Privacy policy

The White Label Shop Ascona-Locarno Tourism is user of the online shop market place Schweizerische Südostbahn AG with Swiss Booking AG as broker

Version: 12th May 2022

1 Data controller

Swiss Booking AG (SWB) is committed to protecting your data. When processing your personal data, we adhere to all applicable data protection provisions.

The data controller responsible for the storage and processing of personal data is Swiss Booking AG, Churerstrasse 54, CH-8808 Pfäffikon.

2 Name and contact details of the data protection officer

Mag. Eva Plaschke acts as the external data protection officer for Swiss Booking AG.

Contact: Mag. Eva Plaschke EQT-Unternehmensberatung e.U./Erfolg durch Qualität und Transparenz Althofen 49, A-9131 Grafenstein Tel. +43(0) 664 829 79 49 E-Mail: privacy-protection@swissbooking.com

3 Information about the processing of your personal data

As part of your registration or the creation of your personal account, SWB requires the following personal data (hereinafter “master data”) in order to process any potential future contract that may be concluded with you.

First name
Surname
Date of birth
Telephone number
E-mail address
Street, building number
Post code, town/city
Country

The details of storage and processing of personal data are set out below.

3.1 Visiting the website

Purpose: If our website is used purely for information purposes (no registration or submission of other information), personal data that your browser transmits to our server is collected. This is necessary for technical reasons: it allows you to view our website and ensures the stability and security of the website.
Legal basis: Legitimate interest
The following data is processed: IP address, date and time of request, time zone difference to GMT, content of request (specific page), access status/HTTP status code, data volume transferred, requesting website, browser, operating system and interface, language and version of browser software
Storage period: For as long as you use our website
Recipients/recipient categories: Order processors

3.2 Electronic contact requests via the website

Purpose: Processing of contact requests received via e-mail or the contact form on the website.
Legal basis: Performance of a contract, required to carry out precontractual measures, legitimate interest
The following personal data is processed: Master data
Storage period: Until the request has been responded to; if statutory data retention obligations apply, processing will be restricted until that time
Recipients/recipient categories: Order processors

3.3 Customer management, accounting, legal disputes

Purpose: Processing of personal data in connection with any business relationships with customers and suppliers as part of normal business operations, including systematic recording of all transactions relating to income and outgoings
Legal basis: Consent, performance of a contract, required to carry out precontractual measures, fulfilment of a legal obligation, legitimate interest, particularly defending, exercising or establishing legal claims, explicit consent
The following personal data is processed: Master data
Storage period: Until the termination of the business relationship or until the expiry of applicable statutory retention or limitation periods. Data will also be stored until the resolution of any legal disputes for which it is required as evidence.
Recipients/recipient categories: Event organisers, service providers, legal representatives, accountants and tax advisors, tax offices, courts and authorities

3.4 Customer relationship management and marketing

Purpose: Processing of data on existing and prospective customers for initial business contact purposes in respect of the range of products and services, provision of additional travel or leisure information as a supplementary service as part of the contractual relationship, advertising activities and newsletter mailing, customer relationship management
Legal basis: Consent, performance of a contract, required to carry out precontractual measures, fulfilment of a legal obligation, legitimate interest, particularly defending, exercising or establishing legal claims
The following personal data is processed in connection with the provision of additional travel or leisure information as a supplementary service as part of the contractual relationship and for mailing of newsletters via our website: Master data
Storage period: The data will be stored until the end of the contractual relationship unless longer contractual or statutory retention periods apply
Recipients/recipient categories: Service providers

4 Rights of affected persons

4.1 You have the following rights in relation to your personal data:

the right to be informed,
the right to rectification,
the right to restrict processing,
the right to data portability,
the right to object to processing.

4.2 Right to withdraw consent

If you have previously given us your consent to process your personal data, you may also withdraw your consent at any time. Withdrawing your consent will not affect the lawfulness of any processing carried out prior to its withdrawal.

4.3 Right to object

If the processing of your personal data is based on a balance of interests (legitimate interest), you have the right to object to such processing at any time for reasons relating to your particular situation. If you exercise your right to object, we would ask you to inform us of the reasons why we should not process your personal data in the way that we do. We will review the situation and either suspend data processing, adapt it or demonstrate to you our compelling legitimate grounds to continue processing your data. We will also continue processing your data if this is necessary for the establishment, exercise or defence of legal claims. You may object to the processing of your data for direct marketing and data analysis purposes at any time. In this case we will cease data processing.

4.4 Exercising your rights

You must notify us in person, by telephone or in writing if you wish to exercise your rights. You should send your request to Swiss Booking AG, Churerstrasse 54, CH-8808 Pfäffikon, tel. +41 (0) 55 588 0238 or via e-mail to privacy-protection@swissbooking.com. We can only provide you with information if you are able to identify yourself.

