With this privacy policy, we provide information about the processing of personal data in connection with our activities and operations, including our website at the domain name atmamountainlodge.ch. We provide information in particular on why, how and where we process which personal data. We also provide information on the rights of the persons whose data we process.
For individual or additional activities and operations, we may publish further privacy policies or other information on data protection.
We are subject to Swiss data protection law and, where applicable, foreign data protection law, in particular that of the European Union (EU) with the European General Data Protection Regulation (GDPR).
With its decision of 26 July 2000, the European Commission recognised that Swiss data protection law ensures an adequate level of data protection. With its report of 15 January 2024, the European Commission confirmed this adequacy decision.
Controller responsible for the processing of personal data:
Sandwich Silvaplana SA
Via dal Farrer 1 - 7513 - Silvaplana
E-mail: mail.atmamountainlodge.ch
In individual cases, third parties may be responsible for the processing of personal data, or there may be joint responsibility with third parties.
1.1 DATA PROTECTION OFFICER OR DATA PROTECTION ADVISOR
We have the following data protection officer or data protection advisor as a point of contact for data subjects and authorities for enquiries relating to data protection:
Sandwich Silvaplana SA
Via dal Farrer 1 - 7513 - Silvaplana
E-mail: mail.atmamountainlodge.ch
1.2 DATA PROTECTION REPRESENTATIVE IN THE EUROPEAN ECONOMIC AREA (EEA)
We have the following data protection representative pursuant to Art. 27 GDPR:
VGS Datenschutzpartner GmbH
Am Kaiserkai 69 - 20457- Hamburg, Germany
E-mail: mail.atmamountainlodge.ch
The data protection representative serves data subjects and authorities in the European Union (EU) and in the rest of the European Economic Area (EEA) as an additional point of contact for enquiries relating to the GDPR.
2.1 DEFINITIONS
We process personal data in accordance with Swiss data protection law, in particular the Federal Act on Data Protection (Data Protection Act, FADP) and the Ordinance on Data Protection (Data Protection Ordinance, DPO).
We process – where and to the extent that the European General Data Protection Regulation (GDPR) is applicable – personal data on the basis of at least one of the following legal bases:
We process the personal data that are necessary to enable us to conduct our activities and operations on a lasting, user-friendly, secure and reliable basis. The personal data processed may in particular fall into the categories of browser and device data, content data, communication data, metadata, usage data, master data including inventory and contact data, location data, transaction data, contract data and payment data.
We also process personal data that we receive from third parties, obtain from publicly accessible sources or collect in the course of our activities and operations, to the extent that such processing is permitted for legal reasons.
We process personal data, where necessary, with the consent of the data subjects. In many cases we may process personal data without consent, for example in order to comply with legal obligations or to safeguard overriding interests. We may also ask data subjects for their consent where their consent is not required.
We process personal data for the period that is necessary for the respective purpose. We anonymise or delete personal data in particular depending on statutory retention and limitation periods.
We may disclose personal data to third parties, have it processed by third parties or process it jointly with third parties. Such third parties are in particular specialised providers whose services we use.
We may disclose personal data, for example, to banks and other financial service providers, authorities, educational and research institutions, advisors and lawyers, interest groups, IT service providers, cooperation partners, credit and business information agencies, logistics and shipping companies, marketing and advertising agencies, media, organisations and associations, social institutions, telecommunications companies and insurance companies.
We process personal data in order to be able to communicate with individuals as well as with authorities, organisations and companies. In doing so, we process in particular data that a data subject transmits to us when making contact, for example by post or email. We may store such data in an address book or with comparable tools.
Third parties who transmit data about other persons to us are obliged to ensure the data protection of those data subjects on their own responsibility. In particular, they must ensure that such data are correct and may be transmitted.
We use selected services from suitable providers in order to enable and improve communication with individuals and other communication partners. With such services, we may also manage and otherwise process the data of data subjects beyond direct communication.
We process personal data about applicants to the extent that it is necessary for assessing suitability for an employment relationship or for the subsequent performance of an employment contract. The necessary personal data arise in particular from the information requested, for example in the context of a job advertisement. We may publish job advertisements with the help of suitable third parties, for example in electronic and print media or on job portals and job platforms.
We also process personal data that applicants voluntarily provide or publish, in particular as part of cover letters, CVs and other application documents as well as online profiles.
