Privacy Policy - Hotel Cabana Grindelwald Schweiz

With this Privacy Policy, we inform you about the personal data we process in connection with our activities and operations, including our https://www.cabana-grindelwald.ch website. We particularly inform about why, how, and where we process which personal data. We also inform about the rights of individuals whose data we process.

For individual or additional activities and operations, further privacy policies as well as other legal documents such as Terms and Conditions (T&C), Terms of Use, or Participation Terms may apply.

We are subject to Swiss data protection law and, if applicable, foreign data protection laws, in particular those of the European Union (EU) with the General Data Protection Regulation (GDPR). The European Commission acknowledges that Swiss data protection law ensures adequate data protection.

1. Contact Addresses

Responsibility for the processing of personal data:

Hotel Cabana Grindelwald
Familie P. und B. Bohren
Dorfstrasse 46
3818 Grindelwald
Switzerland

hotel@cabana-grindelwald.ch

2.1 Terms

Personal data refers to all information relating to an identified or identifiable natural person. An affected person is a person whose personal data we process.
Processing encompasses every handling of personal data, regardless of the methods and procedures used, for instance, accessing, matching, adjusting, archiving, retaining, reading, disclosing, obtaining, capturing, collecting, deleting, revealing, arranging, organizing, storing, modifying, distributing, linking, destroying, and using personal data.

The European Economic Area (EEA) includes the Member States of the European Union (EU) as well as the Principality of Liechtenstein, Iceland, and Norway. The General Data Protection Regulation (GDPR) refers to the processing of personal data as the processing of personal-related data.

We process personal data in accordance with Swiss data protection law, in particular the Federal Act on Data Protection (Data Protection Act, DPA) and the Ordinance on Data Protection (Data Protection Ordinance, DPO).

We process personal data in accordance with the General Data Protection Regulation (GDPR) – where and to the extent that it applies – based on at least one of the following legal bases:

  • Art. 6 Para. 1 lit. b GDPR for the necessary processing of personal data for the performance of a contract with the data subject and for taking steps prior to entering a contract.
  • Art. 6 Para. 1 lit. f GDPR for the necessary processing of personal data to pursue our or a third party’s legitimate interests, unless the fundamental freedoms, rights, and interests of the data subject prevail. Legitimate interests particularly include our aim to permanently conduct our activities in a user-friendly, safe, and reliable manner, ensuring information security, protection against misuse, enforcing our legal claims, and complying with Swiss law.
  • Art. 6 Para. 1 lit. c GDPR for the necessary processing of personal data to comply with a legal obligation under any potentially applicable law of member states within the European Economic Area (EEA).
  • Art. 6 Para. 1 lit. e GDPR for the necessary processing of personal data to perform a task carried out in the public interest.
  • Art. 6 Para. 1 lit. a GDPR for the processing of personal data with the consent of the data subject.
  • Art. 6 Para. 1 lit. d GDPR for the necessary processing of personal data to protect vital interests of the data subject or another natural person.

3. Type, Scope, and Purpose

We process the personal data that is necessary to continuously, user-friendly, securely, and reliably conduct our activities. Such personal data can particularly fall into the categories of basic and contact data, browser and device data, content data, meta or margin data, usage data, location data, sales data, as well as contract and payment data.
We process personal data for the duration that is necessary for the respective purpose or purposes or as required by law. Personal data no longer needed for processing is anonymized or deleted.

We may have personal data processed by third parties. We can process personal data in collaboration with third parties or transfer it to third parties. Such third parties particularly include specialized providers whose services we use. We also ensure data protection with such third parties.

We process personal data fundamentally only with the consent of the affected individuals. Where and to the extent that processing is allowed based on other legal reasons, we might not seek consent. For example, we can process personal data without consent to fulfill a contract, comply with legal obligations, or safeguard predominant interests.

Within this framework, we process, in particular, information that a data subject voluntarily submits to us when making contact – for example, by mail, e-mail, instant messaging, contact form, social media, or telephone – or when registering for a user account. We may store such information, for instance, in an address book or using similar tools. If we receive data about other individuals, those transmitting the data are obliged to ensure the protection of data for these individuals and to ensure the accuracy of these personal data.

Furthermore, we process personal data that we obtain from third parties, acquire from publicly available sources, or collect during the course of our activities, provided and to the extent that such processing is legally permissible.

4. Personal Data Abroad

We process personal data principally in Switzerland and in the European Economic Area (EEA). However, we may also export or transfer personal data to other countries, especially for processing or to be processed there.
We can export personal data to all countries and territories on Earth and elsewhere in the Universe, provided that the local law, according to the decision of the Swiss Federal Council, ensures adequate data protection and – if and to the extent that the General Data Protection Regulation (GDPR) applies – according to the decision of the European Commission, ensures adequate data protection.

