Data protection

Kursaal Bern AG, Kornhausstrasse 3, PO Box, 3000 Bern 22, Switzerland runs the restaurants Allegro Bar, Restaurant Meridiano, Restaurant Giardino and Restaurant Yù, the Swissôtel Kursaal Bern, the MICE Centre, and operates the website www.kursaal-bern.ch and is thus responsible for the collection, processing and use of your personal data and the compliance of such data processing with applicable data protection legislation.

Your trust is important to us, which is why we take the subject of data protection seriously and pay close attention to taking appropriate security measures. Of course, we comply with the legal provisions of the Federal Data Protection Act (DSG), the Ordinance to the Federal Data Protection Act (VDSG), the Telecommunications Act (FMG) and other applicable data protection provisions of Swiss or EU law, in particular the General Data Protection Regulation (GDPR).

In order for you to know what personal data we collect from you and for what purposes we use it, please take note of the information below.

1 Data controller

The data controller responsible for the collection, processing and use of your personal data within the meaning of Art. 4 No. 7 GDPR is

Kursaal Bern AG
Kornhausstrasse 3
3013 Bern, Switzerland.

If you wish to object to the collection, processing or use of your data by us in accordance with these data protection regulations as a whole or for individual measures, you can address your objection to the data controller.

You can save and print out this privacy policy at any time.

2 General purposes for processing data

We use personal information for the purpose of operating the website and to fulfil our contractual and legal obligations.

3 What data we use and why

3.1. Data processing in connection with our website

Below, we describe the data we process in connection with our website.

3.1.1. Visiting our website/hosting

The website provider automatically collects and stores information in "server log files", which your browser automatically transmits to us. This includes your:

Browser type and browser version
The operating system used
Referrer URL
Host name of the accessing computer
Time of the server request
The IP address

This data will not be combined with data from other sources.

The IP address is also evaluated together with the other data in the event of attacks on the network infrastructure or other unauthorised or abusive use of the website for explanatory and defensive purposes and may be used in the course of criminal proceedings to identify and prosecute the users concerned under civil and criminal law.

3.1.2. Use of our contact form

You have the opportunity to get in touch with us via our contact form. For this, we absolutely need the following information:

Form of address
First and last name
Company
Email address
Message/your opinion

We use this data as well as any voluntarily provided telephone number only in order to answer your enquiry in the best possible and personal manner.

3.1.3. Subscribing to our newsletter

You can subscribe to our newsletter on our website. Registration is required. The following data must be provided during registration:

Form of address
First and last name
Company
Position
Phone/Mobile
Email address

The above data is necessary for data processing. In addition, you may voluntarily provide additional information. We process this data exclusively in order to personalise the information and offers sent to you and to better tailor them to your interests.

By registering, you give us your consent to the processing of the data provided for the regular dispatch of the newsletter to the address you have provided and for the statistical evaluation of usage behaviour and optimisation of the newsletter. We are entitled to commission third parties with the technical handling of advertising measures and are entitled to pass on your data for this purpose (cf. § 10 below).

At the end of each newsletter, you will find a link to unsubscribe at any time. After opting out, your personal data will be deleted. Further processing will only take place in anonymous form to optimise our newsletter. Further information about our newsletter can be found under §3.3.

3.1.4. Opening a customer account

In order to make bookings with us, you will also be redirected to third-party booking platforms. Here you can place orders as a guets or create an account.

If you make bookings via a third-party platform, we receive various pieces of personal information from the respective platform operator. As a rule, these are the same data listed in § 3.1.5 of this privacy policy. In addition, we may receive enquiries regarding your booking. We will process this data in order to record your booking as requested and to make the booked services available.

Furthermore, the provisions under § 10.2 of this privacy policy regarding booking platforms also apply.

3.1.5. Booking on the website, in writing, or by telephone call

If you make bookings either through our website, in writing (email or letter), or by telephone call, we need the following data to complete the contract:

Form of address
First and last name
Postal address
Date of birth
Phone number
Credit card information
Email address

We will only use this data and other information you voluntarily provide (e.g. expected time of arrival, vehicle registration number, preferences, comments) to process the contract, unless otherwise stated in this data protection declaration or unless you have given your separate consent. We will process the data in order to record your booking as requested, to make the booked services available, to contact you in case of ambiguities or problems and to ensure correct payment.

3.2. Data to fulfil our contractual and legal obligations

We process data to fulfil our contractual obligations. For this we need to save your personal information. The collection of this data is necessary for the conclusion of the contract.

