Privacy policy

1. introduction

Kraftwerke Oberhasli AG (KWO), offers guided tours of the Power plant and guided day tours, manages the Grimsel Hospiz Hotel, the Hotel Handeck, the Berghaus Oberaar and the Alpinhütte Bäregg, operates the Mountain railways (Gelmer, Gerstenegg, Trift, Tälli, Sidelhorn, Hospiz, Reichenbachfallbahn and Oberaarbahnen), the Oberaar parking lot management and the website www.Grimselwelt.ch and is responsible for the collection, processing and use of your personal data and the compliance of the data processing with the applicable data protection law.

Your trust is important to us, which is why we take the issue of data protection seriously and ensure appropriate security. It goes without saying that we comply with the statutory provisions of the Federal Act on Data Protection (FADP), the Ordinance to the Federal Act on Data Protection (OFADP) and any other applicable data protection regulations.

Please take note of the following information so that you know what personal data we collect from you and for what purposes we use it. At the beginning you will find an overview “General information on the processing of personal data”, which is intended to provide you with a brief overview. We will then provide you with more detailed information.

Please note that this Privacy Policy does not contain an exhaustive description of our data processing and that individual matters may be governed in whole or in part by specific data protection declarations or general terms and conditions (with or without reference to them in this Privacy Policy).

2. responsible person

The controller in terms of data protection is

Kraftwerke Oberhasli AG
Grimselstrasse 19
3862 Innertkirchen
Switzerland

Phone: +41 33 982 20 11
E-mail: info@kwo.ch

To exercise your rights and/or if you have any questions about data protection, please contact: datenschutz@kwo.ch.

3. personal data processed by us

We process personal data which you provide to us, which we collect about you or which we have received from third parties. This relates in particular to personal data:

  • which we receive from (future) customers, interested parties, service providers, suppliers, business partners or other persons involved in our business relationships;
  • that we receive from job applicants;
  • that we receive from our hotel guests;
  • that we receive from our guests on the power plant tours and Mountain railways;
  • that we receive from participants in events, functions and other occasions;
  • that we receive from users of our booking platform,
  • that we receive from booking platforms, e.g. Booking or HolidayCheck;
  • which we are legally or contractually obliged to collect;
  • that we collect from users when they use our website and other applications;
  • that we receive from authorities and other third parties.

This includes the following types of personal data:

  • Contact and identification data such as first and last name, postal address, telephone number, e-mail address;
  • Personal details such as age, gender, nationality, place of birth, residence status, marital status, language, family data;
  • Contract data such as services used, type of contract, contract content, type of products and services, applicable terms and conditions, start of contract, contract term, invoice data, names of contact persons;
  • Booking data, such as length of stay, arrival/departure time, room category, nationality;
  • Feedback, in particular feedback on your stay in one of our hotels, hotel reviews or on a Guided Tours you have visited or Mountain railways you have used;
  • Communication data such as physical or electronic correspondence, information from the assertion of rights;
  • Applicant data such as letters of recommendation and/or application, letter of motivation, CV and photo, job references, diplomas, training certificates, references;
  • Financial data such as account information, payment information, payment history, average revenue;
  • Edge data from telecommunications traffic such as telephone number, date, time and duration of the connection, connection type;
  • Meta/usage data and other technical data such as IP address, details of your device and settings;
  • Interaction and usage data such as preferences and target group information, device type, device settings, operating system, software;
  • Website information such as IP address, cookie information, browser settings, frequency and duration of visits to the website, search terms, clicks on content, website of origin.

3.1 Purposes and legal bases of processing

We use the personal data we collect primarily to conclude and process contracts with our customers and business partners.

We also rely on the processing of personal data for the purchase of products and services from our suppliers and subcontractors. If you work for a customer or business partner, your personal data may of course also be affected in this function.

In addition, we process personal data in order to comply with our legal obligations in Switzerland and abroad (e.g. storage of accounting-related documents).

Furthermore, we also process personal data of you and other persons, to the extent permitted and deemed appropriate by us, for the following purposes in which we (and sometimes third parties) have a legitimate interest corresponding to the purpose:

  • Offer and further develop our products, services, website and other platforms on which we are present;
  • Communication and processing of inquiries (e.g. via e-mail, telephone, media inquiries);
  • Communication about closures of booked offers, closures of access options;
  • Contact us for refunds;
  • Processing guest feedback and complaints;
  • Advertising and marketing (including the organization of events and competitions, including newsletters, see section 4.4), provided you have consented/not objected to the use of your data. If we send you advertising from us as an existing customer, you can object to this at any time and we will then place you on a blacklist against further advertising mailings;
  • Market research, media monitoring;
  • Assertion of legal claims and defense in connection with legal disputes and official proceedings;
  • Prevention and investigation of criminal offenses and other misconduct (e.g. conducting internal investigations, data analysis to combat fraud);
  • Guarantees of our operations, in particular IT, our websites and other platforms.

If you have given us your consent to process your personal data for specific purposes (e.g. registration for our job subscription or for the use of an image/sound recording), we will process this data within the scope of and based on this consent, unless we have another legal basis and require one. Consent that has been given can be withdrawn at any time, but this has no effect on data processing that has already taken place. You can send us a revocation to the e-mail address stated under point 2.