We can transfer personal data to countries whose law does not ensure adequate data protection, provided data protection is ensured for other reasons, especially based on standard data protection clauses or other appropriate guarantees. In exceptional cases, we may export personal data to countries without adequate or suitable data protection if the specific data protection requirements are met, for example, the explicit consent of the affected persons or a direct connection with the conclusion or execution of a contract. We will gladly provide affected persons with information about any guarantees upon request or provide a copy of any guarantees.

5. Rights of Affected Persons

5.1 Data Protection Claims

We grant affected persons all claims according to applicable data protection law. Affected persons have the following rights in particular:

  • Information: Affected persons can request information on whether we process personal data about them, and if so, which personal data this concerns. Affected persons also receive the information necessary to assert their data protection claims and ensure transparency. This includes the processed personal data as such, but also details about the purpose of processing, the duration of storage, any disclosure or potential export of data to other countries, and the origin of the personal data.
  • Correction and Restriction: Affected persons can correct inaccurate personal data, complete incomplete data, and request the restriction of the processing of their data.
  • Deletion and Objection: Affected persons can have personal data deleted (the “right to be forgotten”) and object to the processing of their data with effect for the future.
  • Data Release and Data Transfer: Affected persons can request the release of personal data or the transfer of their data to another responsible party.

We can postpone, limit, or deny the exercise of the rights of affected persons within the legally permissible framework. We may inform affected persons about any conditions that need to be met to exercise their data protection claims. For example, we may partially or fully refuse to provide information citing trade secrets or the protection of other individuals. We may also partially or fully refuse to delete personal data citing statutory retention obligations.
We may exceptionally charge fees for the exercise of rights. We will inform affected persons in advance about any potential costs.

We are obliged to identify individuals who request information or assert other rights using appropriate measures. Affected individuals are required to cooperate.

5.2 Right to Complain

Affected individuals have the right to enforce their data protection claims through legal channels or to lodge a complaint with a competent data protection supervisory authority.
The data protection supervisory authority for private entities and federal bodies in Switzerland is the Federal Data Protection and Information Commissioner (FDPIC).

If and when the General Data Protection Regulation (GDPR) is applicable, affected individuals have the right to lodge a complaint with a competent European data protection supervisory authority.

6. Data Security

We take appropriate technical and organizational measures to ensure data security commensurate with the respective risk. However, we cannot guarantee absolute data security.
Access to our website is secured through transport encryption (SSL / TLS, particularly with the Hypertext Transfer Protocol Secure, abbreviated as HTTPS). Most browsers indicate transport encryption with a padlock in the address bar.

Our digital communication is subject to—like essentially all digital communication—mass surveillance without cause or suspicion, as well as other monitoring by security agencies in Switzerland, the rest of Europe, the United States of America (USA), and other countries. We cannot exert direct influence over the respective processing of personal data by intelligence agencies, police departments, and other security authorities.

7. Use of the Website

7.1 Cookies

We may use cookies. Cookies—both our own cookies (First-Party-Cookies) and those of third parties whose services we use (Third-Party-Cookies)—are data that is stored in the browser. Such stored data is not necessarily limited to traditional text-form cookies.
Cookies can be stored in the browser temporarily as “session cookies” or for a specific duration as so-called permanent cookies. “Session cookies” are automatically deleted when the browser is closed. Permanent cookies have a specific storage duration. Cookies, in particular, allow a browser to be recognized during its next visit to our website and thus help in measuring, for instance, the reach of our website. However, permanent cookies can also be used for online marketing.

Cookies can be deactivated fully or partially and deleted at any time in the browser settings. Without cookies, our website may not be fully accessible. We request—when and where necessary—an active explicit consent for the use of cookies.

For cookies used for performance and reach measurement or for advertising, a general objection (“Opt-out”) is possible for numerous services via the AdChoices (Digital Advertising Alliance of Canada), the Network Advertising Initiative (NAI), YourAdChoices (Digital Advertising Alliance), or Your Online Choices (European Interactive Digital Advertising Alliance, EDAA).

7.2 Server Log Files

For every access to our website, we may capture the following details, provided they are transmitted by your browser to our server infrastructure or can be determined by our web server: Date and time including time zone, Internet Protocol (IP) address, access status (HTTP status code), operating system including user interface and version, browser including language and version, individual sub-page of our website accessed including the volume of data transmitted, and the last webpage accessed in the same browser window (referer or referrer).
We store such details, which may also constitute personal data, in server log files. These details are necessary to provide our website consistently, user-friendly, and reliably and to ensure data security, especially the protection of personal data – even by third parties or with the help of third parties.

