PRIVACY - Imholz Sport Andermatt

Privacy Information of the Imholz Sport AG 01.09.2023

TABLE OF CONTENTS

I. Controller and Contact Information

II. Processing Operations

A.) Call up the Website
B.) Processing Activities Related to the Website
C.) YouTube Video Integration
D.) Vimeo-video Integration
E.) Facebook Integration
F.) Instagram Integration
G.) Google Maps iFrame
H.) Cookies
1. Technically Necessary Cookies
2. Comfort Cookies
3. Analysis and Statistics Cookies
4. Marketing-Cookies

I.) Participation in Raffles
J.) Ski Rental Service
1. Customer Account
2. Contract Execution
3. Data Processing “Analysis for the Purposes of Product Development and “Quality Management in Connection with the Rental Service”
4. Feedback-Mailing

K.) Shop
1. Customer Account and General Information about the Shop
2. Contract Execution and Payment
3. Payment on Account and Credit Assessment

L.) Newsletter
M.) Contact Form
N.) General Communication with us and Applications

III. Retention Period

IV. Cross-Border Disclosure to Third Countries without Adequate Level of Data Protection

V. Data Security

VI. Your Rights

VII. Language

VIII. Actuality and Change of this Privacy Policy

I. Controller and Contact Information
The controller for the processing of your personal data in accordance with the provisions of data protection law is

Controller Switzerland Imholz Sport AG
represented by Hans-Ueli Imholz, Klausenstrasse 142, 6463 Bürglen

Supervisory authority for Switzerland
Eidgenössischer Datenschutz- und Öffentlichkeitsbeauftragter, EDÖB Feldeggweg 1, 3003 Bern Switzerland

II. Processing Operations
A.) Call up the Website
(1) Processing Operation
When you call up our website, information is automatically sent to our website server via your browser. This information is temporarily stored in a so-called log file until it is automatically deleted. Our website is hosted by Hostpoint AG, Neue Jonastrasse 60, 8640 Rapperswil-Jona

(2) Personal Data Processed
The following information is collected without your intervention and stored until automated deletion: Browser type and browser version, operating system used, referrer URL, accessed pages and files, host name of the accessing computer, time of the server request and the IP address.

(3) Purpose
We use this information to ensure a smooth connection of the website, to guarantee a comfortable use of our website, to evaluate the system security and stability and for statistical purposes.

(4) Legal Basis of Data Processing
The legal basis for data processing is Art. 13 para. 1 FADP or Art. 6 para. 1 p. 1 lit. f GDPR and thus our legitimate interest. This data is collected and evaluated for statistical purposes and to improve the quality of the website. In no case do we use the collected data to draw conclusions about your person or to create user profiles with the help of this data.

(5) Necessary for Functionality of the Website
This processing operation is necessary for the functionality of the website.

(6) Retention Period
After your session expires, the session cookies are deleted after 2 weeks at the latest.

(7) Recipient
The website is hosted in the data centers of Hostpoint AG, Neue Jonastrasse 60, 8640 Rapperswil-Jona

B.) Processing Activities Related to the Website
Some of our services and data processing activities are made available or operated through our website, among other places. These are personal data processing activities, which we declare in the following articles. These include, for example:
– Facebook Pixel
– YouTube and Vimeo Video integration
– Instagram and Facebook integration
– Google Maps iFrame
– Technical necessary cookies
– Analysis and statistics cookies
– Marketing cookies
– Participation in raffles
– Ski rental service
– Shop
– Newsletter and Feed-Back-Mail
– Contact and applications

C.) YouTube Video Integration
(1) Processing Operation
On our website, we use YouTube videos of the company Google Ireland Limited, with its registered office in Gordon House, Barrow Street, Dublin 4, Ireland. These are stored on http://www.youtube.com and can be played directly from our website.

(2) Personal Data Processed
By clicking on the embedded YouTube video, YouTube or Google receives the information that you have accessed the corresponding subpage of our website. In addition, log files are transmitted. This occurs regardless of whether YouTube provides a user account through which you are logged in or whether there is no user account. If you are logged into Google, your data will be directly assigned to your account. If you do not want the assignment with your profile at YouTube, you must log out before activating the button.
YouTube stores your data as usage profiles and uses them for the purposes of advertising, market research and/or demand-oriented design of its website. Such an evaluation is carried out in particular (even for users who are not logged in) to provide needs-based advertising. You have the right to object to the creation of these user profiles, whereby you must contact YouTube to exercise this right.
For more information on the purpose and scope of data collection and its processing by YouTube, please refer to Google’s privacy policy. There you will also find further information on your rights and setting options to protect your privacy: https://policies.google.com/privacy

(3) Purpose
The purpose of this data processing is the simplified presentation of videos on our website and the direct playability of videos.

(4) Legal Basis of Data Processing
Data processing is carried out with your express consent in accordance with Art. 13 para. 1 FADP or Art. 6 para. 1 p. 1 lit. a GDPR, which you have given via the cookie banner.
Note: Your personal data will also be processed by Google in the USA. The USA is a so- called unsafe third country (see also chapter IV). Your personal data in the USA is therefore not subject to a level of data protection comparable to that in Switzerland or the EU. If you consent to processing by Google, you therefore consent at the same time to your data being transferred to the USA in accordance with Art. 13 para. 1 FADP, Art. 17 new FADP or Art. 49 para. 1 lit. a GDPR.
Consequences of non-consent: No direct effect on the function of the website; No possibility to play embedded videos from Youtube within the website.

(5) Necessary for Functionality of the Website
This processing activity is not necessary for the functionality of the website.

(6) Retention Period
We have no influence on how long Google stores your data. We refer to the explanations on the analysis & statistics cookies.

(8) Recipient
The recipient of your data is Google Ireland Limited, with its registered office at Gordon House, Barrow Street, Dublin 4, Ireland.

D.) Vimeo-video Integration
(1) Processing Operation
On our website we embed videos with Vimeo, Vimeo LLC, 555 West 18th Street, New York, New York 10011, USA.
The data collected is anonymised and evaluated in the form of statistics. Recognizable markers are also set. If you are logged in to Vimeo at the same time, this information is assigned to your respective member account with Vimeo.

(2) Personal Data Processed
By clicking on the embedded Vimeo video, Vimeo receives the information that you have accessed the corresponding sub-page of our website. In the process, connection data, IP address, browser data and data about the content accessed, location data are collected from the user. If you are logged in to Vimeo at the same time, this information is assigned to your respective member account with Vimeo. You can prevent this by logging out of your member account.
For more information on how Vimeo processes your information, please visit: https://vimeo.com/privacy.

(3) Purpose
The purpose of this data processing is the statistical evaluation of website usage in connection with the use of Vimeo and to make our website more interesting for you by embedding the videos.

(4) Legal Basis of Data Processing
The data processing is carried out with your express consent in accordance with Art. 13 para. 1 FADP or Art. 6 para. 1 p. 1 lit. a GDPR, which you have given via the cookie banner.
Note: Your personal data will also be processed by Vimeo in the USA. The USA is a so-called unsafe third country (see also chapter IV). Your personal data in the USA is therefore not subject to a level of data protection comparable to that in Switzerland or the EU. If you consent to processing by Vimeo, you therefore consent at the same time to your data being transferred to the USA in accordance with Art. 13 para. 1 FADP, Art. 17 new FADP or Art. 49 para. 1 lit. a GDPR.
Consequences of non-consent: No direct effect on the function of the website; no possibility to play embedded videos from Vimeo within the website.

(5) Necessary for Functionality of the Website
This processing activity is not necessary for the functionality of the website.

(6) Retention Period
Storage on the end device for up to 2 years.

