menu
menu

Privacy Statement

Privacy Policy

With this Privacy Policy, we inform you about the processing of personal data in connection with our activities and operations, including our crestapalace.ch website. Specifically, we explain for what purpose, how, and where we process which personal data. We also inform you about the rights of individuals whose data we process.

 

Additional or separate privacy policies or other data protection information may apply for certain activities and operations.

 

We are subject to Swiss data protection law, as well as any applicable foreign data protection law, such as the European Union's General Data Protection Regulation (GDPR).

 

The European Commission recognized in its decision of July 26, 2000 that Swiss data protection law ensures adequate protection. In its report of January 15, 2024, the European Commission confirmed this adequacy decision.

 

1. Contact Addresses

Responsible for the processing of personal data:

 

Cresta Palace Celerina AG
Via Maistra 75
7505 Celerina/Schlarigna
Switzerland

welcome@crestapalace.ch

In individual cases, third parties may be responsible for the processing of personal data, or joint responsibility with third parties may exist.

 

1.1 Data Protection Officer or Data Protection Advisor

We have the following data protection officer or data protection advisor as a contact point for individuals and authorities regarding inquiries related to data protection:

 

Liane Kohl
Cresta Palace Celerina AG
Via Maistra 75
7505 Celerina/Schlarigna
Switzerland

office@crestapalace.ch

 

1.2 Data Protection Representation in the European Economic Area (EEA)

We have the following data protection representative in accordance with Art. 27 GDPR:

 

VGS Datenschutz­partner GmbH
Am Kaiserkai 69
20457 Hamburg
Germany

office@crestapalace.ch

The data protection representative serves as an additional point of contact for individuals and authorities in the European Union (EU) and the rest of the European Economic Area (EEA) regarding inquiries related to the GDPR.

 

2. Terms and Legal Bases

2.1 Terms

Data Subject: A natural person whose personal data we process.

Personal Data: Any information relating to an identified or identifiable natural person.

Special Categories of Personal Data: Data concerning union membership, political, religious, or philosophical views and activities, health data, intimate sphere, ethnic or racial origin, genetic data, biometric data that uniquely identify a natural person, criminal and administrative sanctions or prosecutions, and social assistance measures.

Processing: Any handling of personal data, regardless of the means or procedures used, such as querying, matching, adjusting, archiving, storing, reading, disclosing, obtaining, recording, collecting, deleting, making known, organizing, storing, modifying, disseminating, linking, destroying, or using personal data.

European Economic Area (EEA): Member States of the European Union (EU) as well as Liechtenstein, Iceland, and Norway.

 

2.2 Legal Bases

We process personal data in accordance with Swiss data protection law, including the Federal Act on Data Protection (Data Protection Act, FADP) and the Ordinance on Data Protection (Data Protection Ordinance, DPO).

If and to the extent the European General Data Protection Regulation (GDPR) applies, we process personal data or personally identifiable information in accordance with at least one of the following legal bases:

  • Art. 6(1)(b) GDPR for necessary processing of personal data to fulfill a contract with the data subject or to carry out pre-contractual measures.
  • Art. 6(1)(f) GDPR for necessary processing of personal data to protect legitimate interests, including those of third parties, provided that the fundamental rights and freedoms of the data subject do not prevail. Such interests include the long-term, humane, secure, and reliable conduct of our activities, ensuring information security, protection against misuse, enforcing legal claims, and complying with Swiss law.
  • Art. 6(1)(c) GDPR for necessary processing of personal data to comply with a legal obligation to which we are subject under the applicable law of member states in the European Economic Area (EEA).
  • Art. 6(1)(e) GDPR for necessary processing of personal data for the performance of a task carried out in the public interest.
  • Art. 6(1)(a) GDPR for processing personal data with the consent of the data subject.
  • Art. 6(1)(d) GDPR for necessary processing of personal data to protect the vital interests of the data subject or another natural person.
  • Art. 9(2) GDPR for processing special categories of personal data, especially with the consent of the data subjects.

The European General Data Protection Regulation (GDPR) refers to the processing of personal data as the processing of personally identifiable information and the processing of special categories of personal data as the processing of special categories of personally identifiable information (Art. 9 GDPR).

 

3. Type, Scope, and Purpose of the Processing of Personal Data

We process personal data that is necessary to carry out our activities and operations in a long-term, humane, secure, and reliable manner. The personal data processed may particularly fall into categories such as browser and device data, content data, communication data, metadata, usage data, master data including inventory and contact data, location data, transaction data, contract data, and payment data.