3.2 Data disclosures

As part of our business activities and for the above-mentioned purposes, we also disclose personal data to third parties where permitted and where we deem it appropriate, either because they process it for us or because they wish to use it for their own purposes. This applies in particular to the following parties:

  • Service providers, including processors;
  • Dealers, suppliers, subcontractors and other business partners;
  • IT service provider (e.g. web hosting provider)
  • Banks and payment service providers;
  • authorities, official bodies and courts.

It goes without saying that we comply with the legal regulations on the transfer of personal data to third parties. If we use processors to provide our services, we take suitable legal precautions and appropriate technical and organizational measures to ensure the protection of your personal data in accordance with the relevant legal regulations.

The recipients are usually located in Germany, but can also be abroad.

3.3 Place of data processing

We generally process personal data in Switzerland or in an EU/EEA country or in another country that has an adequate level of data protection. With regard to certain processing, you must expect your data to be transferred to other countries within and outside Europe, where some of the IT service providers we use are located. If we disclose data to a country that does not have an adequate legal level of data protection, we require that the recipient takes appropriate measures to protect your privacy (e.g. by agreeing so-called EU standard contractual clauses, current version available here, or other precautions) or rely on justification grounds, such as your consent.

3.4 Duration of data processing

We process personal data for as long as is necessary to fulfill our contractual obligations or otherwise for the purposes pursued with the processing, for example for the duration of the entire business relationship (from the initiation, execution to the termination of a contract) and beyond that in accordance with the statutory retention and documentation obligations. It is possible that personal data may be stored for the period in which claims can be asserted against us and insofar as we are otherwise legally obliged to do so or legitimate interests require this (e.g. for evidence and documentation purposes). As soon as your personal data is no longer required for the above-mentioned purposes, it will generally be deleted or anonymized.

3.5 Data security

The KWO takes appropriate technical and organizational security measures to protect your personal data and continuously improves these in line with technological developments. This includes protection against accidental or intentional manipulation, loss, destruction or unauthorized access by third parties, such as the use of recognized encryption methods (e.g. encryption using SSL/TLS). KWO employees and service providers commissioned by us are obliged to maintain confidentiality and to comply with data protection regulations and are only granted access to your personal data to the extent necessary.

3.6 Rights of the data subject

In principle, you have the right to information, rectification, erasure, restriction, data portability, objection to processing and withdrawal of consent with regard to your personal data.

Please note, however, that we reserve the right to assert the restrictions provided for by law, for example if we are obliged to store or process certain data, have an overriding interest in doing so (insofar as we are entitled to invoke this) or require it for the assertion of claims.

Please note that the exercise of these rights may conflict with contractual agreements and may have consequences such as premature termination of the contract or cost consequences. We will inform you in advance if this is not already contractually regulated.

The exercise of your rights under data protection law generally requires that you clearly prove your identity (e.g. by means of a copy of your identity card, where your identity is otherwise not clear or cannot be verified). To assert your rights, please contact us at the e-mail address specified in section 2.

If you believe that the processing of your personal data violates data protection law or that your data protection rights have been violated in any other way, you can also lodge a complaint with the competent supervisory authority. In Switzerland, this is the Federal Data Protection and Information Commissioner (FDPIC ).

3.7 Video surveillance

Based on our legitimate interests in safeguarding our domiciliary rights and to ensure the protection of our employees and other persons as well as assets, data and secrets belonging to or entrusted to us, we may use video surveillance systems and other measures for IT, building and system security at our locations, such as access controls, visitor lists, network and mail scanners and telephone recordings.

If our locations are under video surveillance, we will inform you of this with appropriate signs. The recordings will be destroyed or transferred again after a predefined period has expired. The recordings will only be kept for longer if a criminal offense or an act relevant to liability law is detected and the recordings are required for criminal prosecution or if we need the recordings to enforce justified claims, in particular claims under civil law.

If proceedings are initiated by a criminal prosecution authority, the records will be retained until the proceedings have been legally concluded.

Outside of the procedures mentioned, no copies of the recordings made will be made and they will not be made accessible to unauthorized third parties.

4. data processing in connection with our website

4.1 Making contact

You have the option of contacting us by e-mail and/or telephone. Your details will be stored by us for the purpose of processing your request, handling it and in the event of follow-up questions and will not be passed on to unauthorized third parties without your consent. Of course, this also applies to requests that you send us by post.

The basis for processing your personal data is our legitimate interest in processing your request. If the purpose of contacting you is to fulfill a contract to which you are a party or to carry out pre-contractual measures, this is an additional basis for processing your personal data.

You can object to this data processing at any time. Please send your objection to the e-mail address stated under point 2 and we will examine your request. In such a case, your contact will not be processed any further.

Your personal data will be deleted as soon as the request you have made has been dealt with. This is the case if it can be inferred from the circumstances that the matter in question has been conclusively clarified and the deletion does not conflict with any statutory retention obligations.

4.2 Server log files

When you visit our website, our servers temporarily store every access in a log file, the so-called server log files.

For example, your IP address, the date and time of your visit, the name of the file accessed, the access status (completed, partially completed, not completed, etc.), the web browser and operating system used and other similar information used for security purposes in the event of attacks on our information technology systems are recorded.

The purpose of processing this information is to correctly display our website and its content and offers to you and to ensure data traffic, to optimize our website, content and offers, to ensure the stability and security of our website and systems in the long term and to enable the investigation, defense and prosecution of cyber attacks, spam and other unlawful acts in relation to our website and systems and to enforce claims in this regard. This is our legitimate interest in processing.