(7) Contractual Agreement
Vimeo relies on standard contractual clauses approved by the EU Commission for the transfer as a guarantee of a level of data protection comparable to that in the EU. Switzerland recognizes the approvals of standard contractual clauses by the EU.

(8) Recipient
The recipient of your data is: Vimeo LLC, 555 West 18th Street, New York, New York 10011, USA.

E.) Facebook Integration

(1) Processing Operation
We operate our own public Facebook presence through which you can communicate with us and through which we conduct marketing. For this purpose, we use the social media channel Facebook of Meta Platforms Ireland Ltd, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. In doing so, we maintain our own Facebook profile under the name «imholzsport». We share the content from our Facebook profile on our website. We have also placed Facebook social media buttons on our website so that you can easily link to our Facebook profile.
Your data is only processed when you click on the Facebook social media button, on the embedded images or contact us. The data collected is also anonymized and then used in the form of statistics. A recognisable marker is also set.
We are joint controllers with Meta Platforms Ireland Ltd. according to Art. 26 GDPR, but only with regard to the collection and transmission of the data. Meta Platforms Ireland Ltd. is solely responsible for the subsequent processing of the information on Meta’s part.
We have concluded a joint responsibility agreement to determine the respective responsibilities for fulfilling the obligations under the GDPR. Under this agreement, we are responsible for informing users of our website, while Meta is responsible for fulfilling requests for data subjects’ rights under Art. 15 to 21 of the GDPR. However, within the framework of joint responsibility, you can assert your data subject rights against each of the joint controllers.
Meta processes personal data in accordance with its data protection principles and statements. For more information on how Meta processes personal data, please see Meta’s privacy policy at: https://www.facebook.com/privacy/policy/?entry_point=data_policy_redirect&entry=0

(2) Personal Data Processed
If you contact us, the following information will be collected from you: User name or first and last name, possibly a picture, data that you send us in the course of contacting us. Data such as IP address, connection data, browser data and data on the content accessed are also collected when you click on the social media buttons.

(3) Purpose
On the one hand, the data processing serves the statistical evaluation of website use in connection with the use of Facebook. If you contact us via Facebook, we process the data for the purpose of answering your query.

(4) Legal Basis of Data Processing
The data processing via the click on the social media buttons takes place with your express consent pursuant to Art. 13 para. 1 FADP or Art. 6 para. 1 p. 1 lit. a GDPR, which you have given via the cookie banner.
Note: Your personal data will also be processed by Meta in the USA. The USA is a so-called unsafe third country (see also Chapter IV). Your personal data in the USA is therefore not subject to a level of data protection comparable to that in Switzerland or the EU. If you consent to processing by Meta, you therefore consent at the same time to your data being transferred to the USA in accordance with Art. 13 para. 1 FADP, Art. 17 new FADP or Art. 49 para. 1 lit. a GDPR.
Consequences of non-consent: No immediate effect on the function of the website; No possibility to play embedded content from Facebook within the website.
If you contact us via our Facebook profile, we process your data to fulfil the contract or to take pre-contractual measures in accordance with Art. 13 para. 2 lit. a FADP or Art. 6 para. 1 lit. b GDPR and on the basis of our legitimate interest in accordance with Art. 13 para. 1 FADP or Art. 6 para. 1 lit. f GDPR in order to provide a possibility of communication.

(5) Necessary for Functionality of the Website
This processing activity is not necessary for the functionality of the website.

(6) Retention Period
The cookies set are stored on the end device for up to 10 years. Data that is processed in connection with your contact via our Facebook profile is deleted after 1 year, unless we are obliged to retain the communication for 5 or 10 years.

(7) Contractual Agreement
Meta relies on standard contractual clauses approved by the EU Commission for the transfer as a guarantee of a level of data protection comparable to the EU. Switzerland recognizes the approvals of standard clauses by the EU.
The data processing conditions of Meta are available at: https://www.facebook.com/legal/terms/dataprocessing
Furthermore, we have concluded a joint controller agreement with Meta.

(8) Recipient
The recipient of your data is: Meta Platforms Ireland Ltd, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.

F.) Instagram Integration
(1) Processing Operation
We operate our own public Instagram presence through which you can communicate with us and through which we conduct marketing. For this purpose, we use the social media channel Instagram of Meta Platforms Ireland Ltd, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. In doing so, we maintain our own Instagram profile under the name “imholzsportandermatt”. We share the content from our Instagram profile on our website. We have also placed Instagram social media buttons on our website so that you can easily link to our Instagram profile.
Your data is only processed when you click on the Instagram social media button, on the embedded images or contact us. The data collected is also anonymized and then used in the form of statistics. A recognisable marker is also set.
We are joint controllers with Meta Platforms Ireland Ltd. according to Art. 26 GDPR, but only with regard to the collection and transmission of the data. Meta Platforms Ireland Ltd. is solely responsible for the subsequent processing of the information on Meta’s part.
We have concluded a joint responsibility agreement to determine the respective responsibilities for fulfilling the obligations under the GDPR. Under this agreement, we are responsible for informing users of our website, while Meta is responsible for fulfilling requests for data subjects’ rights under Art. 15 to 21 of the GDPR. However, within the framework of joint responsibility, you can assert your data subject rights against each of the joint controllers.
Meta processes personal data in accordance with its data protection principles and statements. For more information on how Meta processes personal data, please see Meta’s privacy policy at: https://www.facebook.com/privacy/policy/?entry_point=data_policy_redirect&entry=0

(3) Purpose
On the one hand, the data processing serves the statistical evaluation of website use in connection with the use of Instagram. If you contact us via Instagram, we process the data for the purpose of responding to your request.

(4) Legal Basis of Data Processing
The data processing via the click on the social media buttons is carried out with your express consent pursuant to Art. 13 para. 1 FADP or Art. 6 para. 1 p. 1 lit. a GDPR, which you have given via the cookie banner.
Note: Your personal data will also be processed by Meta in the USA. The USA is a so-called unsafe third country (see also chapter IV). Your personal data in the USA is therefore not subject to a level of data protection comparable to that in Switzerland or the EU. If you consent to processing by Meta, you therefore consent at the same time to your data being transferred to the USA in accordance with Art. 13 para. 1 FADP, Art. 17 new FADP or Art. 49 para. 1 lit. a GDPR.
Consequences of non-consent: No direct effect on the function of the website; No possibility to display embedded Instagram posts within the website.
If you contact us via our Instagram profile, we process your data to fulfil the contract or to take pre-contractual measures in accordance with Art. 13 para. 2 lit. a FADP or Art. 6 para. 1 lit. b GDPR and on the basis of our legitimate interest in accordance with Art. 13 para. 1 FADP or Art. 6 para. 1 lit. f GDPR to provide a possibility of communication.

(5) Necessary for Functionality of the Website
This processing activity is not necessary for the functionality of the website.

(6) Retention Period
The cookies set are stored on the end device for up to 10 years. Data that is processed in connection with your contact via our Instagram profile is deleted after 1 year, unless we are obliged to retain the communication for 5 or 10 years.

Furthermore, we have concluded a joint controller agreement with Meta.

(8) Recipient
The recipient of your data is: Meta Platforms Ireland Ltd, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.

G.) Google Maps iFrame
(1) Processing Operation
We use a Google Maps iFrame from Google Ireland Limited, seated in Gordon House, Barrow Street, Dublin 4, Irland.

(2) Personal Data Processed
By clicking on the iFrame, the user is redirected to the provider’s website. If you click on the Google Maps iFrame, this will take you to the websites of Google Maps. We have no influence on the processing of personal data on the websites of Google. Google records, for example, activities that users undertake via Maps. This can be specific places, calculated routes, shops and institutions that users look at via Maps.
For more information regarding the data collected, please see Google’s privacy policy at https://policies.google.com/privacy.

