the website in the future. An opt-out cookie will be stored on the user's end device. If the user deletes cookies (see section 5 Cookies), the link must be clicked again.

5.4 Social media
5.4.1 Social media profiles

On our website, we have included links to our profiles in the social networks of the following providers

Meta Platforms Inc, 1601 S California Ave, Palo Alto, CA 94304, USA, privacy policy;
Twitter Inc. with registered office at 1355 Market Street, Suite 900, San Francisco, CA 94103, USA, privacy policy;
TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland, data protection information
LinkedIn Unlimited Company, Wilton Place, Dublin 2, Ireland, privacy policy.

If you click on the social network icons, you will be automatically redirected to our profile in the respective network. This establishes a direct connection between your browser and the server of the respective social network. As a result, the network receives the information that you have visited our website with your IP address and clicked on the link. This may also result in data being transferred to servers abroad, e.g. in the USA (see sections 4.2 and 4.3 for more information, in particular on the lack of an adequate level of data protection and the guarantees provided).

If you click on a link to a network while you are logged into your user account with the relevant network, the content of our website may be linked to your profile so that the network can associate your visit to our website directly with your account. If you want to prevent this, you should log out before clicking on the relevant links. A connection between your access to our website and your user account takes place in any case if you log in to the respective network after clicking on the link. The respective provider is responsible under data protection law for the associated data processing. Please therefore refer to the data protection information on the network's website.

The legal basis for any data processing attributed to us is our legitimate interest within the meaning of Art. 6 para. 1 lit. f GDPR in the use and advertising of our social media profiles.

5.4.2 Social media plugins

You can use social media plugins from the following providers on our website

Meta Platforms Inc, 1601 S California Ave, Palo Alto, CA 94304, USA, privacy policy;
Twitter Inc, 1355 Market Street, Suite 900, San Francisco, CA 94103, USA, privacy policy;
TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland.
Google LLC, D/B/A YouTube, 901 Cherry Ave, San Bruno, CA 94066, USA Privacy Policy
LinkedIn Unlimited Company, Wilton Place, Dublin 2, Ireland, Privacy Policy.

We use social media plugins to make it easier for you to share content from our website. The social media plugins help us to increase the visibility of our content on social networks and thus contribute to better marketing.

The plugins are deactivated on our websites by default and therefore do not send any data to the social networks when you simply visit our website. To increase data protection, we have integrated the plugins in such a way that a connection to the networks' servers is not automatically established. Your browser only establishes a direct connection to the servers of the respective social network when you activate the plugins by clicking on them and thus give your consent to data transmission and further processing by the social network providers.

The content of the plugin is transmitted directly from the social network to your browser, which integrates it into the website. As a result, the respective provider receives the information that your browser has accessed the corresponding page of our website, even if you do not have an account with this social network or are not currently logged in to it. This information (including your IP address) is transmitted directly from your browser to a server of the provider (usually in the USA) and stored there (see, in particular, the lack of an adequate level of data protection and the guarantees provided, sections 4.2 and 5.3). We have no influence on the scope of the data that the provider collects with the plugin, although we can be regarded as joint controllers with the providers to a certain extent from a data protection perspective.

If you are logged in to the social network, it can assign your visit to our website directly to your user account. If you interact with the plugins, the corresponding information is also transmitted directly to a server of the provider and stored there. The information (e.g. that you like a product or service from us) may also be published on the social network and may be displayed to other users of the social network. The provider of the social network may use this information for the purpose of displaying advertising and customising the respective offer. For this purpose, usage, interest and relationship profiles may be created, e.g. to analyse your use of our website with regard to the advertisements displayed to you on the social network, to inform other users about your activities on our website and to provide other services associated with the use of the social network. The purpose and scope of the data collection and the further processing and use of the data by the providers of the social networks as well as your rights in this regard and setting options to protect your privacy can be found directly in the data protection information of the respective provider.

If you do not want the social network provider to assign the data collected via our website to your user account, you must log out of the social network before activating the plugins. Your consent within the meaning of Art. 6 para. 1 lit. a GDPR forms the legal basis for the data processing described. You can revoke your consent at any time by declaring your revocation to the provider of the plugin in accordance with the information in their data protection information.

5.5 Online advertising and targeting
5.5.1 In general

We use the services of various companies to provide you with interesting offers online. This involves analysing your user behaviour on our website and the websites of other providers in order to subsequently display online advertising tailored to you.

Most technologies for tracking your user behaviour and for the targeted display of advertising (targeting) work with cookies (see also section 5.2), with which your browser can be recognised via various websites. Depending on the service provider, it may also be possible for you to be recognised online even when using different end devices (e.g. laptop and smartphone). This may be the case, for example, if you have registered with a service that you use on several devices.