Data processing to fulfil legal reporting obligations include:

3.2.1. Data processing in connection with your stay

Upon arrival at our hotel, we will need the following information from you and, if applicable, your companions:

First and last name
Postal address
Date of birth
Nationality
Official ID and number
Arrival and departure day
Room number
Wishes and/or needs

We collect this information in order to fulfil legal reporting obligations which arise in particular from hospitality or police regulations. Where we are required to do so by applicable regulations, we will forward this information to the appropriate police authority.

3.2.2. Records of services purchased

If you receive additional services during your stay (e.g. mini-bar, etc.), the nature of the service as well as the time it was provided will be recorded by us for billing purposes.

The data will be deleted after expiry of the warranty periods and statutory retention periods. Data associated with a user account (see above) will always be retained for the duration of the account.

3.3. Newsletter - Mailchimp

The newsletters contain a so-called "web-beacon", i.e. a pixel-sized file thet is retrieved from the server when openting the newsletter from our server that of our email delivery service provider. During the download, technical information such as your browser and operating system,as well as your IP address and the time of the download, are collected and stored in a log file.

This information is used for technical improvement of the service, as technical data or target group data can be analysed according to their reading behaviour, their download locations (identifiable through IP addresses), or download times. Statistical data collection also includes an analysis of when the newsletters are opened and which links are clicked on. Although this information technically allows the tracking of individual newsletter recipients, neither we nor the shipping provider, if involved, are interested in watching the behaviour of individual users. Data analysis is more importantly used to recognise patterns in the reading behaviour of our users, and to adapt contents accordingly or send different content according to the interests of our users.

Such personal data collected via the tracking pixels in the newsletters are stored and evaluated by the controller for the purpose of optimising dispatch of the newsletter and to adapt the content of future newsletters to the interests of data subjects to an even better degree. The data will not be disclosed to third parties. You may revoke the separate declaration of consent at any time. Once consent is revoked, this personal data will be deleted by the controller. Unsubscribing from the newsletter is automatically interpreted by Kongress + Kursaal AG as a revocation of consent.

A separate revocation of performance measurement is unfortunately not possible. To do this, the entire newsletter subscription must be cancelled.

4 Cookies

We use so-called session cookies to optimise our website. A session cookie is a small text file that is sent by the respective servers when you visit a website and stored temporarily on your hard drive. These store a session ID which assigns the various requests made by your browser during the joint session. This allows your computer to be recognised when you return to our website. These cookies are deleted after you close your browser.

We also use persistent cookies (also small text files that are stored on your terminal device) to a small extent, which remain on your terminal device and enable us to recognise your browser the next time you visit. These cookies are stored on your hard disk and are deleted automatically after the specified time. Their life span is 1 month to 10 years. This enables us to present our services to you in a more user-friendly, effective and secure manner and, for example, to display information on the site that is specifically tailored to your interests.

The following data and information is stored in the cookies:

Log-in information
Language settings
Search terms entered
Information about the number of visits to our website and
use of individual functions of our website.

When the cookie is activated, it is assigned an identification number and your personal data is not assigned to this identification number. Your name, IP address or similar data that would allow the cookie to be assigned to you

will not be stored in the cookie. Based on the cookie technology, we only receive pseudonymous information, for example about which pages of our site were visited. General information about cookies can be found in our Cookie Policy. (LINK)

Share plug-ins from Facebook, Instagram and Twitter are integrated into our website and will set cookies if used. Google Analytics and YouTube video cookies are also linked on the website. When the cookie is activated, it is assigned an identification number and your personal data is not assigned to this identification number. Your name, IP address or similar data that would allow the cookie to be assigned to you will not be placed in the cookie. Further information on the share plugins can be found in §§5.1.1. – 5.1.4.

4.1. Third-party cookies

Our website may also use cookies from companies with whom we cooperate for the purpose of advertising, analysing, or improving the features of our website. Please refer to the following information for details, in particular the purpose of such third-party cookies.

5 Integration of third-party services and content

We use third-party content or services on our website to analyse, optimise and operate our online content. This includes integration of their content and services, such as videos or fonts (hereinafter referred to collectively as "content").