(3) Purpose
The data processing serves to enable the integration of Google Maps on our website. An iFrame is used to structure our website and is used to place other web content on our website.

(4) Legal Basis of Data Processing
The data processing is carried out with your explicit consent according to Art. 13 para. 1 FADP or Art. 6 para. 1 p. 1 lit. a GDPR, which you have given via the cookie banner.
Note: Your personal data will also be processed by Google in the USA. The USA is a so- called unsafe third country (see also Chapter IV). Your personal data in the USA is therefore not subject to a level of data protection comparable to that in Switzerland or the EU. If you consent to processing by Google, you therefore consent at the same time to your data being transferred to the USA in accordance with Art. 13 para. 1 FADP, Art. 17 new FADP or Art. 49 para. 1 lit. a GDPR.
Consequences of non-consent: No immediate effect on the function of the website; No possibility to display Google Maps within the website.

(5) Necessary for Functionality of the Website
This processing activity is not necessary for the functionality of the website.

(6) Retention Period
We have no influence on how long Google stores your data. We refer to the explanations on the analysis & statistics cookies.

(8) Recipient
The recipient of the data is Google Ireland Limited, seated in Gordon House, Barrow Street, Dublin 4, Irland.

H.) Cookies
We use cookies on our website. Some of them are technically necessary and cannot be refused. Other cookies that increase the comfort of using this website, analyse usage to improve the website and services for you and personalise content for you, as well as those cookies set by external media and services and shared with third parties, are only activated with your consent. Cookie settings can be managed in the cookie settings menu on https://imholzsport-andermatt.ch/.

1. Technically Necessary Cookies

Essential cookies are automatically set when you visit our website for the first time. They are needed so that you can move around a website and use its features. Without these cookies, essential website functionalities cannot be guaranteed, for example, that actions performed during a visit (e.g. text entry in a web form) are retained, even when navigating between individual pages of the website.

2. Comfort Cookies

Functional cookies enable a website to store information that has already been entered (such as language selection) and to offer the user improved, more personalized functions. Functional cookies are used, for example, to enable requested functions such as playing videos. Such cookies remain stored after the Internet session (persistent cookies) and are available when you return to the website to improve your use of the website.

3. Analysis and Statistics Cookies

Analysis and statistics cookies collect information about how a website is used – for example, which pages a visitor visits most often and whether they receive error messages from a page. These cookies do not store any information that allows the user to be identified. The information collected is aggregated and thus analyzed anonymously. These cookies are used exclusively to improve the performance of a website and thus the user experience.

Google Analytics 4

(1) Processing Operation
We use Google Analytics 4, a web analytics service provided by Google Ireland Limited, located at Gordon House, Barrow Street, Dublin 4, Ireland, on our website. The data is stored on the end device, anonymized and analyzed in the form of statistics.

(2) Personal Data Processed
In connection with the Google Analytics 4 web analytics service, the following data will be processed from you: Browser type/version, operating system used, referrer URL, IP address and the time of the server request. The IP addresses are anonymised so that an assignment is generally not possible (IP masking).
For more information on how Google Analytics handles user data, please see Google’s privacy policy at:
https://support.google.com/analytics/answer/6004245?hl=de

(3) Purpose
We use Google analytics 4 for error analysis and statistical evaluation of website usage.

(4) Legal basis of Data Processing
The data processing is carried out with your explicit consent according to Art. 13 para. 1 FADP or Art. 6 para. 1 p. 1 lit. a GDPR, which you have given via the cookie banner.
Note: Your personal data will also be processed by Google in the USA. The USA is a so- called unsafe third country (see also Chapter IV). Your personal data in the USA is therefore not subject to a level of data protection comparable to that in Switzerland or the EU. If you consent to processing by Google, you therefore consent at the same time to your data being transferred to the USA in accordance with Art. 13 para. 1 FADP, Art. 17 new FADP or Art. 49 para. 1 lit. a GDPR.
Consequences of non-consent: No immediate effect on the function of the website; No possibility to play embedded videos from Google within the website. Limited possibilities for further development and error analysis and limited possibility of personalised advertising based on interests.

(5) Necessary for Functionality of the Website
This processing activity is not necessary for the functionality of the website.

(6) Retention Period
Storage on the end device for up to 1 year.

(7) Contractual Agreement
Google relies on standard contractual clauses approved by the EU Commission for the transfer as a guarantee of a level of data protection comparable to the EU. Switzerland recognizes the approvals of standard clauses by the EU.
We have concluded a processor agreement with Google. Through this agreement, Google ensures that they process the data in accordance with our instructions and ensure the protection of the data subject’s rights.
Google’s processor terms are available at: https://privacy.google.com/intl/de/businesses/processorterms/

(8) Recipient
The recipient of the data is Google Ireland Limited, seated in Gordon House, Barrow Street, Dublin 4, Irland.

Google Analytics
(1) Processing Operation
We use Google Analytics, a web analytics service provided by Google Ireland Limited, located at Gordon House, Barrow Street, Dublin 4, Ireland, on our website. The data is stored on the end device, anonymized and analyzed in the form of statistics.

(2) Personal Data Processed
In connection with the Google Analytics web analytics service, the following data will be processed from you: Browser type/version, operating system used, referrer URL, IP address and the time of the server request. The IP addresses are anonymised so that an assignment is generally not possible (IP masking).
For more information on how Google Analytics handles user data, please see Google’s privacy policy at:
https://support.google.com/analytics/answer/6004245?hl=de

(3) Purpose
We use Google analytics for error analysis and statistical evaluation of website usage.

(5) Necessary for Functionality of the Website
This processing activity is not necessary for the functionality of the website.

(6) Retention Period
Storage on the end device for up to 1 year.

(8) Recipient
The recipient of the data is Google Ireland Limited, seated in Gordon House, Barrow Street, Dublin 4, Irland.

4. Marketing-Cookies

Cookies for marketing purposes are used to play out targeted advertisements that are relevant to the user and adapted to his interests. They are also used to limit the frequency of appearance of an ad and to measure the effectiveness of advertising campaigns. They register whether one has visited a website or not. This information can be shared with third parties, such as advertisers. Cookies used to improve targeting and advertising are often linked to third-party site functionality.

Facebook Pixel
(1) Processing Operation
For conversion measurement, our website uses the visitor action pixel from Facebook, whose provider is Meta Platforms Ireland Ltd, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.
In this way, the behaviour of page visitors can be tracked after they have been redirected to the provider’s website by clicking on a Facebook ad. With the help of Facebook Pixel, it is possible for Meta to determine the visitors to our online offer, even across multiple end devices, as a target group for the display of advertisements (so-called “Facebook Ads”). You can read about the exact functionality of Facebook Pixel here:
https://de-de.facebook.com/business/learn/facebook-ads-pixel
The pixel is loaded when you react to an ad placed by us on Facebook, for example because you click on a link to our page. In this context, a pixel ID is created and stored in cookies so that we receive evaluations of your user behaviour. The pixel is not used to identify you personally. However, the data is stored and processed by Facebook so that a connection to the respective user profile is possible.
We are joint controllers with Meta Platforms Ireland Ltd. according to Art. 26 GDPR, but only with regard to the collection and transmission of the data. Meta Platforms Ireland Ltd. is solely responsible for the subsequent processing of the information on the part of Meta.
We have entered into a joint responsibility agreement to determine the respective responsibilities for fulfilling the obligations under the GDPR.
According to this agreement, we are responsible for informing users of our website, while Facebook is responsible for fulfilling requests regarding data subjects’ rights under Articles 15 to 21 of the GDPR. However, within the framework of joint responsibility, you can in principle assert your data subject rights against each of the joint controllers.
Meta processes personal data in accordance with its data protection principles and statements. For more information on how Meta processes personal data, please see Meta’s privacy policy at: https://www.facebook.com/privacy/policy/?entry_point=data_policy_redirect&entry=0

(2) Personal Data Processed
The personal data processed by the Facebook Pixel includes:
• The HTTP header information containing information about the web browser or app used (e.g. user agent, country settings, language).
• Information about standard/optional events such as “page view” or “app installation”, other object properties as well as buttons clicked by visitors
• Online identifiers such as IP addresses and, if provided, meta-related identifiers or device identifiers (e.g. advertising IDs for mobile operating systems) as well as information on the status of opt-out/limited ad tracking

(3) Purpose
The purpose of this processing operation is to evaluate the effectiveness of the meta- advertisements for statistical and market research purposes so that future advertising measures can be optimised.

