Privacy policy
1. Contact details
The controller responsible under data protection law is:
Office for Economy Develop and Tourism Graubünden
Ringstrasse 10
7001 Chur
Switzerland
In individual cases, third parties may be responsible for processing personal data, or we may act as joint controllers with third parties. We will be happy to provide data subjects with information about the respective responsibilities on request.
1.1 Data protection officer or adviser
The following data protection officer or adviser serves as a point of contact for data subjects and authorities with enquiries relating to data protection:
Sebastian Jüngling
Office for Economy and Tourism Graubünden
Ringstrasse 10
7001 Chur
Switzerland
2. Definitions and legal bases
2.1 Definitions
Data subject: A natural person whose personal data we process.
Personal data: Any information relating to an identified or identifiable natural person.
Sensitive personal data: Data concerning trade union, political, religious or philosophical views and activities; health, a person’s private sphere or ethnic or racial origin; genetic data; biometric data that uniquely identifies a natural person; criminal or administrative proceedings and sanctions; and social assistance measures.
Processing: Any handling of personal data, regardless of the means and procedures used, including consulting, comparing, adapting, archiving, retaining, retrieving, communicating, obtaining, recording, collecting, erasing, disclosing, arranging, organising, storing, altering, disseminating, combining, destroying and using personal data.
European Economic Area (EEA): The Member States of the European Union (EU), together with the Principality of Liechtenstein, Iceland and Norway.
2.2 Legal bases
We process personal data in accordance with Swiss law, particularly the Federal Act on Data Protection (FADP) and the Data Protection Ordinance (DPO).
Where and to the extent that the European General Data Protection Regulation (GDPR) applies, we process personal data on at least one of the following legal bases:
- Article 6(1)(b) GDPR, where processing is necessary for the performance of a contract with the data subject or to take steps prior to entering into a contract.
- Article 6(1)(f) GDPR, where processing is necessary to safeguard legitimate interests, including those of third parties, unless these are overridden by the data subject’s fundamental rights, freedoms and interests. These interests include, in particular, conducting our activities and operations on an ongoing, people-friendly, secure and reliable basis, ensuring information security, preventing misuse, enforcing our legal claims and complying with Swiss law.
- Article 6(1)(c) GDPR, where processing is necessary to comply with a legal obligation to which we are subject under any applicable law of a Member State of the European Economic Area (EEA).
- Article 6(1)(e) GDPR, where processing is necessary for the performance of a task carried out in the public interest.
- Article 6(1)(a) GDPR, where personal data is processed with the data subject’s consent.
- Article 6(1)(d) GDPR, where processing is necessary to protect the vital interests of the data subject or another natural person.
- Article 9(2) et seq. GDPR, for processing special categories of personal data, particularly with the consent of the data subjects.
The European General Data Protection Regulation (GDPR) refers to the handling of personal data as the processing of personal data, and to the handling of sensitive personal data as the processing of special categories of personal data (Article 9 GDPR).
3. Nature, scope and purposes of personal data processing
We process the personal data necessary to conduct our activities and operations on an ongoing, people-friendly, secure and reliable basis. The personal data processed may include, in particular, browser and device data, content data, communication data, metadata, usage data, master data including existing records and contact details, location data, transaction data, contractual data and payment data. Personal data may also constitute sensitive personal data.
We also process personal data received from third parties, obtained from publicly accessible sources or collected in the course of our activities and operations, provided that such processing is permitted.
Where required, we process personal data with the consent of the data subjects. In many cases, we may process personal data without consent, for example to fulfil legal obligations or safeguard overriding interests. We may also ask data subjects for consent where their consent is not required.
We process personal data for the period necessary for the relevant purpose. In particular, we anonymise or erase personal data with reference to statutory retention periods and limitation periods.
4. Automation and artificial intelligence (AI)
We may process personal data automatically or use artificial intelligence to process personal data.
We may use profiling to evaluate certain personal aspects relating to data subjects automatically. Profiling may, for example, be used to analyse or predict interests, behaviour or personal preferences.
We provide information on a case-by-case basis about decisions based solely on automated processing of personal data that have legal consequences for data subjects or significantly affect them (automated individual decisions).
5. Disclosure of personal data
We may disclose personal data to third parties, have it processed by third parties or process it jointly with third parties. These third parties include, in particular, specialist providers whose services we use.
For example, we may disclose personal data to banks and other financial service providers, authorities, educational and research institutions, advisers and lawyers, interest groups, IT service providers, cooperation partners, credit reference and business information agencies, logistics and delivery companies, marketing and advertising agencies, media organisations, organisations and associations, social institutions, telecommunications companies, insurers and payment service providers.
6. Communication
We process personal data to communicate with individuals, authorities, organisations and businesses. In particular, we process data provided by a data subject when contacting us, for example by post or email. We may store this data in an address book or using comparable tools.
Third parties who provide us with data about other people are responsible for independently ensuring the protection of those data subjects’ data. In particular, they must ensure that the data is accurate and may lawfully be transmitted.
