This privacy policy provides information on how and for what purposes companies belonging to Dogus Health & Wellness AG (Chenot Palace Weggis) (hereinafter “we” or “Chenot”) process Your Personal Data (hereinafter „You„).

„Personal Data“ means all details and information relating to an identified or identifiable natural person.

We process Personal Data in accordance with the requirements of the Swiss Federal Data Protection Act (hereinafter „FDPA„) and, if and to the extent applicable, in accordance with the EU General Data Protection Regulation (hereinafter „GDPR„) and local data protection laws. Where we deem it appropriate, we may provide you with additional privacy policies.

The contact person for any queries You may have regarding data protection is:

Franziskus Jesse

Hertensteinstrasse 34

6353 Weggis

Telephone: +41 41 255 20 00

E-Mail: data-protection@chenotpalaceweggis.com

EU data protection representative according to Art. 27 GDPR is:

Swiss Infosec AG

6210 Sursee

Telephone: +41 41 984 12 12

E-Mail: datenschutzberater@infosec.ch

Please contact us at the above addresses with any questions regarding data protection at Chenot.

We primarily process Personal Data that we receive or collect from our guests, customers (including their employees, shareholders, directors, etc.), website visitors, service providers, banks and other business partners in the course of our business activities. In addition, we may also process Personal Data that we have obtained from publicly accessible sources (e.g. websites or public registers such as the commercial register, etc.). Finally, we may also have received Your Personal Data from family members of Yours, from business partners of ours, from official agencies and authorities or from other third parties.

The Personal Data we process includes, as the case may be, in particular name and contact details (e.g. address, telephone number and e-mail address), identification and background information (e.g. passport number, ID-number, language, date of birth, nationality, gender, religious denomination), license plate, political data, job title and business relationship, country of residence, geographic location, origin-related data, family situation (e.g. marital status, number of children), financial information for payment purposes (e.g. bank account details, credit card details), economic data (e.g. financial assets, origin of funds), transaction data (e.g. payment instructions, investment instructions),  information about the use of our websites and information of any kind from correspondence, contacts and interactions (e.g. photographs, videos and voice recordings) with us. For the purpose of treatments that are tailored to your needs, we also process your health information such as information about your blood type, allergies, undergoing cancer therapy, insulin dependent diabetes, any period of pregnancy and breast feeding, sever disabilities. Data concerning your health situation is considered highly sensitive and will only be shared with qualified recipients. Your health data is handled by medical staff bound by medical secrecy, with strictly limited exceptions that are governed by a declaration of release.

3.1 In connection with our business activities

We process Your Personal Data primarily in order to provide our services in connection with our business activities. In particular, we process Your Personal Data for the following purposes:

1. to communicate with You, in particular to provide You with information or to process Your requests. If You contact us by e-mail/contact form, You authorise us to reply to You via the same channel. Please note that unencrypted e-mails are transmitted via the open Internet, which is why it cannot be ruled out that they can be viewed, accessed and manipulated by third parties. Therefore, we ask You not to send us confidential information by e-mail. We exclude – as far as legally permissible – any liability which You may incur in particular as a result of faulty transmission, falsification of content or disruption of the network (interruptions, overloading, illegal interventions, blocking);
2. to make our services and our websites available to You and to evaluate and improve them;
3. to organise events and webinars and report them or make them available on our websites (e.g. in the form of texts, photographs, videos and voice recordings);
4. for the conclusion, administration and performance of our contractual relationships;
5. to maintain and manage the business relationship with You (incl. issuing invoices);
6. to inform You of recent updates or to provide You with other information about our services;
7. to promote services of ours;
8. for statistical purposes;
9. for IT and building security measures (such as access controls, visitor lists, network and mail scanners, telephone recordings) and risk control reasons;
10. for the assertion of legal claims and defence in connection with legal disputes as well as proceedings before the authorities;
11. to comply with our legal obligations nationally and internationally.

We process Your Personal Data for the purposes specified above, depending on the situation, in particular on the following legal bases:

1. the processing of Personal Data is necessary for the performance of an agreement with You;
2. You have given Your consent to the processing of the Personal Data relating to You;
3. the processing of Personal Data is necessary for the fulfilment of a legal obligation;
4. the processing is necessary to protect the vital interests of the data subject or another natural person; or
5. we have a legitimate interest in processing the Personal Data.

3.2 When Visiting our Website

Each time a user accesses our website, our server collects a set of user information which is stored in the server’s log files. The information collected includes, but is not limited to, the IP address, the date and time of access, the time zone difference relative to GMT, the name and URL of the downloaded file, the website from which the access takes place, the browser used and the operating system used.

The use of this general information does not involve identification of a specific person. The collection of this information or data is technically necessary in order to display our websites to You and to guarantee its stability and security. This information is also collected in order to improve the website and to analyse its use. The legal basis for the temporary storage of the information and log files is our legitimate interest in being able to offer You our websites in sufficient quality and to continuously improve it.

