Source: https://www.gornergratbahn.ch/ja/footerbarnavigationright/datenschutzerklaerung/
Timestamp: 2019-04-18 12:41:30+00:00

Document:
We, the public limited company Matterhorn Gotthard Bahn, Bahnhofplatz 7, 3900 Brig, operate the websites www.matterhorngotthardbahn.ch, www.gornergratbahn.ch and www.glacierexpress.ch (hereinafter referred to as “website”) as well as provide the services offered there and are thus responsible for the collection, processing and use of your personal data and for the compatibility of the data processing with the respectively applicable data pro-tection law, particularly the Swiss Data protection Act.
Your trust is important to us. We therefore take the issue of data protection seriously and ensure appropriate security. As a result, we naturally abide by the statutory requirements of the Federal Act on Data Protection (FADP), the Ordinance to the Federal Act on Data Protection (OFADP), the Telecommunications Act (TCA) and other regulations of the Swiss Data Protection Act. We also naturally meet the statutory requirements of the EU General Data Protection Regulation (GDPR).
Please take note of the information below so that you shall know as to which personal data we collect from you and for which purposes it is used.
- the name of your Internet access provider.
This data shall be collected and processed for the purpose of allowing you to use our website (establishing a connection), ensuring system security and stability consistently and allowing optimisation of our Internet offer, as well as for internal statistical purposes.
The aforementioned information shall not be linked with personal data or saved with personal data. Only in the event of an attack on the network infrastructure of the website or if another form of illicit or abusive use of the website is suspected, the IP address shall be analysed for the purposes of clarification and defence and, if necessary, used in criminal proceedings for identification and in civil and criminal proceedings against the users concerned.
Our legitimate interest in the processing of data within the meaning of art. 6 para. 1 lit. f GDPR shall lie in the afore-described purposes.
Truthful submission shall be mandatory for certain personal data marked with *. We shall require the data for the handling and administration of our website, for verifying the data entered for plausibility, i.e. for justification, content arrangement, processing and modification of the contractual relationships concluded with you through your user account. The e-mail address and the password shall together form the login data.
The data in the customer account can be viewed and changed by the customer at any time. Finally, a customer can demand complete deletion of the customer account.
The legal basis for the processing of your data for the aforementioned purpose shall lie in the fulfilment of a contract pursuant to art. 6 para. 1 lit. b GDPR as well as in our legitimate interest in the optimal administration of the customer relationship with you (art. 6 para. 1 lit. f GDPR). You can object to this data processing at any time; this would however be synonymous to the deletion of your customer account.
The legal basis for the processing of your data for this purpose shall lie in the fulfilment of a contract pursuant to art. 6 para. 1 lit. b GDPR as well as in our legitimate interest in optimising our website offer and personalising our offer to you (art. 6 para. 1 lit. f GDPR). You can object to this data processing at any time; this would however be synonymous to the deletion of your customer account.
Data going beyond this can be entered voluntarily.
If you are registered and have a customer account, we shall save your data in the customer account for the next purchase.
In case of certain offers, additional information shall be required from you. In the purchasing process, you shall be pointed to this additional information.
When buying train tickets or special offers, which are linked with a train journey, you must e.g. also enter the first and last names of the passengers, dates of birth, as well as any discounts (e.g. half-fare) besides the aforementioned information.
When buying train tickets, the data shall be shared with the Swiss Federal Railways, Wyler-strasse 127/128, 3000 Bern 65 as well as, if necessary, with other transport service providers via a technical interface.
When booking a parking place in Matterhorn Terminal Täsch online, you must enter the arrival and departure date in addition to the usual information in case of online bookings.
Finally, accommodations in the Grand Hotel Zermatterhof, Bahnhofstrasse 55, 3920 Zermatt can be booked via our website. When booking an accommodation, the first and last name of the person making the booking as well as arrival and departure date must be entered in addition to the general booking information. We shall then forward this information also to the third-party service provider.
The legal basis for the processing of your data for the aforementioned purposes shall lie in the fulfilment of a contract pursuant to art. 6 para.1 lit. b GDPR.
We shall then forward this information also to the third-party service provider, Verein Freilichtspiele Zermatt, Am Bach 9, 3920 Zermatt.
We shall use this data exclusively to answer the questions asked by you or to provide the services requested by you. The collection of your first and last name allows us targeted support of existing customers. The collection of your country of residence also allows us to point you to any country-specific conditions.
