Terms and conditions

Thank you for visiting our website.

The purpose of this Privacy Policy is to inform you about the processing of your personal data that we collect when you visit our website. Our data protection practices comply with the legal provisions of the Swiss Federal Act on Data Protection (FADP) and the EU General Data Protection Regulation (GDPR). The following privacy policy serves to fulfill the information obligations arising from the DPA and the GDPR. These can be found, for example, in Art. 8 ff. DSG and Art. 13 ff. of the GDPR.

The controller within the meaning of Art. 3 letter i FADP or Art. 4 no. 7 GDPR is the person who alone or jointly with others determines the purposes and means of the processing of personal data. The controller within the meaning of Art. 4 No. 7 GDPR is also the recipient of the personal data within the meaning of Art. 4 No. 9 GDPR. Any third-party recipients are identified separately.

In relation to our website, the owner or responsible person is:

Hotel-Paradis

Kunibergstrasse 24

3954 Leukerbad

+41 27 470 12 33

‍info@hotel-paradis.ch

Your rights as a data subject

You can exercise the following rights at any time using the contact details of our data protection officer:

Information about your data stored by us and its processing,
Correction of inaccurate personal data,
Deletion of your data stored by us,
Restriction of data processing if we are not yet allowed to delete your data due to legal obligations,
to object to the processing of your data by us and
Data portability, provided that you have consented to the data processing or have concluded a contract with us.

If you have given us your consent, you can revoke it at any time with effect for the future.

You can lodge a complaint with a supervisory authority at any time, e.g. with the competent supervisory authority in the federal state in which you are resident or with the authority responsible for us as the controller.

‍

Provision of the website and creation of log files

Each time our website is accessed, our system automatically collects data and information from the device (e.g. computer, cell phone, tablet, etc.) used to access it.

What personal data is collected and to what extent is it processed?

(1) Information about the browser type and version used;
(2) the operating system of the accessing computer;
(3) the host name of the accessing computer;
(4) the IP address of the accessing computer;
(5) the date and time of access;
(6) websites and resources (images, files, other page content) accessed on our website;
(7) websites from which the user's system accessed our website (referrer tracking);
(8) notification of whether the access was successful;
(9) amount of data transferred

This data is stored in the log files of our system. This data is not stored together with the personal data of a specific user, so that individual visitors to the website cannot be identified.

Legal basis for the processing of personal data

Personal data is processed in compliance with the principle of legality (Art. 4 FADP) and the principle of good faith (Art. 2 CC) as well as Art. 6 para. 1 lit. f GDPR (legitimate interest).

Purpose of data processing

The temporary (automated) storage of data is necessary for the course of a website visit in order to enable the provision of the website. The storage and processing of personal data also takes place in order to maintain the compatibility of our website for as many visitors as possible and to combat misuse and eliminate faults. For this purpose, it is necessary to log the technical data of the accessing computer in order to be able to react as early as possible to display errors, attacks on our IT systems and/or errors in the functionality of our website. In addition, we use the data to optimize the website and to generally ensure the security of our IT systems.

Duration of storage

The aforementioned technical data is deleted as soon as it is no longer required to ensure the compatibility of the website for all visitors, but no later than 3 months after accessing our website.

Possibility of objection and deletion

You can object to the processing at any time in accordance with Article 21 of the GDPR and request the erasure of the data in accordance with Article 17 of the GDPR. You can find out what rights you have and how you can exercise them in the lower section of this privacy policy.

‍

Special functions of the website

Our website offers you various functions that collect, process and store personal data when you use them. We explain below what happens to this data:

Contact form(s)

What personal data is collected and to what extent is it processed?

The data entered by you in our contact forms, which you have entered in the input mask of the contact form.

Legal basis for the processing of personal data

The processing of personal data is carried out in accordance with the principle of lawfulness (Art. 4 FADP) and the principle of good faith (Art. 2 CC) as well as Art. 6 para. 1 lit. a GDPR (consent by unambiguous affirmative action or conduct).

Purpose of data processing

We use the data collected via our contact form or our contact forms exclusively to process the specific contact request received via the contact form. Please note that we may also send you e-mails to the address you have provided in order to fulfill your contact request. The purpose of this is to ensure that you receive confirmation from us that your request has been forwarded to us correctly. However, sending this confirmation e-mail is not obligatory for us and is for your information only.

Duration of storage

After your request has been processed, the data collected will be deleted immediately, provided there are no statutory retention periods.