We process – where and to the extent that the General Data Protection Regulation (GDPR) is applicable – personal data about applicants in particular pursuant to Art. 9(2)(b) GDPR.
We may enable applicants to store their details in our talent pool so that we can consider them for future vacancies. We may also use such details to maintain contact and to inform them about news. If we assume that, on the basis of their details, an applicant is eligible for an open position, we may inform the applicant accordingly.
We take appropriate technical and organisational measures to ensure a level of data security appropriate to the respective risk. With our measures, we ensure in particular the confidentiality, availability, traceability and integrity of the personal data processed, without, however, being able to guarantee absolute data security.
Access to our website and our other online presence takes place using transport encryption (SSL / TLS, in particular with the Hypertext Transfer Protocol Secure, abbreviated HTTPS). Most browsers warn before visits to websites without transport encryption.
Our digital communication is subject – like digital communication in general – to mass surveillance without cause or suspicion by security authorities in Switzerland, in the rest of Europe, in the United States of America (USA) and in other countries. We have no direct influence on the corresponding processing of personal data by intelligence services, police authorities and other security authorities. We also cannot rule out that a data subject is being specifically monitored.
We process personal data in principle in Switzerland and in the European Economic Area (EEA). However, we may also export or transmit personal data to other countries, in particular in order to process it there or to have it processed there.
We may export personal data to all countries on earth and elsewhere in the universe, provided that the law there ensures an adequate level of data protection according to a decision of the Swiss Federal Council and – where and to the extent that the General Data Protection Regulation (GDPR) is applicable – also according to a decision of the European Commission.
We may transmit personal data to countries whose law does not ensure an adequate level of data protection, provided that data protection is ensured on other grounds, in particular on the basis of standard data protection clauses or with other suitable safeguards.
In exceptional cases, we may export personal data to countries without adequate or suitable data protection if the special data protection requirements for this are met, for example the explicit consent of the data subjects or a direct connection with the conclusion or performance of a contract. Upon request, we will gladly provide data subjects with information about any safeguards or supply a copy of any safeguards.
9.1 DATA PROTECTION CLAIMS
We grant data subjects all claims under the applicable data protection law. Data subjects have in particular the following rights:
9.2 LEGAL PROTECTION
Data subjects have the right to enforce their data protection claims through legal proceedings or to file a report or complaint with a data protection supervisory authority.
The data protection supervisory authority for private controllers and federal bodies in Switzerland is the Federal Data Protection and Information Commissioner (FDPIC).
European data protection supervisory authorities are organised as members of the European Data Protection Board (EDPB). In some Member States in the European Economic Area (EEA), the data protection supervisory authorities are organised on a federal basis, in particular in Germany.
10.1 LOGGING
For every access to our website and our other online presence, we may log at least the following information, provided it is transmitted to our digital infrastructure during such access: date and time including time zone, IP address, access status (HTTP status code), operating system including user interface and version, browser including language and version, the individual subpage of our website accessed including the volume of data transmitted, the website last accessed in the same browser window (referer or referrer).
We log such information, which may also constitute personal data, in log files. The information is necessary in order to be able to provide our online presence on a lasting, user-friendly and reliable basis. The information is also necessary in order to be able to ensure data security – including by or with the help of third parties.
10.2 TRACKING PIXELS
We may embed tracking pixels in our online presence. Tracking pixels are also referred to as web beacons. Tracking pixels – including those of third parties whose services we use – are usually small, invisible images or scripts written in JavaScript that are automatically retrieved when our online presence is accessed. Tracking pixels can capture at least the same information as log files.
11.1 SUCCESS AND REACH MEASUREMENT
Notifications and messages may contain web links or tracking pixels that record whether an individual message has been opened and which web links have been clicked in the process. Such web links and tracking pixels may also record the use of notifications and messages on a personal basis. We require this statistical recording of usage for success and reach measurement, in order to be able to send notifications and messages effectively and in a user-friendly manner, as well as on a lasting, secure and reliable basis, based on the needs and reading habits of the recipients.
11.2 CONSENT AND OBJECTION
You must in principle consent to the use of your email address and your other contact addresses, unless the use is permitted on other legal grounds. To obtain double-confirmed consent where applicable, we may use the “Double Opt-in” procedure. In that case you will receive a message with instructions for the double confirmation. We may log consents obtained, including IP address and timestamp, for evidentiary and security reasons.