We also process personal data that we receive from third parties, collect from publicly accessible sources, or collect in the course of our activities and operations, provided such processing is lawful.

We process personal data as necessary, with the consent of the data subjects. In many cases, we may process personal data without consent, for example, to comply with legal obligations or to safeguard overriding interests. We may also ask data subjects for their consent when it is not required.

We process personal data for the duration necessary for the respective purpose. We anonymize or delete personal data, particularly depending on legal retention and limitation periods.

 

4. Disclosure of Personal Data

We may disclose personal data to third parties, allow third parties to process personal data, or jointly process personal data with third parties. Such third parties are typically specialized service providers whose services we use.

We may disclose personal data to banks and other financial institutions, authorities, educational and research institutions, consultants and lawyers, interest groups, IT service providers, cooperation partners, credit agencies, logistics and shipping companies, marketing and advertising agencies, media, organizations and associations, social institutions, telecommunications companies, and insurance companies.

 

5. Communication

We process personal data to communicate with third parties. In this context, we particularly process data provided by a data subject when contacting us, for example, by postal mail or email. We may store such data in an address book or similar tools.

Third parties transmitting data about other persons must ensure that data protection is upheld for such individuals. This includes ensuring the accuracy of the transmitted personal data.

We use selected services from appropriate providers to facilitate better communication with third parties.

 

6. Data Security

We implement appropriate technical and organizational measures to ensure a level of data security appropriate to the risk. With these measures, we particularly ensure the confidentiality, availability, traceability, and integrity of the processed personal data, although absolute data security cannot be guaranteed.

Access to our website and our other online presence is encrypted using Transport Layer Security (SSL/TLS, particularly via the Hypertext Transfer Protocol Secure, HTTPS). Most browsers issue warnings when visiting websites without transport encryption.

Our digital communication is generally subject to mass surveillance without cause or suspicion by security authorities in Switzerland, elsewhere in Europe, the United States (USA), and other countries. We cannot directly influence the corresponding processing of personal data by intelligence services, law enforcement agencies, or other security authorities. We also cannot rule out that an individual is specifically monitored.

 

7. International Data Transfers

We primarily process personal data in Switzerland and the European Economic Area (EEA). However, we may also transfer personal data to other countries, particularly for processing or to have it processed there.

We may transfer personal data to any country or territory on Earth, provided that the data protection laws of that country are deemed adequate by the Swiss Federal Council or, to the extent that the GDPR applies, by the European Commission.

We may transfer personal data to countries where the law does not provide adequate data protection, provided that data protection is ensured for other reasons, such as through standard data protection clauses or other appropriate safeguards. In exceptional cases, we may transfer personal data to countries without adequate or suitable data protection, if the specific data protection requirements are met, such as the explicit consent of the data subjects or an immediate connection to the conclusion or execution of a contract. Upon request, we will gladly provide affected individuals with information about any guarantees or provide a copy of any guarantees.

 

8. Rights of Data Subjects

8.1 Data Protection Claims

We grant data subjects all rights under applicable data protection law. In particular, data subjects have the following rights:

  • Access: Data subjects may request information about whether we process personal data about them and, if so, what personal data is involved. Data subjects will also receive the information necessary to exercise their data protection rights and to ensure transparency. This includes the processed personal data, as well as information about the purpose of processing, the retention period, any disclosures or transfers of data to other countries, and the source of the personal data.
  • Correction and Restriction: Data subjects may request the correction of inaccurate personal data, the completion of incomplete data, and the restriction of the processing of their data.
  • Deletion and Objection: Data subjects may request the deletion of personal data ("right to be forgotten") and object to the processing of their data for the future.
  • Data Portability: Data subjects may request the delivery or transfer of their personal data to another controller.

We may postpone, limit, or deny the exercise of data subjects' rights to the extent permitted by law. We may inform data subjects of any conditions that must be met to exercise their data protection rights. For example, we may deny access by citing confidentiality obligations or the protection of other persons. Similarly, we may refuse to delete personal data by citing statutory retention obligations.

We may charge fees for the exercise of rights in exceptional cases. We will inform data subjects of any fees in advance.

We are required to take reasonable measures to identify data subjects who request information or assert other rights. Data subjects are required to cooperate.

 

8.2 Legal Protection

Data subjects have the right to enforce their data protection claims in court or file a complaint with a data protection supervisory authority.