3.3 Contact form and contact by e-mail and telephone

You can contact us by using the contact form or the e-mail addresses and telephone numbers provided on our website. The Personal Data You send us will be stored and processed by us for the purpose of processing Your request. The legal basis for this Personal Data processing is Your consent and our legitimate interest in processing Your request.

3.4 Cookies/Tools

Our website may use so-called cookies or other technologies/tools such as pixels, tags or external services (hereinafter „Cookies“ or „Tools„). Cookies are text files that are stored in or by the internet browser on the computer system or a mobile device of the user. The Cookie contains a characteristic string that allows the browser or mobile device to be identified unambiguously when the website or app is visited again.

The purpose of the use of Cookies is, on the one hand, to enable and simplify the use of our website for users. Some functions of the website cannot be offered without the use of Cookies (so-called technically necessary Cookies). On the other hand, we also use Cookies/Tools to analyse user behaviour on our website, namely for range measurement and marketing purposes. Cookies have a specific live length after which these are automatically deleted.

3.4.1 Technically necessary Cookies

Technically necessary Cookies are necessary for the functioning of our website. Therefore, these Cookies cannot be deactivated in our systems. These Cookies usually record important actions, such as the number of requests made, the editing of Your privacy settings or when You fill out forms. Although You can block these Cookies in Your browser, some parts of our website may no longer function then.

The legal basis for the data processing when using technically necessary Cookies is our legitimate interest, which lies primarily in ensuring the functionality and improvement of our website.

3.4.2 Analytical and marketing Cookies

Analytical Cookies allow us to analyse visitor behaviour and traffic sources so that we can measure the performance of our website and improve the user experience. They help us to identify how popular which pages are and indicate how visitors move around our website. The information collected is aggregated and anonymous.

Marketing Cookies allow us to deliver advertising that is relevant to You. These Cookies may remember that You have visited our website and share this information with other companies, including other advertisers.

If we use Cookies for analysis and marketing purposes, we obtain Your consent to do so. Therefore, the processing of data for analysis and marketing purposes is based on Your consent. If You give us Your consent, You may withdraw it at any time with effect for the future. However, this does not affect the lawfulness of the processing carried out on the basis of Your consent before Your withdrawal of consent. You can express Your withdrawal at any time by adjusting the Cookie settings.

You can object to the use of Cookies, for example, (i) by selecting the appropriate settings in Your browser or (ii) by using appropriate Cookie blocker software (e.g. ghostery etc.).

3.5 Google TAG MANAGER

On our website, we may use Google Tag Manager from Google. Google Tag Manager is a solution that allows us to manage website tags through one interface. The Tool itself is a Cookie-free domain and, according to Google, does not collect any Personal Data. The Tool triggers other tags, which in turn may collect Personal Data. Google Tag Manager does not access this data. If a deactivation has been made at domain or Cookie level, this remains in place for all tracking tags implemented by Google Tag Manager. You can prevent the setting of tags at any time.

The legal basis for this is Your consent and our legitimate interests.

3.6 YOUTUBE-VIDEOS

We can embed videos from the YouTube platform on our website so that they can be played directly from our websites. The YouTube videos are all embedded in „extended data protection mode“, which means that no data about You as a user is transmitted to YouTube if You do not play the videos. Only when You play the videos will data about You be transmitted.

The legal basis for the processing of Your data is Your consent. Further information on the processing of Personal Data by Google Ireland Limited in connection with the playing of YouTube videos can be found at https://policies.google.com/privacy?hl=en&gl=de.

3.7 GOOGLE MAPS

We may use the Google Maps plug-in from Google Ireland Limited or Google LLC, USA, on our website. If You use Google Maps on our website, information about the use of our website (incl. IP address) may be transmitted to a Google server in the USA and also stored on this server. We have no knowledge of the precise content of the data that are transmitted nor of their use by Google. However, the data about You as a user is only transmitted to Google if You activate the content of Google Maps on our website.

The legal basis for the processing of Your data is Your consent. For more information on the privacy policy and terms of use for Google Maps, visit the following link: https://www.google.com/intl/en_de/help/terms_maps.

3.8 SOCIAL MEDIA PLUG-INS

We may use the social media plug-ins contained in the following table on our website. In doing so, we use the so-called two-click solution, which means that, when You visit our website, in principle no Personal Data are disclosed to the providers of the plug-ins. Only if You click on the selected plug-in field and activate the plug-in, provider will be informed that You have accessed our website. In addition, the data referred to in section 3.2 of this privacy policy will be transmitted. The legal basis for the processing of Your data in connection with social media plug-ins constitutes our legitimate interest in enabling our users to use the social media plug-ins.

We have no control over the data collected and data processing operations of the plug-in providers. These are subject to the respective privacy policies of the third-party providers. Further information on the purpose and scope of data collection and its processing by the plug-in provider can be found in the privacy policies of these providers provided below.