7.3 Tracking Pixels

We may use tracking pixels on our website. Tracking pixels are also referred to as web beacons. Tracking pixels—also from third parties whose services we utilize—are typically small, usually invisible images that are automatically accessed when visiting our website. The same details as in server log files can be captured with tracking pixels.

8. Social Media

We have a presence on social media platforms and other online platforms to communicate with interested individuals and inform them about our activities and operations. In connection with these platforms, personal data may also be processed outside of Switzerland and the European Economic Area (EEA).
The respective general terms and conditions (GTC) and usage terms, as well as data protection statements and other provisions of the individual platform operators, also apply. These provisions specifically inform about the rights of affected persons directly against the respective platform, which, for example, includes the right to information.

For our Facebook social media presence, including the so-called Page Insights, we are—where and when the General Data Protection Regulation (GDPR) applies—jointly responsible with Meta Platforms Ireland Limited (Ireland). The Meta Platforms Ireland Limited is part of the Meta companies (including those in the USA). Page Insights provide insights into how visitors interact with our Facebook presence. We use Page Insights to effectively and user-friendly present our social media presence on Facebook.

Further information on the type, extent, and purpose of data processing, information on the rights of affected individuals, as well as the contact details of Facebook and the data protection officer of Facebook can be found in Facebook’s Privacy Policy. We have concluded the so-called “Controller Addendum” with Facebook and have agreed in particular that Facebook is responsible for ensuring the rights of the affected individuals. Relevant information on the so-called Page Insights can be found on the page “Information on Page Insights” including “Information on Page Insights Data”.

9. Third-party Services

We use services from specialized third parties to be able to carry out our activities and operations continuously, user-friendly, safely, and reliably. With such services, we can embed functions and content into our website. When embedding, the services used necessarily capture at least temporarily the Internet Protocol (IP) addresses of users for technical reasons.
For essential security-related, statistical, and technical purposes, third parties whose services we use may process data related to our activities and operations in an aggregated, anonymized, or pseudonymized form. These are, for example, performance or usage data to provide the respective service.

In particular, we use:

9.1 Digital Infrastructure

We use services from specialized third parties to access the required digital infrastructure related to our activities and operations. This includes, for example, hosting and storage services from selected providers.

We especially use:

9.2 Booking Platforms

We use services from specialized third parties to enable direct bookings of our offerings. Furthermore, we integrate “badges” from booking platforms in this context to directly display the current customer rating in numerical form on our website.

We especially use:

9.2 Social Media Features and Social Media Content

We use services and plugins from third parties to be able to embed functions and content from social media platforms as well as to enable sharing of content on social media platforms and other means.

We especially use:

9.3 Maps

We use third-party services to embed maps into our website.

We especially use:

10. Success and Reach Measurement

We try to determine how our online service is used. In this context, for example, we can measure the success and reach of our activities and operations as well as the impact of third-party links on our website. But we can also try and compare how different parts or versions of our online service are used (“A/B testing” method). Based on the results of success and reach measurement, we can fix errors, strengthen popular content, or make improvements to our online offering.

For success and reach measurement, in most cases, the Internet Protocol (IP) addresses of individual users are saved. In this case, IP addresses are fundamentally shortened (“IP masking”) to follow the principle of data economy by the corresponding pseudonymization.

In success and reach measurement, cookies can be used and user profiles created. Any user profiles created may include, for example, the individual pages visited or viewed content on our website, information about screen size or browser window size, and – at least approximately – location. Fundamentally, any user profiles are only created pseudonymously and are not used to identify individual users. Some third-party services where users are logged in may possibly associate the use of our online service with the user account or user profile at the respective service.

We especially use:

  • Google Tag Manager: Integration and management of other services for success and reach measurement as well as other services from Google and third parties; Provider: Google; Google Tag Manager-specific information: “Data captured with Google Tag Manager”; further privacy information can be found in the individual integrated and managed services.

11. Final Provisions

We created this privacy policy with the Privacy Policy Generator by Datenschutzpartner Datenschutz-Generator von Datenschutzpartner and translated it using the Deepl.com Service.

We can adjust and amend this privacy policy at any time. We will inform about such adjustments and additions in an appropriate manner, especially by publishing the current privacy policy on our website.

prepayment-link:
Hotel CABANA - Fam. P. & B. Bohren - Dorfstrasse 46 - 3818 Grindelwald, Switzerland - Tel. +41 33 8545070 - hotel@cabana-grindelwald.ch