In addition to the data already mentioned, which is generated when websites are accessed (log file data, see section 5.1) and when cookies are used (section 5.2) and which may be passed on to the companies involved in the advertising networks, the following data in particular is used to select the advertising that is potentially most relevant to you:

Information about you that you have provided when registering or using a service of advertising partners (e.g. your gender, your age group); and
User behaviour (e.g. search queries, interactions with advertising, types of websites visited, products or services viewed and purchased, newsletters subscribed to).

We and our service providers use this data to recognise whether you belong to the target group we are addressing and take this into account when selecting advertisements. For example, after you have visited our site, you may be shown adverts for the products or services you have consulted when you visit other sites (re-targeting). Depending on the scope of the data, a user profile may also be created that is automatically evaluated, with the ads being selected according to the information stored in the profile, such as membership of certain demographic segments or potential interests or behaviours. Such adverts may be displayed to you on various channels, including our website or app (as part of on-site and in-app marketing) as well as adverts placed via the online advertising networks we use, such as Google.

The data may then be analysed for the purpose of billing the service provider and assessing the effectiveness of advertising measures in order to better understand the needs of our users and customers and improve future campaigns. This may also include the information that the performance of an action (e.g. visiting certain sections of our websites or sending information) is attributable to a specific advertisement. We also receive aggregated reports from the service providers on advertising activities and information on how users interact with our website and our adverts.

The legal basis for this data processing is your consent within the meaning of Art. 6 para. 1 lit. a GDPR. You can revoke your consent at any time by rejecting or switching off the relevant cookies in the settings of your web browser (see section 5.2). Further options for blocking advertising can also be found in the information provided by the respective service provider, e.g. Google.

5.5.2 Google Ads

This website uses the services of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (Google) for online advertising, as explained in Section 5.6.1. Google uses cookies for this purpose (see the list here), which enable your browser to be recognised when you visit other websites. The information generated by the cookies about your visit to these websites (including your IP address) is transmitted to a Google server in the USA and stored there (see, in particular, the lack of an adequate level of data protection and the guarantees provided, sections 4.2 and 4.3). Further information on data protection at Google can be found here.

5.5.3 Bing Ads

This website uses the services of Bing Ads for online advertising, as explained in section 5.6.1. Service provider: Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA. Bing uses cookies that enable your browser to be recognised when you visit other websites. The information generated by the cookies about your visit to these websites (including your IP address) is transmitted to a Bing server in the USA and stored there (see, in particular, the lack of an adequate level of data protection and the guarantees provided, sections 4.2 and 4.3). Further information on data protection at Bing can be found here.

6 Retention periods

We only store personal data for as long as is necessary to carry out the processing described in this privacy policy within the scope of our legitimate interest. In the case of contractual data, storage is prescribed by statutory retention obligations. Requirements that oblige us to retain data result from accounting and tax regulations. According to these regulations, business communication, concluded contracts and accounting documents must be stored for up to 10 years. If we no longer need this data to perform the services for you, the data will be blocked. This means that the data may then only be used if this is necessary for the fulfilment of retention obligations or for the defence and enforcement of our legal interests. The data will be deleted as soon as there is no longer an obligation to retain it and there is no longer a legitimate interest in retaining it.

7 Data security

We use suitable technical and organisational security measures to protect your personal data stored by us against loss and unlawful processing, in particular unauthorised access by third parties. Our employees and the service companies commissioned by us are obliged by us to maintain confidentiality and to respect data protection. Furthermore, these persons are only granted access to personal data to the extent necessary to fulfil their tasks.

Our security measures are continuously adapted in line with technological developments. However, the transmission of information via the Internet and electronic means of communication always harbours certain security risks and we can therefore provide no absolute guarantee for the security of information transmitted in this way.

8 Your rights

If the legal requirements are met, you have the following rights as a data subject:

Right to information: you have the right to request access to your personal data stored by us at any time free of charge if we process it. This gives you the opportunity to check what personal data we process about you and whether we process it in accordance with the applicable data protection regulations.

Right to rectification: You have the right to have inaccurate or incomplete personal data rectified and to be informed of the rectification. In this case, we will also inform the recipients of the data concerned about the adjustments we have made, unless this is impossible or involves disproportionate effort.

Right to erasure: You have the right to have your personal data erased under certain circumstances. In individual cases, particularly in the case of statutory retention obligations, the right to erasure may be excluded. In this case, the data may be blocked instead of erased if the conditions are met.

Right to restriction of processing: You have the right to request that the processing of your personal data be restricted.

Right to data portability: You have the right to receive from us, free of charge, the personal data that you have provided to us in a readable format.

Right to object: You can object to data processing at any time, particularly in the case of data processing in connection with direct marketing (e.g. marketing e-mails).

Right to withdraw consent: You have the right to withdraw your consent at any time. However, processing activities based on your consent in the past are not rendered unlawful by your revocation.

To exercise these rights, please send us an email to the following address: [email protected]

Right to lodge a complaint: You have the right to lodge a complaint with a competent supervisory authority, e.g. against the way in which your personal data is processed.

Privacy policy

Storage and tracking settings