We delete your personal data as soon as it is no longer required to achieve the purpose for which it was collected. In the case of the collection of data for the provision of our website, the deletion takes place when the respective session has ended.

For the hosting of the website, we may use the services of third parties in Switzerland and abroad who carry out the aforementioned processing on our behalf. Our websites are currently hosted exclusively by Swiss hosting providers and on servers in Switzerland.

4.3 Subscribing to our newsletter

You have the option of subscribing to our newsletter on our website. To do so, please fill out the form with the required mandatory information, in particular your e-mail address. Other details, such as your first name and surname, are optional. We need the information collected during registration in order to send you the newsletter and to address you personally.

The basis for processing is the existence of your consent. Accordingly, registration for the newsletter takes place in a so-called double opt-in procedure. This means that after registering, you will receive an e-mail in which you must click on a link to confirm your registration.

You can unsubscribe from the newsletter free of charge at any time and revoke the consent you have given. To do this, click on the corresponding button in the newsletter sent to you. We will then remove you from our list of recipients.

Some of our newsletters may, where permitted, contain graphics and/or web links that record whether, when and how often an individual newsletter was opened in an email application and which web links were clicked on. Such graphics and/or web links record the use of newsletters in order to ensure quality and enable improvements to the newsletter. This is also our legitimate interest in processing.

You can block the placement of such graphics and/or web links in your e-mail application.

4.3.1 E-Marketing Suite

We use the E-Marketing Suite component, a service provided by starmate solutions GmbH, based in Germany (“starmate”), to send and analyze our newsletters as described above.

Your data provided during registration, in particular your e-mail address, if applicable your name, IP address, date and time of your registration, will be transferred to a server of Wilken Rechenzentrum GmbH in Germany and stored there in accordance with the contract.

To protect your personal data, we have concluded an order processing contract with starmate. Further information on data protection at starmate can be found in their privacy policy.

4.4 Job applications

KWO is a leading hydropower company in Switzerland and supplies over one million people with electricity. When you apply for a job with us, we process the data you provide, including personal details, education, professional experience, skills and contact information. Your application documents such as CV and references are also recorded. We use this data exclusively for the application process and, if necessary, anonymized for statistical purposes.

Our vacancies are posted on our job portal jobs.grimselstrom.ch. The job portal is operated by prospective media services pms AG, based in Zurich. The application form for online applications is provided by Abacus Research AG, also based in Switzerland.

Accordingly, the information you provide and your application documents will be stored on the Abacus servers.

If personal data is disclosed in countries that do not offer adequate data protection, Abacus ensures that the protection of your data is guaranteed. For example, standard data protection clauses are concluded and, if necessary, additional contractual and technical measures are taken to legally secure the data transfer. See the Abacus privacy policy.

Your applicant data is stored separately from the other user data and is not merged with it.

If we conclude an employment contract with you, the data transmitted will be stored for the purpose of processing the employment relationship in compliance with the statutory provisions. If the application procedure ends without employment, your personal data will be deleted after a maximum of six months, unless you have given us your consent to retain your data for a certain period of time for further application procedures.

4.4.1 Job newsletter

If you would like to be regularly informed about new job vacancies at KWO, we offer you the opportunity to register for our job subscription.

In order for us to send you the information, it is necessary that you provide us with a valid e-mail address and choose a name for your job subscription. Registration for our job newsletter takes place in a so-called double opt-in procedure. This means that after registering, you will receive an e-mail in which you must click on a link to confirm your registration.

Our job newsletter is sent out by prospective media services pms AG, based in Zurich.

We pass on the personal data you provide when registering for the newsletter, in particular your e-mail address, to Prospective so that it can provide its services to us. Prospective stores your data on servers located in Ireland or Switzerland.

Further information on data protection at Prospective can be found in their privacy policy.

You can revoke your consent to the storage of your data and its use for sending the newsletter at any time, for example via the “Unsubscribe” link at the end of each newsletter.

4.4.2 Cloudflare CDN

Based on our legitimate interests, the job portal on our website uses Cloudflare CDN, a service provided by Cloudflare Inc. based in the USA (“Cloudflare”).

Cloudflare provides a globally distributed content delivery network with DNS. Technically, Cloudflare redirects the exchange of information between your web browser and our website. This allows Cloudflare to monitor the data exchange and act as a layer of protection between our servers and potentially malicious data. During this process, Cloudflare may use technologies such as cookies to identify Internet users, although these technologies are used exclusively for the tasks described here.

To protect your privacy, we have concluded a “Data Processing Agreement” with Cloudflare, including EU standard contractual clauses. Cloudflare is also certified under the EU-U.S. and Swiss-U.S. Data Privacy Framework.

You can find more details regarding security and data protection at Cloudflare in their “Privacy Policy“.

4.5 Map material (SwitzerlandMobility)

Based on our legitimate interests in the presentation of various hiking trails, we have integrated interactive maps on our website using iframe. The providers are the SwitzerlandMobility Foundation based in Switzerland (“Switzerland Mobile”) and Google Maps (see section 4.10.3).

