Data protection statement

1 Introduction and general information

Grand Resort Bad Ragaz AG operates the Hotel Quellenhof and affiliated hotels, the Tamina Therme Bad Ragaz, the Clinic Bad Ragaz and the Medical Health Center Bad Ragaz (“GRBR Group”), the two golf courses Bad Ragaz and Heidiland and is therefore responsible for the collection, processing and use of your personal data, as well as for ensuring that data is processed in compliance with the applicable data protection laws.

Your trust is important to us, which is why we take the issue of data protection very seriously and strive to ensure the appropriate level of security. This means we comply with the statutory provisions of the Swiss Federal Act on Data Protection (FADP; Bundesgesetz über den Datenschutz – DSG), the Ordinance to the Federal Act on Data Protection (DPO; Verordnung zum Bundesgesetz über den Datenschutz – VDSG) and other potentially applicable data protection provisions under Swiss or EU law, especially the EU General Data Protection Regulation (GDPR; Datenschutz-Grundverordnung – DSGVO).

If you have any questions about this document or the handling of your data, you can contact us at any time at the following address:

The address of our data protection officer is:

Grand Resort Bad Ragaz AG
Bernhard-Simon Strasse
7310 Bad Ragaz

E-mail: datenschutz@resortragaz.ch
Telephone: +41 81 303 30 30

1.1 Special provisions and separate data protection statements

This umbrella data protection statement (“Data Protection Statement”) covers the following Group companies of Grand Resort Bad Ragaz AG:

Grand Resort Bad Ragaz
Website: https://www.resortragaz.ch/en/

Medical Health Center Bad Ragaz
Website: https://www.medizin-badragaz.ch/en/

Clinic Bad Ragaz
Website: https://www.clinic-badragaz.ch/

Golf and Sports
Website Golf Club Bad Ragaz: https://www.golfclubragaz.ch/
Website Golf Club Heidiland: https://www.gcheidiland.ch/

The following subsidiaries of the GRBR Group have their own separate data protection statements; please refer to their websites directly for the relevant information:

Tamina Therme AG
Hans Albrecht-Strasse
7310 Bad Ragaz
Website: https://www.taminatherme.ch/datenschutz

Casino Bad Ragaz AG
Hans Albrecht-Strasse
7310 Bad Ragaz
Website: https://www.casinoragaz.ch/en/data-protection.html

All companies of the GRBR Group have agreed to a common privacy policy (“binding corporate rules”) in which the handling of personal data is comprehensively governed.

1.2 Video surveillance

A separate data protection statement has been created for video surveillance on GRBR premises. This can be found here: https://www.resortragaz-gruppe.ch/en/video-surveillance

2 Scope of this Data Protection Statement

This Data Protection Statement describes our commitment to protecting the privacy of individuals who visit our websites (“website visitors”), who register to use our products and services, who use our services or who provide us with their data in the context of other processing activities (e.g. when completing customer surveys). For the purposes of this Data Protection Statement, the term “websites” collectively means resortragaz.ch and other websites operated by GRBR that refer to this Data Protection Statement. If a website has its own data protection statement, then this Data Protection Statement shall apply in a subsidiary capacity.

In the context of this Data Protection Statement, personal data refers to information about a specific or identifiable natural person. An identifiable person is someone who can be identified directly or indirectly, especially by reference to an identifier such as a name, an identification number, location data or an online identifier (e.g. IP address) or by reference to one or more factors specific to their physical, physiological, genetic, mental, economic, cultural or social identity.

The use of information collected through our service is limited to the purpose of providing the service that you have registered or signed up for.

Our websites may contain links to other websites; the information practices and content of these other sites are subject to their own data protection statements. We encourage you to read the data protection statements of these websites to understand their information practices.

Account information (as defined below) and other information that we collect in connection with your registration or authentication for our services fall under this Data Protection Statement. The data security and data protection practices, including how we protect, collect and use electronic data, text, messages, notifications or other material that you transmit to the services and which are stored within the services (“service data”) are detailed individually in this Data Protection Statement. If you have concluded a contract with a member of the GRBR Group concerning your access to and use of a particular service (collectively referred to as “service agreement”), this service agreement will apply in addition to this Data Protection Statement. The order of precedence of different contracts will be specified in the service agreement.