4.5 Complaining to the supervisory authority

If you believe that the storage and processing of your personal data constitutes a violation of applicable data protection law or breaches your data protection rights, you also have the right to lodge a complaint with the supervisory authority.

5 Cookies

5.1 Definition of Cookies

Our website uses HTTP cookies in order to store data specific to the individual user.

We clarify below what cookies are and why they are used so that you can better understand the following Privacy Statement.

Whenever you surf on the internet, you use a browser. Well-known browsers include for example Chrome, Safari, Firefox, Internet Explorer and Microsoft Edge. Most websites store small text files in your browser. These files are known as cookies.

It cannot be denied that cookies are genuinely useful. Almost all websites use cookies. More specifically, these cookies are HTTP cookies, as other types of cookie exist for other types of application. HTTP cookies are small files that are stored by our website on your computer. These cookie files are automatically stored in the cookie folder, which is like the “brain” of your browser. A cookie has a name and a value. When defining a cookie it is also necessary to indicate one or more attributes.

Cookies store certain user data relating to you, such as for example your language or personal page settings. If you return to our website, your browser sends the “user-specific” information back to our page. Thanks to cookies, our website knows who you are and provides you with the settings that you are used to. In some browsers each cookie has its own file, whereas in others such as for example Firefox all cookies are stored in one single file.

5.2 Types of Cookie

It is possible to distinguish between 4 types of cookie:

Essential cookies These cookies are necessary in order to ensure basic website functions. For example these cookies are required if a user puts a product in the basket then moves on to another page and only goes to the checkout at a later stage. Thanks to these cookies, the basket is not emptied, even if the user closes the browser window.

Functional cookies These cookies collect information concerning user behaviour and whether the user has received any error messages. In addition, these cookies also measure loading times and how the website performs with different browsers.

Targeted cookies These cookies ensure greater user friendliness. For example, they store locations, font sizes or form data that has been entered.

Advertising cookies These cookies are also known as targeting cookies. They are intended to provide advertising that is individually tailored to the user. This can be extremely practical, but also very annoying.

You are normally asked whether you would like to allow this type of cookie the first time you visit a website. And naturally this decision itself is also stored in a cookie.

5.3 Right to object – ability to delete cookies

You can decide for yourself how and whether you would like to use cookies. Regardless of the service or website from which the cookies originate, you always have the option of erasing or disabling cookies, or only allowing certain types of cookies. For example, you can block cookies from third party providers, whilst allowing all other cookies.

If you would like to establish which cookies have been stored in your browser, change your cookie settings or delete cookies, you can do so within your browser settings:

Chrome: Clear, enable, and manage cookies

Safari: Manage cookies and website data

Firefox: Clear cookies and site data

Internet Explorer: Delete and manage cookies

Microsoft Edge: Delete and manage cookies

If as a general rule you do not want any cookies, you can configure your browser in such a manner that you are always informed if a cookie is to be saved. You can decide for each individual cookie whether or not to allow the cookie. The procedure differs depending upon the browser. The easiest way of finding instructions is to enter search terms such as “delete cookies Chrome” or “disable cookies Chrome” into Google, if you are using a Chrome browser.

5.4 Legal basis

Since 2009 a so-called “Cookie Directive” has been applicable. It states that the storage of cookies requires your consent (point (a) of Article 6(1) GDPR). However, responses to this Directive within EU Member States have differed widely. In Austria, the Directive was implemented by Section 96(3) of the Austrian Telecommunications Act [Telekommunikationsgesetz, TKG].

Even if consent has not been obtained, essential cookies are justified by legitimate interests (point (f) of Article 6(1) GDPR), which in most cases are economic in nature. We would like to offer a pleasant user experience to visitors to the website, which in many cases means that particular cookies are absolutely essential.

If any cookies are used that are not absolutely essential, this only occurs with your consent. The legal basis for this is point (a) of Article 6(1) GDPR.

6 Google Analytics

6.1 Definition of Goolge Analytics

On our website we use the analysis tracking tool Google Analytics (GA) provided by the US company Google Inc. The company Google Ireland Limited (Gordon House, Barrow Street Dublin 4, Ireland) is responsible for all Google services within Europe. Google Analytics collects data about how you behave on our website. For example, if you click on a link, this action is stored in a cookie and sent to Google Analytics. We can use the reports that we receive from Google Analytics to tailor our website and our services better to your wishes. We describe the tracking tool in greater detail below and inform you in particular about which data are stored and how you can prevent this from happening.

