Datenschutzerklärung

Last update: July 2026

With this privacy policy, we inform you about the processing of personal data when you visit our website, use our online services (newsletter, bookings, voucher purchases, ticketing) and when you contact us. This policy is based on the revised Swiss Federal Act on Data Protection (revFADP, in force since 1 September 2023) and – where applicable to you – on the EU General Data Protection Regulation (GDPR).

1. Data Controller

The controller responsible for data processing within the meaning of Art. 5 lit. j revFADP and Art. 4 no. 7 GDPR is:

Tourism Museum Association Interlaken
Obere Gasse 26
CH-3800 Unterseen

E-Mail: info@tourismuseum.ch

For data protection inquiries, please contact: info@tourismuseum.ch

We are not required to appoint a data protection officer or advisor. Data protection inquiries are handled by the contact point listed above.

2. Definitions and Legal Bases

Personal data means any information relating to an identified or identifiable natural person.

We process personal data on the following legal bases:

• Consent (Art. 6 para. 6 and 7 revFADP; Art. 6 para. 1 lit. a GDPR) – e.g. for non-essential cookies, marketing tracking.
• Performance of a contract (Art. 31 para. 2 lit. a revFADP; Art. 6 para. 1 lit. b GDPR) – e.g. to process bookings, voucher and ticket purchases.
• Legal obligation (Art. 31 para. 1 revFADP; Art. 6 para. 1 lit. c GDPR) – e.g. retention obligations under the Swiss Code of Obligations.
• Overriding legitimate interest (Art. 31 para. 2 revFADP; Art. 6 para. 1 lit. f GDPR) – e.g. to ensure the operation of our website, for fraud prevention, or for direct customer communication.

3. Your rights

You have the following rights regarding your personal data:

• Right of access to the data concerning you
• Rectification of inaccurate data
• Erasure or restriction of processing
• Objection to certain processing activities
• Data release / portability in a commonly used electronic format
• Withdrawal of consent given, with effect for the future
• Lodging a complaint with the competent supervisory authority

To exercise your rights, an informal notification to the contact point named in section 1 is sufficient. We may request appropriate evidence to verify your identity.

Supervisory authorities:

• Switzerland: Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern
• EU/EEA: The national supervisory authority competent for your place of residence

3. Data Collection When Visiting Our Website

3.1 Server-Logfiles

When you access our website, the hosting provider automatically records technical data in so-called server log files:

• IP address (truncated or anonymised)
• Date and time of the request
• Page/file accessed
• Volume of data transferred
• Browser type, operating system, referrer URL

This data is used exclusively to ensure smooth operation and to defend against attacks. The legal basis is our overriding legitimate interest. The logs are generally deleted automatically after 14 days, unless a specific security incident requires longer retention.

3.2 SSL/TLS Encryption

For security reasons, this website uses SSL/TLS encryption. You can recognise an encrypted connection by the “https://” in the address bar and the padlock symbol displayed by your browser.

3.3 Cookies

Our website uses cookies and similar technologies (LocalStorage, pixels, etc.). Cookies are small text files that are stored on your device. Our website uses only technically necessary cookies (language selection).

4. Data Processors / Overview of Service Providers Used

The following service providers process personal data on our behalf. Where required, a data processing agreement (DPA) has been concluded with each of them::

• cyon GmbH, Brunngässlein 12, 4052 Basel | Web hosting, eMail | Switzerland
• TWINT AG, Zürich | Payment processing | Switzerland
• Microsoft Corporation (Microsoft 365) | Internal office communication, email | EU/EEA (with possible access from the USA)

5. International Data Transfers

Where we transfer personal data to service providers outside Switzerland or the EEA (in particular to the USA: Google, Meta, Vimeo, and where applicable Microsoft), this takes place on one of the following bases:

• Adequacy decision for the USA (EU-US Data Privacy Framework as well as the Swiss-US Data Privacy Framework recognised by the Swiss Federal Council, in force since 15 September 2024) for certified recipients;
• Standard Contractual Clauses of the European Commission, supplemented by Swiss adaptations, where no adequacy decision applies;
• Your explicit consent as part of our consent banner.

We point out that, in particular for data transfers to the USA, US authorities may under certain conditions demand access to data, and that the enforcement of rights may be difficult for data subjects.

6. Storage Period

We process personal data only for as long as is necessary for the respective purpose or required by statutory retention obligations. In particular:

Accounting and business records: 10 years (Art. 958f Swiss Code of Obligations)
Server log files: 14 days
Inquiries via email: until completion, then in accordance with statutory periods
Cookies: according to the individual cookie lifetime 

7. Data security

8. No Automated Individual Decision-Making

We do not use automated procedures for individual decision-making that produce legal effects concerning you or significantly affect you.

9. Changes to this Privacy Policy

We reserve the right to amend this privacy policy in order to adapt it to changes in the legal situation or to changes in our services. The applicable version is always the one published on this website.