Data protection regulations
Aletsch Bahnen AG (ABAG), Verwaltungsgebäude, 3992 Bettmeralp, represented by Valentin König, Director, operates the shop.aletschbahnen.ch website and is responsible for the collection, processing and use of your personal data. ABAG is therefore also responsible for ensuring that all data processing is carried out in accordance with the applicable law.
The protection of your personal data is very important to us. We take data protection seriously and pay attention to the security of your data. We comply with the applicable data protection regulations in accordance with the General Data Protection Regulation (GDPR).
It is important to us that you know what personal data we collect from you, how this is done, how this data is processed and for what purposes. By using our website, you declare your consent to all such data processing within the meaning of Art. 6 para. 1 lit. a of the GDPR. Please read the following information carefully.
Please also note the applicable Booking Conditions, Terms and Conditions of Use, and the Tariff and Transport Regulations of ABAG, and read these carefully too.
1. What data do we process when you visit our website?
When you visit our website, our servers temporarily store each access in a log file. The following data is recorded automatically:
- the IP address of the computer requesting access
- the date and time of access
- the name and URL of the retrieved data
- the website from which access was made
- the operating system of your computer and the browser you used
- the country you are accessing from and the language settings of your browser
- the name of your Internet access provider
This data is collected and processed to enable the use of our website (connection setup), to guarantee system security and stability, to optimise our Internet offering and for internal statistical purposes. The IP address in particular is used to record your country of residence and to establish the appropriate default settings (e.g. language). The IP address is also stored in order to be able to react appropriately to attacks on our network infrastructure. In all these activities, our legitimate interest in this data collection and data processing is based on Art. 6 para. 1 lit. f of the GDPR.
2. What personal data do we need and what happens to your data when you make a purchase, a booking or an order with us or a third party via our web shop?
There are various ways to make bookings and request information or other services on our website. If services are provided by third parties, the data collected will be forwarded to these third parties as far as necessary. This includes, for example, the following data:
- Salutation and/or company
- First name and surname
- Date of birth
- Address (street, house number, postcode, town/city, country)
- Further contact details (e-mail address, telephone number)
- Credit card or other payment details
Required entries are marked as such. This information is necessary to be able to provide the booking services. The provision of other information is voluntary and has no influence on the use of our website or booking services. We would also like to point out that the data entered by you will generally also be collected directly by the third-party provider and stored by them and/or forwarded to them by us. If a third party then independently processes the collected data, the data protection regulations of the respective provider apply and we ask that you also consult these. The legal basis for this data processing is the performance of a contract as per Art. 6 para. 1 lit. b of the GDPR.
Clients are subject to access checks before transport, the location and number of accesses are stored. This is done exclusively for billing purposes and to the extent necessary for the fulfilment of the contract. The legal basis for this data processing is the performance of a contract as per Art. 6 para. 1 lit. a of the GDPR. It should be noted that a reference photo is taken for monitoring purposes upon entry to the ski areas.
On purchase of an annual or season pass, we collect the following personal data: Name, first name, address, postcode, town/city, photo and email address (all obligatory). We also store this data in our internal databases. The legal basis for this data processing is the performance of a contract as per Art. 6 para. 1 lit. a of the GDPR.
3. What data do we process when you subscribe to our newsletter?
On our website, you have the opportunity to subscribe to our newsletter. Registration is required for this. The following data must be submitted during the registration process:
- Salutation (obligatory)
- First and last name (obligatory)
- E-mail address (obligatory)
- Language (obligatory)
This information is required for data processing purposes. In addition, you can choose to provide further data (date of birth, town/city, postcode, country, telephone number). We process this data exclusively in order to personalise the information and offers sent to you and to better align them with your interests.
4. What are cookies and what are they used for?
5. What is Google Analytics and what is it for?
The information generated by these cookies, for example the time, location and frequency of website visits, as well as the IP address, is transferred to Google and stored there.
We use Google Analytics with an IP anonymisation feature on our website, whereby the IP addresses of users within member states of the European Union or in other contracting states of the Agreement on the European Economic Area are shortened by Google and thus anonymised. Google will use this information to evaluate the use of our website, compile reports on website activity for us, and provide other services relating to website activity and Internet usage. Google may also transfer this information to third parties where it is required to do so by law, or where such third parties process the information on Google’s behalf.
Google asserts that it will under no circumstances associate the IP address of the user with any other data held by Google. The user can prevent the installation of cookies by adjusting their browser software settings accordingly. However, Aletsch Bahnen would like to point out that some website functions may not be fully accessible if this is done.
Google also offers a deactivation option for the most popular browsers which gives users more control over what data Google collects and processes. If the user activates this option, no information about the website visit will be transmitted to Google Analytics. However, activation does not prevent information from being transmitted to us or to other web analysis services we may use.
6. Is collected data passed on to third parties?
We will only pass on your personal data with your express consent, where there is a legal obligation to do so, or if this is necessary to enforce our rights, in particular to enforce claims arising from the contractual relationship.
Various third-party service providers are explicitly mentioned in this data protection statement (see “What data is collected by us, for what purpose and where is it stored?”). Another service provider to whom personal data is passed on or who has or may have access to your personal data is Aletsch Arena AG (Aletsch Arena AG, Furkastrasse 39, CH-3983 Mörel-Filet).
(See also “7. Storage of your personal data in a central database of Aletsch Arena AG.”)
7. Storage of your personal data in a central database of Aletsch Arena AG and Aletsch Bahnen AG
The personal data mentioned in the preceding sections will be stored, processed and evaluated centrally by Aletsch Arena AG and Aletsch Bahnen AG. These evaluations can be used to create user profiles for you. By using the functionalities mentioned above, you agree that we may store your personal data in our central database and evaluate it there for advertising purposes. You agree that personalised user profiles may be created for you. You may object to the evaluation of your personal data for advertising purposes and the creation of user profiles at any time (see “What are your rights?”).