Possibility of objection and deletion

Necessity of providing personal data

The contact forms are used on a voluntary basis. You are not obliged to contact us via the contact form, but can also use the other contact options offered on our website. If you wish to use our contact form, you must complete the fields marked as mandatory. If you do not fill in the mandatory fields of the contact form, you will either not be able to send the request or we will not be able to process your request due to missing information.

‍

Disclosure of information to third parties

Personal data is processed in compliance with the principle of legality (Art. 4 DSG) and the principle of good faith (Art. 2 ZGB).

The disclosure of information to third parties depends on the scope of the activities or offers of our website or our business model described below.

We only store your data for as long as necessary and treat it confidentially. Exceptions to this are the transfer of personal data to debt collection service providers, to public bodies and authorities and to private individuals who have a right to it due to legal regulations, court decisions or official orders, as well as the transfer to authorities for the purpose of initiating legal proceedings or for law enforcement if our legally protected rights are attacked.

‍

Use of Google Analytics

Nature and purpose of the processing:

This website uses Google Analytics, a web analysis service of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043 USA (hereinafter: "Google"). Google Analytics uses "cookies", which are text files placed on your computer, to help the website analyze how users use the site. The information generated by the cookie about your use of this website is usually transmitted to a Google server in the USA and stored there. However, due to the activation of IP anonymization on these websites, your IP address will be shortened by Google within member states of the European Union or in other contracting states of the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and truncated there. Google will use this information on behalf of the operator of this website for the purpose of evaluating your use of the website, compiling reports on website activity and providing other services relating to website activity and internet usage to the website operator. The IP address transmitted by your browser as part of Google Analytics will not be merged with other Google data.

The purpose of the data processing is to evaluate the use of the website and to compile reports on the activities on the website. Based on the use of the website and the Internet, other related services are then provided.

Legal basis for the processing of personal data:

The legal basis for data processing is your consent to the use of cookies and web tracking in our information banner (consent by clear confirmation of an action or behavior) in accordance with Art. 13 para. 1 FADP and Art. 6 para. 1 lit. a GDPR.

Beneficiary:

The recipient of the data is Google as the processor. We have concluded the corresponding data processing agreement with Google for this purpose.

Duration of storage:

The data will be deleted as soon as it is no longer required for our recording purposes.

Transfer to a third country:

Google processes your data in the USA and has submitted to the EU_US Privacy Shield. We have also concluded standard data protection clauses with Google for the use of Google Analytics.

Prescribed or required provision:

The provision of your personal data is voluntary and is based solely on your consent. If you prevent access, this may lead to functional restrictions on the website.

Withdrawal of consent:

You may refuse the use of cookies by selecting the appropriate settings on your browser, however please note that if you do this you may not be able to use the full functionality of this website. You can also prevent Google from collecting the data generated by the cookie and relating to your use of the website (including your IP address) and from processing this data by Google by downloading and installing the browser plug-in available under the following link: Browser Add On to deactivate Google Analytics.

In addition or as an alternative to the browser add-on, you can prevent tracking by Google Analytics on our pages by clicking on this link. This will install an opt-out cookie on your device. This will prevent Google Analytics from collecting data for this website and for this browser in the future as long as the cookie remains installed in your browser.

Profiling:

With the help of the Google Analytics tracking tool, the behavior of visitors to the website can be evaluated and their interests analyzed. We create a pseudonymous user profile for this purpose.

‍

Use of Google Maps

Nature and purpose of the processing:

We use Google Maps on this website. Google Maps is operated by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (hereinafter referred to as "Google"). This enables us to display interactive maps directly on the website and allows you to conveniently use the map function.

Further information on data processing by Google can be found in the Google Privacy Policy. There you can also change your personal data protection settings in the data protection center.

You can find detailed instructions on managing your own data in connection with Google products here.

Legal basis:

The legal basis for the transfer of personal data is your consent in accordance with Art. 4 para. 5 FADP or Art. 13 para. 2 FADP and according to Art. 6 para. 1 lit. a GDPR or Art. 9 para. 2 lit. a GDPR, which you have given on our website.

Beneficiary:

When you visit the website, Google receives the information that you have accessed the corresponding sub-page of our website. This happens regardless of whether Google provides a user account through which you are logged in or whether no user account exists. If you are logged in to Google, your data will be assigned directly to your account.

If you do not wish to be associated with your Google profile, you must log out of Google before activating the button. Google stores your data as usage profiles and uses them for the purposes of advertising, market research and/or the needs-based design of its website. Such an evaluation is carried out in particular (even for users who are not logged in) to provide needs-based advertising and to inform other users of the social network about your activities on our website. You have the right to object to the creation of these user profiles, whereby you must contact Google to exercise this right.