Our legitimate interest pursuant to art. 6 para. 1 lit. f GDPR shall lie in the processing of your contact request.
You can also buy souvenirs via our website. As soon as you access the page with souvenirs, you shall be directed to another website. This website is operated by Pandinavia AG, Industriestrasse 30, CH-8302 Kloten, on our behalf. The data, which you enter during the purchase, shall be saved on servers of Pandinavia AG.
Within the scope of the purchasing process, Pandinavia AG shall inform you as to which information must be entered as mandatory fields. This shall include, e.g., the contact type (private person, company), first and last name, address, telephone number and e-mail address.
Solely Pandinavia AG shall be responsible for the souvenir shop. Accordingly, even the General Terms and Conditions and data protection guidelines of Pandinavia AG shall be applicable for the purchases in the souvenir shop.
Our legitimate interest pursuant to art. 6 para. 1 lit. f GDPR shall lie in the processing of your application. We shall also process the documents for the possible contract initiation within the meaning of art. 6 para. 1 lit. b GDPR. Finally, you shall give us the approval for the processing of the information contained therein (art. 6 para. 1 lit. a GDPR) with the voluntary upload of application documents.
We shall use your data for sending newsletters until you revoke your consent. You can revoke your consent at any time. You shall also find an unsubscribe link in all newsletter e-mails.
When sending the newsletter, we work with e-mail marketing software from Alturos Destinations, Lakeside B03, 9020 Klagenfurt, Austria. For this, the e-mail address is saved on a database system of Braze.
Our newsletter can contain a so-called web beacon (tracking pixel) or similar technical means. A web beacon is a 1x1 pixel, invisible graphic, which is linked with the user ID of the respective newsletter subscriber.
For every newsletter sent, there is information about the address file used, the subject and the number of newsletters sent. It can also be seen as to which addresses have not yet received the newsletter, to which address it was sent and in case of which addresses the dispatch has failed. It is also evident as to which addresses have opened the newsletter. Finally, the information as to which addresses have unsubscribed. We use this data for statistical purposes and for optimising the newsletter with reference to its content and structure. This allows us to align the information and offers in our newsletter better with the individual interests of the recipients. The tracking pixel shall be deleted if you delete the newsletter.
To prevent the use of the web beacon in our newsletter, please set your mail programme such that no HTML is displayed in messages if this is already not the case by default. On the following pages, you shall find explanations as to how you can make this setting for the most common e-mail programmes.
With the registration, you shall give us your consent to the processing of the data entered for the regular dispatch of the newsletter to the address specified by you and for the statistical analysis of the usage behaviour as well as optimisation of the newsletters. This consent shall represent our legal basis for the processing of the data for the newsletter within the meaning of art. 6 para. 1 lit. a GDPR.
We use so-called retargeting technologies. Your usage behaviour on our website shall thereby be analysed so that advertisement that is individually tailormade for you can be offered even on partner websites. Your usage behaviour shall be recorded pseudonymously.
Most of the retargeting technologies work with cookies (for this, refer to section 7 below).
This website uses Doubleclick by Google, a service from Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (“Google”), for placing advertisements based on the use of previously visited websites. For this, Google uses the so-called DoubleClick cookie, which allows recognition of your browser when visiting other websites. The information generated by the cookie about the visit to these websites (including your IP address) is transferred to a Google server in the USA and saved there (you shall find additional information on transfers of personal data into the USA below in section 8).
Google shall use this information to evaluate your use of the website with respect to the advertisements to be placed, to compile reports about the website activities and advertisements and to provide other services that are associated with the website use and the Internet use. If necessary, Google shall also transfer this information to third parties if this is legally prescribed or if third parties process this data on behalf of Google. Google shall however, under no circumstances, link your IP address with other data of Google. Google is listed as a Privacy Shield participant. The Privacy Shield agreement between the EU and the USA guarantees minimum standards for data protection. More information on Google’s data protection can be found here.
We also use the Google Tag Manager to manage the services for usage-based advertisement. The Tag Manager tool itself is a cookieless domain and does not record any personal data. The tool rather serves for triggering other tags, which record data under certain circumstances (for this, refer above). If you have made a deactivation at the domain or cookie level, this shall be retained for all tracking tags that have been implemented with Google Tag Manager.
You can prevent the retargeting at any time by rejecting or deactivating the relevant cookies in the menu bar of your web browser (for this, refer to section 7 below).