3 Information that you provide to us

3.1 Opening a customer account

If you wish to carry out bookings on our website, you can either book as a guest or open a customer account. When opening a customer account, we collect the following mandatory personal details:

  • Title
  • First name and surname
  • Postal address
  • Date of birth
  • Telephone number
  • E-mail address
  • Password

This data, as well as other information that you provide voluntarily (e.g. company name), is collected in order to provide you with direct, password-protected access to your basic data stored by us. Here you can view your past and current bookings, or manage or modify your personal data. We use an electronic booking platform; more details can be found here: GRBR_External_Contractors_EN.pdf.

3.2 Booking via the website, by correspondence or by telephone

If you make bookings via our website, by correspondence (e-mail or post) or by telephone, we will require the following mandatory personal details to perform the contract:

  • Title
  • First name and surname
  • Postal address
  • Date of birth
  • Telephone number
  • Language
  • Credit card information
  • E-mail address

This data, as well as other information that you provide voluntarily (e.g. expected time of arrival, vehicle number plate, preferences, comments), will only be used by us to perform the contract, unless stated otherwise in this Data Protection Statement or unless you have not provided your separate consent. The data will be processed in particular to record your booking in accordance with your wishes, to provide the services booked, to contact you in the event of any issues or problems, and to facilitate correct payment.

3.3 Other account and registration information

We ask you to provide personal data, such as your name, address, telephone number, e-mail address, gender and date of birth.

For the purposes of this Data Protection Statement, we refer to all of the aforementioned information as “account information”. By providing us with account information voluntarily, you confirm that you are the owner of this personal data or that you have the necessary permission to provide it to us.

3.4 Other submissions

We may ask for and collect personal data from you when you submit online forms on our websites or use interactive features of the websites, including participating in surveys, contests, promotions and competitions, requesting customer support, or communicating with us by other means.

3.5 Mobile applications

When you download and use our services, we automatically collect information about the type of device you are using and the version of your operating system. The following data is collected by our apps (in addition to the “account information”):

  • First name and surname
  • Language
  • Telephone number
  • E-mail address

3.6 Subscribing to our newsletter(s)

If you subscribe to one or more of our newsletters, we require your e-mail address in order to be able to send you the newsletter(s). Further data is optional. You will first receive an e-mail with a link for you to click on and confirm that you would like to receive the newsletter (“double opt-in”). This enables us to prevent anyone from subscribing to the newsletter in your name. We analyse which of the links were clicked on in order to tailor the newsletter to your individual interests and to find out when you read it, so that we can send it to you at your preferred time. We also save your subscription to the newsletter, along with your consent to usage analysis and your confirmation, in order to be able to prove that you have subscribed and given your consent. For the purpose of sending the newsletter and for usage analysis, we continue to store your data until your consent is withdrawn or until the newsletter subscription is cancelled. If you do not confirm your newsletter subscription, we will delete your data after 24 hours. Therefore, please confirm your subscription (“double opt-in”) within 24 hours, or you will have to resubscribe.

We are authorised to use third parties for the technical execution of advertising measures and may share your data with them for this purpose. The list of data processors can be found here: GRBR_External_Contractors_EN.pdf

3.7 Data processing in connection with our website

Whenever you visit our website, our servers temporarily save each access in a log file. Just like any other connection to a web server, the following technical data is recorded automatically and stored by us before automated deletion:

  • The IP address of the accessing computer
  • The name of the holder of the IP address range (generally your Internet access provider)
  • The date and time of access
  • The website from which the access was requested (referrer URL), possibly with the search term used
  • The name and URL of the file accessed
  • The status code (e.g. error message)
  • The operating system of your computer
  • The browser you use (type, version and language)
  • The transfer protocol (e.g. HTTP/1.1)
  • Possibly your username from a registration/authentication

This data is collected and processed to enable the use of our website (establish a connection), to ensure consistent system security and stability, and to optimise our Internet offering. We also collect and process data for internal statistical purposes.

Furthermore, the IP address is evaluated together with other data in the event of an attack on the network infrastructure or other unauthorised or improper use of the website for the purpose of investigation and defence, and, if appropriate, is used within the framework of legal proceedings to establish identity and initiate civil or criminal proceedings against the users concerned.

4 How we use the information that we collect

4.1 General use

We may use the information that we collect about you (including personal data, where applicable) for various purposes, including: (a) providing, operating, maintaining, improving and promoting the services; (b) enabling you to access and use the services; (c) processing and completing transactions and sending you related information, including purchase confirmations and invoices, or job postings; (d) sending transactional messages, including responses to your comments, questions and requests; providing customer service and support; sending you technical notifications, updates, security alerts, and support and administrative messages; (e) processing contest entries and providing rewards; (f) monitoring and analysing trends, usage and activities in connection with the websites and services for marketing or advertising purposes; (g) investigating and preventing fraudulent transactions, unauthorised access to the services and other illegal activities; and (h) for any other purpose for which we obtain your consent.