The data protection supervisory authority for private controllers and federal bodies in Switzerland is the Swiss Federal Data Protection and Information Commissioner (FDPIC).

European data protection supervisory authorities are organized as members of the European Data Protection Board (EDPB). In some EEA member states, the data protection supervisory authorities are federally structured, particularly in Germany.

 

9. Use of the Website

9.1 Cookies

We may use cookies. Cookies – both first-party cookies (our own) and third-party cookies (from services we use) – are data stored in the browser. Such stored data is not necessarily limited to traditional text-based cookies.

Cookies can be stored in the browser temporarily as "session cookies" or for a specific period as so-called persistent cookies. "Session cookies" are automatically deleted when the browser is closed. Persistent cookies have a defined retention period. Cookies enable a browser to be recognized during the next visit to our website, thereby allowing us to, for example, measure the reach of our website. Persistent cookies may also be used for online marketing.

Cookies can be deactivated or deleted entirely or partially in the browser settings. Without cookies, our website may no longer be fully available. We will request – at least to the extent necessary – explicit consent for the use of cookies.

For cookies used for performance and reach measurement or advertising, an opt-out is possible for numerous services through AdChoices (Digital Advertising Alliance of Canada), the Network Advertising Initiative (NAI), YourAdChoices (Digital Advertising Alliance), or Your Online Choices (European Interactive Digital Advertising Alliance, EDAA).

 

9.2 Logging

We may log the following information for each access to our website and other online presence, provided it is transmitted to our digital infrastructure during such access: date and time including time zone, IP address, access status (HTTP status code), operating system including user interface and version, browser including language and version, individual sub-page of our website accessed including data volume transferred, and the last web page accessed in the same browser window (referer).

We log such information, which may also include personal data, in log files. The information is necessary to provide our online presence in a long-term, humane, and reliable manner. The information is also necessary to ensure data security, whether directly or through third parties.

 

9.3 Tracking Pixels

We may embed tracking pixels in our online presence. Tracking pixels are also known as web beacons. Tracking pixels – including those from third parties whose services we use – are typically small, invisible images or JavaScript scripts that are automatically loaded when our online presence is accessed. Tracking pixels can capture at least the same information as log files.

 

10. Notifications and Communications

10.1 Performance and Reach Measurement

Notifications and communications may contain web links or tracking pixels that capture whether a specific notification was opened and which web links were clicked. Such web links and tracking pixels can also track the usage of notifications and communications on an individual basis. We require this statistical usage tracking for performance and reach measurement in order to send notifications and communications effectively and humanely to recipients, based on their needs and reading habits, as well as to do so reliably and securely.

 

10.2 Consent and Objection

You must generally consent to the use of your email address and other contact addresses unless their use is otherwise legally permitted. For the purpose of obtaining double-confirmed consent, we may use the "double opt-in" procedure. In this case, you will receive a notification with instructions for the double confirmation. We may log the consents obtained, including IP address and timestamp, for evidence and security reasons.

You may generally object to receiving notifications and communications, such as newsletters, at any time. By objecting, you may also object to the statistical usage tracking for performance and reach measurement. Required notifications and communications related to our activities and operations are exempt from this.

 

10.3 Service Providers for Notifications and Communications

We send notifications and communications with the help of specialized service providers.

 

11. Social Media

We are present on social media platforms and other online platforms to communicate with interested individuals and to inform them about our activities and operations. In connection with such platforms, personal data may also be processed outside of Switzerland and the European Economic Area (EEA).

The terms and conditions (T&Cs), privacy policies, and other provisions of the respective platform operators apply. These provisions particularly inform data subjects about their rights directly with the respective platform, including the right to access.

For our social media presence on Facebook, including the so-called Page Insights, we – if and to the extent that the GDPR applies – are jointly responsible with Meta Platforms Ireland Limited (Ireland). Meta Platforms Ireland Limited is part of the Meta companies (including the USA). The Page Insights provide insights into how visitors interact with our Facebook presence. We use Page Insights to provide our social media presence on Facebook effectively and humanely.

Further information about the type, scope, and purpose of data processing, information on the rights of data subjects, as well as Facebook's contact details and the Facebook Data Protection Officer, can be found in the Facebook Privacy Policy. We have concluded the so-called "Controller Addendum" with Facebook, agreeing that Facebook is responsible for ensuring the rights of data subjects. For Page Insights, the corresponding information can be found on the "Information about Page Insights" page, including "Information about Page Insights Data".

