Privacy Notice of the Berner Oberland Pass

Preamble
The website of the Berner Oberland Pass is subject to Swiss data protection law, in particular the Swiss Federal Act on Data Protection (FADP), and, where applicable, the General Data Protection Regulation of the European Union (GDPR).

Access to our website is protected by transport encryption (TLS).

We appreciate your interest in our organisation. The protection of your personal data is of great importance to us. Through this Privacy Notice, we inform you about the nature, scope, purposes and legal bases of the processing of personal data, as well as your rights.

1. Controller

The controller responsible for the processing of personal data is:
Berner Oberland Pass
c/o BLS AG
Freiburgstrasse 130
CH-3001 Bern
E-mail: berneroberlandpass@bls.ch

1.1 Data Protection Contact
If you have any questions regarding data protection or wish to exercise your data protection rights, you may contact the controller at the address stated above at any time.

2. General Information on Data Processing

As a general principle, we process personal data only to the extent necessary for the provision of a functional website, our services, and the fulfilment of contractual and legal obligations.

2.1. Legal Bases
Where the GDPR applies, data processing is carried out in particular on the basis of:

your consent;
the performance of a contract or pre-contractual measures;
legal obligations;
our legitimate interests.

Where the Swiss Federal Act on Data Protection applies, personal data is processed in accordance with the applicable provisions of the FADP. References to GDPR legal bases are provided solely in relation to circumstances where the GDPR applies.

2.2 Categories of Personal Data

Depending on your use of our website and services, we may process the following categories of personal data in particular:

Identification data (name, first name, address)
Contact details (telephone number, email address)
Communication data
Contract and order data
Ticketing and booking data
Payment information
Usage and log data
Device and browser information
IP addresses
Chat and support enquiries

2.3 Recipients of Personal Data
For the performance of our activities, personal data may be disclosed to the following categories of recipients:

Hosting providers
IT service providers
CRM providers
Customer service systems
Ticketing and booking systems
Payment service providers
Analytics and statistics providers
Cloud service providers
Public authorities and courts where legally required

Recipients receive only such data as is necessary for the provision of the respective services.

2.4 Processors and Service Providers
We use the following service providers in particular:

Microsoft Dynamics (CRM system)
Zendesk (customer support)
knowhere GmbH / moinAI (chatbot)
Cptr AG / fusedeck (analytics)
Piwik PRO (analytics)
MapTiler (mapping services)
Cloudflare (content delivery network and security)
MyFonts (fonts)

Where required, the necessary data protection agreements are concluded with these providers.

2.5 Data Deletion and Retention Periods
Personal data is deleted or anonymised as soon as the purpose of the processing no longer applies and no statutory retention obligations prevent such deletion.

Retention period: Documents relevant for accounting purposes are retained for ten years in accordance with statutory retention obligations.

3. Provision of the Website and Log Files

When our website is accessed, the following data is collected automatically in particular:

Browser type and browser version
Operating system
IP address
Date and time of access
Referrer URL
Pages accessed

The processing is carried out to ensure the technical operation, stability and security of the website.

3.1 Retention Period
Technical server log files are deleted after a maximum period of 365 days.

4. Cookies and Similar Technologies

Our website uses cookies and similar technologies.
These are used in particular to:

ensure the functionality of the website;
store user preferences;
enable statistical analyses;
improve content and user experience.

4.1 Cookie Consent
Where required by law, non-essential cookies and similar technologies are activated only after your explicit consent has been obtained.
You may withdraw or amend your consent at any time through the cookie settings.

4.2 Categories of Cookies
We use in particular:
Strictly Necessary Cookies
These cookies are required for the operation of the website and enable its core functionalities.
Analytics Cookies
These cookies help us understand how visitors use our website and support us in continuously improving it.

4.3 Cookie Register
An up-to-date list of all cookies used, including information on:

provider;
purpose;
legal basis;
retention period;

is available through the consent solution in the "Cookie Declaration" section.

5. Contact Form and Email Communication

In connection with contact enquiries, the following data may be processed in particular:

First name
Last name
Email address
Content of the enquiry

The data is used exclusively for processing your request.

5.1. Retention Period
Contact enquiries are deleted once the communication has been completed and no statutory retention obligations apply.
Where communications contain information relevant to a contractual relationship, the data may be retained for longer in accordance with applicable statutory retention periods.

6. Ticket Sales, Bookings and Contract Performance

Where you purchase tickets or use other services, we process the personal data required for such purposes.
This includes in particular:

Customer master data
Booking data
Ticket information
Payment information
Correspondence relating to your orders

Processing is carried out for the performance of contracts, customer support and compliance with legal obligations.

