Source: https://www.badruttspalace.com/en/corporate/disclaimer
Timestamp: 2019-04-25 23:39:41+00:00

Document:
Badrutt’s Palace Hotel AG, Via Serlas 27, 7500 St. Moritz, Switzerland (entered into the Commercial Register of the Canton of Graubünden under the number CHE-105.980.962) runs the Hotel “Badrutt’s Palace Hotel”, is also the operator of the website www.badruttspalace.com and is thereby responsible for the collection, processing and use of your personal data and the compliance with the applicable data protection law.
Your trust is important to us, which is why we take the issue of data privacy seriously and ensure a corresponding level of security. Of course, we comply with the legal provisions of the Federal Law on Data Protection (DSG), the Ordinance to the Federal Act on Data Protection (VDSG), the Telecommunications Act (FMG) and any other applicable data privacy provisions in Swiss or EU law, or the EU General Data Protection Regulation (GDPR), where applicable.
So that you are aware which personal data we collect from you and what purposes we use it for, please acknowledge the following information.
The address of our data privacy law representative in the EU is: MLL Bruxelles SPRL, 222 Avenue Louise, 1050 Brussels, Belgium (bph@mll-gdpr.com).
- Where applicable your user name from registration/authentication.
The collection and processing of this data is done with the purpose of allowing the use of the website (establishing a connection), ensuring permanent system security and stability and optimising the website, as well as for internal statistical purposes. This represents our justified interest in data processing in accordance with Art. 6, paragraph 1 f, GDPR.
The IP address is also evaluated together with other data, in the event of attacks on the network infrastructure or other illegal or abusive use of the website to resolve the issue and defend against it, and, if necessary, within the scope of criminal proceedings, for identification purposes and for civil and criminal proceedings against the affected user. This represents our justified interest in data processing in accordance with Art. 6, para- graph 1 f, GDPR.
You have the option to use a contact form to get in touch with us. For this purpose, we require you to provide your e-mail address. Your e-mail address and other data you have provided voluntarily (e.g. your first name and surnames, telephone number etc.) are re- quired by us so that we can provide the best possible, personalised response to your en- quiry. This processing of this data is therefore required in accordance with Art. 6, para- graph 1 b, GDPR to execute pre-contractual measures, or is in our justified interest as per Art. 6, paragraph 1 f, GDPR.
You have the option to get in contact by e-mail. To be able to get in touch with us, you have to click on the e-mail symbol. By clicking on this symbol, a connection is automati- cally created to your e-mail program and a window is opened to send an e-mail. You can send us questions by e-mail about the functions or the content of the website. You are solely responsible for the messages and the content you send to us using the e-mail func- tion. We recommend not sending any sensitive information via the e-mail function. To be able to use the e-mail function, you simply have to enter your e-mail address. Your e-mail address and other data you have provided voluntarily (e.g. your first name and surnames, telephone number etc.) are required by us so that we can provide the best possible, per- sonalised response to your enquiry. This processing of this data is therefore required in accordance with Art. 6, paragraph 1 b, GDPR to execute pre-contractual measures, or is in our justified interest as per Art. 6, paragraph 1 f, GDPR.
You have the option to use an enquiry form to get in touch with us. You can use the en- quiry form to ask about our premises, particularly if you are planning a conference or a party and would like to use our services and rooms for this. For this purpose, we require you to provide your e-mail address. Your e-mail address and other data you have provid- ed voluntarily (e.g. your first name and surnames, telephone number etc.) are required by us so that we can provide the best possible, personalised response to your enquiry. This processing of this data is therefore required in accordance with Art. 6, paragraph 1 b, GDPR to execute pre-contractual measures, or is in our justified interest as per Art. 6, paragraph 1 f, GDPR.
On our website you have the option of subscribing for our newsletter. Registration is re- quired for this. During the registration process it is mandatory to enter your e-mail ad- dress. Your e-mail address and other data you have provided voluntarily (e.g. your first name and surname) are only processed by us to personalise the information and offers we send to you, and to better align them to your interests.