We cannot rule out the possibility that SwitzerlandMobility may receive certain information about your use of our website, including your IP address, if you visit one of our websites on which maps from SwitzerlandMobility are integrated. However, according to SwitzerlandMobility’s privacy policy, its websites can be used without the need to provide personal data. The necessary data is recorded, which is used for website security, among other things (so-called server log files). This data is only stored temporarily by SwitzerlandMobility and then deleted.

We do not collect any information when you use the map material.

Further information on data protection and data security at Switzerland Mobile can be found in their privacy policy.

4.6 Webcams

We use the Roundshot Livecam Fontend application from Seitz Phototechnik AG, based in Switzerland, on our website. This enables us to show you various live images, or time-delayed recordings, from various webcams at our locations, such as the Reichenbach Falls, the Trift and Oberaar mountain stations, Gelmersee and the Grimsel Hospiz. These images/recordings are intended to provide you with up-to-date impressions of the Grimsel region and are primarily for touristic purposes.

We do not collect any personal data by embedding the live images/recordings on our website.

Processing is based on our legitimate interests in providing the public with up-to-date images of our locations, enhancing the attractiveness of our locations and promoting tourism in the region in general.

The operator of the webcams is Seitz Phototechnik AG, based in Switzerland (“Seitz Phototechnik”). Seitz Phototechnik may use cookies and similar tracking technologies. The basis for processing is your consent. Please note their data protection and cookie guidelines. You will also find these directly under the respective live images/recordings.

The webcams are generally set up so that no people are visible in the recording area. Should this be the case in exceptional cases, however, you can report the corresponding image to Seitz Phototechnik for pixilation. To do this, use the § symbol next to the respective live images/recordings.

4.7 Cookies

We use so-called cookies on our website. Cookies are small text files that are placed and stored on your end device (laptop, tablet, smartphone, etc.) with the help of the browser. They are used to make our website more user-friendly and effective overall and to make your visit to our website as pleasant as possible. Cookies do not cause any damage to your end device. They cannot execute programs or contain viruses.

Most of the cookies we use are so-called session cookies. These are automatically deleted when you log out or close the browser. Other cookies remain stored on your end device beyond the respective usage process and enable us or our partner companies (third-party cookies) to recognize your browser on your next visit. Insofar as other cookies (e.g. cookies to analyze your surfing behavior) are stored, these are treated separately in this privacy policy.

The basis on which we process your personal data using cookies depends on whether we ask for your consent. If this is the case and you consent to the use of cookies, the basis for processing your data is your consent. Otherwise, the personal data processed with the help of cookies will be processed on the basis of our legitimate interests (e.g. customer-friendly and effective design of the website visit) or if the use of cookies is necessary to fulfill our contractual obligations.

Regardless of whether the processing is based on consent or legal permission, you have the option at any time to withdraw your consent or to object to the processing of your data by cookie technologies.

You can change your cookie settings and preferences at any time and revoke any consent you have given with effect for the future. To do this, open our cookie consent banner again to make the appropriate settings.

Alternatively, you can set up your browser so that it informs you about the setting of cookies and you allow the acceptance of cookies for certain cases only in individual cases or generally exclude them. However, we would like to point out that you may then not be able to use all the functions of our website.

4.7.1 Use of Cookiebot

We use the Cookiebot service from Usercentrics A/S, Denmark, on our website. Cookiebot helps us to obtain and manage the consent of our website visitors for cookies and similar technologies in a legally compliant manner.

When you visit our website, your consent to the cookies used is requested and stored together with your IP address (shortened), the consent status, date and time. This data is used to track your consent and is stored on servers in the EU.

Further information can be found in Cookiebot’s privacy policy: https://www.cookiebot.com/de/privacy-policy/

4.8 Google services

On the basis of your consent, we use various services of Google LLC, based in the USA, or if you have your habitual residence in the European Economic Area (EEA) or Switzerland, Google Ireland Ltd, based in Ireland (“Google”), on our website. Google LLC is always responsible for the processing of personal data when using “YouTube”. We use the following Google services on our website:

  • Google Tag Manager
  • Google Analytics
  • Google Maps
  • YouTube
  • Google Fonts
  • Google reCAPTCHA
  • Google Ads

You can withdraw your consent at any time with effect for the future. Please refer to our explanation in section 3.1.

Further information on the individual services can be found below.

Google uses technologies such as cookies, web storage in the browser and tracking pixels that enable your use of our website to be analyzed. The information generated about your use of our website may be transmitted to a Google server in the USA or other countries and stored there. Information about the locations of Google’s data centers can be found here.

We use tools provided by Google which, according to Google, can process personal data in countries in which Google or its subcontractors maintain facilities. In its “Data Processing Addendum for Products where Google is a Data Processor“, Google promises to ensure an adequate level of data protection by relying on the EU standard contractual clauses.

Google is also certified under the EU-U.S. and Swiss-U.S. Data Privacy Framework.

For more information on processing by Google and privacy settings, please refer to Google’s privacy policy or privacy settings.

4.8.1 Google Tag Manager

Our websites use the Google Tag Manager. Google Tag Manager allows website tags to be managed efficiently. Website tags are placeholders that are stored in the source code of the respective website, e.g. to record the integration of frequently used website elements, such as code for web analysis services. Google Tag Manager works without cookies and triggers other tags, which in turn may collect data. Google Tag Manager does not access this data. If deactivation has been carried out at domain or cookie level, this remains in place for all tracking tags that are implemented with Google Tag Manager.