We will ask for your express consent (through a double opt-in process or similar) before sending you advertising material, such as information about our products and services, features, surveys, newsletters, offers, promotions, contests and events, or other news or information about us and our partners.

You can opt out of receiving marketing communications from us by contacting us at datenschutz@resortragaz.ch or by following the unsubscribe instructions contained in our marketing communications.

4.2 Lawful basis for processing

We will only collect personal data from you under the following conditions: a) We have your consent to do so, (b) we need the personal data to conclude a contract with you (e.g. to provide the GRBR services requested by you); or (c) the processing is in our own legitimate interest or that of a third party pursuant to the applicable data protection laws. In some instances, we also have a legal obligation to collect personal data from you.

If we have relied on your consent to process personal data, you have the right to withdraw that consent at any time. However, please note that this will not affect the lawfulness of processing based on the consent provided before its withdrawal.

When we ask you to provide personal data to fulfil a legal obligation or to conclude a contract with you, we will make this clear at the relevant time and advise you whether the provision of your personal data is mandatory and, if so, will inform you of the potential consequences of not providing your personal data. If we collect and use your personal data on the basis of our own (or a third party’s) legitimate interests that are not already described in this Data Protection Statement, we will notify you of these legitimate interests at the relevant time.

If you have any questions or would like more information about the lawful basis on which we collect and use your personal data, please contact us using the contact details provided in Chapter 1.

5 Cookies

5.1 What are cookies?

Cookies help in many ways to make your visit to our website simpler, and more pleasant and rewarding. Cookies are information files that your browser saves automatically on the hard drive of your computer whenever you visit our website.

The use of cookies depends on your consent; you will have the option to accept or reject cookies in the cookie banner that appears when you first access the website. Cookies that are necessary for the correct functioning of the website cannot be disabled.

5.2 Use of cookies

We use cookies for purposes such as temporarily saving your selected services and entries when you complete a form on the website, so that you do not have to repeat the entry when accessing a different subpage. Cookies may also be used to identify you as a registered user once you have registered on the website, without you having to log in again when accessing a different subpage. We also log whether and how you have accepted or rejected the use of cookies.

Most web browsers accept cookies automatically. You can configure your browser in such a way that no cookies are saved on your computer, or that a message appears each time you receive a new cookie. Please consult your browser’s user guide for details.

Disabling cookies may prevent you from being able to use all of the functions of our website.

6 Tracking tools

The following tools are used on our website. You can completely or partially disable cookies by configuring your browser accordingly, rejecting cookies in the cookie banner or using special blockers (Ghostery, Privacy Badger).

6.1 Google Analytics

Preliminary remark: Google has written a detailed guide on how to configure your Google services in a privacy-friendly way. The guide can be found on the Google website under “Privacy controls”.

This website uses Google Analytics, a web analysis service of Google LLC, 1600 Amphitheatre Parkway Mountain View, CA 94043, USA. Google Analytics uses cookies, which make it possible to analyse how you use our website.

The information that the cookie generates about your use of this website is transmitted to and stored on a Google server in the USA. We use Google Analytics with the “_anonymizeIp()” extension, which means that IP addresses sent to Google are only processed there in truncated form and thus cannot be associated directly with individual persons (IP masking). Google uses this information to analyse your visit to the website, to compile reports about activities on our website and to provide other services associated with the use of the website and the Internet. Google may also forward this information to third parties if prescribed by law or if third parties are processing this data on behalf of Google. Google will never associate your IP address with other data held by Google.

You can prevent cookies from being installed by selecting the corresponding settings in your browser; however, please be aware that you may not be able to enjoy all functions of our website if you do so. The future collection and storage of data for Google Analytics can be objected to at any time by means of a Google browser plugin. Please note that if you delete cookies in your browser or access our website using a different browser, you will need to object again.

6.2 Google Tag Manager

Google Tag Manager is a Google product that allows us to manage website tags through an interface. Tag Manager is a cookie-less domain and does not collect personal data. This tool triggers other tags that may also collect data. Google Tag Manager does not access this data. A deactivation at the domain or cookie level will be preserved for all tracking tags implemented with Google Tag Manager. If you do not wish to receive interest-based advertising, you can disable the use of cookies by Google for these purposes.