The legal basis for the processing of the data for the aforementioned purposes shall lie in our legitimate interest in the interest-related and personalised advertising communication with you (art. 6 para. 1 lit. f GDPR).
We shall forward your personal data only if you have explicitly consented to this, if there is a legal obligation to do so or if this is necessary to enforce our rights, particularly to enforce claims resulting from the contractual relationship.
We shall also forward your data to third parties if this is necessary within the scope of the use of the website and the contract processing, namely the processing of your orders, the processing of your purchases, the delivery of your ordered products and the payment for them, to provide the services requested by you as well as to analyse your user behaviour. The use of the forwarded data by the third parties shall be limited strictly to the specified purposes.
A service provider, to which the personal data collected through the website shall be forwarded or which has or can have an access to such data, is our web host iWay AG, Badenerstrasse 569, 8048 Zurich. The website is hosted on servers in Switzerland.
We shall also forward your personal data to insurance companies if you have booked cancellation insurance via our website. The legal basis for the forwarding shall lie in the fulfilment of a contract pursuant to art. 6 para.1 lit. b GDPR.
A service provider, which shall get access to our web shop and the personal data, is our web shop operator Peaksolution GmbH, Lakeside B03, 9020 Klagenfurt am Wörthersee, Austria.
We shall be authorised to forward your personal data even to third-party companies abroad if this is necessary in connection with the processing of your bookings, inquiries, the provision of services and marketing campaigns. The legal provisions on the forwarding of personal data to third parties shall naturally be adhered to while doing so. The third parties shall be obligated for data protection to the same extent as that applicable for the provider itself. If the level of data protection in a country does not correspond to that in Switzerland or the EU data protection law, we shall ensure by contractual means that the protection of your personal data corresponds to that in Switzerland or in the European Economic Area (EEA) at all times.
Right to information: You shall have the right to demand an insight into your personal data saved with us any time and free of charge if we are processing this data. You can check as to which of your personal data is being processed by us, and that we are using it according to the applicable data protection regulations.
Right to correction: You shall have the right to have incorrect or incomplete personal data corrected and to be informed about the correction. In this case, we shall inform the recipients of the data concerned about the corrections made unless this is impossible or associated with disproportionate effort.
Right to deletion: You shall have the right to have your personal data deleted under certain circumstances. In the individual case, the right to deletion can be ruled out.
Right of restriction of processing: Under certain conditions, you shall have the right to demand restriction of the processing of your personal data.
Right to data transfer: If you have your domicile in an EU or EEA member state, you shall, under certain circumstances, have the right to get the personal data that was provided to us by you free of charge in a readable format.
Right of appeal: If you have your domicile in an EU or EEA member state, you shall have the right to appeal to a competent supervisory authority against the method of the processing of your personal data.
Right of revocation: You shall basically have the right to revoke an issued consent at any time. Processing activities in the past based on your consent shall however not become illegal through your revocation.
We take appropriate technical and organisational security measures to protect your personal data that is stored with us from manipulation, partial or complete loss and unauthorised access by third parties. Our security measures are constantly being improved in line with technological developments.
When you register yourself with us as a customer, the access to your customer account shall be possible only upon entering your personal password in each case. You should always treat your payment information as confidential and close the browser window once you have ended the communication with us, particularly if you are using a shared computer.
We also take data protection within our organisation very seriously. Our employees and the service providers commissioned by us are obligated by us to maintain confidentiality and to comply with our data protection regulations. Moreover, they are granted access to personal data only to the necessary extent.
Cookies help in many ways to make your visit to our website easier, more pleasant and more meaningful. Cookies are information files that your web browser automatically stores on your computer’s hard drive when you visit our website. Cookies neither damage your computer’s hard drive nor do they transfer the users’ personal data to us.
Most Internet browsers accept cookies automatically. It is possible, however, to configure your browser such that no cookies are stored on your computer or such that a message shall always appear when you receive a new cookie. On the following pages, you shall find explanations as to how you can configure the processing of cookies in the most common browsers.
If you deactivate cookies, you may not be able to use all functions on our website.
shall be transferred to Google servers in the USA and saved there. Since IP anonymisation (“anonymizeIP”) has been activated on this website, the IP address shall be shortened before the transmission within European Union member states or in other signatory states of the Agreement on the European Economic Area. The anonymised IP address sent by your browser within the scope of Google Analytics shall not be grouped with other Google data. Only in exceptional cases, the full IP address shall be transferred to a Google server in the USA and shortened there. In these cases, we shall ensure through contractual guarantees that Google adheres to a sufficient level of data protection.