Duration of storage:

We do not collect any personal data through the integration of Google Maps.

Transfer to a third country:

Google processes your data in the USA and has submitted to the EU_US Privacy Shield https://www.privacyshield.gov/EU-US-Framework.

Withdrawal of consent:

If you do not want Google to collect, process or use data about you via our website, you can deactivate JavaScript in your browser settings. In this case, however, you will not be able to use our website, or only to a limited extent.

Prescribed or required provision:

The provision of your personal data is voluntary and is based solely on your consent. If you prevent access, this may lead to functional restrictions on the website.

‍

Use of Google Tag Manager

What personal data is collected and to what extent is it processed?

We use the Google Tag Manager service of Google Ireland Ltd, Gordon House, Barrow Street, 4 Dublin, Ireland, e-mail: support-deutschland@google.com, website: http://www.google.com/ (hereinafter: Google Tag Manager) on our website. Google Tag Manager offers a technical platform for the execution and bundling of other web services and web tracking programs by means of so-called "tags". In this context, Google Tag Manager stores cookies on your computer and analyzes your surfing behavior (so-called "tracking") if web tracking tools are executed with Google Tag Manager. This data sent by the individual tags integrated in Google Tag Manager is merged, stored and processed by Google Tag Manager under a uniform user interface. All integrated "tags" are listed separately in this privacy policy. Further information on data protection for the tools integrated in Google Tag Manager can be found in the relevant section of this privacy policy. When you use our website with activated integration of Google Tag Manager tags, data, in particular your IP address and your user activities, are transmitted to servers of Google Ireland Limited. The regulations in the corresponding section of this privacy policy apply to the web services integrated via Google Tag Manager. The tracking tools used in Google Tag Manager ensure that the IP address is anonymized before transmission by Google Tag Manager by means of IP anonymization of the source code. The Google Tag Manager is only able to record IP addresses anonymously (so-called IP masking).

Legal basis:

Purpose of data processing:

On our behalf, Google will use the information obtained with the help of the Google Tag Manager to evaluate your visit to this website, to compile reports on website activity and to provide us with other services relating to website activity and internet usage.

Duration of storage:

Google stores the data relevant to the function of the Google Tag Manager for as long as is necessary to fulfill the booked web service. Data collection and storage is anonymized. If there is a personal reference, the data will be deleted immediately, provided that there are no legal retention obligations to the contrary. In any case, the data will be deleted after the retention period has expired.

Possibility of objection and deletion:

You can prevent the collection and transmission of personal data to Google (in particular your IP address) and the processing of this data by Google by deactivating the execution of script code in your browser, installing a script blocker in your browser or activating the "Do Not Track" setting in your browser. You can also prevent Google from collecting the data generated by the Google cookie and relating to your use of the website (including your IP address) and from processing this data by Google by downloading and installing the browser plug-in available at the following link http://tools.google.com/dlpage/gaoptout?hl=de . You can find Google's security and data protection guidelines at https://policies.google.com/privacy.

‍

Use of Google Fonts

We use the Google Fonts service provided by Google Ireland Limited, Gordon House, Barrow Street, 4 Dublin, Ireland, e-mail: support-deutschland@google.com, website: http://www.google.com/. According to the Swiss authorities, processing takes place in secure third countries. The list of countries in Switzerland can be found at the following link: https://www.edoeb.admin.ch/edoeb/
en/home/data-protection/trade-and-economy/transborder-data-flows.html. Personal data is also transferred to the USA. For the transfer of personal data to the USA, an adequacy decision on the EU-US data protection framework of the EU Commission within the meaning of Art. 45 of the General Data Protection Regulation (hereinafter: DPF - https://commission.europa.eu/document/
fa09cbad-dd7d-4684-ae60-be03fcb0fddf_en). The operator of the service is certified according to the DPF, so that the usual level of protection of the GDPR applies to the transmission.

We use the Google Fonts service to integrate attractive fonts on our website in order to be able to show you our website in a visually better version. The service can also be used on our website if other Google services are loaded on our website that require Google Fonts fonts to run. This is the case, for example, if our website uses Google services that require Google Fonts for execution.

For the processing itself, the service or we collect the following data: Data on fonts, IP address of the page visitor, statistics on the use of fonts and other data from Google services in connection with our website.