Note: Your personal data will also be processed by Meta in the USA. The USA is a so-called unsafe third country (see also chapter IV). Your personal data in the USA is therefore not subject to a level of data protection comparable to that in Switzerland or the EU. If you consent to processing by Meta, you therefore consent at the same time to your data being transferred to the USA in accordance with Art. 13 para. 1 FADP, Art. 17 new FADP or Art. 49 para. 1 lit. a GDPR.
Consequences of non-consent: No immediate effect on the functioning of the website; You can revoke or adjust your consent at any time with effect for the future.

(5) Necessary for Functionality of the Website
This processing activity is not necessary for the functionality of the website.

(6) Retention Period
Tracking of users who have landed on our website after clicking on one of our Facebook ads can remain active for up to 180 days.

(7) Contractual Agreement
Meta relies on standard contractual clauses approved by the EU Commission for the transfer as a guarantee of a level of data protection comparable to the EU. Switzerland recognizes the approvals of standard clauses by the EU.
Meta’s order data processing conditions are available at: https://www.facebook.com/legal/terms/dataprocessing
Furthermore, we have concluded an agreement with Meta as joint responsible parties.

(8) Recipient
Meta Platforms Ireland Ltd, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Irland.

Performance Analytics Pixel from [m]PLATFORM
(1) Processing Operation
We use [m]PLATFORM technology from GroupM, the media investment management group of WPP plc. 13 Castle Street, St Helier, Jersey JE1 1ES, USA. In the European Economic Area (EEA) and Switzerland, [m]PLATFORM Ltd, c/o GroupM, 26 Red Lion Square, London, WC1R 4HQ, UK, is the data controller for the data collected by [m]PLATFORM.
When the [m]insights analysis tools are executed, data is stored on the end device, anonymised and evaluated in the form of statistics. Cookies, IDs and pixels are used to set a recognisable marker on the user. [m]PLATFORM stores the data collected by [m]Insights in non-aggregated (i.e. pseudonymised) form in usage profiles after the last contact of the cookie in the browser of a user with a website on which [m]Insights is used. If there is no such contact, the corresponding usage profile is deleted.

(2) Personal Data Processed[m]Insights collects data about the type of websites users visit and the interactions they have with the sites and advertisements. Technical identifiers such as cookie ID, IP addresses, connection data, browser data and data about the content accessed and the user’s online activity are collected. [m]Insights also receives online and offline user data collected by third parties, including data on demographics and interests.[m]PLATFORM shares data with GroupM agencies and their clients for the purposes of providing interest-based advertising, analytics and the other services. Data is also shared with processors (e.g. demand side platforms, ad networks, ad exchanges and ad servers).
For more information on data processing by [m]PLATFORM, please see GroupM’s privacy policy at:
https://www.groupm.com/mplatform-privacy-notice/

(3) Purpose
The processing serves marketing and optimization purposes, in particular usage profiles are created under pseudonyms. These usage profiles are used by means of [m]Insights to play advertisements and to evaluate the playout of these advertisements in order to understand which factors make advertising successful or unsuccessful for advertisers and create evaluations in order to understand and improve the use of the service and the advertising effectiveness.

(4) Legal Basis of Data Processing
The data processing is carried out with your explicit consent according to Art. 13 para. 1 FADP or Art. 6 para. 1 p. 1 lit. a GDPR, which you have given via the cookie banner.
Note: Your personal data will also be processed by GroupM in countries (e.g. USA) which are so-called unsafe third countries (see also chapter IV). Your personal data in the USA is therefore not subject to a level of data protection comparable to that in Switzerland or the EU. If you consent to processing by GroupM, you therefore consent at the same time to your data being transferred to the USA in accordance with Art. 13 para. 1 FADP, Art. 17 new FADP or Art. 49 para. 1 lit. a GDPR.
Consequences of non-consent: No immediate effect on the functioning of the website; Limited possibilities for further development and error analysis and limited possibility of personalized advertising based on interests.

(5) Necessary for Functionality of the Website
This processing activity is not necessary for the functionality of the website.

(6) Retention Period
The cookie is deleted after 35 days.

(7) Contractual Agreement
GroupM relies on standard contractual clauses approved by the EU Commission for the transfer as a guarantee of a level of data protection comparable to the EU. Switzerland recognizes the approvals of standard clauses by the EU.

(8) Recipient
The recipient of your data is [m]PLATFORM, c/o GroupM, 26 Red Lion Square, London, WC1R 4HQ, UK.

Light Reaction
(1) Processing Operation
We used the Light Reaction marketing software from Light Reaction Germany GmbH, Derendorfer Allee 4, 40476 Düsseldorf, Germany. In the process, usage profiles are created under pseudonyms. These usage profiles are used to serve ads and evaluate the serving of those ads, to understand what factors make advertising successful or unsuccessful for advertisers, and create analytics to understand and improve service usage and advertising effectiveness.
When the analysis software is executed, data is stored on the end device, anonymized and evaluated in the form of statistics.

(2) Personal Data Processed
In the process, connection data, browser data and data about the content accessed and about your online activity are collected.

(3) Purpose
The processing serves marketing and optimization purposes.

(4) Legal Basis of Data Processing
The data processing is carried out with your express consent in accordance with Art. 13 para. 1 new FADP or Art. 6 para. 1 p. 1 lit. a GDPR, which you have given via the cookie banner.
Consequences of non-consent: No immediate effect on the functioning of the website; Limited possibilities for further development and error analysis and limited possibility of personalized advertising based on interests.

(5) Necessary for Functionality of the Website
This processing activity is not necessary for the functionality of the website.

(6) Retention Period
The cookie is deleted after 90 days.

(7) Recipient
The recipient of your data is: Light Reaction Germany GmbH, Derendorfer Allee 4, 40476 Düsseldorf, Germany.

Plista Tracking
(1) Processing Operation
We use marketing software from plista GmbH, Torstrasse 33-35, 10119 Berlin, Germany. When the analysis software is running, data is stored on the end device, anonymized and evaluated in the form of statistics..

(2) Personal Data Processed
In the process, connection data, browser data and data about the content called up and about your online activity are collected.

(3) Purpose
The processing serves marketing and optimization purposes, in particular usage profiles are created under pseudonyms. These usage profiles are used to play advertisements and to evaluate the playout of these advertisements, to understand which factors make advertising successful or unsuccessful for advertisers, and create evaluations to understand and improve the use of the service and advertising effectiveness.