This always requires that the third-party providers of this content can see the IP address of users, since without the IP address they would not be able to send the content to the users' browsers. The IP address is therefore necessary in order to display this content. We strive only to use content from providers who use the IP address to deliver content, and for nothing else. Third-party providers may also use "pixel tags" (invisible graphics, also known as "web beacons") for statistical or marketing purposes. "Pixel tags" can be used to evaluate information such as visitor traffic on the pages of this website. The pseudonymous information may also be stored in cookies on the user's device and may include technical information about the browser and operating system, referring websites, visiting time, and other information about the use of our website. It may also be linked to such information from other sources.

5.1. Online social media presence

We maintain online presences on social networks and platforms in order to communicate with active customers, interested parties, and users and to inform them about our services. When accessing the respective networks and platforms, the terms and conditions and the data processing guidelines of their respective operators apply.

Unless otherwise stated in our privacy policy, we process the data of users who communicate with us on social networks and platforms, e.g. write posts on our pages or send us messages.

5.1.1. Facebook plug-in

Our website uses the plug-in of the Facebook social network. Facebook.com is a service provided by Facebook Inc., 1601 S. California Ave, Palo Alto, CA 94304, USA. In the EU, this service is also operated by Facebook Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland, hereinafter both referred to as "Facebook."

Through certification according to the EU-US Privacy Shield

https://www.privacyshield.gov/participant?id=a2zt0000000GnywAAC&status=Active

Facebook guarantees that it will follow the EU's data protection regulations when processing data in the United States. For more information about the plugins and their features, please go to Facebook's information page at https://developers.facebook.com/docs/plugins/. If the plug-in is stored on one of the pages you visit on our website, your browser will download an icon for the plug-in from Facebook's servers in the USA. For technical reasons, it is necessary for Facebook to process your IP address. In addition, the date and time of your visit to our website will also be recorded.

If you are logged in to Facebook while visiting one of our plugged-in websites, the information collected by the plug-in from your specific visit will be recognised by Facebook. The information collected may then be assigned to your personal account at Facebook. If, for example, you use the Facebook Like button, this information will be stored in your Facebook account and published on the Facebook platform. If you want to prevent this, you must either log out of Facebook before visiting our website or use an add-on for your browser to prevent the Facebook plug-in from loading.

Further information about the collection and use of data as well as your

related rights and protections can be found on the following privacy policy page provided by Facebook:

https://www.facebook.com/policy.php.

5.1.2 Twitter plug-in

Our website uses the plug-in of the Twitter social network. The Twitter service is operated by Twitter Inc., 795 Folsom St., Suite 600, San Francisco, CA 94107, USA ("Twitter"). Thanks to EU-US Privacy Shield certification https://www.privacyshield.gov/participant?id=a2zt0000000TORzAAO&status=Active,

Twitter guarantees that it will follow the EU's data protection regulations when processing data in the United States. If the plug-in is stored on one of the pages you visit on our website, your browser will download an icon for the plug-in from Twitter's servers in the USA. For technical reasons, it is necessary for Twitter to process your IP address. In addition, the date and time of your visit to our website will also be recorded. If you are logged in to Twitter while visiting one of our plugged-in websites, the information collected by the plug-in from your specific visit will be recognised by Twitter. The information collected may then be assigned to your personal account at Twitter. If, for example, you use the Twitter Tweet button, this information will be stored in your Twitter account and may be published on the Twitter platform. To prevent this, you must either log out of Twitter before visiting our site or make the appropriate settings in your Twitter account. For more information about how Twitter collects and uses your data and your rights and protections, please visit Twitter's privacy policy available at https://twitter.com/privacy.

5.1.3. YouTube

We use YouTube on our website. This is a video portal operated by YouTube LLC, 901 Cherry Ave, 94066 San Bruno, CA, USA, hereinafter referred to as "YouTube". YouTube is a subsidiary of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043 USA, hereinafter referred to as "Google".

Through certification according to the EU-US Privacy Shield

https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active

Google and its subsidiary YouTube guarantee that they

will follow the EU's data protection regulations when processing data in the United States. We use YouTube to show videos. According to YouTube, the advanced privacy mode means that the data specified below will only be transmitted to the YouTube server if you actually start a video. Without this "Advanced Privacy", you would be connected to the YouTube server in the USA,

as soon as you visit one of our pages hosting a YouTube video. This connection is required in order to be able to display the respective video on our website within your browser. YouTube will record and process at a minimum your IP address, the date and time the video was displayed, as well as the website you visited. In addition, a connection to the DoubleClick advertising network of Google is established.

