Source: https://www.aquatis.ch/en/privacy-statement/
Timestamp: 2019-04-19 07:23:13+00:00

Document:
The Boas Group (Boas-Yakhin Holding SA and its subsidiaries) is a website operator and therefore responsible for collecting, processing and using your personal data. Consequently it is responsible for the compliance of data processing with the applicable data protection legislation.
Your trust is really important to us, this is why we take data protection very seriously and ensure adapted security. We of course respect the legal provisions of the federal law on data protection (LPD/FADP), the order relating to the federal law on data protection (OLPD/DPO), the federal law on telecommunications (LTC) and other potentially applicable provisions relating to data protection from Swiss or EU legislation, in particular the general data protection regulation (GDPR).
If you wish to familiarise yourself with the nature of the personal data (concerning you) that we collect and for what purposes we use it, please carefully read the information below.
The aim of the collection and processing of this data is to allow the use of our websites (establishment of a connection), to guarantee the security and stability of the system in the long-term and to optimise our online offer, as well as for the purposes of internal statistics. This processing is based on our legitimate interest in virtue of Art. 6 para. 1 let. f GDPR.
The IP address is furthermore analysed with other data for the purposes of recognition and defence in the event of attacks on the network infrastructure or other non-authorised or abusive uses of the website and potentially used in the framework of legal proceedings for the purposes of identification and civil and criminal action against the user in question. This processing is based on our legitimate interest in virtue of Art. 6 para. 1 let. f GDPR.
Our websites contain links to third party websites that may interest you. By activating these links, you potentially leave our websites. The Boas Group has no control over third party websites and can, on no account, be held responsible for the content or the operation of these websites. The risk or danger that may result from logging onto third party websites or consulting them is exclusively the concern of the user.
We only use this data, as well as your telephone number (optional field) to be able to reply to your contact request to the best of our ability and in a personalised way. The processing of this data is therefore necessary for the performance of pre-contractual measures in accordance with Art. 6 para. 1 let. b GDPR or is based on our legitimate interest in accordance with Art. 6 para. 1 let. f GDPR.
The above data is essential for processing data, but only the email address is compulsory (the other fields are optional). We process this data exclusively with the aim of personalising the information and offers we send you to best adapt them to your interests.
On signing up, you agree to the data you supplied in this framework being processed, in view of the regular sending of the newsletter to the address you have given, but also in view of the statistical analysis of your user habits and the optimisation of the newsletter. This agreement represents our legal basis for the processing of your email address in virtue of Art. 6 para. 1 let. a GDPR. We are justified in calling on third parties for the technical realisation of advertising campaigns and are justified in transmitting your data to this end (Chapter III Section 5 below).
At the end of each newsletter, you will find a link to unsubscribe at any time. In the framework of your subscription cancellation, you have the option of indicating to us the reason. Your personal data is deleted following your subscription cancellation.
Password of the client account.
This data, as well as other optional information (e.g. company name), is collected with the aim of giving you direct, protected access by password to your base data saved in our system. You can consult your previous and current bookings there or even manage or modify your personal data.
Your agreement according to Art. 6 para. 1 let. a GDPR constitutes the legal basis of data processing to this end.
The performance of a contract according to Art. 6 para. 1 let. b GDPR constitutes the legal basis of data processing to this end.
In many respects cookies make your visit to our websites easier, more pleasant and more useful. Cookies are files containing information that your web browser automatically saves on your computer’s hard drive when you visit our websites. During your first visit to our websites, you will be called on to express yourself by authorising cookies or not, via the cookie banner.
The deactivation of cookies may prevent you from using all functionalities of our websites.
We collect this information to meet the legal disclosure requirements resulting in particular from law-enforcement legislation and regarding the hotel industry. Insofar as we are obliged to do so according to applicable provisions, we transmit this information to the competent police authority.
We have a legitimate interest in virtue of Art. 6 para. 1 let. f GDPR to fulfil the legal provisions.
We collect this information to meet the legal obligations resulting from the contract drawn up on creating the subscription. This information also allows us to modify or block the subscription in the event of loss or theft of the subscriber’s card as well as to formally identify the owner of the subscription in question.
We have a legitimate interest in virtue of Art. 6 para. 1 let. b GDPR to fulfil the legal provisions.
Insofar as you receive additional services in the framework of your stay (e.g. use of the mini bar…), for invoicing purposes, we input the subject of the service as well as the date on which you received it. The processing of this data is necessary for the performance of your contract with us in virtue of Art. 6 para. 1 let. b GDPR.
In view of the adapted presentation and the ongoing optimisation of our websites, we use the audience analysis service Google Analytics. We create pseudonymised user profiles and use small text files stored on your computer (“cookies”). The information generated by the cookie concerning your use of these websites is transmitted to the servers of the suppliers of these services, then stored and processed for us. The details of the data collected by the Google Analytics service can be consulted at https://support.google.com/analytics#topic.
The information is used to analyse the use of the websites, to collect reports on website activities and provide other services in connection with the use of the websites and the use of Internet for the purposes of market research and an adapted presentation of these websites. This information can also be transmitted to third parties insofar as this is prescribed by law or insofar as third parties are mandated to process this data.