(4) Legal Basis of Data Processing
The data processing is carried out with your express consent in accordance with Art. 13 para. 1 FADP or Art. 6 para. 1 p. 1 lit. a GDPR, which you have given via the cookie banner.
Consequences of non-consent: No immediate effect on the functioning of the website; Limited possibilities for further development and error analysis and limited possibility of personalized advertising based on interests.

(5) Necessary for functionality of the Website
This processing activity is not necessary for the functionality of the website.

(6) Retention Period
The cookie is deleted after 90 days.

(7) Recipient
The recipient of your data is plista GmbH, Torstrasse 33-35, 10119 Berlin, Germany.

I.) Participation in Raffles
(1) Processing Operation
If you agree to enter in one of our raffles, personal data about you will be processed in the course of your participation.

(2) Personal Data Processed
The following personal data are processed: First name, last name, gender, title, username on Facebook or Instagram, address, phone number, email address, date of birth, name of legal guardian, acceptance of the conditions of participation, consent to publication, consent to receive advertising.
The data actually required for participation in the respective raffle are marked as mandatory fields in the entry form and will be obtained directly from you.
In addition, we automatically collect the following data in the course of participation in a raffle: Type and name of the raffle, Facebook or Instagram user ID (in case of occasion), date of participation, content from the raffle (e.g. answer to questions), type of prize.
Furthermore, in the case of individual raffle promotions, photographs can be taken and processed by us when the prize is handed over or in the course of consuming the prize.

(3) Purpose
We process the data to process and organize participation in the raffle, to determine the winner and to hand out the prizes. The processing of the data is necessary so that, in compliance with the conditions of participation, the winner can be determined from all participants and the prize can be handed over. We may also pass on your data to cooperation partners so that they can hand over the prize to the winner. We process the age of the raffle participant and the details of the legal guardian if either the handing over of the prize requires a certain legal capacity or if the participant’s data is processed by way of information society service (e.g. Facebook or Instagram raffle, raffle on the website or newsletter mailing).
In addition, we announce the names of the winners together with the prize received on our website and on our social media channels and otherwise process your data for the purpose of public relations (naming at prize handover, press release, social media) only insofar as you have given your consent to this.
In the event of a public presentation of the prize, we will use the photographs taken in the course of this to illustrate our reporting on this event and the competition.

(4) Legal Basis of the Data Processing
The legal basis for the processing of the data is Art. 13 para. 2 lit. a FADP or Art. 6 para. 1 lit. b GDPR, as far as it concerns the determination of the prize, notification of the winners and sending of the prize, and therefore the processing for the fulfillment of our obligations arising from your participation in the raffle. n addition, we process the data in our legitimate interest pursuant to Art. 13 para. 1 FADP and Art. 6 para. 1 lit. f GDPR for the purpose of determining and documenting multiple winners in series together with the respective prizes and otherwise for the purpose of determining unfair means in the participation in the raffle.

We process the information on your age and a parent or guardian on the basis of Art. 13 para. 1 FADP or Art. 6 para. 1 lit. f GDPR and therefore only to the extent required by law and for documentation purposes in our legitimate interest, insofar as either the participation in the competition itself requires the legal capacity of the participant or data protection regulations bind the processing of the data of minors to the consent of the parent or guardian.
Only on the basis of your express consent pursuant to Art. 6 para. 1 lit. a GDPR, your data as a winner may be published (e.g. in a raffle via Facebook, Instagram or our website) or otherwise made public (e.g. mentioned in live draws).
The taking and publication of photographs in the event of a public presentation of the award is based on our overriding legitimate interest in providing pictorial coverage of the event (Art. 13 para. 1 FADP or Art. 6 para. 1 lit. f GDPR). Furthermore, photographs will only be taken and published with your consent (Art. 13 para. 1 FADP or Art. 6 para. 1 lit. a GDPR).
The legal basis for the processing of your data for marketing purposes is Art. 13 para. 1 FADP or Art. 6 para. 1 lit. a GDPR. The processing of data for this purpose therefore only takes place with your consent, which you can declare voluntarily in the course of participating in the raffle.
You can revoke your consent to the processing of this data at any time without reason with effect for the future, either by e-mail to box@imholzsport.ch or by calling +41 41 8740090.

(5) Necessary for Functionality of the Website
This processing activity is not necessary for the functionality of the website.

(6) Retention Period
The personal data will be stored and processed for the purpose of fulfilling the contract and therefore until the raffle has been completed and beyond, insofar as concrete claims against us from a raffle are imminent, and finally to the extent that statutory retention periods exist.

(7) Recipient
We will pass on your data to any cooperation partners for a specific raffle in the event of an occasion so that they can hand over the prize to you. Any other use of your data by them will only take place with your consent.

J.) Ski Rental Service
1. Customer Account
(1) Processing Operation
If you want to use the ski rental service on our website, you need to create a customer account. For the ski rental service we use the rental software EasyRent – WINTERSTEIGER Schweiz AG, Industriestrasse 86, 7310 Bad Ragaz, Schweiz. This is hosted by EasyRent – WINTERSTEIGER Schweiz AG, Industriestrasse 86, 7310 Bad Ragaz, Schweiz and is operated on-premise (server-based).

(2) Personal Data Processed
If you open a customer account with us, then we process the following data: First name, last name, password, e-mail address.
When you make reservations with us, we may also process the following data about you: Salutation, address data, telephone number, birthday, weight, shoe size, height, self- assessment of your driving ability, model preferences and your comments, active reservations, past reservations and canceled reservations.

(3) Purpose
The purpose of the data processing is to enable a web-based ski rental service, to identify the customer and thus to take pre-contractual measures or to fulfill contractual obligations.

(4) Legal basis of Data Processing
The purpose of the data processing is to enable a web-based ski rental service, to identify the customer and thus to take pre-contractual measures or to fulfill contractual obligations.

(5) Necessary for Functionality of the Website
This processing activity is not necessary for the functionality of the website.

(7) Recipient
The recipient of your data is EasyRent – WINTERSTEIGER Schweiz AG, Industriestrasse 86, 7310 Bad Ragaz, Schweiz.

2. Contract Execution
(1) Processing Operation
For the purpose of contract processing of the ski rental service or fulfillment and enforcement of our contractual rights and obligations, we process certain personal data. For the ski rental service we use the rental software EasyRent – WINTERSTEIGER Schweiz AG, Industriestrasse 86, 7310 Bad Ragaz, Schweiz. This is hosted by EasyRent – WINTERSTEIGER Schweiz AG, Industriestrasse 86, 7310 Bad Ragaz, Schweiz and is operated on-premise (server-based).
For enabling or processing the electronic payment transactions, we work together with Worldline – Worldline Schweiz AG, Hardturmstrasse 201, 8005 Zürich, Schweiz. The payment data is transmitted to this company, which processes the payment data on our behalf and according to our instructions.

(2) Personal Data Processed
We process the following data of the person with whom the rental contract for the sports equipment exists: customer number, first name, last name, address, postal code, city and country of origin, which you provide to us in the course of the request for rental of sports equipment via the online mask on our website or in a business premises.
You can also voluntarily provide us with your date of birth and e-mail address. In addition, in case of conclusion of a rental contract in the store, we collect the type of rental sports equipment (skis, bike), and other information about the rented sports equipment, namely item description, quantity, EAN code and the price for the rental and discounts granted.
In the further course of the rental process in the business premises, we process the date of birth of the user of the rental sports equipment and, in the case of the rental of skis, we also collect from the user the body height, body weight, shoe size, sole length and rider type (skiing ability). We require this data for the correct adjustment of the ski binding. If you borrow the sports equipment for another person, the first and last name of this person as well as your relationship to this person must be disclosed. The provision of this data is required for the conclusion of the rental contract.
In the event that you have announced your interest in the rental of sports equipment at your hotel or travel agency, we will be informed by this hotel or travel agency, with your consent, your first and last name, your capacity as a hotel guest / travel agency customer, and the interest in ski / bike rental. We therefore process in this case, in addition to the data provided by the hotel / travel agency, the name of the hotel or travel agency, and the name of any tour guide.
For the purpose of processing payments with electronic means of payment on the booking platform or on site, we additionally process the following personal data (payment data): the selected payment method, identification data of the payment method (e.g. card number), payment office, payment amount incl. currency, name and first name.