Further information can be found in the Google Tag Manager terms of use.

4.8.2 Google Analytics

We use the web analysis service Google Analytics 4 for the purpose of analyzing our website and its visitors as well as for marketing and advertising purposes.

Google Analytics uses cookies that are stored on your end device (laptop, tablet, smartphone, etc.) and enable your use of our website to be analyzed. This allows us to evaluate the usage behavior on our website and use the statistics/reports obtained to make our offer more interesting.

If used: We use Google Signals. This allows Google Analytics to collect additional information about users who have activated personalized ads (interests and demographic data) and ads can be delivered to these users in cross-device remarketing campaigns.

In Google Analytics 4, the anonymization of IP addresses is activated by default. This means that your IP address is shortened by Google within Switzerland or the EU/EEA before transmission. Only in exceptional cases will the full IP address be transmitted to a Google server and shortened there.

Google uses this information for the purpose of evaluating your use of our website, compiling reports on website activity and providing us with other services relating to website activity and internet usage. According to Google, the IP address transmitted by your browser as part of Google Analytics will not be merged with other Google data. When you visit our website, your user behavior is recorded in the form of events (such as page views, interaction with the website or your “click path”) as well as other data such as your approximate location (country and city), technical information about your browser and the end devices you use or the referrer URL, i.e. the website/advertising media from which you came to our website.

You can prevent the collection and transmission of the data generated by the cookie and related to your use of our website (including your IP address) to Google and the processing of this data by Google by downloading and installing the browser add-on to deactivate Google Analytics. If you wish to object to interest-based advertising by Google, you can use the settings and opt-out options provided by Google.

An overview of data usage in Google Analytics and the measures taken by Google to protect your data can be found in the Google Analytics Help.

Further information on the terms of use of Google Analytics and on data protection at Google can be found in the respective documents.

4.8.3 Google Maps

We use the online map service Google Maps on our website to integrate interactive maps on our website.

When you visit a website on which Google Maps maps are embedded, Google Maps will set a cookie. As a rule, this cookie is not deleted when the browser is closed, but only expires after a certain period of time, unless you delete it manually beforehand.

By using Google Maps, information about your use of our website (including your IP address) may be transmitted to a Google server in the USA and stored there. Google may store this data as usage profiles for the purposes of customizing its services, advertising and market research. If you are logged in to Google, your data will be assigned directly to your account. If you do not wish this to happen, you must log out beforehand.
If you do not agree to this processing of your information, you have the option of deactivating the Google Maps service. To do this, you must deactivate the Java Script function in your browser. However, this may also affect other functions of our website.

Further information can be found in the terms of use for Google Maps and Google’s privacy policy.

4.8.4 YouTube

On our website, we use the services of the provider YouTube LLC, based in the USA (“YouTube”), a subsidiary of Google LLC. (“Google”).

When you start a YouTube video on our website, a connection to the YouTube servers is established. This tells the YouTube server which of our pages you have visited. This information (including your IP address) may be transmitted to a Google server in the USA and stored there. If you are logged into your YouTube account at the same time, you enable YouTube to assign your surfing behavior directly to your personal profile. You can prevent this by logging out of your YouTube account before visiting our website.

Further information can be found in YouTube’s terms of use and Google’s privacy policy.

4.8.5 Google Fonts

In order to display our content correctly and graphically appealing across browsers, we may use script and font libraries on our website to display fonts. Google Fonts are transferred to your browser’s cache to avoid multiple loading. If your browser does not support Google Fonts or prevents access, our website content will be displayed in a standard font.

Calling up script or font libraries automatically triggers a connection to the operator of the library. It is theoretically possible – although it is currently unclear whether and, if so, for what purposes – that the operator, in this case Google, collects data.

We do not collect any personal data through the integration of Google Fonts.

You can object to data processing by Google Fonts by deactivating the execution of JavaScript in your browser or by installing a JavaScript blocker. Please note that this may result in functional restrictions on the website.

Further information on Google Fonts can be found in the Google Fonts FAQ and in Google’s privacy policy.

4.8.6 Google reCAPTCHA

The reCAPTCHA function helps us to differentiate whether an entry (e.g. in a contact form) is made by a human or automatically by a computer program (so-called bots). In this way, we want to ensure the security of our website and protect it in particular from automated entries (or attacks) and spam.

For this purpose, reCAPTCHA analyzes the behavior of the website visitor based on various characteristics. These analyses run completely in the background and start automatically as soon as you access our website. To differentiate between humans and bots, Google analyzes various information, such as the IP address of the end device used, the time spent on the website, the browser and operating system used or mouse movements made by the website visitor.

Further information on the use of the data collected by Google in this way can be found in Google’s privacy policy and terms of use.

4.8.7 Google Ads

Our website uses the online advertising program Google Ads, which is part of Google Marketing Services, to draw attention to our attractive offers with the help of advertising material on external websites. We can determine how successful the individual advertising measures are in relation to the advertising campaign data.

Google Ads places a cookie on your computer (“conversion cookie”) if you have reached our website via a Google ad. These cookies generally lose their validity after 30 days and are not intended to identify you personally.