In principle, you may object at any time to receiving notifications and messages, such as newsletters. With such an objection, you can at the same time object to the statistical recording of usage for success and reach measurement. Necessary notifications and messages in connection with our activities and operations remain reserved.
11.3 SERVICE PROVIDERS FOR NOTIFICATIONS AND MESSAGES
We send notifications and messages with the help of specialised service providers.
We use in particular:
We maintain a presence on social media platforms and other online platforms in order to be able to communicate with interested persons and to inform them about our activities and operations. In connection with such platforms, personal data may also be processed outside Switzerland and the European Economic Area (EEA).
The general terms and conditions (GTC) and terms of use as well as the privacy policies and other provisions of the individual operators of such platforms also apply in each case. These provisions provide information in particular about the rights of data subjects directly towards the respective platform, which includes, for example, the right of access.
For our social media presence on Facebook, including the so-called Page Insights, we are – where and to the extent that the General Data Protection Regulation (GDPR) is applicable – jointly responsible with Meta Platforms Ireland Limited (Ireland). Meta Platforms Ireland Limited is part of the Meta companies (including in the USA). Page Insights provide information on how visitors interact with our Facebook presence. We use Page Insights in order to be able to provide our social media presence on Facebook effectively and in a user-friendly manner.
Further information on the nature, scope and purpose of the data processing, information on the rights of data subjects and the contact details of Facebook as well as of the data protection officer of Facebook can be found in the privacy policy of Facebook. We have concluded the so-called “Controller Addendum” with Facebook and have thereby agreed in particular that Facebook is responsible for ensuring the rights of data subjects. For the so-called Page Insights, the corresponding information can be found on the page “Information about Page Insights”, including “Information about Page Insights Data”.
We also use in particular:
• Tripadvisor: The Tripadvisor platform is used by our guests to review our service. Provider: Tripadvisor Inc., 400 1st Avenue, Needham, MA 02494 USA; data protection information: privacy policy
We use services from specialised third parties in order to be able to conduct our activities and operations on a lasting, user-friendly, secure and reliable basis. With such services, we may, among other things, embed functions and content in our website. When such embedding takes place, the services used record the IP addresses of users at least temporarily for technically compelling reasons.
For necessary security-related, statistical and technical purposes, third parties whose services we use may process data in connection with our activities and operations in aggregated, anonymised or pseudonymised form. This concerns, for example, performance or usage data, so that the respective service can be offered.
We use in particular:
13.1 DIGITAL INFRASTRUCTURE
We use services from specialised third parties in order to be able to make use of the digital infrastructure we require in connection with our activities and operations.
13.2 MAPS
We use third-party services in order to be able to embed maps in our website.
We use in particular:
13.3 E-COMMERCE
We operate e-commerce and use third-party services in order to be able to offer services, content or goods successfully.
• resmio: Reservation tool. Embedded on the website, the reservation tool allows guests to check availability and to book online. All table reservations go directly into a digital reservation book; provider: resmio GmbH, headquarters: Katzwanger Straße 150, 90461 Nürnberg, branch office: Gneisenaustraße 66-67, 10961 Berlin; data protection information: privacy policy.
13.4 PAYMENTS
We use specialised service providers in order to be able to process payments securely and reliably. The legal texts of the individual service providers, for example general terms and conditions (GTC) or privacy policies, additionally apply to the processing of payments.
We use in particular:
We try to measure the success and reach of our activities and operations. In this context, we may also measure the effect of referrals from third parties or test how different parts or versions of our online offering are used (“A/B test” method). Based on the results of the success and reach measurement, we may in particular fix errors, strengthen popular content or make improvements.
For success and reach measurement, the IP addresses of individual users are recorded in most cases. In this case, IP addresses are in principle shortened (“IP masking”) in order to comply with the principle of data minimisation through the corresponding pseudonymisation.
Cookies may be used and user profiles created for success and reach measurement. Any user profiles created include, for example, the individual pages visited or content viewed on our website, information on the size of the screen or browser window and the – at least approximate – location. In principle, any user profiles are created exclusively in pseudonymised form and are not used to identify individual users. Individual third-party services with which users are logged in may be able to attribute the use of our online offering to the user account or user profile with the respective service.
We use in particular:
We have created this privacy policy using the Data Protection Generator of Datenschutzpartner.
We may update this privacy policy at any time. We will provide information on updates in an appropriate form, in particular by publishing the current privacy policy on our website.