Source: https://www.museumspass.ch/en/privacy-notice/
Timestamp: 2019-04-19 19:04:04+00:00

Document:
The Swiss Museum Pass Foundation is the operator of the website www.museumspass.ch and therefore responsible for collecting, processing and using your personal data and for ensuring that data processing complies with applicable privacy laws.
Your trust is important for us, which is why we take the subject of data protection seriously and take pains to ensure an adequate level of security. It goes without saying that we abide by the statutory provisions of the Federal Act on Data Protection (FADP), the Ordinance of the Federal Act on Data Protection (VDSG), the Telecommunications Act (FMG) and any other applicable privacy provisions under Swiss or EU laws, in particular the General Data Protection Regulation (GDPR).
Please take note of the following information so that you are aware of what type of personal data we collect from you and the purposes for which we use such data.
This data is collected and processed to enable our website to be used (establishment of connection), to ensure system security and stability in the long run, to optimise our internet service and for internal statistical purposes. This is where our legitimate interest in processing data pursuant to in art. 6, para. 1, letter f GDPR lies.
During attacks on our network infrastructure or other unauthorised use or misuse of the website the IP address together with other data is also analysed for clarification and to defend against such attacks and in some cases it is used for identification during criminal proceedings and to enable civil and criminal actions to be taken against the users in question. This is where our legitimate interest in processing data pursuant to art. 6, para. 1, letter f GDPR lies.
On our website you can contact us via email. All you have to do is to provide your email address.
We use your email address and other data freely provided by you to reply to your query as best we can and to personalise our reply. Therefore, the processing of such data is required pursuant to art. 6, para. 1, letter b GDPR to enable any steps prior to entering into a contract to be taken and/or lies in our legitimate interest pursuant to art. 6, para. 1, letter f GDPR.
On our website you have the option of signing up for our newsletter. Registration is required for this purpose. During registration you must provide your email address. The email address is required by us to send you our newsletter. Upon registration you provide your consent for the email address to be processed, for the newsletter to be regularly sent to the address provided by you, for statistical analysis of usage patterns and for optimising the newsletter.
This consent pursuant to art. 6, para. 1, letter a GDPR provides the legal basis for us to process your email address. We are entitled to engage third parties to handle technical aspects of online advertising and to pass on your data for this purpose (see para. 13 ff for details on the exchange of data with third parties). We use the email marketing service CleverReach provided by CleverReach GmbH & Co. KG from Germany to send you our newsletter.
You will find a link at the end of each newsletter enabling you to unsubscribe from the newsletter at any time. Once you have unsubscribed from the newsletter your personal data will be erased. Any further processing will only take place in an anonymised form for the optimisation of our newsletter.
This data is only processed to enable the order to be handled and checked smoothly. Therefore, the processing of this data is required pursuant to art. 6, para. 1, letter b GDPR to enable any steps prior to entering into a contract to be taken and/or lies in our legitimate interest pursuant to art. 6, para. 1, letter f GDPR.
This data is only used to enable the registration to be handled and checked smoothly. Therefore, the processing of this data is required pursuant to art. 6, para. 1, letter b GDPR to enable any steps prior to entering into a contract to be taken and/or lies in our legitimate interest pursuant to art. 6, para. 1, letter f GDPR.
On our website you can order a Raiffeisenblock and/or advertising material. When the order is placed you must provide your email address. The email address and any other data freely provided by you are only processed to enable the order to be handled and checked smoothly. Therefore, the processing of this data is required pursuant to art. 6, para. 1, letter b GDPR to enable any steps prior to entering into a contract to be taken and/or lies in our legitimate interest pursuant to art. 6, para. 1, letter f GDPR.
Cookies help in many respects to render your visit to our website more convenient, pleasant and useful. Cookies are information files automatically stored by your web browser on your computer’s hard disk when you visit our website.
Disabling cookies may mean that you are unable to use all the functions on our website.
This information is used to analyse how the website is used, to compile reports on website activities and to provide other services related to use of the website and internet usage for the purpose of market research and to customise this website.
Google Tag Manager is also used to manage usage-based advertising services. The tool Tag Manager is a cookie-free domain and does not collect any personal data. The tool is used rather to remove other tags which, in turn, collect data under certain circumstances. If you have disabled this tool at domain or cookie level, it continues to operate for all tracking tags created using Google Tag Manager.
These services are provided by Google Inc., a subsidiary of the holding Alphabet Inc, with registered office in the USA. Before data is sent to the provider the IP address is shortened on this website in member states of the European Union and in other countries party to the Agreement on the European Economic Area. The anonymised IP address sent to Google Analytics is not associated with other Google data. Only in exceptional cases is the entire IP address sent to a Google server in the USA and shortened there. However, Google is a company certified under the US Privacy Shield and as such possesses an appropriate level of data protection. Moreover, according to Google Inc., the IP address is not associated under any circumstances with other data relating to the user.
You can obtain further information about the services used on the Google website. You can find instructions about how to prevent your data from being processed by clicking here. You can obtain further information about Google and its privacy guidelines by clicking here.
We have a legitimate interest in processing data for this purpose pursuant to art. 6, para. 1, letter f GDPR.
We use the online advertising platform Google AdWords on our website and, within the context of this platform, conversion tracking. Google AdWords Conversion Tracking is also a service provided by Google. When you click on an ad placed by Google, a conversion tracking cookie is stored on your computer. These cookies have a limited duration. If you visit certain pages on our website and the cookie has not yet expired, Google and our website are able to recognise that you have clicked on the ad and that you have been redirected to this page. Each Google AdWords client receives a different cookie. This means that there is no way of tracking cookies through the websites of AdWords clients.