Google Analytics is a tracking tool for analysing data traffic on our website. In order for Google Analytics to work, a tracking code is incorporated into the code for our website. If you visit our website, this code records your various actions on our website. Once you have left our website, these data are sent to Google Analytics servers and stored at that location.

Google process the data and we receive reports concerning your user behaviour. These may include, amongst others, the following types of report:

Audience reports: audience reports enable us to find out more about our users and to know who exactly is interested in our services.

Ad reports: ad reports make it easier for us to analyse and improve our online advertising.

Acquisition reports: acquisition reports provide us with helpful information about how we can get more people interested in our services.

Behaviour reports: here we find out how you interact with our website. We can identify the route by which you arrived at our website as well as the links that you have clicked on.

Conversion reports: conversion means the way in which you carry out a pre-defined act on the basis of a marketing message. For example, this might concern how you turn from a mere visitor to the website into a customer or a subscriber to the newsletter. Using these reports we find out more about how our marketing initiatives are received by you. Our aim in doing so is to increase our conversion rates.

Real time reports: here we find out in real time what exactly is happening on our website. For example, we can see how many users are reading this text at any given time.

6.2 The purpose for which Google Analytics is used

We want to offer the best possible service to you. The statistics and data obtained from Google Analytics help us to achieve this goal.

After they have been statically assessed, the data provide us with a clear picture of the strengths and weaknesses of our website. First of all, we are able to optimise our website so that it is easier for people who are interested in it to find it on Google. Secondly, the data help us to understand you better as a visitor. This means that we know with a high degree of precision what aspects of our website we have to improve in order to provide you with the best possible service. We also use the data in order to conduct individual, cost-effective advertising and marketing. Ultimately, it only makes sense to display our products and services to people who are interested in them.

Using a tracking code, Google Analytics generates a random, unique ID, which is associated with your browser cookie. This enables Google Analytics to recognise you as a new user. The next time you visit our website, you are recognised as a “returning” user. All data collected are stored along with this user ID. This makes it possible to include pseudonymised user profiles in reports.

In order to be able to analyse our website with Google Analytics, a property ID has to be embedded in the tracking code. The data are then stored in the corresponding property. Google Analytics 4 Property is used as standard for each newly created property. However, it is still possible to create the Universal Analytics Property as an alternative. Depending upon the property used, data are stored for different periods of time.

Your interactions with our website are measured using identifiers such as cookies and app instance IDs. Interactions are types of action that you carry out on our website. If you also use other Google systems (such as e.g. a Google account), data generated using Google Analytics can be cross-referenced with cookies of third party providers. Google does not pass on any Google Analytics data except with our approval as the website operator. Exceptions may apply if required by law.

An overview is provided below of the most important data collected by Google Analytics:

Heatmaps: Google creates so-called “heatmaps”. Heatmaps display specifically the areas that you click on. This allows us to find out where you are browsing on our website.

Session duration: Google defines the session duration as the period of time that you spend on our website without leaving the site. The session ends automatically if you have been inactive for 20 minutes.

Bounce rate: a bounce occurs if you visit only one page on our website and then leave the site again.

Account creation: if you create an account on our website or place an order, Google Analytics collects this information.

IP address: the IP address is only displayed in truncated form in order to prevent it from being uniquely associated with any given user.

Location: the IP address enables the country and your approximate location to be determined. This process is also referred to as IP tracking.

Technical information: technical information includes amongst other things your browser type, your internet provider and your screen resolution.

Referrer: both Google Analytics and we are naturally interested also in finding out via which website or advert you arrived at our website.

6.3 Right to object – right to erasure

According to EU data protection law, you have the right to obtain access to your data, to update them, to erase them and to restrict processing. Using the browser extension for disabling Google Analytics JavaScript (ga.js, analytics.js, dc.js), you can prevent Google Analytics from using your data. You can download and install the browser extension from https://tools.google.com/dlpage/gaoptout?hl=en-GB. Please note that this extension only disables data collection by Google Analytics.

As stated in section 4.3 of this Privacy Statement, it is possible to delete cookies as a general rule.

6.4 Legal basis

The use of Google Analytics is conditional upon your consent, which we will have obtained via our cookie pop-up. This consent is the legal basis according to point (a) of Article 6(1) GDPR (consent) for the processing of personal data that may be collected by the web analytics tool.

In addition to consent, we have a legitimate interest in analysing the behaviour of visitors to the website for the purpose of improving our content in both technical and financial terms. Google Analytics helps us to identify errors within the website, identify attacks and enhance cost-effectiveness. The legal basis for this is point (f) of Article 6(1) GDPR (legitimate interests). Nevertheless, we only use Google Analytics if we have obtained your consent.