By registering, you give us your consent for the processing of the data provided, for the regular sending of the newsletter to the address you have provided, for the statistical evaluation of user behaviour and to optimise the newsletter. This consent forms, in ac- cordance with Art. 6, paragraph 1 a, EU-GDPR, our legal basis for the processing of your e-mail address. We are permitted to commission third parties with the technical pro- cessing of advertising measures and are permitted to forward your data for this purpose (see below under “Transfer of data to third parties”).
At the end of each newsletter there is a link which you can use to unsubscribe at any time. During the unsubscribe process you can notify us voluntarily of the reason why you are unsubscribing. After unsubscribing, your personal data is deleted. Your data is only for- warded anonymously in order to optimise our newsletter.
The collection of this data, as well as other data provided voluntarily (e.g. a fax number) is done with the purpose of providing you with direct, password-protected access to your basic data held by us. There you can view your previous and current orders or manage and change your personal data.
The legal basis for the processing of your data for this purpose is therefore the consent you have issued, as per Art. 6, paragraph 1a GDPR.
We only collect and process the data to handle the reservation, particularly to compile your reservation enquiry according to your request, to make the reservation and to contact you in the event of uncertainty or problems. For this purpose, your data is also forwarded to the relevant service providers.
The legal basis for the processing of your data for this purpose lies in the fulfilment of a contract as per Art. 6, paragraph 1 b, GDPR.
We only collect and process this data to handle your purchases, especially to provide you with the purchased products and services, and to contact you in the event of uncertainty or problems. For this purpose, your data is also forwarded to the relevant service provid- ers.
This data is used for the application process. If you do not explicitly consent to the further processing, the data is deleted after the respective application process.
The legal basis for the processing of data therefore lies in the execution of pre-contractual measures and in our justified interest as per Art. 6, paragraph 1 b and f, GDPR. For other data processing, the legal basis lies in the consent you have issued as per Art. 6, para- graph 1a, GDPR.
On our website you have the option to submit a review. To do so you have to click on the intended link, which connects you to the website of TripAdvisor Inc., 400 1st Avenue, Needham, 02494 MA, USA. It is possible that your IP address may be forwarded to the server of TripAdvisor. The data protection provisions of TripAdvisor apply in this case.
The legal basis for the processing of data therefore lies in our justified interest as per Art. 6, paragraph 1 f, GDPR.
Along with many other things, cookies help us to make your visit to our website easier, more pleasant and effective. Cookies are information files which your web browser au- tomatically saves on the hard drive of your computer, when you visit our website.
The deactivation of cookies may, however, mean that you are not able to use all of the functions of our website.
- Whether it was a repeat or new visitor.
The information is used to evaluate the use of the website, to compile reports about web- site activities and to provide other services associated with the use of the website and the internet, for the purpose of market research and designing this website to meet your needs. This information is also transferred to third parties if necessary, if this is specified by law or if third parties processing this data on our behalf.
We also use Google Tag Manager to manage usage-based advertising services. The Tool Tag Manager itself if a cookie-free domain and does not compile any personal data. In- stead, the tool removes other tags which may compile your data. If you perform deactiva- tion at domain or cookie level, this applies to all tracking tags which are implemented with Google Tag Manager.
Google Analytics is a service provided by Google Inc., a company of the holding compa- ny Alphabet Inc, with its registered office in the USA. Before being transferred to the service provider, the IP address is abbreviated by activating the IP anonymising function (“anonymizeIP”) on this website within a Member State of the European Union or in another EEC state. The anonymised IP address transferred by your browser due to Google Analytics is not compiled with other data from Google. Only in exceptions is the full IP address transferred to a server of Google in the USA and abbreviated there. In these cases we ensure, by undertaking contractual guarantees, that Google Inc. maintains a sufficient level of data protection. According to Google Inc. the IP address is not linked to other data associated with the user.
To manage the usage-based advertising service, we use Google Tag Manager, which is also a service of Google. The Tool Tag Manager itself if a cookie-free domain and does not compile any personal data. Instead, the tool removes other tags which may compile your data. If you perform deactivation at domain or cookie level, this applies to all track- ing tags which are implemented with Google Tag Manager.