The information collected with the aid of the conversion cookie is used to compile conversion statistics. Here we find out about the total number of users who clicked on one of our ads and were redirected to a page using conversion tracking tags. However, we do not collect any information enabling users to be personally identified.
You can prevent cookies from being stored by using the technical configuration options of your browser software (see para. 7). Once the cookies have been erased you will no longer be included in the conversion tracking statistics.
We have a legitimate interest pursuant to art. 6, para. 1, letter f GDPR in processing data for this purpose.
We use Google Dynamic Remarketing on our website, another service provided by Google. Google Dynamic Remarketing is used to analyse visitor behaviour and visitor interests.
Youtube, a service provided by Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.
When you click on the corresponding symbols of the social networks you are automatically redirected to our profile at the social network in question. In order to use the network’s functions you must partially log into your user account at the network.
When you follow a link to one of our social media profiles a direct connection is established between your browser and the server of the corresponding social network. This enables the network to obtain the information that you have visited our website using your IP address and followed the link. When you follow a link to a network while you are logged into your account, the content of our pages may be linked to your profile at the network, which means that the network is able to directly associate your visit to our website with your user account. If you wish to prevent this, you must log out before clicking on the links in question. An association is established every time you log into the network in question after clicking on the link.
This information is only processed and passed on to us by the physical points of sale to enable the order to be handled and checked smoothly. Therefore, the processing of such data is required pursuant to art. 6, para. 1, letter b GDPR to enable any steps prior to entering into a contract to be taken and/or lies in our legitimate interest pursuant to art. 6, para. 1, letter f GDPR.
This data is used by the museums and/or institutions to monitor visitor numbers and for statistical purposes and is passed on to us. Therefore, we have a legitimate interest pursuant to art. 6, para. 1, letter f GDPR in processing data for this purpose.
We may store data in a central electronic data processing system. The data concerning you is systematically collected and linked to process your order and handle the contractual services. We use software provided by Triboni AG, Pliatusstrasse 2, 8032 Zurich for this purpose. The processing of such data is based on our legitimate interest pursuant to art. 6, para. 1, letter f GDPR in the customer-friendly and efficient management of customer data.
We only store personal data for as long as required to use the aforementioned tracking services and for further processing based on our legitimate interest. Contractual data is stored by us for longer periods since such data is governed by statutory retention requirements. Statutory retention requirements under which we are obliged to store data are based on accounting regulations and tax laws. Under these regulations business communications, contracts and order records must be retained for up to ten years. If this data is no longer required for the provision of services to you, the data is blocked. This means that the data can only be used thereafter for accounting purposes and for tax purposes.
We only pass on personal data if you have given your explicit consent, if there is a statutory requirement or in order to exercise our rights, in particular, to assert claims under the contractual relationship. We also pass on data to third parties if this is necessary to enable the website to be used and for contract management.
Various third-party service providers (e.g. in para. 3 newsletter, para. 8 Tracking and retargeting tools) have been explicitly mentioned in this privacy notice. Another service provider to which personal data is passed on and/or which has or may obtain access thereto is our web hoster Cyon GmbH. The website is hosted on servers located in Switzerland. This transfer of data takes place to enable the functions of our website to be provided and maintained. This is where our legitimate interest pursuant to art. 6, para. 1, letter f GDPR lies.
You have the right to request information about the personal data stored by us concerning you. You also have the right to rectify any inaccurate data and the right to erase your personal data, provided this is not precluded by any statutory retention requirements or permission allowing us to process such data.
You also have the right to recover the data you have provided to us (right to data portability). If requested, we can also transmit the data to a third-party controller of your choice. You have the right to receive the data in a commonly used data format.
You can contact us via the email address info@museumspass.ch for the aforementioned purposes. In order to handle your request we may ask you to furnish an ID document as we see fit.
We employ appropriate technical and organisational security measures to protect your personal data stored with us against manipulation, partial or complete loss and against unauthorised access by third parties. Our security measures are continually improved to incorporate the latest technological advancements.
You should always handle your login data confidentially and close the browser window when you have ended your communication with us, especially if you share your computer with other people.
We also take in-house data security very seriously. Our staff and the service providers we engage have been bound by us to maintain confidentiality and to comply with privacy provisions.
For the sake of completeness we draw the attention of users with a place of residence in Switzerland that surveillance measures have been put in place by the US authorities generally enabling the storage of all the personal data of any persons whose data has been sent from Switzerland to the USA. This takes place without any differentiation, limitation or exception with regard to the objective pursued and without any objective criterion enabling access by US authorities to such data and its subsequent use to be limited to specific, strictly defined purposes that might justify any intervention associated with access to and use of such data. We should also point out that no legal remedies are available in the USA to persons from Switzerland allowing them to obtain access to such data and to order its rectification or erasure and/or that there is no effective legal protection against general rights of access exercised by US authorities. We expressly draw the attention of those affected to this legal situation and state of affairs, to enable them to take an informed decision on whether to grant consent for the use of their data.
You have the right to lodge a complaint before a data protection authority at any time.

References: art. 6
 art. 6
 art. 6
 art. 6
 art. 6
 art. 6
 art. 6
 art. 6
 art. 6
 art. 6
 art. 6
 art. 6
 art. 6
 art. 6
 art. 6
 art. 6
 art. 6
 art. 6