If you are logged in to YouTube when you access our site, YouTube will assign the connection information to your YouTube account. To prevent this, you must either log out of YouTube before visiting our site or make the appropriate settings in your YouTube account.

For the purpose of functionality and analysis of usage behaviour, YouTube permanently stores cookies on your device via your browser. If you do not agree to this processing, you have the option of preventing the installation of cookies by making the appropriate settings in your browser.

5.1.4. Instagram

Within our online offer, functions and contents of the Instagram service, offered by Instagram Inc, 1601 Willow Road, Menlo Park, CA, 94025, US, can be integrated. This may include, for example, content such as images, videos, or texts and buttons that users can use to share content from this online offer within Instagram. If the users are members of the Instagram platform, Instagram can assign the calling up of the above content and functions to the users' profiles there. Instagram privacy policy: http://instagram.com/about/legal/privacy/.

You can set your browser so that you are informed in advance about the setting of cookies and can decide in individual cases whether you want to exclude the acceptance of cookies for certain cases or in general, or that cookies are completely prevented. This may restrict the functionality of the website. For general information about cookies, please refer to our Cookie Policy.

6 Tracking-Tools

6.1. General information

We use the web analysis service of Google Analytics for the purpose of demand-oriented design and continuous optimisation of our website. In this context, pseudonymous user profiles are created and small text files stored on your computer ("cookies") are used. The information generated by the cookie about your use of this website is transmitted to the servers of the providers of these services, stored there and processed for us. In addition to the details set forth under § 3.1.1, we may receive the following information:

Navigation path that a visitor takes on the site,
Duration of stay on the website or subpage,
The subpage on which the website is left,
The country, region or city from which it is accessed,
Terminal (type, version, colour depth, resolution, width and height of the browser window), and Whether you are a repeat or new visitor.

The information is used to evaluate the use of the website, to compile reports regarding website activity and to provide other services related to website activity and Internet usage for the purposes of market research and needs-based design of these websites. This information may also be transferred to third parties, provided this is legally required, or to the extent that such third parties process the information.

6.2. Google Analytics

Our web pages use Google Analytics, a web analytics service provided by Google, Inc. ("Google"). Google Analytics uses cookies, text files that are stored on your computer and enable an analysis of how you use the website. The information generated by the cookie about the use of this website by the user is generally transmitted to and stored in a Google server in the USA.

Google is subject to and certified under the Privacy Shield Agreement between the European Union and the USA. Google therefore undertakes to comply with the standards and regulations of European data protection law. Further information can be found in the following linked entry: https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active.

We have enabled IP anonymisation on this site (anonymizeIp). Thus your IP address will be truncated by Google within the member states of the European Union or in other parties to the Agreement about the European Economic Area. Only in

exceptional cases will the entire IP address be transmitted to a Google server in the USA and truncated there. Google will use this information on behalf of the operator of this website to analyse your use of the website, to compile reports on website activity and provide additional services associated with the use of the website and internet to the website operator.

The IP address provided by your browser as part of Google Analytics will not be combined with other data from Google. You can prevent the use of cookies by selecting the corresponding settings on your browser; however, we would like to point out that if you do this, you may not be able to fully utilise all functions provided on this website.

You can also prevent the data generated by cookies regarding your website use (incl. your IP address) from being passed to Google, and the processing of these data by Google, by downloading and installing the browser plugin available at the following link: http://tools.google.com/dlpage/gaoptout?hl=en.

6.3. Other tracking tools

6.3.1.Google Ads and conversion measurement

We use the services of Google LLC, 1600 Amphitheater Parkway, Mountain View, CA 94043, USA, ("Google") to analyse, optimise and operate our website.

Google is certified under the Privacy Shield agreement, thereby offering a guarantee of compliance with European data protection law (https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active).

We use the online marketing process Google "AdWords" to place ads on the Google Advertising Network (e.g., in search results, videos, on websites, etc.) to show them to users who may find the ads interesting. This allows us to display ads for and within our website more specifically in order to only present ads that potentially correspond to the users interests. For example, if a user sees ads for products he has been interested in on other websites, this is referred to as "re-marketing". When our website and other websites using Google marketing services are accessed, Google directly runs code (graphics known as web beacons) to integrate (re)marketing tags into the website. These store a unique cookie (a small file) on the user's device. Comparable technology may also be used instead of cookies. This file keeps a record of which websites the user visited, which contents he is interested in and which offers he has clicked on, as well as technical information about the browser and operating system, referring websites, visiting time and further information about the use of the website.