6.3 Google AdWords and Remarketing

This website uses the Google service Google Adwords, which includes data analysis and conversion tracking. When you click on an ad published by Google, Google AdWords will store a “conversion cookie” on your computer’s hard drive for the purpose of tracking conversions. These cookies expire after 30 days and are not used for personal identification purposes. When you visit certain pages of our website, we and Google can tell that you clicked on the ad and were redirected to that page. The information obtained using conversion cookies is used to compile statistics for AdWords customers who use conversion tracking. From these statistics, we can determine the total number of users who clicked on the ad published by Google and visited a page featuring a conversion tracking tag. However, we do not obtain information that would allow us to identify individual users. The data that we collect cannot be attributed to specific users.

In addition to conversion tracking, we also use the following functions:

  • Remarketing
  • Interest-based audience targeting
  • Custom affinity audiences
  • In-market audiences
  • Similar audiences
  • Demographic and geographic targeting

Google’s Remarketing feature allows us to reach users who have previously visited our website. We can thereby display our ads to target groups who are already interested in our products or services. In addition, AdWords identifies the shared interests and characteristics of our website’s users on the basis of their behaviour on websites within the Google Display Network and the contextual search engine from the past 30 days. With the help of this information, AdWords can then identify potential new customers for marketing purposes who share similar interests and characteristics with the users of our website. This targeted remarketing is done by using a combination of cookies, such as ones for Google Analytics and Google DoubleClick.

6.4 Google DoubleClick

On our websites, we use Google’s DoubleClick feature to analyse the use of the website and to enable Google and other advertisers that work with DoubleClick to show you ads that are relevant to you. For this purpose, a cookie is stored on your computer’s hard drive. This cookie assigns a pseudonymous identification number to your browser and collects information about the ads that are displayed in your browser and how they are accessed. The information that the cookie generates about your use of websites is usually transmitted to and stored on a Google server in the USA. Based on the collected information, interest-relevant categories are assigned to your browser. These categories are used to display interest-based advertising.

In addition to changing your browser settings, you can also permanently disable the DoubleClick cookie using a browser plugin. With the plugin, your deactivation settings for this browser are preserved even if you delete all cookies.

By using our website, you consent to the use of the DoubleClick cookie and thus to your usage data being collected, stored and used in the aforementioned manner for the specified purpose. You also provide your consent for the cookie data to be stored beyond the end of the browser session and retrieved again, such as when you next visit the website. You can withdraw this consent at any time with future effect by deleting the DoubleClick cookie and permanently disabling it.

6.5 Google Optimize

Google Optimize is a testing tool that we use to optimise our website. Google Optimize analyses the use of different variants of our website and helps us to make the site more user-friendly based on the behaviour of the users. The Google Optimize tool is integrated into Google Analytics.

6.6 Facebook Custom Audiences and Pixel

Our website uses Facebook Custom Audiences, a service of Facebook Inc., 1601 S. California Ave, Palo Alto, CA 94304, USA (“Facebook”). In this context, a Facebook remarketing pixel is integrated into our website, which allows Facebook to track our website visitors and use their data as a basis for advertising (Facebook Ads). The pixel transmits general information about the browser session to Facebook, as well as a non-reversible and non-personal checksum (hash value) generated from your Facebook ID. For details about how Facebook handles your data, as well as your rights and configuration options for protecting your personal information, please refer to Facebook’s privacy policy at https://www.facebook.com/privacy/explanation.

Our website also uses the Facebook pixel to track visitors’ actions. This allows the behaviour of users to be tracked after they have clicked on a Facebook ad and been redirected to the provider’s website. In this way, the effectiveness of Facebook ads can be analysed for statistical and market research purposes in order to optimise advertising measures. The collected data is anonymous to us. However, the data is processed by Facebook, making it possible to link it to the respective Facebook account.

6.7 Tracking with fusedeck

The fusedeck tracking solution of Capture Media AG (hereinafter referred to as “Capture Media”) is integrated into this website. Capture Media is a Swiss company based in Zurich that measures the use of this website on our behalf with regard to engagement and events. Tracking is anonymous, which means that no connection can be made to specific or identifiable persons.

6.8 DialogShift Chat

Our website uses the chat application of DialogShift GmbH, Rheinsberger Str. 76/77, 10115 Berlin.

For the operation of the chat function, chat texts are stored and a cookie with a unique ID is set, enabling you to be recognised as a customer. This cookie is stored for 90 days since its last use. You can disable cookies in your browser settings. However, the chat function will not work if cookies are not enabled.