We use marketing automation software to cover various aspects of our digital marketing, sales and customer relationship management. Furthermore, we use the tool to analyse and optimise our web offers and to give you a user-friendly experience and the best possible service.
We use marketing automation software for:
- providing a point of contact with us via the contact form (see “For an enquiry via the contact form on aletscharena.ch”)
- newsletter subscriptions and dispatching (see “When you subscribe to the newsletter on aletscharena.ch”)
- creating landing pages that are used as part of an advertising campaign and enable interactions such as getting in touch with us or downloading documents
- social media linking or social media sharing
- evaluating how our websites are used (e.g. visits, pages visited, length of visit, etc.) as well as for evaluating how our newsletters are used, e.g. opening rates, click rates, unsubscribe rates, etc.
(see “On opening a newsletter”)
8. Is data transmitted abroad?
ABAG is also entitled to transfer your personal data to third parties (i.e. contracted service providers) abroad if this is necessary for the data processing described in these Data Protection Regulations. These third parties are obliged to protect your data to the same extent as we are. If the level of data protection in a country does not correspond to that in Switzerland or Europe, we will contractually ensure that the protection of your personal data by the third party corresponds to that in Switzerland or the EU at all times.
For the sake of completeness, we would like to point out that in the USA, surveillance measures put in place by the US authorities generally allow the storage of all personal data belonging to anyone whose data is transferred from Switzerland to the USA. This is done without differentiation, limitation or exception with regard to the objective pursued and without any objective criteria that might make it possible to restrict the US authorities’ access to and subsequent use of the data to highly specific, strictly limited purposes that might justify the interference associated with accessing and using the data. We would also like to point out that there are no legal remedies in the USA that allow you to gain access to the data concerning you and have it corrected or deleted, and that there is no effective legal protection against the general access rights of US authorities.
It is important to us that we draw your attention to this legal situation and these facts so that you can make an informed decision about consenting to the use of your data.
We would also like to draw the attention of users residing in an EU member state to the fact that, from the point of view of the European Union, the USA does not have an adequate level of data protection, partly because of the issues mentioned in this section.
Where we have explained in these Data Protection Regulations that data recipients (such as Google) are located in the United States, we will ensure that your information is protected at an appropriate level by our partners, either through contractual arrangements with those companies or by ensuring that those companies are certified under the EU – US Privacy Shield.
9. Data security and confidentiality
We deploy appropriate technical and organisational security measures to protect your personal data stored with us from manipulation, partial or complete loss, and from unauthorised access by third parties. Our security measures are continuously improved to keep pace with the latest technological developments.
It is important that you always treat your payment information (especially credit card details) confidentially. We recommend closing the browser window at the end of your session, especially if you share a computer with other people.
We also take in-house data protection very seriously. We oblige our employees and the service providers commissioned by us to observe confidentiality and to comply with the provisions of data protection legislation.
10. Retention of data
We only store personal data for as long as is necessary
- to use the tracking and analysis services mentioned above in our legitimate interest;
- to perform services which you have requested or for which you have given your consent, to the extent described above;
- to comply with our legal obligations.
We retain data related to the conclusion or performance of a contract for a longer period of time, as this is prescribed by statutory storage obligations, for example, accountancy regulations and tax law. According to these regulations, business communication, concluded contracts and accounting vouchers must be kept for up to 10 years. If we no longer need this data to perform services for you, the data will generally be blocked. This means that the data may then only be used for accounting and tax purposes.
11. Your rights
You have the following rights with regard to your personal data:
- Right of access (Art. 15 GDPR),
- Right to rectification (Art. 16 GDPR) or erasure (Art. 17 GDPR),
- Right to restriction of processing (Art. 18 GDPR),
- Right to data portability (Art. 20 GDPR),
- Right to object to processing (Art. 21 GDPR).
11.1 Right of revocation
If you have given us your consent for the processing of your personal data, you can revoke your consent at any time. Your revocation does not affect the legality of the data processing carried out until the revocation.
11.2 Right of objection
If the processing of your personal data is subject to a weighing of interests (Art. 6 para. 1 lit. f of the GDPR: legitimate interests), you have the right to object to the processing at any time for reasons arising from your particular situation. When exercising your right of objection, we ask you to explain to us your reasons why we should not process your personal data as we have done. We will examine the situation and either discontinue the data processing, adjust our data processing, or continue the data processing after demonstrating our compelling legitimate grounds for carrying it out. We will also continue to process data if it is used to assert, exercise or defend legal claims. You can object to data processing for the purposes of direct marketing and data analysis at any time. In these cases, we will stop collecting data.
11.3 Exercise of your rights
In order to exercise your rights, you must notify us personally, by telephone or in writing. The request must be sent to firstname.lastname@example.org or Aletsch Bahnen AG, Verwaltungsgebäude, 3992 Bettmeralp, or made by phone on +41 27 928 41 41. We can only provide you with information if you can identify yourself.
11.4 Complaint to the supervisory authority
If you are of the opinion that the storage and processing of your personal data violates applicable data protection laws or your data protection rights[EM5] are violated, you also have the right to lodge a complaint with the supervisory authority. Please address the complaint to the Swiss data protection authority.[EM6]
You can contact us for the aforementioned purposes at email@example.com. You can also tell us what to do with your information after your death by providing us with the appropriate instructions. We may, at our discretion, require proof of your identity in order to process your requests. If you contact us, we will do our best to send you an answer as soon as possible and to take the desired steps.
If you reside in an EU country, you have the right to complain to a data protection supervisory authority at any time.