7. CRM and Customer Service Systems

For the processing of customer enquiries and the management of customer relationships, personal data may be stored in the following systems:

Microsoft Dynamics
Zendesk

Storage takes place exclusively for customer service purposes, business administration and the documentation of customer interactions.

8. Analytics and Tracking Services

8.1 fusedeck Analytics
This website uses the analytics solution fusedeck provided by Cptr AG.
According to the provider, analytics are carried out in an anonymised manner so that no personal reference can be established.

8.2 Piwik PRO Analytics
This website uses the analytics solution Piwik PRO.
Analytics are carried out in accordance with the preferences selected by you in the consent banner.

8.3 Purposes of Analytics
Analytics are used in particular for:

improving the website;
analysing errors;
optimising content;
statistical evaluations;
measuring the success of offers and services.

9. Mapping Services (MapTiler)

Our website uses mapping services provided by MapTiler.
When using the maps, the following technical data may in particular be processed:

Coordinates of the displayed map section
IP address (according to the provider, not permanently stored)
Browser and device data
Referrer URL

Processing takes place solely for the provision of map and location functionalities.

10. Content Delivery Network and Security (Cloudflare)

To improve the security, stability and loading speed of this website, we use services provided by Cloudflare.
Cloudflare operates a globally distributed network for the delivery of web content and supports us in protecting the website against technical attacks and abusive use.
In particular, technical connection data such as IP addresses, browser information, timestamps and security-related metadata may be processed.
Such processing is based on our legitimate interest in ensuring the secure and reliable operation of the website.

11. International Data Transfers

Personal data may be processed outside Switzerland in connection with our services.
Processing takes place in particular within the European Economic Area (EEA) or in countries recognised as providing an adequate level of data protection.
Where personal data is transferred to countries that do not provide a recognised adequate level of data protection, such transfer takes place exclusively on the basis of appropriate legal safeguards, including in particular:

Standard Contractual Clauses (SCCs);
contractual data protection agreements;
other legally recognised protective mechanisms.

12. Communication with the Chatbot

The Berner Oberland Pass provides a chatbot on this website.
The entry of personal data is generally not required in order to use the chatbot. Users are requested not to enter sensitive personal data or personal data that is not necessary for the respective enquiry.
The information submitted is processed exclusively for handling the enquiry, quality assurance and the improvement of the chatbot.
Processing takes place within Europe.
Chat histories are deleted no later than 90 days after collection, unless statutory retention obligations apply.

12.1 Artificial Intelligence and Chatbot Optimisation
To improve the quality and functionality of the chatbot, enquiries and interactions may be analysed in anonymised or pseudonymised form.
Appropriate technical and organisational measures are implemented to ensure the protection of personal data.
No solely automated decisions are made that produce legal effects concerning data subjects or similarly significantly affect them.

13. Automated Decision-Making and Profiling

At present, no solely automated individual decision-making takes place that produces legal effects or similarly significantly affects data subjects.
Profiling within the meaning of applicable data protection legislation takes place only where legally permissible or where the relevant consent has been obtained.

14. Data Security

We implement appropriate technical and organisational security measures to protect personal data.
These include in particular:

Encryption of data transmission (SSL/TLS)
Access controls
Role and authorisation concepts
Logging of security-relevant events
Data backups
Protection against unauthorised access

15. Rights of Data Subjects

Data subjects are entitled, within the framework of the applicable legal provisions, to the following rights in particular:

Right of access
Right to rectification
Right to erasure
Right to restriction of processing
Right to receive or transfer personal data in accordance with applicable legal provisions
Right to object
Right to withdraw consent

15.1 Exercising Your Rights
To exercise your rights, please contact the controller identified in Section 1 in writing or by email.
For data protection reasons, we may request appropriate proof of identity, particularly in connection with access requests.
Data protection requests are processed within the legally prescribed time limits.

16. Right to Lodge a Complaint

If you are not satisfied with the handling of your data protection request, you have the right to lodge a complaint with the competent data protection supervisory authority.

16.1 Swiss Supervisory Authority
Federal Data Protection and Information Commissioner (FDPIC)
Feldeggweg 1
CH-3003 Bern
www.edoeb.admin.ch

17. Amendments to this Privacy Notice

We reserve the right to amend this Privacy Notice at any time, in particular in the event of changes to legal requirements or the introduction of new services and technologies.
The version of this Privacy Notice published on this website shall be the applicable version.

You are here:

Privacy Notice of the Berner Oberland Pass