If you provide your name, e-mail address or phone number, for example, you do so voluntarily and you provide your consent for this data to be used and stored temporarily for contact purposes until the end of the interaction. This personal data is deleted after 90 days.

7 Data processing in connection with your stay

7.1 Data processing in order to meet legal reporting obligations

When you arrive at our hotel, we require the following details from you and any accompanying persons:

  • First name and surname
  • Postal address and canton
  • Date of birth
  • Place of birth
  • Nationality
  • Official identification document and number
  • Date of arrival and departure

We collect this information to fulfil our legal reporting obligations, especially those under hospitality laws or police law (Art. 52bis PG Ct. St. Gallen). Insofar as we are obliged to do so in accordance with the applicable provisions, we pass on this information to the competent police authorities.

7.2 Recording of the services used

If you use additional products or services during your stay (e.g. minibar, pay-TV), we will record the product or service, as well as the time they were used, for billing purposes.

7.3 Medical services

(Clinic Bad Ragaz and Medical Health Center)
When you stay at one of these centres, the GRBR Group will provide the services that have been agreed with you. Medical services are offered either by our own staff or by external medical or healthcare professionals. As a general rule, medical data may only be processed by individuals bound by professional confidentiality pursuant to Article 321 of the Swiss Criminal Code (SCC; Schweizerisches Strafgesetzbuch – StGB). The sharing of data within this group of persons does not require additional consent if it relates to your treatment. For further treatments or referrals, your consent will be obtained from the data controller.

For treatments such as massages, sports training or other therapies that may not be performed by medical professionals, we will request your consent to collect any health data that is important for the treatment.

7.4 Golf services

If you are a guest at our golf courses, in addition to your data we also store your golf club, data in connection with your Swiss Golf card, your authorization to play and your handicap.

When you book Group services through us, we will transfer your data to the relevant service provider in your interest.

8 Collection and storage of third-party data

8.1 Booking platforms

When you make bookings via a third-party platform, we receive various items of personal data from the platform operator concerned.

This is generally the information described in Section 3 of this Data Protection Statement. Any queries concerning your booking will also be forwarded to us. This data will be processed in particular to record your booking in accordance with your wishes, and to provide the services booked.

In addition, we will also be informed by the platform operators of any possible disputes arising in connection with a booking. In this context, we may also receive data regarding the booking process, with a copy of the booking confirmation serving as proof of the actual completion of a booking. We process this data with a view to enforcing our rights. Please also refer to the privacy policies of the providers. A list of platform operators can be found here: GRBR_External_Constructors_EN.pdf

8.2 Central storage and linking of data

We store the data described in Section 3 in a central electronic data processing system. The data concerned is recorded in our system and linked in order to enable us to process your bookings and provide the contractual services. (List of subcontractors: GRBR_External_Constructor_EN.pdf.

8.3 Retention period

We retain personal data only for as long as is necessary for the provision of the aforementioned services and for further processing within the scope of our legitimate interests. Contractual data is stored for longer periods, as required by statutory retention obligations. The obligation to retain data is based on provisions regarding the right to report, accounting and tax law. According to these provisions, business communications, concluded contracts and accounting documents must be kept for 10 years. This data is blocked once we no longer need it to provide the services for you. This means that the data may then only be used for accounting and tax purposes.

Health data collected in connection with medical treatments is subject to a retention period of 20 years.

9 Sharing of data with payment services and loyalty programmes

9.1 Principles

We only disclose your personal data to any third parties if you have given your explicit consent for us to do so, if such disclosure is required by law or if it is necessary in order to enforce our rights, in particular those arising from the contractual relationship. Furthermore, we also disclose your data to third parties if this is necessary within the framework of your use of the website and for the performance of the contract (including outside the website), i.e. for processing your bookings.

A list of the data recipients, the content, the data transmitted and the lawful basis can be found in this table: GRBR_External_Contractors_EN.pdf

9.2 Loyalty and bonus programmes

If you participate in a bonus or loyalty programme with us, we will share your information with the respective programme in accordance with its privacy policy. Please refer to the applicable data protection provisions of the respective website.

9.3 Credit card and payment providers

When you make a card payment on our website, we will forward your credit card details to your credit card provider and the credit card acquirer. If you decide to pay by credit card, you will be asked to enter all the necessary information. With regard to the processing of your credit card details by these third parties, please also read the general terms and conditions and the data protection statement of your credit card issuer.