The supplier of Google Analytics is Google Inc., a company of the holding Alphabet Inc., whose registered office is in the United States of America. Before the transmission of data to the supplier, the IP address is shortened via the activation of IP anonymization (“anonymizeIP”) on this website within member States of the European Union or in other States that have signed the European Economic Area Agreement. Google does not group the anonymized IP address with other data (transmitted by your browser) in the framework of Google Analytics. Exceptionally, the full IP address is transmitted to a Google server in the United States of America before being shortened there. In this case, we ensure via contractual guarantees that Google Inc. respects a sufficient level of data protection. According to Google Inc., the IP address will on no account be associated with other data concerning the user.
We use marketing services by third party email for sending our newsletter. For this reason, our newsletter may include a Web tag (invisible GIF) or similar technical means. A Web tag is an invisible image called mono pixel (1x1) that is linked to the user ID of the newsletter subscriber.
Turning to this type of service allows us to assess whether emails containing our newsletter have been opened. Furthermore, this also allows the clicks made by the newsletter recipient to be detected and assessed. We use this data for statistical purposes and to optimise the newsletter in terms of content and structure. This allows us to better direct the information and offers featuring in our newsletter depending on the centres of interest of the recipient concerned. The invisible GIF is deleted when you delete the newsletter.
For further information, you can consult the following address https://mailchimp.com/legal/cookies.
To prevent the presence of monitoring pixels in our newsletter, please configure your mailbox so that your messages are not displayed in HTML.
Social Media Plug-Ins described below are used on our websites. Plug-ins are deactivated by default on our websites and do not consequently transmit any data. You can activate plug-ins by clicking on the button of the social network concerned.
When these plug-ins are activated, you browser establishes a direct connection with the servers of the social network concerned, once you open one of the pages of our websites. The contents of the plug-in is directly transmitted by the social network to your browser and integrated by the latter into the web page. A simple click allows you to deactivate the plug-ins again.
Other information is available in the respective data protection policies of Facebook, Twitter and Instagram.
Facebook Social Plug-Ins can be used on our websites to personalise the input page. To do this we use the “LIKE” or “SHARE” button. In this respect this involves an offer from the American company Facebook Inc., 1601 S. California Ave, Palo Alto, CA 94304, USA.
Thanks to this integration of plug-ins, Facebook receives the information according to which your browser accessed the corresponding page of our websites, even when you do not have a Facebook account or you are not logged into Facebook at that time. This information (including your IP address) is directly transmitted by your browser to a Facebook server in the USA to be saved there.
If you’re logged into Facebook, Facebook can directly link your visit to our websites to your Facebook account. When you interact with the plug-ins, for example by using the “LIKE” or “SHARE” button, the corresponding information is directly transmitted to a Facebook server to be saved there. The information is furthermore published on Facebook and visible to your Facebook friends.
Facebook can use this information for the purposes of advertising, market research and the creation of adapted Facebook pages. To this end, use, interest and relationship profiles are created from Facebook, for example to assess the use you make of our websites in relation to Facebook adverts, to inform other Facebook users of your activities on our websites and to supply other services linked to the use of Facebook.
If you do not want Facebook to attribute data collected via our websites to your Facebook account, you must log out of Facebook before visiting our websites.
For more information on the objective and scope of this data collection, its subsequent processing and the use of this data by Facebook, as well as on your related rights and setting options regarding privacy control, refer to the statement regarding Facebook data protection.
Our websites can integrate plug-ins of the SMS network Twitter Inc., 795 Folsom St., Suite 600, San Francisco, CA 94107, USA.
Twitter plug-ins (Tweet button) are recognisable by the Twitter logo on our pages. Insofar as you have activated the Social Plug-Ins, a direct connection is established between your browser and the Twitter server. In this way Twitter receives the information according to which you have visited our websites with your IP address. If you click on the “Tweet button” of Twitter by being logged into your Twitter account, you can connect the contents of our pages to your Twitter profile. In this way, Twitter can link the visit on our pages to your user account. We draw your attention to the fact that our company, as supplier of the pages concerned, receives no information as to the contents of the data transmitted and its use by Twitter. You will find more information on this subject in the Twitter data protection statement.
If you do not want Twitter to link the visit to our pages to your account, please log out of your Twitter user account.
We potentially use Re-Targeting technologies for our websites. In this respect, your user habits are analysed to also be able to propose personalised adverts on the websites of our partners. Your user habits are entered in a pseudonymised way.
Our websites can use Google AdWords Remarketing, services from the company Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043 USA (“Google”) to insert adverts depending on the previously visited websites.
Google will exploit this information to analyse your user habits on the website and best choose the adverts to insert, to compile reports on the activity and the adverts of the website intended for the website owner, and to supply services in relation with the use that you make of the website and your browsing habits. If applicable, Google will also transmit this information to third parties, insofar as the law demands it, or if third parties process this data on behalf of Google. However, Google will on no account link your IP address to other Google data.