We also use an individual "conversion cookie". The information collected with the help of cookies is used by Google to generate conversion statistics for us. However, we only see the total number of anonymous users who clicked on our ad and were redirected to a page with a conversion tracking tag. We do not obtain any information that can be used to identify users personally.

User data is processed pseudonymously within the Google advertising network. This means that Google does not store and process the names or email addresses of users, for example, but processes the relevant data cookie-related within pseudonymous user profiles. This means that, from Google's point of view, ads are not managed and displayed for a specifically identified person, but for the cookie holder, regardless of who this cookie holder is. This does not apply if a user has expressly permitted Google to process the data without this pseudonymisation. The information collected about users is transmitted to Google and stored on Google's servers in the USA.

Further information on data use by Google, setting and objection options, can be found in Google's data protection policy (https://policies.google.com/technologies/ads) and in the settings for the display of advertisements by Google (https://adssettings.google.com/authenticated).

6.3.2. Facebook pixels, custom audiences and Facebook conversion

To analyse, optimise and operate our online content, we use "Facebook pixels" by the social network Facebook, which is operated by Facebook Inc, 1 Hacker Way, Menlo Park, CA 94025, USA, or, if you are based in the EU, Facebook Ireland Ltd, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland ("Facebook").

Facebook is certified under the Privacy Shield agreement, thereby offering a guarantee of compliance with European data protection law (https://www.privacyshield.gov/participant?id=a2zt0000000GnywAAC&status=Active).

With the help of Facebook pixels, Facebook is able to identify those who visit our website and target them for the presentation of related advertisements (so-called "Facebook Ads"). Accordingly, we use Facebook pixels to display our Facebook ads only to Facebook users who have shown an interest in our website or who have certain traits (e.g. interests in certain topics or products that are determined by the websites visited) that we transmit to Facebook (so-called "custom audiences"). With the help of Facebook pixels, we want to make sure that our Facebook ads correspond to the potential interest of the users and are not annoying. Facebook pixels also help us understand the effectiveness of Facebook ads for statistical and marketing research purposes by showing and evaluating whether users are directed to our site after they have clicked a Facebook ad (so-called "conversion").

Facebook processes the data in accordance with Facebook's Data Usage Policy. Accordingly, general information on the display of Facebook ads can be found in the Facebook Data Usage Policy: https://www.facebook.com/policy.php. For specific information and details about Facebook pixels and how they work, please visit the Facebook Help section: https://www.facebook.com/business/help/651294705016616.

You can object to the collection and use of your data by Facebook pixel to display Facebook ads. To set what types of ads you see within Facebook, go to the page set up by Facebook and then follow the information there about the settings for interest-based advertising: https://www.facebook.com/settings?tab=ads. The settings apply across platforms, i.e. they are applied to all devices, such as desktop computers or mobile devices.

You can object to the use of cookies for range measurement and advertising purposes via the deactivation page of the network advertising initiative (http://optout.networkadvertising.org/) and additionally the US website (http://www.aboutads.info/choices) or the European website (http://www.youronlinechoices.com/uk/your-ad-choices/).

6.3.3. Hotjar

We use the Hotjar service to analyse, optimise and operate this website. Hotjar is a service of Hotjar Limited (Level 2, St Julian's Business Center, 3, Elia Zammit Street, St Julian's STJ 1000, Malta).

We use Hotjar to better understand the needs of our users and to optimise the offerings on this website. Using Hotjar's technology, we get a better understanding of our users' experiences (e.g. how much time users spend on which pages, which links they click, what they like and what not, etc.) and that helps us to align our offer to our users' feedback. Hotjar uses cookies and other technologies to collect information about the behaviour of our users and their devices (in particular, the IP address of the device (recorded and stored in anonymous form only), screen size, unique device identifiers, information about the device used browser, country, preferred language for displaying our website). Hotjar stores this information in a pseudonymous user profile. The information will not be used by Hotjar or by us to identify individual users nor will it be aggregated with other data about individual users. For more information, see Hotjar's privacy policy here: https://www.hotjar.com/legal/policies/privacy.

You may object to the storage of a user profile and information about your visit to our website by Hotjar as well as the setting of Hotjar tracking cookies on other websites if you click on this opt-out link: https://www.hotjar.com/legal/compliance/opt-out.

7 Storage period

Unless specifically stated, we only store personal data for as long as is necessary to fulfil the purposes pursued.