(3) Purpose
The purpose of the data processing is to enable a web-based ski rental service, the identification of the customer, the processing of payments and thus the performance of pre- contractual measures or the fulfillment of contractual obligations.
The user’s body data is used by us for the proper adjustment of the ski binding, which we are obliged to do on the basis of the rental contract with you. The scope of the data collected results from the ISO standard 11110 together with the adjustment guidelines issued for this purpose, which applies to the compilation of special binding/boot combinations, which must always be checked when a new combination is formed.

(4) Legal Basis of Data Processing
The legal basis for the processing of data in connection with the rental service and the use of the sports equipment is Art. 13 para. 2 lit. a FADP or Art. 6 para. 1 lit. b GDPR and therefore the processing for the performance of a contract.
We process the data regarding the hotel/travel agency on the basis of our legitimate interest according to Art. 13 para. 1 FADP or Art. 6 para. 1 lit. f GDPR, in order to be able to fulfill the contract with the travel agency and/or hotel in connection with the borrowing of sports equipment accordingly.

Insofar as you lend a piece of sports equipment to another person or we have received your data via a contact person, we process your data to fulfill the contract in accordance with Art. 13 para. 2 lit. a FADP or Art. 6 para. 1 lit. b GDPR and on the basis of our legitimate interest in accordance with Art. 13 para. 1 FADP or Art. 6 para. 1 lit. f GDPR, after you have disclosed your relationship with this person to us or this contact person has declared to us to disclose your data on your behalf and with their consent.

(5) Necessary for Functionality of the Websites
This processing operation is not necessary for the functionality of the website.

(6) Retention Period
Your data in connection with the rental service will be kept until you delete the customer account and beyond, as we have a retention obligation for the storage of this data. This is usually between 5 years and 10 years.
The data country of origin, name of the hotel or travel agency, and the description of the rented sports equipment will be anonymised as soon as they no longer need to be kept for the purposes of the rental service and processed for the purposes of statistical evaluation and analysis in accordance with.

(7) Recipient
The recipient of your data is EasyRent – WINTERSTEIGER Schweiz AG, Industriestrasse 86, 7310 Bad Ragaz, Schweiz.
For payments with electronic means of payment, your data will also be transmitted to Worldline
– Worldline Schweiz AG, Hardturmstrasse 201, 8005 Zürich, Schweiz.
In case of loss or theft of the sports equipment, we will pass on the data related to the rental contract to the police, the public prosecutor’s office and/or courts for the purpose of investigating and clarifying the facts of the case and finding out who the perpetrator is. In addition, we make a report to the insurance company and pass on the data on the rental contract required for this purpose.
A transfer of personal data to other third parties for their own purposes, including the hotel or travel agency, which serve us as the source of your data, will not take place without your consent.

3. Data Processing “Analysis for the Purposes of Product Development and “Quality Management in Connection with the Rental Service”
(1) Processing Operation
The following personal data is used anonymously for analysis and interpretation in the area of product development and quality management in the rental service. The non personal results obtained from the analysis are used to create evaluations of the customer structure, as well as to survey the interests of customers and customer behavior. This data is used to generate information that is used to align the company and sales strategy accordingly, or to survey the possible future demand behavior of customers, and to adapt and improve products and services, as well as to otherwise develop concepts to better reach customers and satisfy their needs. We do not establish a personal reference with these evaluation results.

(2) Personal Data Processed
We use the country of origin, name of the hotel or travel agency, and the description of the rented sports equipment anonymously for purposes of analysis to generate information for company direction and product development/improvement.

(3) Purpose
The personal data is used anonymously for analysis and interpretation for the area of product development and quality management in the rental service.

(4) Legal Basis of Data Processing
The legal basis for the processing of the data, which are permissibly collected in accordance with the processing in point 1. in such a way that they are anonymized, is Art. 13 para. 1 FADP or Art. 6 para. 1 lit. f GDPR. Protected interests of the customers are not affected by this.

(5) Necessary for Functionality of the Website
This processing activity is not necessary for the functionality of the website.

(6) Retention Period
The data are anonymized and are therefore kept without any time limit.

4. Feedback-Mailing
(1) Processing Operation
Following a reservation or order via our rental service or the store, we will send you an e-mail in which we give you the opportunity to evaluate our service. Based on your ratings, we optimize our services.
We use the services of Mailchimp – The Rocket Science Group, LLC, 675 Ponce de Leon Ave NE, Suite 5000, 30308 Atlanta, GA, USA to send the feed-back mail. The provider of this service is Mailchimp – The Rocket Science Group, LLC, 675 Ponce de Leon Ave NE, Suite 5000, 30308 Atlanta, GA, USA.

(2) Personal Data Processed
For this purpose, we process the following personal data: Your name, first name, e-mail address, ratings.

(3) Purpose
The purpose of the processing operation is to enable us to continuously improve our services and our offering based on customer feedback.

(4) Legal Basis of Data Processing
The legal basis for this data processing is your consent according to Art. 13 para. 1 FADP or Art. 6 para. 1 lit. a GDPR. You have the right to revoke your consent at any time by written notification or by clicking on the unsubscribe link, without affecting the lawfulness of the processing carried out on the basis of the consent until revocation. If you revoke your consent, you will no longer receive feedback mailings from us.

(5) Necessary for Functionality of the Website
This processing activity is not necessary for the functionality of the website.

(6) Retention Period
Your data will be kept as long as you have given us consent for this. After you have unsubscribed from the newsletter, we delete your data regarding this processing activity.

(7) Contractual Agreement
We use Mailchimp – The Rocket Science Group, LLC, 675 Ponce de Leon Ave NE, Suite 5000, 30308 Atlanta, GA, USA technologies to send the feedback requests.

(8) Recipient
The recipient of your data is Mailchimp – The Rocket Science Group, LLC, 675 Ponce de Leon Ave NE, Suite 5000, 30308 Atlanta, GA, USA.
Another transfer to third parties does not take place without your consent.

K.) Shop
1. Customer Account and General Information about the Shop
(1) Processing Operation
If you want to use the online store (store) on our website, you need to create a customer account.
For our shop, we use e-commerce software from MAGENTO 2.0, Adobe Systems Software Ireland Limited, 4-6 Riverwalk, Citywest Business Campus, Dublin 24, Irland.

(2) Personal Data Processed
If you open a customer account with us, then we process the following data: First name, last name, password, e-mail address.
When you place orders with us, we may also process the following data about you: address data, telephone number, birthday date, the shopping cart, product preferences and your comments.

(3) Purpose
The purpose of the data processing is to enable a web-based store, to identify the customer and thus to take pre-contractual measures or to fulfill contractual obligations.

(5) Necessary for Functionality of the Website
This processing activity is not necessary for the functionality of the website.

(6) Retention Period
Your data in connection with the store will be kept until you delete the customer account and beyond, as we have a retention obligation for the storage of this data. This is usually between 5 years and 10 years.