Furthermore we use Google Tag Manager to manage services associated with setting up advertising based on user habits. The Tag Manager tool itself is a domain exempt from cookies and collects no personal data. The tool rather carries out the activation of other tags that for their part collect data in certain circumstances. When you have deactivated a domain or cookies, the latter remains valid for all traceability markers implemented with Google Tag Manager. You can at any time prevent the Re-Targeting by refusing or deactivating the cookies concerned in the menu bar of your Web browser.
If you make bookings via a third party platform, the platform operator in question sends us different information of a personal nature. In principle, this involves data indicated in chapter I section 6 of this privacy statement. Furthermore, requests concerning your booking are potentially transmitted to us. We notably process this data to enter your booking in accordance with your request and supply the booked services. The performance of a contract according to Art. 6 para. 1 let. b GDPR constitutes the legal basis of data processing to this end.
Finally, platform operators potentially inform us of disputes connected to a booking. They also transmit data to us concerning the booking process, for which a copy of the booking confirmation may be used as justification for its effective closing. We process this data for the protection and respect of our rights. For this processing, we use our legitimate interest in virtue of Art. 6 para. 1 let. f GDPR as a basis.
Please also familiarise yourself with the privacy statements of the respective suppliers.
We save the data indicated in Chapter I sections 3-6, Chapter II sections 1-2 and Chapter III section 2 in an electronic data processing system. The data concerning you is therefore systematically entered and grouped together in view of processing your bookings and performing the contractual services. The processing of this data is based on our legitimate interest in virtue of Art. 6 para. 1 let. f GDPR.
We only store personal data as long as it is necessary for the use of the aforementioned monitoring services as well as for subsequent processing based on our legitimate interest. We retain contractual data for a longer period once this is prescribed by legal retention obligations. The obligations to retain data that force us to retain data result from provisions relating to the right to inform authorities, to financial accounting and fiscal law. In accordance with these provisions, marketing communication, concluded contracts and accounting documents must be retained for up to 10 years. Insofar as we no longer have need of this data for performing services, it will be blocked. This means that this data can only be used for accounting and tax purposes.
We only transmit your personal data if you have expressly agreed to it, if we are subject to a legal obligation to do so or if this is necessary to assert our rights, notably to assert our rights from the contractual relationship. Furthermore, we transmit your data to third parties insofar as this is necessary for the use of websites and the performance of the contract (including outside of websites), notably for the processing of your bookings.
Our web host, Infomaniak, is a service provider that has access or can have access to personal data collected via websites. The websites are hosted on servers in Switzerland. The purpose of the data transmission is to supply and maintain the functionalities of our websites. The processing is based on our legitimate interest in virtue of Art. 6 para. 1 let. f GDPR.
Furthermore, please familiarise yourself with the indications in Chapter II section 1 and Chapter III sections 1-3 concerning data transmission to third parties.
We are also entitled to transmit your personal data to third party companies (appointed service providers) overseas for the processing of data specified in this privacy statement. These companies are subject to the same level of data protection as us. If the level of data protection in a given country does not correspond to the Swiss or European level, we ensure contractually that the protection of your personal data corresponds to that of Switzerland or the EU.
You are entitled to obtain, upon request, information relating to the personal data concerning you that we register. Furthermore, you are entitled to rectify false data and delete your personal data as long as no legal retention obligation or no legal grounds allowing us to process the data forbids it.
You also have the right to demand the return of data that you have transmitted to us (right to data portability). On request, we also transmit data to a third party of your choice. You are entitled to obtain the data in a standard format.
You can contact us for the abovementioned purposes at the following email address privacy@boas.ch. We may ask you for proof of identity for the processing of your requests.
We use suitable technical and organisational security measures to protect the personal data concerning you that we save against any handling, partial or total loss and against any non-authorised third party access. Our security measures are constantly being improved depending on technological progress.
You must always keep your access data confidential and close the window of your browser when you have finished your communication with us, in particular if you are not the only person to use the computer.
We also take data protection very seriously within our company. Our employees and service provider companies that we mandate are subject to secrecy and compliance with legal provisions regarding data protection.
In the interests of exhaustiveness, we inform users whose domicile or registered office is located in Switzerland that the United States of America are subject to surveillance measures by American authorities. These generally allow all personal data of persons whose data has been transmitted from Switzerland to the United States of America to be saved. This is carried out without differentiation, limitation or exception based on the pursued goal and without objective criterion limiting the access of American authorities to data and its subsequent use. Moreover, we inform you that in the United States of America, for concerned persons coming from Switzerland there is no possibility of appeal allowing you to have access to data concerning you or to obtain their rectification or erasure, or effective jurisdictional protection against the general access rights of American authorities. We explicitly draw the attention of the person concerned to this legal and factual situation so he/she can take an informed decision regarding consent relating to the use of this data.
We inform users domiciled in a member State of the EU that according to the EU, the United States of America – notably due to the subjects evoked in this section – do not have a sufficient level of data protection. Insofar as we have explained in this privacy statement that certain data recipients (e.g. Google) have their registered office in the United States of America, we make sure that either via contractual provisions with these companies or through their certification according to the EU- United States of America or Swiss-United States of America data privacy shield, that your data benefit from a reasonable level of protection among our partners.

References: Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6