This information shall be used to analyse the website usage, to compile reports on the website activities and to provide other services associated with the website and Internet usage for the purposes of market research and designing of these websites according to the users’ needs. If necessary, this information shall also be transferred to third parties if this is legally prescribed or if third parties process this data on order. According to Google, the IP address shall never be linked with other data concerning the user.
The legal basis for the processing of the data for the aforementioned purposes shall lie in our legitimate interest in the optimisation and personalisation of our website and the services offered there (art. 6 para. 1 lit. f GDPR).
For reasons pertaining to completeness, we would like to point out that monitoring measures are taken in the USA by US authorities, which generally allow the storage of all the personal data of all persons, whose data has been transmitted from the Union into the USA. This takes place without differentiation, restriction or exception by means of the purpose pursued and without an objective criterion that allows to restrict the access of the US authorities to the data and its subsequent use to certain, strictly limited purposes, which justify the intervention that is associated with the access to this data as well as with its use.
We use the web tracking tool Crazy Egg on our website. Crazy Egg is operated by Crazy Egg Inc., 6220 E. Ridgeview Lane, La Mirada, CA, 90638, USA.
The legal basis for the processing of the data for this purpose shall lie in our legitimate interest pursuant to art. 6 para. 1 lit. f GDPR.
On our website, you shall find links to social media networks. These are not plugins provided by the service provider, which already transmit data to the service provider when loading the website without influence of the users. The interfaces to the social media networks shall only contain a link to the social media network including transfer of the website to be shared. No user data shall be transmitted from the website to the social media network.
When you call up a link to one of our social media profiles, a direct connection shall be established between your browser and the server of the social network concerned. The network shall thus receive the information that you, with your IP address, have visited our website and called up the link. When you call up a link to a network while being logged in to your account with the network concerned, the contents of our website can be linked with your profile with the network; this means that the network can directly assign your visit to our website to your user account. If you want to prevent this, you should log out before using the corresponding links. An assignment shall take place in any case if you log in with the network concerned after using the link.
On our websites, social plugins of Facebook are also used to make the online shop more personal. For this, we use the “SHARE” button. This is an offer of the American company Facebook Inc. (1601 S. California Ave, Palo Alto, CA 94304, USA).
When you call up a page of our web presence, which contains such a plugin, your browser creates a direct connection with the Facebook servers. The content of the plugin is directly transmitted from Facebook to your browser and integrated into the Website from the browser.
Through the integration of the plugins, Facebook receives the information that your browser has called up the corresponding page of our web presence even if you do not have a Facebook account or are not logged in to Facebook at the moment. This information (including your IP address) is directly transmitted from your browser to a Facebook server in the USA and saved there.
If you have logged in to Facebook, Facebook can directly assign the visit to our website to your Facebook account. If you interact with the plugins, for example use the “SHARE” button, the corresponding information is also directly transmitted to a Facebook server and saved there. The information is also published on Facebook and shown to your Facebook friends.
Facebook can use this information for the purpose of advertisement, market research and needs-based designing of the Facebook pages. For this, Facebook creates usage, interest and relationship profiles, e.g. to analyse your use of our website with respect to the advertisements faded in for you on Facebook, to inform other Facebook users about your activities on our website and to provide other services associated with the use of Facebook.
If you do not want Facebook to assign the data collected through our web presence to your Facebook account, you must log out from Facebook before visiting our website.
Please refer to the data protection information of Facebook for the purpose and scope of the data collection and the further processing and use of the data by Facebook as well as your related rights and setting options for the protection of your private sphere.
If you do not want Twitter to assign the visit to our websites, please log out from your Twitter user account.
We shall save personal data only as long as this is necessary to execute the aforementioned tracking services and to carry out the further processing activities within the scope of our legitimate interest. We shall retain contractual data for a longer period, as this is prescribed by legal retention obligations. Retention obligations that require us to retain data shall result from accounting regulations and tax regulations. According to these regulations, business communication, concluded contracts, and accounting records must be retained for up to 10 years. If we no longer need this data to execute the services for you, the data shall be blocked. This means that the data may then only be used for billing and tax purposes.

References: art. 6
 art. 6
 art. 6
 art. 6
 art. 6
 art. 6
 art. 6
 art. 6
 art. 6
 art. 6