(7) Recipient
Your data, which is processed in connection with our shop, may be transmitted to the following recipients in the event of support requests:
• PSG Premium Sports Group AG, Vadianstrasse 40, 9000 St. Gallen, Switzerland;
• SPORT 2000 Zentrasport Österreich e.Gen. GmbH, Ohlsdorfer Strasse 10, 4694 Ohlsdorf, Austria;
• ANWR-Garant SWISS AG, Pfadackerstrasse 7, 8957 Spreitenbach, Switzerland;
• Linder Management, Bahnhofstrasse 16, 3072 Ostermundigen, Switzerland;
• MSTAGE GmbH, Hofstatt 5, 3100 St. Pölten, Austria
In addition, the shop data is stored in the data processing centre of internex GmbH, Lagerstrasse 15, 3950 Gmünd, Austria

2. Contract Execution and Payment
(1) Processing Operation
For the purpose of contract processing within the framework of the store or fulfillment and enforcement of our contractual rights and obligations, we process certain personal data. This includes the acceptance of the order, the delivery of the purchased products, as well as the processing of the payment.
To enable or process electronic payment transactions, we work together with Worldline Schweiz AG (formerly Six Payment Services), Hardturmstrasse 201, 8005 Zurich, Switzerland. Your personal data will be sent to them for the purpose of processing the payment with the desired payment method. This company processes the payment data on our behalf and in accordance with our instructions.
There is also the option of processing payments via TWINT using the TWINT app from TWINT AG, Stauffacherstrasse 41, 8004, Zurich, Switzerland. TWINT does not pass on your personal data to third parties, with the exception of passing on data to order data processors who process certain data on behalf of TWINT.
To enable you to pay for our services by invoice, we also work with Bank Klarna AB, Sveavägen 46, 111 34 Stockholm (for more information, see “Payment by invoice and credit check”).

(2) Personal Data Processed
We process the following data of the person with whom the purchase contract exists: Details of the price, type and quantity of the product purchased, customer number, first name, last name, address, postal code, city and country of origin, Date of birth and possibly data on their body mass, which you provide to us in the course of order submission via the online mask on our website or in a business location.
For the purpose of processing payments with electronic means of payment on the booking platform or on site, we additionally process the following personal data (payment data): the selected payment method, identification data of the payment method (e.g. card number), payment office, payment amount incl. currency, name and first name Address and date of birth.
If you use TWINT for the payment process, a distinction is made during data processing by TWINT as to whether you have made an opt-in for third-party offers in your TWINT app or whether you have opted for an opt-out. For users with opt-out, only the data required to process the payments is collected. For users with opt-in, additional data is collected and evaluated. This data allows TWINT to show users offers that suit them as well as possible. Specifically, the following data is processed during the payment process with TWINT: Which merchant is being purchased from with TWINT, details of the location (if access to this has been permitted by the user) as well as identification data (e.g. bank, card number) and payment amount including currency.
You can find out more about how TWINT processes your information at: https://www.twint.ch/datenschutz-app/

(3) Purpose
The purpose of the data processing is to enable a web-based store, the identification of the customer, the processing of payments or the invoicing and thus the performance of pre- contractual measures or the fulfillment of contractual obligations.
The Data on the body mass of the client is used by us for the proper setting of equipment, which we are obliged to do at most on the basis of the purchase contract with you. The scope of the collected data results from the ISO standard 11110 together with the adjustment guidelines issued for this purpose, which applies to the compilation of special binding-shoe combinations, which must always be checked when a new combination is formed.

(4) Legal Basis of Data Processing
The legal basis for the processing of the data is Art. 13 para. 2 lit. a FADP or Art. 6 para. 1 lit. b GDPR and therefore the processing for the performance of a contract or for pre-contractual measures.
Insofar as you make a purchase in the store on behalf of another person or we have received your data via a contact person, we process your data to fulfill the contract in accordance with Art. 13 para. 2 lit. a FADP or Art. 6 para. 1 lit. b GDPR and on the basis of our legitimate interest in accordance with Art. 13 para. 1 FADP or Art. 6 para. 1 lit. f GDPR, after you have disclosed your relationship with this person to us or this contact person has declared to us that he or she will disclose your data on your behalf and with your consent.

(5) Necessary for Functionality of the Website
This processing operation is not necessary for the functionality of the website.

(6) Retention Period
Your data in connection with the processing of the purchase contract will be kept until you delete the customer account and beyond, as we have a retention obligation for the storage of this data. This is usually between 5 and 10 years.

(7) Recipient
For electronic payment, your data will be transmitted to Worldline Schweiz AG (formerly Six Payment Services), Hardturmstrasse 201, 8005 Zurich, Switzerland. For payment with TWINT, your data will be transmitted to TWINT AG, Stauffacherstrasse 41, 8004 Zurich, Switzerland.

3. Payment on Account and Credit Assessment

(1) Processing Operation
For the purpose of enabling a purchase on account, Klarna Bank AB may, if the data subject (i.e. the customer) chooses the payment option “payment on account”, carry out a credit check. We cede our claim to Klarna Bank AB, Sveavägen 46, 111 34 Stockholm, Sweden, in the event that this payment method is chosen, and thereby transfer personal data to it, which Klarna subsequently processes as an independent controller.

(2) Personal Data Processed
In the context of the assignment and a possible subsequent credit check and payment processing by Klarna, the following personal data will be processed: Surname, first name, address data, the selected payment method, paying agent, payment amount incl. currency, and date of birth.

(3) Purpose
The purpose of the data processing is to offer the payment option “purchase on account”. For collection reasons, this may also require a credit check. The credit check serves the purpose of preventing debt collection proceedings on the part of the responsible party and on the part of the data subject it serves to protect against financial overcharging. The transfer of personal data to Klarna serves the purpose of executing the assignment of receivables from us to Klarna.

(4) Legal Basis for Data Processing
The legal basis for the processing of the data is Art. 13 para. 2 lit. a FADP or Art. 6 para. 1 lit. b GDPR and therefore the processing for the fulfilment of a contract or for pre-contractual measures.
Insofar as you make a purchase in the shop for another person or we have received your data via a contact person, we process your data for the fulfilment of the contract in accordance with Art. 13 para. 2 lit. a FADP or Art. 6 para. 1 lit. b GDPR and on the basis of our legitimate interest in accordance with Art. 13 para. 1 FADP or Art. 6 para. 1 lit. f GDPR, after you have disclosed your relationship with this person to us or this contact person has declared to us that he/she will disclose your data on your behalf and with your consent.

(5) Necessary for the Functionality of the Websites
This processing operation is not necessary for the functionality of the website.

(6) Retention Period
Your data in connection with the credit check and purchase on account will be retained until you delete the customer account and beyond, as long as we have a retention obligation for the retention of this data. This is usually between 5 and 10 years.

(7) Recipients
In the case of payment on account, your payment data will be transmitted to Klarna Bank AB, Sveavägen 46, 111 34 Stockholm (independent responsible party).

L.) Newsletter
(1) Processing Operation
On our website you can subscribe to a newsletter. In this newsletter you will receive information about our offers and promotions by e-mail.
We use the service of Mailchimp – The Rocket Science Group, LLC, 675 Ponce de Leon Ave NE, Suite 5000, 30308 Atlanta, GA, USA to send the newsletter.

(2) Personal Data Processed
The following personal data is processed: first and last name, e-mail address, city, postal code, country.

(3) Purpose
We use the data exclusively for sending newsletters.

(4) Legal Basis of Data Processing
The subscription to the newsletter is only possible with your consent. Legal basis for the processing is Art. 13 para. 1 FADP or Art. 6 para. 1 lit. a GDPR. You have the right to revoke your consent at any time by written notice or by clicking on the unsubscribe link, without affecting the lawfulness of the processing carried out on the basis of the consent until revocation. If you revoke your consent, you will no longer receive newsletters from us.