Further information about the web analysis service can be found on the website of Google Analytics.
ports and heatmaps about the website activities and to provide other ser- vices associated with the use of the website and the internet for the pur- pose of market research and to design our website to meet your needs.
The provider of Mouseflow is a company of Mouseflow ApS, with its registered office at Flaesketorvet 68, 1711 Copenhagen, Denmark. Further information about the web analy- sis services used can be found on the Mouseflow website. Further information about the forwarding and processing of data by third parties can be found, in point 20 of this priva- cy policy, and on the website of Mouseflow ApS.
We use a communication tool called Facebook Custom Audience. In general, a non- reversible and non-personal related test value (fingerprint) is generated from your usage data by Custom Audience, which can be sent to Facebook for analysis and marketing purposes (using a so-called Facebook cookie).
Custom Audience is a service of Facebook Inc., 1601 S California Ave, Palo Alto, CA 94304, USA or, if you are a resident in the EU, Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. Further information about the re- targeting tool used can be found on the website of Facebook.
- Google+ of Google Inc., Amphitheatre Parkway, Mountain View, CA 94043, USA.
If you click on symbols of the social networks, you are automatically forwarded to our profile page on the respective network. To be able to use the functions of the respective network, you may have to log in to your user account. By doing so, the network receives information that you visited our website with your IP address, and clicked on the link. If you click on a link to a network while you are logged in to your account on the respective network, the content of our page can be linked with your profile on the network, which means that the network can directly allocated your visit to our website to your user ac- count. If you want to prevent this, you should log out before clicking on the respective links. In any case, the information is linked if you login to the respective network after clicking on the link.
- Xing of Xing SE, Dammtorstrasse 30, 20354 Hamburg, Germany.
If you click on the symbols of the social networks, you are connected to the respective social network to execute the selected function, i.e. to share content on Facebook. For this purpose, however, you must log in to, or be logged in to, your user account.
If you click on symbols of the social networks, you are automatically forwarded to our profile page on the respective network. To be able to use the functions of the respective network, you may have to log in to your user account. By doing so, the network receives information that you visited our website with your IP address, and clicked on the link. If you click on a link to a network while you are logged in to your account on the respective network, the content of our page can be linked with your profile on the network, which means that the network can directly allocate your visit to our website to your user ac- count. If you want to prevent this, you should log out before clicking on the respective links. In any case, the information is linked if you log in to the respective network after clicking on the link.
We collect these details in order to meet our legal reporting obligations, based in particu- lar on the hospitality and police laws. If we are obliged to do so by the applicable regula- tions, we forward this information to the responsible police authorities.
Our justified interest lies in the fulfilment of legal provisions as per Art. 6, paragraph 1 f, GDPR.
to you, but also to be able to offer you the best-possible service.
The legal basis for this data processing thereby lies in the processing of the contract, as per Art. 6, paragraph 1b GDPR.
per Art. 6, paragraph 1b GDPR.
If you use extra services during your stay (e.g. the mini bar) the subject of the service and the time of the service are recorded by us for invoicing purposes. This processing of this data is therefore required for us to execute the contract in accordance with Art. 6, para- graph 1 b, GDPR.
Eventually, we may be notified by the platform operators about disputes associated with a booking. In this case we may also receive data about the booking process, whereby a copy of the booking confirmation may be used as proof that the booking has actually been completed. We process this data to protect and assert our claims. This represents our jus- tified interest in accordance with Art. 6, paragraph 1 f, GDPR.
Please also note the data privacy guidelines of the respective provider.
We save the data in a central electronic data processing system. The data concerning you is then systematically recorded and linked to process your booking and execute the con- tractual services. Furthermore, the data in the system is used for advertising purposes, in particular to be able to offer you personalised services and products.
The legal basis for the processing of data for customer management lies in the processing of the contract, in accordance with Art. 6, paragraph 1 b, GDPR. With regards to the pro- cessing of data for advertising activities, the legal basis lies, on the one hand, in the pro- cessing of the contract (the existing customer relationship justified the processing of data for advertising activities) and, on the other hand, in the consent issued by you in accord- ance with Art. 6, paragraph 1 a, GDPR, when registering for the newsletter (see point 3).