These cookies enable Google to recognize your browser. If you visit certain of our websites and the cookie has not yet expired, Google and we can recognize that you clicked on the ad and were redirected to our website. A different cookie is assigned to each Google Ads customer. Cookies can therefore not be tracked via the websites of Google Ads customers. We ourselves do not collect or process any personal data in the aforementioned advertising measures. We only receive statistical evaluations from Google. Based on these evaluations, we can recognize which of the advertising measures used are particularly effective. We do not receive any further data from the use of the advertising material; in particular, we cannot identify you on the basis of this information.

Interest-relevant categories are assigned to your browser on the basis of the information collected. These categories are used to display interest-based advertising.

By using Google Ads, we reach users who have already visited our website. This allows us to present our advertising to target groups who are already interested in our products or services.

You can prevent participation in this tracking process in various ways, including

  • by setting your browser software accordingly; in particular, the suppression of third-party cookies means that you will not receive any ads from third-party providers;
  • by deactivating cookies for conversion tracking by making the appropriate settings for personalized advertising from Google;
  • by deactivating the interest-based ads of providers that are part of the “YourAdChoices” self-regulation campaign.

You can find more information on how it works and on data protection in the Google Ads privacy policy and terms of use.

4.9 Font Awesome

Based on our legitimate interests in displaying our content correctly and graphically appealing across browsers, we use web fonts (in particular icons) from Fonticons Inc. based in the USA (“Font Awesome”) on our website.

The icons are loaded via the Font Awesome Content Delivery Network (CDN). CDNs are server networks that are distributed worldwide and therefore make it possible to load files quickly from the nearest server. In order for the icons to be loaded, the browser you are using automatically establishes a connection to Font Awesome’s servers. In particular, Font Awesome receives information about your IP address and which icon you have loaded and when. This information is stored on the respective CDN server, including in the USA.

According to Font Awesome’s privacy policy, Font Awesome processes this data about the use of your CDN, among other things, to optimize your CDN, diagnose and correct technical errors, protect the CDN from misuse and attacks and to compile statistics.

We ourselves do not collect any personal data through the integration of Font Awesome.

Further information about Font Awesome can be found in the privacy policy and the Support + FAQ page of Font Awesome.

4.10 Meta Pixel

Based on your consent, if you are habitually resident in the European Economic Area (EEA) or Switzerland, we use a service of Meta Platforms Ireland Ltd, based in Ireland, on our website Meta Pixel. The parent company is Meta Platforms Inc. based in the USA (“Meta”). Instagram is also a Meta service.

The information generated by the Meta Pixel may be transferred to a Meta server in the USA and may also be processed in countries where Meta or its subcontractors maintain facilities. According to Meta’s data processing conditions, the “Meta Contractual Addendum for the Transfer of European Data” applies in this case. Meta promises to ensure an adequate level of data protection by relying on EU standard contractual clauses.

Meta is also certified under the EU-U.S. and Swiss-U.S. Data Privacy Framework.

With the help of the meta pixel, Meta is able to determine the visitors of our online offers as a target group for the display of ads (so-called “Facebook” or “Instagram Ads”). Accordingly, we use the Meta Pixel to display the Facebook and Instagram ads placed by us only to those Facebook and Instagram users who have also shown an interest in our online offers or who have certain characteristics (e.g. interests in certain services determined on the basis of the websites visited) that we transmit to Meta (so-called “custom audiences”). With the help of Meta Pixel, we also want to ensure that our Facebook and Instagram ads correspond to the potential interest of users and are not annoying. With the help of the meta pixel, we can also track the effectiveness of Facebook and Instagram ads for statistical and market research purposes by seeing whether users are redirected to our website after clicking on a Facebook or Instagram ad (so-called “conversions”).

Data processing by Meta is carried out in accordance with Meta’s data policy. You can find general information on the display of Facebook and Instagram ads here. https://www.facebook.com/about/privacy/

By using cookies, Meta can subsequently recognize you in the member area of Facebook or Instagram and optimize the efficiency of advertisements, e.g. by offering target group-oriented advertisements. The prerequisite for this is that you have a Facebook and/or Instagram account and are logged into the Facebook or Instagram member area. If you are not a member of Facebook or Instagram, you are not affected by this data processing.

General information on the use of data by Meta, your rights in this regard and options for protecting your privacy can be found in Meta’s data policy. Specific information and details about Meta Pixel and how it works can be found in Meta’s help section. If you generally wish to object to the collection by Meta Pixel and the use of your data to display Facebook or Instagram ads, you can do so in Facebook’s advertising settings or Instagram’s privacy settings. To do this, you must be logged in to Facebook or Instagram.

If you do not have a Facebook or Instagram account, you can also object to the use of cookies for reach measurement and advertising purposes via the deactivation page of the Network Advertising Initiative and additionally on the US website YourAdChoices or the European website Your Online Choices.

4.11 Matomo

We use Matomo, a web analysis service from InnoCraft Ltd. from New Zealand (“Matomo”), on our website. The open source analytics tool “Matomo” is operated by datahub gmbh, Sentimattstrasse 6, 6003 Lucerne on our behalf

Matomo is an open source software that allows us to analyze the behavior of our users. For this purpose, Matomo sets a cookie which is used to record your IP address, the website accessed and the time spent on the respective website, among other things. Your IP address is shortened and thus anonymized immediately after it is collected and before it is stored.

This data processing takes place exclusively for the statistical analysis of the use of our website. The processing is carried out on the basis of our legitimate interests and serves to optimize our offer and, as far as possible, to avoid the processing of personal data.