(5) Necessary for Functionality of the Website
This processing operation is not necessary for the functionality of the website.

(6) Retention Period
Your data will be kept as long as you have given us consent for this. After you have unsubscribed from the newsletter, we delete your data regarding this processing activity.

(7) Contractual Agreement
We use Mailchimp – The Rocket Science Group, LLC, 675 Ponce de Leon Ave NE, Suite 5000, 30308 Atlanta, GA, USA technologies to send newsletters.

(8) Recipient
The recipient of your data is Mailchimp – The Rocket Science Group, LLC, 675 Ponce de Leon Ave NE, Suite 5000, 30308 Atlanta, GA, USA. Another transfer to third parties does not take place without your consent.

M.) Contact Form
(1) Processing Operation
We provide a contact form on our website to make it easier for our customers to contact us.

(2) Personal Data Processed
If you contact us via our contact form on the website, we process the following personal data from you: Salutation, name, first name, subject, comment text, store concerned (voluntary), telephone number (voluntary), attachment (voluntary), confirmation or refusal of a copy of the contact form.

(3) Purpose
The purpose of the data processing is the communication with the requesting person or, if applicable, the implementation of pre-contractual measures or the fulfillment of a contractual obligation.

(4) Legal Basis of Data Processing
We process your data to fulfill the contract or to take pre-contractual measures according to Art. 13 para. 2 lit. a FADP or Art. 6 para. 1 lit. b GDPR and on the basis of our legitimate interest to provide a communication option according to Art. 13 para. 1 FADP or Art. 6 para. 1 lit. f GDPR.

(5) Necessary for Functionality of the Website
The data processing is not necessary for the function of the website.

(6) Retention Period
If we are not obliged to retain the communication for 5 or 10 years, it will be deleted after 1 year.

(7) Recipient
The data is stored in the data centers of Hostpoint AG, Neue Jonastrasse 60, 8640 Rapperswil-Jona

N.) General Communication with us and Applications
(1) Processing Operation
You can contact us at any time via e-mail, mail or telephone. Within the scope of these communication channels, we process your personal data.

(2) Personal Data Processed
When communicating via the aforementioned channels, we generally process the following personal data: E-mail address, postal address, telephone number and all data transmitted by you as defined, such as specific content, attachments, enclosures and statements.

(5) Necessary for Functionality of the Website
The data processing is not necessary for the function of the website.

(6) Retention Period
Written and digital application files are deleted after 6 months if no employment is found or is not in prospect. All other personal data will be deleted after 1 year, unless we are obliged to retain the communication for 5 or 10 years.

(7) Recipient
The data is stored in the data centres of Hostpoint AG, Neue Jonastrasse 60, 8640 Rapperswil-Jona.

III. Retention Period

Your personal data will be kept as long as it is explained in the individual processing activities.

These retention periods result from the circumstances explained below. Personal data is retained for as long as
• it is necessary to fulfill the purpose of the processing;
• we are obliged to retain it in accordance with applicable law;
• you have given us consent for this, provided that the basis of the processing is your consent;
Your personal data will be deleted at the latest upon expiry of the maximum prescribed retention periods, i.e. after 5 or 10 years.

IV. Cross-Border Disclosure to Third Countries without Adequate Level of Data Protection

As a matter of principle, no disclosures are made to third countries without an adequate level of data protection or only under the contractual obligation to comply with an adequate level of data protection (e.g. EU standard contractual clauses).
A transfer of personal data to third countries only takes place if the data protection requirements of Art. 6 FADP or Art. 44 et seq. GDPR are given.

A third country is a country outside of Switzerland or the European Economic Area (EEA) in which Swiss data protection law or the European GDPR is not directly applicable. A third country is considered unsafe if, according to the FDPIC or the EU Commission, the country does not have an adequate level of data protection.
With the ECJ ruling of 16 July 2020 (C-311/18), the (partial) adequacy decision for the USA, the so-called EU – US Privacy Shield, was declared invalid. In Switzerland, the FDPIC has also revoked the adequacy of the Swiss – US Privacy Shield. The USA is thus a so-called unsafe third country. This means that the USA does not offer a level of data protection comparable to that in the EU or Switzerland.
When personal data is transferred to the U.S., there is a risk that U.S. authorities may gain access to the personal data based on the PRISM and UPSTREAM surveillance programs based on Section 702 of FISA (Foreign Intelligence Surveillance Act), as well as based on Executive Order 12333 or Presidential Police Directive 28.
In this context, there is a particular risk that your data may be processed by institutions and authorities for control and monitoring purposes via access at the third-party provider.
The persons concerned have no effective legal protection against this access in the USA. At the present time, no commercially satisfactory solution is available for the transfer of data to the USA.
Guarantees according to Art. 6 para. 2 lit. a FADP or Art. 46 GDPR can be so-called standard contractual clauses. In these standard contractual clauses, the recipient assures to sufficiently protect the data and thus to guarantee a level of protection comparable to the FADP or the GDPR.

V. Data Security

Personal data is protected by us through proportionate technical and organizational security measures. They are secured against access by unauthorized persons, against accidental or intentional manipulation or misuse, destruction and loss. Our data processing and security measures are continuously improved in line with technological developments.
Personal data is any information relating to an identified or identifiable natural person, including name, address, telephone number or email or IP address.
The website https://imholzsport-andermatt.ch/ uses SSL encryption for security reasons and to protect the transmission of confidential content, such as requests that you send to us as the site operator. You can recognize an encrypted connection by the fact that the address line of the browser changes from “http://” to “https://” and by the lock symbol in your browser line. If SSL encryption is activated, the data you transmit to us cannot be read by third parties.

VI. Your Rights

As a potentially data subject, you may assert various claims against us and in accordance with the applicable national and international law.
To fulfill these claims, we may process your personal data again.
Depending on the applicable law, data subjects may exercise the following rights:

• Request information about your personal data processed by us. In particular, information may include the following information:
o about the purposes of processing
o the category of personal data
o the categories of recipients to whom your data have been or will be disclosed
o the planned storage period
o the existence of a right to rectification, erasure, restriction of processing or objection
o the existence of a right of appeal
o the origin of your data, if it was not collected by us
o as well as about the existence of automated decision-making, including profiling, and, if applicable, meaningful information about its details.

• To request the correction of incorrect or completion of your personal data stored by us.
• To request the restriction of the processing of your personal data, insofar as the accuracy of the data is disputed by you, the processing is unlawful, but you object to its erasure and we no longer need the data, but you need it for the assertion, exercise or defense of legal claims or you have objected to the processing.
• To receive your personal data that you have provided to us in a structured, commonly used and machine-readable format or to request that it be transferred to another controller.
• To request the erasure of your personal data stored by us, unless the processing is necessary for the exercise of the right to freedom of expression and information, for compliance with a legal obligation, for reasons of public interest, or for the establishment, exercise or defense of legal claims.
• To revoke your consent once given to us at any time. This has the consequence that we may no longer continue the data processing based on this consent for the future.
• Object to the processing, provided that your personal data are processed on the basis of legitimate interests according to and insofar as there are grounds for this that arise from your particular situation or the objection is directed against direct advertising. In the latter case, you have a general right to object, which will be implemented by us without specifying a particular situation.
• To complain to a supervisory authority (cf. above).

VII. Language

If the German text and the English text are in conflict, the German text shall prevail in its validity.

VIII. Actuality and Change of this Privacy Policy

We reserve the right to change this privacy policy or adapt it to new processing methods at any time. The current privacy policy can be accessed at any time at https://imholzsport-andermatt.ch/