3.9 APPLICATIONS

You can submit Your application for a position with us by post or via the e-mail addresses provided on our websites as well as through job application portals. For the latter, we refer to their respective privacy policies. Your application documents and all Personal Data thereby disclosed to us will be treated in the strictest confidence, will not be disclosed to any third party (with the exception of our parent company HC International SA, Hertensteinstrasse 34, 6353 Weggis, with whom we share HR ressources) and will only be processed for the purpose of processing Your application for employment with us. Unless You have given consent which provides otherwise, Your application file will either be returned to You after the conclusion of the application process or will be deleted/destroyed, unless it is subject to a statutory retention requirement. The legal basis for the processing of Your data is Your consent, the performance of the contract with You and our legitimate interests.

4.1 Disclosure of Personal Data to recipients

In addition to the transfers of data to recipients expressly mentioned in this privacy policy, we may to the extent permitted – disclose Personal Data to the following categories of recipients:

1. Providers to whom we have outsourced certain services (e.g. IT and hosting providers, payment service providers, debt collection service providers, risk management and compliance providers etc.);
2. Service providers, subcontractors and other business partners;
3. Banks and insurance companies;
4. Tax advisors, auditors, lawyers, notaries and other external professional advisors of Chenot;
5. Counterparties;
6. National and foreign authorities, agencies and courts.

Furthermore we do exchange all staff and applicant related personal data with our parent company HC International SA, Hertensteinstrasse 34, 6353 Weggis with which we share HR ressources.

4.2 Disclosure of Personal Data abroad

Your Personal Data may be processed within Switzerland, the European Union or the European Economic Area (hereinafter „EU/EEA„) but may also be processed in and transferred to a country outside of Switzerland, EU or EEA, for example the USA (list further potential recipient countries).

If we transfer data to a country without adequate legal data protection, we ensure an adequate level of protection as provided for by law by using appropriate contracts (namely on the basis of the so-called standard contractual clauses of the European Commission) or we rely on the legal exceptions of consent, the performance of a contract, the establishment, exercise or enforcement of legal claims, overriding public interests, published Personal Data or because it is necessary to protect the integrity of the data subjects. We would like to point out that data transmitted abroad is no longer protected by Swiss law and foreign laws as well as official orders may require the disclosure of this data to authorities and other third parties.

We process and store Your Personal Data only for as long as is necessary in accordance with the relevant purpose of processing or if there is another legal basis for doing so (e.g. statutory retention periods). We retain Personal Data that we hold on the basis of a contractual relationship with You for at least the duration of that contractual relationship and the statutory limitation periods for potential claims or based on contractual retention obligations. As soon as Your Personal Data are no longer required for the above-referenced purposes, they will be set inactive, deleted or anonymised as far as possible.

Under the data protection law applicable to You and to the extent provided for, You have the right to information, rectification, erasure, the right to restrict data processing and otherwise to object to our data processing as well as to the handover of certain Personal Data for transfer to another location (so-called data portability). Please note, however, that we reserve the right to assert the statutory restrictions on our part, for example if we are obliged to retain or process certain data, if we have an overriding interest in this (to the extent we are entitled to rely on such interest) or if we need the data in order to assert claims. If this results in costs for You, we will inform You in advance.

If data processing is based on Your consent, after giving Your consent You may withdraw it at any time with future effect. However, this does not affect the lawfulness of the processing carried out on the basis of Your consent prior to Your withdrawal of consent.

The exercise of such rights generally requires that You clearly prove Your identity (e.g. by means of a copy of an identification document, where Your identity is otherwise unclear or cannot be verified). In order to assert Your rights, You may contact us at the address specified in Section 1 of this privacy policy.

In addition, every data subject has the right to enforce his/her rights in court or to lodge a complaint with the competent data protection authority. The competent data protection authority may vary depending on Your place of residence or the place where the alleged infringement of the applicable data protection law takes place.

Our Site may provide links to third party websites for your convenience and information. These websites are operate independently from CPW. Linked websites may have their own privacy notices or policies, which we strongly suggest you review if you visit any linked websites. To the extent any linked websites you visit are not owned or controlled by CPW, the latter is not responsible for the websites’ content, any use of the websites, or the privacy practices of the websites.

Please note that the destinations are individual legal entities with each having their respective privacy policies. The data you submit to the destination of your choice will be treated in accordance with the privacy policy of that destination.

We take appropriate security measures in order to maintain the required security of your Personal Data and ensure its confidentiality, integrity and availability, and to protect it against unauthorized or unlawful processing, and to mitigate the risk of loss, accidental alteration, unauthorized disclosure or access.

We expressly reserve the right to amend this privacy policy at any time. If such amendments are made, we will immediately publish the amended privacy policy on our website. The privacy policy published on our website, as from time to time amended, shall apply.