If the service is activated on our website, our website establishes a connection to the servers of Google Ireland Limited and transmits the required data. As part of order processing, personal data may also be transferred to the servers of Google LLC, 1600 Amphitheatre Parkway, 94043 Mountain View, USA. When using the Google service on our website, Google may transfer and process information from other Google services in order to provide background services for the presentation and data processing of the services offered by Google. For this purpose, data may also be transferred to the Google services Google Apis, Google Cloud and Google Ads in accordance with the Google Privacy Policy. You can view the certification in accordance with the EU-US data protection framework at https://www.dataprivacyframework.gov/s/participant-search/participant-detail?id=a2zt000000001L5AAI&status=Active.

You can withdraw your consent at any time. Further information on withdrawing your consent can be found either in the consent itself or at the end of this privacy policy.

Further information on the handling of the transmitted data can be found in the provider's privacy policy at https://policies.google.com/privacy.

The provider also offers an opt-out option at https://support.google.com/My-Ad-Center-Help/answer/12155451?hl=de.

‍

Use of YouTube

Nature and purpose of processing

We embed YouTube videos and Facebook/Instagram links on some of our websites. The operators of the corresponding plugins are YouTube, LLC, 901 Cherry Ave, San Bruno, CA 94066, USA (hereinafter "YouTube") and Facebook Inc, Menlo Park, California. When you visit a page with the YouTube plugin, a connection to the YouTube servers is established. YouTube is informed which pages you visit. If you are logged into your YouTube account, YouTube can assign your surfing behavior to you personally. You can prevent this by logging out of your YouTube account beforehand.

When a YouTube video is started, the provider uses cookies that collect information about user behavior.

Further information on the purpose and scope of data collection and processing by YouTube can be found in the provider's privacy policy, where you will also find further information on your rights in this regard and setting options to protect your privacy (https://policies.google.com/privacy). Google processes your data in the USA and has submitted to the EU-US Privacy Shield https://www.privacyshield.gov/EU-US-Framework.

Legal basis

The legal basis for the integration of YouTube and the associated data transfer to Google is your consent.

Receiver

By accessing YouTube, a connection to Google is automatically established.

Storage period and revocation of consent

If you have deactivated the storage of cookies for the Google ad program, you do not have to expect such cookies when watching YouTube videos. However, YouTube also stores non-personal usage information in other cookies. If you wish to prevent this, you must block the storage of cookies in your browser.

Further information on data protection at "YouTube" can be found in the provider's privacy policy at

https://www.google.de/intl/de/policies/privacy/

Transfer to a third country

Google processes your data in the USA and has submitted to the EU_US Privacy Shield https://www.privacyshield.gov/EU-US-Framework.

Regulation mandatory or required

The provision of your personal data is voluntary and is based solely on your consent. If you prevent access, this may lead to functional restrictions on the website.

‍

Integration of external web services and processing of data outside the EU

On our website, we use active content from external providers, so-called web services. By accessing our website, these external providers may receive personal information about your visit to our website. This may result in data being processed outside Switzerland and the EU. You can prevent this by installing an appropriate browser plug-in or deactivating the execution of scripts in your browser. This may lead to functional restrictions on the websites you visit.

‍

Use of Webflow

We host our website with Webflow. The provider is Webflow, Inc, 398 11th Street, 2nd Floor, San Francisco, CA 94103, USA (hereinafter: Webflow). When you visit our website, Webflow collects various log files including your IP addresses.

Webflow is a tool for creating and hosting websites. Webflow stores cookies or other recognition technologies that are required to display the page, to provide certain website functions and to ensure security (necessary cookies).

Details can be found in Webflow's privacy policy: EU & Swiss Privacy Policy | Webflow 41.

The use of Webflow takes place on the basis of Art. 6 para. 1 lit. f GDPR. We have a legitimate interest in ensuring that our website is displayed as reliably as possible. If a corresponding consent has been obtained, the processing is carried out exclusively on the basis of Art. 6 para. 1 lit. a GDPR and § 25 para. 1 TTDSG, insofar as the consent includes the storage of cookies or access to information in the user's terminal device (e.g. device fingerprinting) within the meaning of the TTDSG. Consent can be withdrawn at any time.

Data is transferred to the USA on the basis of the EU Commission's standard contractual clauses. Details can be found here: EU & Swiss Privacy Policy | Webflow 41.

‍

Use of CloudFlare

We use the CloudFlare service from Cloudflare, Inc, 101 Townsend St, 94107 San Francisco, United States, email: support@cloudflare.com, website: https://www.cloudflare.com/de-de/. Your personal data is transferred to so-called insecure third countries. In doing so, we have checked the partners involved for compliance with the data protection laws applicable in Switzerland (usually EU standard contractual clauses) in accordance with Art. 6 para. 2 let. a FADP. You have given your consent to this or there is a direct connection between the state and the conclusion of the contract. Personal data is also transferred to the USA. With regard to the transfer of personal data to the USA, there is an adequacy decision on the EU-US data protection framework of the EU Commission within the meaning of Art. 45 of the General Data Protection Regulation (hereinafter: DPF - https://commission.europa.eu/document/fa09cbad-dd7d-4684-ae60-be03fcb0fddf_en). The operator of the service is certified according to the DPF, so that the usual level of protection of the GDPR applies to the transfer.

