This privacy policy serves to inform users of the website of the Swiss Travel Industry Ombudsman's Office about the purpose for which personal data may be collected and used.
Data controller
The Swiss Travel Industry Ombudsman, Etzelstrasse 42, 8038 Zurich, is responsible for the processing of personal data
If you have any questions about data protection, please write to us at the above address or send an e-mail to info@ombudsman-touristik·ch with the subject "Data protection"
The protection of your privacy and the security of your personal data is important to us. Our ombudsman's office is aware of the sensitive nature of the use of personal data. The data you provide will be treated with the utmost care. By contacting the Swiss Travel Industry Ombudsman's Office, you consent to your personal data being processed in accordance with this privacy policy.
1 What data do we process?
We process the personal data that we receive from you or your representative in the context of an inquiry, a complaint or a request for mediation. This includes information provided verbally and information resulting from the documents you submit to the ombudsman's office. We only process the personal data relating to the person concerned and travel that is required to fulfill the aforementioned purposes. In detail, this may be the following personal data, depending on the personal situation of the data subject and the claims to which the data subject is entitled:
- Salutation, first and last name, date of birth, number of children and adults booked on the trip, first and last name and date of birth of fellow travelers;
- ID/passport details and social security number
- Residential address with street, zip code and country of residence
- Contact details such as cell phone number and e-mail address
- Payment details such as full bank details
- Booking data for the trip, such as start and duration of the trip, location of the trip and the individual travel services booked
- Information on advance payments already made and other charges.
In addition, we process data relating to you that we receive from the travel agency or tour operator selected by you, to which your entry relates, as part of a contact/intermediation with the travel agency or tour operator. If data processing is transparent and recognizable, we refrain from obtaining the consent of the data subject to the extent permissible in favor of an economical and user-friendly data flow. The legal basis for the processing of personal data is the provisions of the Swiss Data Protection Act. According to these provisions, personal data may be processed insofar as this is necessary to fulfill the travel contract between a data subject and their travel provider or agent for the booked trip. This also applies to processing in connection with pre-contractual measures requested or otherwise requested by a data subject. The contact form offered by us on the website for requesting processing is read and used exclusively by our office.
2 For what purpose do we process your data?
We process your data in order to carry out our tasks in accordance with the regulations of the ombudsman's office, i.e. to check our responsibility and, if necessary, your request, to answer it and, if the conditions are right, to carry out a mediation procedure with the company/companies involved in the Swiss travel industry.
3. access to your data / disclosure of your data
The employees at the ombudsman's office in Zurich have access to your data. They are bound to secrecy. As part of our mediation activities in accordance with the regulations of our foundation, data relating to you may be transferred to the companies involved in the Swiss travel industry and are then no longer subject to this data protection declaration. Service providers engaged by us may have temporary access to your data for the purpose of maintaining, checking and servicing our data processing systems or in connection with the technical and administrative maintenance of the ombudsman's office. These service providers are bound to secrecy by us. Personal data will only be transferred to third countries (countries outside the European Union and the European Economic Area - EEA) or to an international organization in exceptional cases where clarification with bodies abroad is necessary. If you submit your inquiry, complaint or request for mediation to us by telephone, in writing, by e-mail or electronically (by e-mail or via the upload function available on the homepage via the Internet), your data will be processed and stored by an external service provider who acts for us as a processor in accordance with our instructions. The transmission of information via the Internet involves security risks. We cannot accept any responsibility for the security and confidentiality of data during electronic transmission. Important note: Please note that the proceedings before the ombudsman's office are confidential and that we do not disclose to third parties any information on individual cases that would allow conclusions to be drawn about the names of those involved in the proceedings. Data processing to fulfill legal obligations In addition, we process personal data to fulfill legal obligations (e.g. regulatory requirements, commercial and tax law retention and verification obligations).
4. recipients of the personal data
Personal data will only be passed on or otherwise transmitted to third parties if this is necessary for the purpose of contract processing or billing or if prior consent has been given or if there is a legal basis for the transfer. For the operation of our website and our technical infrastructure, we work together with external service providers who act as processors for us and only process personal data in accordance with our instructions. Service providers who support us are software (SaaS) providers, IT service providers, in particular service providers for software and hardware maintenance, hosting providers and e-mail service providers. In addition, data may be passed on to third parties commissioned to advise the Swiss travel industry ombudsman's office, such as consulting firms or law firms, tax consultants, auditors or comparable consulting service providers and, if necessary, to the supervisory authority responsible for us (foundation supervisory authority, Federal Department of Home Affairs). These are regularly not active as processors. However, they are subject to statutory or contractually agreed confidentiality obligations.
5. cookies
We may use so-called cookies in order to be able to offer website-specific services. Cookies are small text files that are stored on a visitor's computer and contain data about the respective user in order to give them access to various functions. Both session cookies and permanent cookies can be used on websites. A session cookie is temporarily stored on the computer used while navigating through the website. A session cookie is deleted as soon as the Internet browser is closed or as soon as the session has expired after a certain period of time. A persistent cookie remains on the computer until it is deleted. We use necessary cookies that are required to enable the provision of the services owed by us or to ensure the functionality of our services. Our interest then lies in ensuring the provision of the functions of our services. We may obtain consent for the use of other, non-essential cookies. We may work together with third parties for some of our offers and therefore cookies from partner companies may also be stored when you visit such a website (third-party cookies).