Google processes data, amongst other locations, also in the USA. Please note that, in the view of the European Court of Justice, at the present time there is not an adequate level of protection for data transfers to the USA. This may entail various risks for the lawfulness and security of data processing.

Google uses the standard contractual clauses approved by the EU Commission (Article 46(2) and (3) GDPR) as a basis for data processing by recipients operating in third countries (outside the European Union, Iceland, Liechtenstein and Norway: and thus in particular in the USA) or for the transfer of data to such a country. These clauses oblige Google to maintain the EU level of data protection when processing relevant data, even outside the EU. The clauses are based on an implementing decision of the EU Commission. The decision and the clauses can be found inter alia here: https://ec.europa.eu/info/law/law-topic/data-protection_en.

7 Google Tag Manager

7.1 Definition of Google Tag Manager

On our website we use Google Tag Manager provided by the company Google Inc. The company Google Ireland Limited (Gordon House, Barrow Street Dublin 4, Ireland) is responsible for all Google services within Europe. Tag Manager is one of many useful marketing products provided by Google. We can use Google Tag Manager to integrate centrally and manage code fragments of various tracking tools that we use on our website.

In this Privacy Statement we would like to explain to you precisely what Google Tag Manager does, why we use it and in what form data are processed.

Google Tag Manager is an organisational tool that we can use to integrate and manage website tags centrally via a user interface. Tags are small fragments of code that record (track) for example your activities on our website. For this purpose JavaScript code fragments are embedded in our website’s source text. Tags often originate from Google’s own products such as Google Ads or Google Analytics; however, it is also possible to integrate and manage tags from other companies using the manager. These tags perform various tasks. They may collect browser data, feed data into marketing tools, incorporate buttons, save cookies and also track users across various other websites.

7.2 The purpose for which Google Tag Manager is used

We use various tracking tools, such as for example Google Analytics, in order to structure our website in the best way possible for you and other people interested in our products and services. The data collected by these tools show us what you are most interested in, where we can improve our services as well as which additional people we should present our services to. In order for this tracking to work properly, we must embed the corresponding JavaScript codes into our website. As a general rule, we could incorporate each code fragment of each individual tracking tool separately into our source text. However, that would take up a disproportionately large amount of time and it would be easy to lose sight of the general picture. For this reason we use Google Tag Manager. We can embed the necessary scripts straightforwardly and manage them from one single location. In addition, Google Tag Manager offers a user friendly user interface, for which no programming knowledge is required.

Tag Manager itself is a domain that does not save any cookies or store any data. It operates merely as a “manager” of the tags that have been deployed. The data record the individual tags from various web analysis tools. Data within Google Tag Manager are basically fed through to the individual tracking tools and are not stored.

However, this works very differently for the embedded tags of the various web analysis tools, such as for example Google Analytics. Depending upon the analysis tool, a variety of data concerning your online behaviour are collected, stored and processed, mostly using cookies. In order to find out more about this, please read the information contained in our Privacy Statement concerning the individual analytical and tracking tools that we use on our website.

In the Tag Manager account settings we have allowed Google to receive anonymised data from us. However, these data only relate to the exploitation and usage of our tag manager and not data that are stored via code fragments. We allow Google and other operators to receive selected data in anonymised form. We thus agree to the sharing of anonymous data relating to our website. Despite extensive research, we have been unable to establish precisely which summarised and anonymous data are shared. In any case, when doing so Google deletes all information that could be capable of identifying our website. Google collects data anonymously along with hundreds of other operators and identifies user trends with reference to benchmarking methods. Benchmarking involves the comparison of individual results with those of fellow competitors. It is possible to optimise processes based on the information collected.

Google Tag Manager itself does not store any cookies, but rather manages tags from various tracking websites.

7.3 Legal basis

The use of Google Tag Manager is conditional upon your consent, which we will have obtained via our cookie pop-up. This consent is the legal basis according to point (a) of Article 6(1) GDPR (consent) for the processing of personal data that may be collected by the web analytics tool.

In addition to consent, we have a legitimate interest in analysing the behaviour of visitors to the website for the purpose of improving our content in both technical and financial terms. Google Tag Manager enables us to enhance cost-effectiveness. The legal basis for this is point (f) of Article 6(1) GDPR (legitimate interests). Nevertheless, we only use Google Tag Manager if we have obtained your consent.

If you would like to find out more about Google Tag Manager, we recommend that you consult the FAQs at https://support.google.com/tagmanager/?hl=en#topic=3441530.

8 Information About Data Transfers to Third Countries or International Organizations

The data processed by us are not transmitted to recipients in third countries or to international organisations.