Further information on the terms of use and data protection regulations can be found in Matomo’s privacy policy.

4.12 Social media presence and booking platforms

We maintain social media presences and use various booking platforms (“Platforms”). These include in particular

  • Facebook and Instagram, offers from Meta Platforms Inc. (USA) and Meta Platforms Ireland Ltd. (Ireland)
  • LinkedIn, a service provided by LinkedIn Corporation (USA) or LinkedIn Ireland Unlimited Company (Ireland)
  • Booking.com, operated by Booking.com B.V. based in the Netherlands
  • HolidayCheck, operated by HolidayCheck AG (Switzerland) and HC Touristik GmbH (Germany)
  • TripAdvisor, operated by Tripadvisor LLC (USA), Tripadvisor Ireland Ltd (Ireland) or TripAdvisor Ltd (United Kingdom)

The data you enter on our social media profiles or booking platforms will be published by the respective platform operators and will not be processed by us for other purposes. However, we reserve the right to delete content should this be necessary. We may communicate with you via these platforms or receive information from the platform operator, in particular if you book an offer (e.g. a hotel room) with us via a booking platform.

The basis for this data processing is our legitimate interest in communicating with you and presenting our offers via these channels. If the processing serves the fulfillment of a contract to which you are a party or the implementation of pre-contractual measures, this constitutes an additional legal basis.

Please note that the operators of social media platforms and booking platforms may use web tracking methods over which we have no control. This web tracking can also take place regardless of whether you are logged in or registered with the respective platform.

For detailed information on the processing of your personal data by the respective providers, please refer to their data protection declarations.

4.13 Yumpu

To display online brochures on our website, we can use the digital publishing service Yumpu, a service of i-magazine AG based in Switzerland (“Yumpu”). Yumpu enables us to display the content of pdf files digitally as so-called flip catalogs/flipbooks directly on our website without you having to download the pdf files.

The basis for the processing is our legitimate interest in an appealing presentation of our online offers.

Yumpu uses cookies which, according to Yumpu, are necessary to ensure the basic functions of the service. When you visit one of our websites on which a flip catalog/flipbook such as our Grimselwelt magazine is integrated, your browser automatically establishes a connection to Yumpu’s servers. Yumpu receives various pieces of information that your browser automatically transmits (so-called server log files). This includes information on the operating system used, browser type and version, your IP address or the time of the server request.

We do not store any personal data when you view a flip catalog/flipbook on our website.

According to Yumpu, this data is not merged with other data sources.

Further information about data protection at Yumpu and your rights and privacy settings can be found in Yumpu’s privacy policy and cookie guidelines.

4.14 Yoast SEO

Our website uses the Yoast Search Engine Optimization (SEO) plugin from Yoast BV, based in the Netherlands (“Yoast”).

The plugin serves the technical optimization of our website for search engines, which increases our visibility in them and thus serves our legitimate interests. No personal data is processed, collected or stored in any way by Yoast, neither by Yoast itself nor on our servers.

Further information can be found in the Yoast BV privacy policy and in the Yoast help center.

4.15 Links to third party websites

Some links on this website lead to third-party websites that are not operated by the KWO and to which this data protection declaration does not extend. After clicking on the link, we no longer have any influence on the processing of any data transmitted to third parties, such as the IP address, as the behavior of third parties is naturally beyond our control. For this reason, we cannot accept any liability for this third-party content. The respective provider or operator of the pages is always responsible for the content of the linked pages.

Illegal contents were not recognizable at the time of linking. However, we cannot reasonably be expected to permanently monitor and check the content of linked pages without concrete evidence of an infringement. If we become aware of any legal infringements, such links will be removed immediately.

5. online purchase / reservation of Guided Tours, Mountain railways and overnight stays

KWO owns various hotels on the Grimsel Pass, operates the Grimselwelt Mountain railways and runs various summer and winter guided tours. As a rule, you can book our offers directly on our website or by contacting us by telephone or by correspondence (e-mail or post).

Depending on the respective offer, the provision of various personal data is required. The specific types of data are described below. The processing is generally carried out to fulfill our (pre-)contractual obligations or due to legal reporting obligations, in particular from hospitality and/or police law.

5.1. Grimselwelt

You can book various Guided Tours on our website, buy tickets for our Mountain railways, the Oberaar car park or vouchers for our Grimselwelt offers. Bookings can also be made by telephone or by correspondence (e-mail).

Regardless of whether you make your booking online or use one of our other communication channels, we require various pieces of information. Depending on which of our offers you are interested in, we process various personal data. In particular, this may include your first name/last name, (e-mail) address, telephone number, motor vehicle license plate and payment information. You can see which of your personal data we process in the specific case from the respective input screen, whereby we draw your attention to the mandatory information.

This mandatory information is required to process, fulfill and/or deliver your order and to ensure correct payment.

The basis for the processing of your personal data is your and our mutual legitimate interest in processing your order. If the order serves the fulfillment of a contract to which you are a party or the implementation of pre-contractual measures, this is an additional basis for the processing of your personal data.

The provision of data that is not mandatory is voluntary and based on your consent. We essentially process this data in order to tailor our offer to your personal needs in the best possible way, to facilitate the processing of contracts or, if necessary, to contact you via an alternative communication channel with a view to fulfilling the contract.