The legal basis for the transfer of personal data is our legitimate interest in processing in accordance with Art. 6 para. 1 lit. f GDPR. Our legitimate interest lies in achieving the purpose described below.

Cloudflare is a so-called content delivery network which, in addition to distributing the website across several servers, also offers security functions. Cloudflare also acts as a reverse proxy for our website.

You can view the certification in accordance with the EU-US data protection framework at https://www.dataprivacyframework.gov/s/participant-search/participant-detail?id=a2zt0000000GnZKAA0.

With regard to processing, you have the right to object in accordance with Art. 21 GDPR. Further information can be found at the end of this privacy policy.

Further information on the handling of the transmitted data can be found in the provider's privacy policy at https://www.cloudflare.com/privacypolicy/.

‍

Use of Hotjar

We use Hotjar to better understand the needs of our users and to optimize this service and experience. Hotjar is a technology service that helps us better understand our users' experiences (e.g. how much time they spend on which pages, which links they click on, what users like and dislike, etc.) and allows us to build and maintain our service with user feedback.

Hotjar uses cookies and other technologies to collect data about the behavior of our users and their devices. This includes a device's IP address (which is processed during your session and stored in anonymized form), device screen size, device type (unique device identifiers), browser information, geographic location (country only) and the preferred language in which our website is displayed. Hotjar stores this information on our behalf in a pseudonymized user profile. Hotjar is contractually prohibited from selling the data collected on our behalf.

For more details, see the "About Hotjar" section on the Hotjar support website: https://help.hotjar.com/hc/en-us/categories/115001323967-About-Hotjar

‍

Use of Vimeo

On our website, we use the Vimeo service provided by Vimeo, Inc., 555 West 18th Street, 10011 New York, United States, e-mail: Privacy@vimeo.com, website: http://www.vimeo.com/. Your personal data is transferred to so-called insecure third countries. In doing so, we have checked the partners involved for compliance with the data protection laws applicable in Switzerland (usually EU standard contractual clauses) in accordance with Art. 6 para. 2 let. a FADP. You have given your consent to this or there is a direct connection between the state and the conclusion of the contract. From the perspective of the EU, the data processing takes place in a third country for which there is no adequacy decision by the EU Commission. Therefore, the usual level of protection of the GDPR cannot be guaranteed for the transfer, as it cannot be ruled out that authorities in the third country, for example, may be able to access the data collected.

Videos from the Vimeo platform are integrated into our website via the Vimeo service.

You can withdraw your consent at any time. Further information on withdrawing your consent can be found either in the consent itself or at the end of this privacy policy.

Further information on the handling of the transmitted data can be found in the provider's privacy policy at https://vimeo.com/privacy.

The provider also offers an opt-out option at https://vimeo.com/privacy.

‍

SSL encryption

To protect the security of your data during transmission, we use state-of-the-art encryption methods (e.g. SSL) via HTTPS.

‍

Right to data portability

In accordance with Article 20 of the General Data Protection Regulation, you have the right to receive the personal data concerning you. We will provide the data in a structured, commonly used and machine-readable format. The data can be transmitted either to you or to a controller designated by you.

We will provide you with the following data on request:

Data collected on the basis of consent (Art. 13 para. 1 FADP and Art. 6 para. 1 let. a GDPR);
Data that we have received from you in the context of existing contracts (Art. 13 para. 2 let. a FADP and Art. 6 para. 1 let. b GDPR and Art. 9 para. 2 let. a GDPR);
Data that has been processed as part of an automated procedure.

We will transfer the personal data directly to a controller of your choice, insofar as this is technically possible. Please note that we may not transfer data that affects the overriding interests of third parties in accordance with Article 9 (1) b of the FADP and Article 20 (4) of the GDPR, or only to a limited extent.

‍

Changes to our privacy policy

We reserve the right to adapt this privacy policy so that it always complies with current legal requirements or to implement changes to our services in the privacy policy, e.g. when introducing new services. The new privacy policy will then apply to your next visit.

‍

Questions for the data protection officer

If you have any questions about data protection, please send us an e-mail: info@hotel-paradis.ch