In some cases, the legislator provides for the storage of personal data, for example in tax or commercial law. In these cases, the data will only be stored by us for these legal purposes, but will not be processed in any other way and deleted after expiry of the legal retention period.

8 Your rights as a data subject

According to the applicable laws, you have various rights regarding your personal data. If you would like to assert these rights, please address your request by email or by post with a clear identification of your person (e.g. by means of a copy of identity card when your identity is otherwise not clear or can be verified) to the contact address given in §11.

Below you will find an overview of your rights.

8.1. The right of confirmation and information

In a number of cases we are obliged to delete personal data concerning you.

In detail:

According to Art. 17 para. 1 GDPR, you have the right to demand that we delete personal data concerning you without delay and we are obliged to delete personal data without delay if one of the following reasons applies:

the personal data is no longer being used for the purposes for which it was collected or for other purposes;
you withdraw your consent to its processing per Art. 6 para. 1 lit. a) or Art. 9 para. 2 lit. a GDPR and there is no other legal basis for its continued processing;
You object to its processing per Art. 21 para. 1 GDPR, and there are no overriding legitimate grounds for processing, or you submit an objection according to Art. 21 para. 2 GDPR.
The personal data have been unlawfully processed.
The deletion of personal data is required to fulfil a legal obligation to which we are subject.
The personal data has been collected in relation to services offered according to Art. 8 para. 1 GDPR.

If we have made the personal data public and we are obliged to delete in accordance with Art. 17 para. 1 GDPR, we will take appropriate measures, including technical measures, taking into account the available technology and the implementation costs, to inform data processors who process the personal data that you as the data subject have requested the deletion of all links to this personal data or of copies or replications of this personal data.

8.2. Right to have data corrected

You have the right to request the correction of your personal data without undue delay.

In detail:

You have the right to request the correction of your personal data without undue delay. Taking into account the purpose of the data processing, you also have the right to demand the completion of your incomplete personal data – also by means of a supplementary declaration.

8.3. The right to have data deleted ("right to be forgotten")

In a number of cases we are obliged to delete personal data concerning you.

In detail:

the personal data is no longer being used for the purposes for which it was collected or for other purposes;

you withdraw your consent to its processing per Art. 6 para. 1 lit. a) or Art. 9 para. 2 lit. a GDPR and there is no other legal basis for its continued processing;
You object to its processing per Art. 21 para. 1 GDPR, and there are no overriding legitimate grounds for processing, or you submit an objection according to Art. 21 para. 2 GDPR.
The personal data have been unlawfully processed.
The deletion of personal data is required to fulfil a legal obligation to which we are subject.
The personal data has been collected in relation to services offered according to Art. 8 para. 1 GDPR.

8.4. Right to restrict processing

In a number of cases you are entitled to request us to restrict the processing of your personal data.

In detail:

You have the right to request us to restrict processing if one of the following conditions is met:

the accuracy of your personal information is contested by you for a period of time that allows us to verify the accuracy of your personal information;
the processing is unlawful and you oppose the erasure of the personal data and request the restriction of its use instead;
we no longer needs the personal data for the purposes of processing, but it is required by you for the establishment, exercise or defence of legal claims or
you object to the processing according to Art. 21 para. 1 GDPR, as long as it is not yet clear whether the justified reasons of our company outweigh yours.

8.5. Right to data portability

You have the right to receive, transmit or have us transmit personal data concerning you in machine-readable form.

In detail:

You have the right to receive the personal data concerning you that you have provided to us in a structured, current and machine-readable format, and you have the right to transmit this data to another person in charge without our interference, provided that

the processing is based on your consent under Art. 6 para. 1 clause 1 lit. a or Art. 9 para. 2 lit. a GDPR or on a contract in accordance with Art. 6 para. 1 clause lit.b GDPR and the processing is carried out using automated procedures.

In exercising your right to data portability in accordance with para. 1 above, you have the right to demand that the personal data be transmitted directly by us to another responsible person, as far as this is technically feasible.

8.6. Right to object

You have the right to object to the lawful processing of your personal data by us if this is justified by your particular situation and if our interests in the processing do not outweigh ours.

In detail:

You have the right, for reasons arising from your particular situation, to object at any time to the processing of personal data concerning your person, which may be processed on the basis of Art. 6 para. 1 lit. e or f GDPR, including profiling based on those provisions. We will no longer process your personal data unless we can prove compelling legitimate reasons for the processing, which outweigh your interests, rights, and freedoms, or the processing serves to assert, exercise, or defend legal claims.