6 Log files, plug-ins and services
Each time our websites are accessed, usage data is transmitted by the respective Internet browser and stored in log files, the so-called server log files. The stored data records contain the following data
- the page from which the page was requested (so-called referrer URL)
- the name and URL of the requested page
- the date and time of the request
- the description of the type, language and version of the web browser used
- the IP address of the requesting computer
- the amount of data transferred
- the operating system
- the message as to whether the request was successful (access status/Http status code)
- the GMT time zone difference
This data cannot be assigned to specific persons. This data is not merged with other data sources. We reserve the right to check this data retrospectively if we become aware of specific indications of unlawful use. We have an interest in the prosecution, prevention and punishment of unlawful use of our website. Our website uses Google Analytics, a service provided by Google Ireland Ltd, Google Building Gordon House, Barrow St, Dublin 4, Ireland and Google LLC, 1600 Amphitheatre Parkway Mountain View, CA 94043, USA; both together "Google", whereby Google Ireland Ltd. is responsible for the processing of personal data. Google uses cookies, which are stored on your device and enable the website to be analyzed. The information generated by the cookie about your use of the website will be transmitted to and stored by Google on servers in the United States. We have added the code "anonymizeIP" to Google Analytics. This ensures that all data is collected anonymously. Only in exceptional cases is the full IP address transmitted to a Google server in the USA and shortened there. Google evaluates the data collected on our behalf so that we can get an idea of the visits and user behavior on our website. This enables us to improve our services and website content as well as its design. You can prevent the storage of cookies by adjusting the settings in your browser accordingly (see our information on cookies). You can deactivate Google Analytics by downloading and installing the Google browser add-on. We use the web analysis service software Matomo(https://matomo.org) on our website, a service provided by InnoCraft Ltd, 150 Willis Street, 6011 Wellington, New Zealand ("Matomo"). Matomo can be used to create and evaluate pseudonymized user profiles. Cookies can be used for this purpose (see above for the term "cookie"). Among other things, cookies make it possible to recognize the Internet browser. The data collected using Matomo technology (including your pseudonymized IP address) is processed on our servers. The information generated by the cookie in the pseudonymized user profile is not used to personally identify the visitor to this website and is not merged with personal data about the bearer of the pseudonym. Matomo is used for statistical analysis of user behavior for optimization and marketing purposes. This is also in our legitimate interests. You can prevent the storage of cookies and thus the analysis by Matomo by changing the settings in your browser. We use the Google Tag Manager on our website. This collects data about user behavior on our website and forwards it to our analysis tools. Google Tag Manager does not have access to the data, it only collects the data. As Google Tag Manager does not process any personal data per se, please refer to the information on the respective tracking services and the Google Tag Manager usage guidelines. We use so-called web fonts provided by Google on our website for the uniform display of fonts. When you access one of our pages, your browser loads the required web fonts into your browser cache in order to display texts and fonts correctly. The browser you use establishes a connection to Google's servers. This informs Google that our website has been accessed via your IP address. If your browser does not support web fonts, a standard font will be used by your computer. The use of Google Web Fonts is in the interest of a uniform and appealing presentation of our online offers. For more information about Google Web Fonts, see the Google Web Fonts FAQs: https://developers.google.com/fonts/faq. The US Privacy User Signal Mechanism is used on a website to give users the opportunity to give or refuse their consent to the processing of their personal data. This mechanism can be implemented in various ways, e.g. through an opt-in or opt-out system that allows the user to choose which data may or may not be processed. Global Site Tag (gtag.js) is a tag management system developed by Google. It is used to track and manage data such as traffic, sales, conversions and more via a single line of code. It allows companies to implement tracking tags for various purposes, e.g. Google Ads, Google Analytics and more.
7. duration of data storage
In principle, we delete personal data as soon as it is no longer required for the above-mentioned purposes, unless temporary storage is still necessary. For example, we store personal data on the basis of legal obligations to provide evidence and retain records, which arise from the Swiss Code of Obligations (CO), the Business Records Ordinance (GebüV), the Value Added Tax Act (MWSTG) and the Criminal Code (STGB) (obligations to retain business records). The storage periods are up to ten full years. In addition, we retain personal data for the period during which claims can be asserted against our company (statutory limitation period).
8 Rights of data subjects
Within the framework of the applicable statutory provisions, data subjects have the right to obtain information free of charge at any time about their personal data stored by us, its origin and recipients and the purpose of the data processing and, if applicable, a right to rectification or erasure of this data. You can contact us at any time using the contact details provided in this privacy policy if you have any further questions on the subject of personal data. Data subjects may also have the right to restrict the processing of their data and the right to receive the data they have provided in a structured, commonly used and machine-readable format. If you have given us your consent to process personal data for specific purposes, you can withdraw your consent at any time with effect for the future. If we process your data to protect legitimate interests, you can object to this processing on grounds relating to your particular situation. If we cannot demonstrate compelling legitimate grounds for further processing that outweigh your interests, rights and freedoms, we will no longer process your data. Data subjects also have the option of contacting a data protection supervisory authority (FDPIC).
Zurich, July 05, 2023