The maximum storage time for personal data is as long as a business relationship is main- tained, in order to use the afore-mentioned tracking services as well as the further pro- cessing within the scope of our justified interest. Contract data is stored for us for a longer period of time, if this is specified by legal storage obligations. Storage obligations which oblige us to store data, arise from the provisions concerning the right of registration, in- voicing and the tax law. According to these provisions, business communication, con- cluded contracts and accounting documents have to be stored for up to 10 years. If we no longer require this data to provide the services for you, the data is blocked. This means that the data can only be used for invoicing and tax purposes.
We only forward your personal data if you have explicitly agreed to it, if there is a legal obligation to do so, or if this is necessary to assert our rights, in particular to assert claims from the contractual relationship. Furthermore, we forward your data to third parties if this is necessary within the scope of the use of the website and the processing of the con- tract (also outside of the website), namely the processing of your bookings.
Various third-party service providers have been mentioned explicitly in this privacy poli- cy (e.g. TAC Informationstechnologie GmbH, Facebook etc.) and the purpose of the transfer of data has been mentioned. Another service provider to whom personal data is forwarded or who has or could have access, is our web hosting company Positioner (web- site data), iWay AG, Badenerstr. 569, 8048 Zurich; Dailypoint (newsletter data), dai- lypoint GmbH, Augustenstr. 79, 80333 Munich; TAC (web shop data), RKP IT-Solutions GmbH, Schildbach 111, 8230 Hartberg. The website is hosted on servers in Switzerland, Germany and Austria. The transfer of data is done with the purpose of providing and maintaining the functions of our website. This represents our justified interest in accord- ance with Art. 6, paragraph 1 f, GDPR.
Finally, for payments by credit card made on our website, we forward your credit card information to your credit card issuer and the credit card acquirer. If you decide to make a payment by credit card, you will be requested to enter all the mandatory information. The legal basis for the transfer of data lies in the fulfilment of a contract in accordance with Art. 6, paragraph 1 b, GDPR. With regards to the processing of your credit card infor- mation by these third parties, we request that you also read the general terms and condi- tions and the data privacy statement of your credit card issuer.
You have the right to receive information about the personal data we have saved about you, on request. In addition, you have the right to correct any incorrect data and the right to delete your personal data, provided no legal storage obligation or legal provision which allows us to process the data, contradicts this.
You also have the right to request back the data that you have given us (right to data port- ability). On request, we will also forward the data to a third party of your choice. You have the right to receive the data in a standard file format.
You can reach us for these purposes via the e-mail address dataprotection@badruttspalace.com. For the processing of your requests, we can require proof of identity, at our discretion.
We take suitable technical and organisational security measures, to protect your personal data we have saved from manipulation, full or partial loss and unauthorised third-party access. Our safety measures are continually adapted in line with the development of tech- nology.
You should always treat your access data as confidential and close the browser window once you have finished communication with us, in particular if you share the computer with other people.
We also take the protection of data in our own company very seriously. Our employees and the service providers commissioned by us have been obliged to confidentiality and to comply with the legal provisions concerning data protection.
For the sake of completeness, for users with their place of residence or registered office in Switzerland, we would like to point out that monitoring measures of US authorities exist, which generally allow the saving of personal data of every person whose data is sent from Switzerland to the USA. This is done without differentiation, restriction or exceptions for the intended goal, and without an objective criterion, which allows the US authorities to access the data and the later usage to be restricted to a particular, strictly limited purpose, which may justify both the access to this data as well as interventions associated with its usage. In addition, we would also like to point out that, in the USA there is no legal aid for data subjects from Switzerland, which would allow you to receive access to the af- fected data and to correct or delete the data, or no effective legal protection exists against the general rights of access of the US authorities. We hereby explicitly refer the affected party to this legal and factual situation, so that an informed decision can be made about the consent to use the data.
You have the right to complain at any time to the data protection authorities.

References: Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6