Where personal data is processed for direct marketing purposes, the data subject shall have the right to object at any time to the processing of personal data concerning him/her for the purposes of such advertising, including profiling in so far as it is related to such direct marketing.

You have the right, for reasons arising out of your particular situation, to object against the processing of personal data relating to you for scientific or historical reserach purposes or for statistical purposes pursuant to Art. 89 para. 1 GDPR, unless processing is necessary for the performance of a task in the public interest.

8.7. Automated decisions including profiling

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects that concern you or in a similar way significantly affects you.

Decisions are not made automatically on the basis of the personal data collected.

8.8. Right to revoke consent

You have the right to withdraw or refuse your consent at any time where we rely on it to process your personal information. If we process personal data for marketing and promotional purposes, you may revoke consent for your data to be processed for these purposes in general or in relation to particular products or services.

8.9. The right to file a legal complaint with a supervisory authority

You have the right to report to the relevant regulatory authority or to file a complaint if you believe that the processing of your personal data is not compliant with data protection. You can do this with the regulator in the country where you live or work, or in the place or country where the alleged data breach occurred.

9 Data security

We make every effort to ensure the security of your data in accordance with the applicable data protection laws and technical possibilities.

Your personal data will be transmitted encrypted. This applies to your orders and also to the customer login. We use the SSL (Secure Socket Layer) coding system, but point out that data transmission over the Internet (e.g. communication by email) can have security gaps. Completely protecting data against third-party access is impossible.

To safeguard your data, we maintain technical and organizational security measures according to Art. 32 GDPR, which we constantly adapt to the latest state of the art.

We do not guarantee that our offer will be available at specific times; Disturbances, interruptions or failures can not be excluded. The servers we use are regularly and carefully secured.

10 Transfer of data to third parties and data transmission abroad

In principle, we only use your personal data within our company.

If and to the extent that we involve third parties in the performance of contracts (such as logistics service providers), this personal data is only received to the extent to which the transfer is necessary for the corresponding service.

In the event that we outsource certain parts of data processing ("order processing"), we contractually oblige contractors to use personal data only in accordance with the requirements of data protection laws and to ensure the protection of the rights of the data subject.

A service provider to whom the personal data collected via the website is passed on or who has or can have access to it is our host campfire GmbH,
Schlossstrasse 24, 2560 Nidau, Switzerland. The website is hosted on servers in Switzerland. The data is passed on for the purpose of providing and maintaining the functionalities of our website.

Finally, we will forward your credit card information to your credit card issuer and acquirer when payment is made by credit card on the website. If you decide to pay by credit card, you will be asked to enter all necessary information. Concerning the processing of your credit card information by these third parties, we ask you to also read the General Terms and Conditions and the data protection declaration of your credit card issuer.

Furthermore, with regard to the passing on of data to third parties, please also observe the notices in §§ 10.1 and 10.2 as well as 10.3.

10.1. Transmission of personal data abroad

We are entitled to transfer your personal data to third parties (commissioned service providers) abroad for the purpose of the data processing described in this data protection declaration. These are obliged to the same extent as we ourselves to data protection. If the level of data protection in a country does not correspond to that in Switzerland or Europe, we contractually ensure that the protection of your personal data corresponds at all times to that in Switzerland or the EU.

10.2. Booking platforms

Finally, we may be informed by the platform operators of any disputes in connection with a booking. We may also receive information about the booking process, which may include a copy of the booking confirmation as proof of the actual completion of the booking. We process this data to protect and enforce our claims.

Please also note the information on data protection of the respective provider.

10.3. Central storage and linking of data

We store the data specified in sections §§3.1.1-3.2.1 in a central electronic data processing system. The data concerning you is systematically recorded and linked in order to process your bookings and the contractual services. For this we use software from REBAG DATA AG; Einsielderstrasse 533 8810 Horgen, Switzerland.

11 Data protection officer

If you have any questions about data protection, please contact our data protection officer:

Lukas Meier
COO / Hospitality Director
lukas.meier@kursaal-bern.ch
Phone: +41 31 339 52 55

12 Amendments

We may modify this privacy policy at any time without notice. The current version published on our website shall apply. If the privacy policy is part of an agreement with you, we will notify you of the change by email or other appropriate means if it is updated.