You can object to this data processing at any time. Please send your objection to datenschutz@kwo.ch and we will examine your request. In such a case, your order will not be processed any further. Please also take note of the applicable cancellation options in our GTC.

As part of order processing, the service providers we use (such as carriers and payment service providers) receive the necessary data for order and order processing. The payment service provider you select is responsible for your payment data. You can find more information on data protection with these providers on their websites.

We retain data that we are required to retain for a longer period due to statutory retention obligations or due to legitimate interests, in particular for the defense/enforcement of claims.

5.1.1 Online store system and payment processing

The Grimselwelt online shop system was implemented using software from INTREXX GmbH, Germany and is hosted on our own servers in Innertkirchen, Switzerland.

For order processing in the online store, we use Saferpay, an online payment system of the payment service provider Worldline Group S.A., based in France (“Saferpay”). The Wordline Group company responsible for processing your data depends on your location; for Switzerland, this is Worldline Schweiz AG. Saferpay complies with current security standards, in particular the Payment Card Industry Data Security Standard (PCI DSS). Payment and related personal data is processed directly by this provider. In this case, we do not know or store your payment data.

Insofar as we pass on Saferpay data, this is done exclusively for the purpose of payment processing. The legal basis for the transfer of your data is the fulfillment of the contract concluded with you.

Further information on the processing of your personal data and data protection at Saferpay can be found in Worldline’s privacy policy.

If you order on account, your data will be transferred to our accounting department, which processes the payment via Abacus ERP, hosted by us in Innertkirchen.

5.2 Hotels on the Grimsel

If you would like to stay in one of our hotels, we offer you the possibility to book the hotel and room of your choice online. If you would like to use other services of our hotels, e.g. organizing seminars or weddings, please contact us by phone or by correspondence (e-mail or post).

Regardless of whether you make your booking online or use one of our other communication channels, we require various pieces of information. This includes in particular the date of your arrival and departure, desired room category and number of guests as well as your contact details, such as first/last name, address and telephone number. If you wish to hold or celebrate a seminar, banquet or your wedding with us, it may be necessary to provide further information (e.g. number of courses, projector & screen, music system & microphone and other requests on your part).

We will only use this data and other information voluntarily provided by you (e.g. expected arrival time, preferences, comments) to process the contract, unless otherwise stated in this privacy policy or unless you have given your separate consent. We will process the data by name in order to record your booking as requested, to provide the booked services, to contact you in the event of ambiguities or problems and to ensure correct payment.

You can object to this data processing at any time. Please send your objection to the (e-mail) address stated under point 2 and we will check your request. In such a case, your booking will not be processed any further. Please also note the cancellation conditions in our General Terms and Conditions.

5.2.1 Hotels reporting system

In order to fulfill legal reporting obligations, which arise in particular from hospitality or police law, we collect further information from you and your accompanying persons at the latest upon arrival at our hotel. This includes, in particular, first/last name, address, date and place of birth, nationality, official identification card and number. If we are obliged to do so under the applicable regulations, we will forward this information to the relevant police authority.

This data can also be provided in advance online via the digital registration system of Jungfrau Region Tourismus AG. Please note the General Terms and Conditions and Privacy Policy regarding the processing of your personal data. There you will also find information on the digital guest card.

5.2.2 Protel

We use Protel, a hotel management software from protel Hotelsoftware GmbH, based in Germany, on our website (“Protel”). The system is operated on our servers in Innertkirchen. The Protel web service is used for some functions, including online booking.

When you book an overnight stay in one of our hotels, the booking details you provide, such as arrival/departure date and contact details, such as first/last name and e-mail address, are transmitted to Protel and stored on their servers. Protel processes this information to book your stay on our behalf and to send you the booking confirmation.

The legal basis for the processing of your personal data is the fulfillment of the contract to which you are a party.

To protect your privacy, we have concluded an order processing contract with Protel.

No payment details are recorded at the time of booking. Payment for the service is then made directly on site. When an invoice is issued, your data is transferred to our accounting department, which processes the payment via Abacus ERP, hosted by us in Innertkirchen.

You can find more information about Protel on their website.

5.2.3 Guest feedback

Following your stay with us, we offer you the opportunity to provide us with a feedback form, e.g. with your praise, criticism and suggestions for improvement. We collect various personal data, in particular your first name/surname and a report on your experience during your stay. The specific information we collect can be found in the form.

In order to obtain your feedback and to display the various reviews of our hotel guests on our website, we use the Cutomer Experience platform of TrustYou GmbH, based in Germany (“TrustYou”). Your data is therefore stored on a TrustYou server.

Your feedback is of course voluntary and is provided as part of our quality management and serves the purpose of better aligning our services and offers to the needs of our guests, for example by clarifying your concerns (e.g. obtaining opinions from employees contacted or obtaining feedback from you), evaluating and analyzing your information (e.g. compiling satisfaction statistics) or taking measures based on the knowledge gained (e.g. remedying shortcomings, such as instructing and praising/reminding employees, repairing defective equipment). With your consent, we will be happy to publish your feedback and evaluation on our website. The name or pseudonym you provide (e.g. first name, initials or family X), the date of your feedback, your feedback and your rating of our hotel will be published.

Further information on security and data protection at TrustYou can be found in their terms and conditions and privacy policy.