10 Transfer of personal data abroad

We are authorised to transfer your personal data to third-party companies abroad (contracted providers) for the purpose of the data processing described in this Data Protection Statement. These providers are subject to data protection requirements in the same scope as us. Should the level of data protection in a given country not be equivalent to the level applicable in Switzerland or the EU, we will ensure by contractual means that the level of protection of your personal data corresponds to the level of protection provided in Switzerland or the EU at all times.

11 Further information

11.1 Right of access, right to rectification, right to erasure, right to restriction of processing and right to data portability

You have the right to obtain information about your personal data stored by us. You also have the right to incorrect data being rectified and the right to your personal data being erased, provided that there is no legal retention obligation.

Furthermore, you have the right to request the return of data that you have provided to us (right to data portability). At your request, we will also pass on the data to a third party of your choice.

For the aforementioned purposes, you can reach us by e-mail at datenschutz@resortragaz.ch. To process your requests, we must ask you to provide proof of identity.

11.2 Children

With the exception of youth memberships in the two golf clubs, we do not knowingly collect personal data from children under the age of thirteen. Children under 13 are asked not to provide any personal data. We encourage parents and guardians to monitor their children’s Internet use and to help enforce our privacy policy by instructing them never to provide personal data through the services without their permission. Please inform us if you have reason to suspect that a child under the age of 13 has provided us with personal data via the service. We will delete the data from our databases.

11.3 Data security

We take the appropriate technical and organisational security measures to protect the personal data stored by us from manipulation, partial or complete loss and unauthorised access by third parties. Our security measures are being improved on an ongoing basis in line with technological developments. You should always keep your access credentials secret, close the browser window and empty the cache when you have finished communicating with us, especially if you are using a shared computer.

We also take internal data protection within the company very seriously. Our employees are given comprehensive training, and all contractors that we use are obliged by us to maintain confidentiality and comply with the provisions of data protection law.

11.4 Related links

This Data Protection Statement only applies to our website. This website may contain links to external websites that do not fall within the scope of this Data Protection Statement. When you leave our website via a link, we recommend that you carefully read the privacy policy of the linked website.

11.5 Note on data transfer to the USA

For the sake of completeness, users residing or based in Switzerland are hereby made aware that surveillance measures by US authorities in the United States generally allow the storage of all personal data of any individual whose data has been transmitted to the US. This is carried out without differentiation, restriction or exception on the basis of the respective aim and with no objective criteria that enable access by the US authorities to the data and its later use to be restricted to very specific, strictly limited purposes which would justify access to this data and the intervention related to its use. We would also like to point out that there are no means of legal redress in the USA for data subjects from Switzerland that would enable them to gain access to their data and request its rectification or erasure, and that there is no effective legal protection against the general access rights of US authorities. We refer those affected explicitly to this legal and factual basis in order to enable them to make an informed decision concerning the provision of consent to the use of their data.

Users resident in an EU member state should be aware that, from the perspective of the European Court of Justice, the USA does not have a sufficient level of data protection based, among other things, on the issues outlined in this section; however, there is an adequacy decision for companies that become certified under the Data Privacy Framework (since 2023).

12 Changes to this Data Protection Statement

We reserve the right to amend this Data Protection Statement from time to time in order to ensure that it always complies with current legal requirements or to implement changes to our services in the Data Protection Statement (e.g. when introducing new services). The new Data Protection Statement will then apply on your next visit. We also regularly update the list of authorised representatives.

13 Right to lodge a complaint with a data protection supervisory authority

You have the right to lodge a complaint with the competent data protection supervisory authority.

Federal Data Protection and Information Commissioner (Eidgenössischer Datenschutz- und Öffentlichkeitsbeauftragter)

Feldeggweg 1
CH-3003 Bern

Telephone: +41 (0)58 462 43 95
Fax: +41 (0)58 465 99 96

Our company has a data protection representative in accordance with Article 27 GDPR within the European Economic Area (EEA) (including the European Union [EU] and the Principality of Liechtenstein), who serves as an additional point of contact for supervisory authorities and data subjects in the case of queries relating to the GDPR:

Consulting Weiß, Paulstrasse 13, DE-67346 Speyer, grbr@consulting-weiss.de

14 Data protection advice

For data protection impact assessments, the Grand Resort Bad Ragaz AG Group has delegated an external and independent specialist unit:

Dr. Bruno Wildhaber
krm Kompetenzzentrum Records Management AG
Stettbachstrasse 6
CH-8600 Dübendorf

Telephone: +41 (0)44 888 1011
E-mail: bruno.wildhaber@krm.swiss

Your web browser is outdated

Update your browser for more security, speed and a good user experience.

Update browser Continue