 

12. Third-Party Services

We use third-party services to ensure that we can carry out our activities and operations in a long-term, humane, secure, and reliable manner. Through such services, we can embed functions and content into our website. As a result of this embedding, the services used may necessarily collect at least temporarily the IP addresses of users.

For necessary security, statistical, and technical purposes, third parties whose services we use may process data related to our activities and operations in an aggregated, anonymized, or pseudonymized manner. This may include performance or usage data, necessary for providing the respective service.

We particularly use:

 

12.1 Digital Infrastructure

We use third-party services to access the necessary digital infrastructure in connection with our activities and operations. These include hosting and storage services from selected providers.

We particularly use:

 

12.2 Automation and Integration of Apps and Services

We use specialized platforms to integrate and connect existing third-party apps and services. We can also automate processes and activities with third-party apps and services through such "no-code" platforms.

We particularly use:

 

12.3 Audio and Video Conferencing

We use specialized services for audio and video conferencing to communicate online. These services allow us to conduct virtual meetings or host online classes and webinars. When participating in audio and video conferences, the legal texts of the individual services, such as privacy policies and terms of use, also apply.

We recommend muting the microphone by default and blurring the background or using a virtual background, depending on the situation.

We particularly use:

 

12.4 Online Collaboration

We use third-party services to enable online collaboration. In addition to this privacy policy, the terms and conditions or privacy policies of the services used, which are directly visible, may also apply.

We particularly use:

 

12.5 Social Media Functions and Social Media Content

We use third-party services and plugins to embed functions and content from social media platforms and to allow content to be shared on social media platforms and other channels.

We particularly use:

 

12.6 Maps

We use third-party services to embed maps into our website.

We particularly use:

 

12.7 Digital Content

We use specialized third-party services to embed digital content into our website. Digital content includes, in particular, image and video material, music, and podcasts.

We particularly use:

 

12.8 E-Commerce

We operate e-commerce and use third-party services to offer services, content, or goods successfully.

 

12.9 Payments

We use specialized service providers to process payments securely and reliably from our customers. For payment processing, the legal texts of the individual service providers, such as terms and conditions or privacy policies, apply.

We particularly use:

 

12.10 Advertising

We take the opportunity to display advertisements on third-party platforms, such as social media platforms and search engines, for our activities and operations.

We aim to reach individuals who are already interested in or might be interested in our activities and operations (remarketing and targeting). For this purpose, we may transmit relevant – potentially personally identifiable – information to third parties that enable such advertising. We may also determine whether our advertising is successful, particularly whether it leads to visits to our website (conversion tracking).

Third parties, where we advertise and where you are registered as a user, may potentially link the use of our website to your profile on their platform.

We particularly use:

 

13. Performance and Reach Measurement

We strive to measure the success and reach of our activities and operations. In this context, we may also measure the effectiveness of third-party references or test how different parts or versions of our online offering are used (A/B testing). Based on the results of performance and reach measurement, we can fix errors, enhance popular content, or implement improvements.

For performance and reach measurement, IP addresses of individual users are usually captured. In this case, IP addresses are generally shortened ("IP masking") to follow the principle of data minimization through the corresponding pseudonymization.

In performance and reach measurement, cookies may be used, and user profiles may be created. Any user profiles created typically include the specific pages visited or content viewed on our website, details of the screen size or browser window, and – at least approximately – the user's location. Generally, any user profiles are created on a pseudonymous basis and are not used to identify individual users. Certain third-party services, where users are logged in, may link the use of our online offering to their respective account or profile.

We particularly use:

 

14. Video Surveillance

We use video surveillance to prevent crime, secure evidence in the event of a crime, enforce and assert our legal rights, defend against third-party claims, and exercise our house rights. In doing so – if and to the extent that the GDPR applies – we rely on overriding legitimate interests according to Art. 6(1)(f) GDPR, in the case of special categories of personal data, with reference to Art. 9(2)(f) GDPR.

We retain recordings from our video surveillance as long as they are necessary for securing evidence or any other stated purpose.

We may secure recordings from our video surveillance and transmit them to relevant authorities, such as courts or law enforcement agencies, if the transmission is necessary for a stated purpose, in our other overriding legitimate interest, or due to legal obligations.

 

15. Final Provisions

We created this Privacy Policy using the privacy policy generator from Datenschutzpartner. The present privacy policy is an unofficial translation from the original German version.

We may adjust and supplement this Privacy Policy at any time. We will inform about such adjustments and supplements in an appropriate manner, particularly by publishing the current Privacy Policy on our website.