We use selected services from suitable providers to facilitate and improve communication with individuals and other communication partners. These services may also allow us to manage and otherwise process data subjects’ data beyond direct communication.
7. Job applications
We process applicants’ personal data to the extent necessary to assess their suitability for employment or subsequently perform an employment contract. The personal data required is determined, in particular, by the information requested, for example in a job advertisement. We may publish job advertisements with the assistance of suitable third parties, including in electronic and print media or on job portals and recruitment platforms.
We also process personal data that applicants voluntarily provide or publish, particularly in cover letters, CVs, other application documents and online profiles.
Where and to the extent that the General Data Protection Regulation (GDPR) applies, we process applicants’ personal data particularly in accordance with Article 9(2)(b) GDPR.
8. Data security
We take appropriate technical and organisational measures to ensure a level of data security proportionate to the relevant risk. In particular, these measures safeguard the confidentiality, availability, traceability and integrity of the personal data processed. However, we cannot guarantee absolute data security.
Access to our website and other digital services uses transport encryption (SSL/TLS, particularly Hypertext Transfer Protocol Secure, abbreviated to HTTPS). Most browsers warn users before they visit a website without transport encryption.
Like essentially all digital communication, our digital communication is subject to indiscriminate mass surveillance by security authorities in Switzerland, elsewhere in Europe, the United States of America (USA) and other countries, without specific grounds or suspicion. We have no direct influence over the associated processing of personal data by intelligence services, police forces and other security authorities. Nor can we rule out targeted surveillance of a data subject.
9. Personal data abroad
We generally process personal data in Switzerland and the European Economic Area (EEA). However, we may also export or transfer personal data to other countries, particularly to process it there or have it processed there.
We may export personal data to any country in the world and elsewhere in the universe, provided that the applicable law ensures an adequate level of data protection according to a decision of the Swiss Federal Council and, where and to the extent that the General Data Protection Regulation (GDPR) applies, also according to a decision of the European Commission.
We may transfer personal data to countries whose laws do not ensure an adequate level of data protection if data protection is otherwise guaranteed, particularly through standard data protection clauses or other appropriate safeguards. In exceptional cases, we may export personal data to countries without adequate data protection or appropriate safeguards where the specific conditions under data protection law are met, for example where data subjects have given their explicit consent or where there is a direct connection with the conclusion or performance of a contract. On request, we will be happy to provide data subjects with information about any safeguards or a copy of those safeguards.
10. Rights of data subjects
10.1 Rights under data protection law
We grant data subjects all rights provided for under applicable law. In particular, data subjects have the following rights:
- Access: Data subjects may request information on whether we process personal data about them and, if so, which personal data. They also receive the information necessary to exercise their rights under data protection law and ensure transparency. This includes the personal data itself and, among other things, information about the purpose of processing, the retention period, any disclosure or export of data to other countries, and the source of the personal data.
- Rectification and restriction: Data subjects may have inaccurate personal data corrected, incomplete data completed and the processing of their data restricted.
- Expressing their views and obtaining human review: Where decisions are based solely on automated processing of personal data and have legal consequences for data subjects or significantly affect them (automated individual decisions), data subjects may express their views and request a review by a human.
- Erasure and objection: Data subjects may have personal data erased (“right to be forgotten”) and object to the future processing of their data.
- Data delivery and portability: Data subjects may request that personal data be provided to them or transferred to another controller.
We may defer, restrict or refuse the exercise of data subjects’ rights to the extent permitted by law. We may inform data subjects of any conditions they must meet to exercise their rights under data protection law. For example, we may refuse access in whole or in part on the grounds of confidentiality obligations, overriding interests or the protection of others. We may also refuse to erase personal data in whole or in part, particularly because of statutory retention obligations.
In exceptional cases, we may charge a fee for the exercise of these rights. We will inform data subjects of any fees in advance.
We are required to take appropriate measures to verify the identity of data subjects who request access or exercise other rights. Data subjects are required to cooperate.
10.2 Legal remedies
Data subjects have the right to enforce their rights under data protection law through legal proceedings or to report a matter or lodge a complaint with a data protection supervisory authority.
The data protection supervisory authority for private controllers and federal bodies in Switzerland is the Federal Data Protection and Information Commissioner (FDPIC).
European data protection supervisory authorities are organised as members of the European Data Protection Board (EDPB). In some Member States of the European Economic Area (EEA), data protection supervisory authorities have a federal structure, particularly in Germany.
11. Use of the website
11.1 Cookies
We may use cookies. Cookies, including our own cookies (first-party cookies) and cookies from third parties whose services we use (third-party cookies), are data stored in the browser. Such stored data is not necessarily limited to traditional text-based cookies.
Cookies may be stored temporarily in the browser as “session cookies” or for a specified period as persistent cookies. Session cookies are automatically deleted when the browser is closed. Persistent cookies have a defined storage period. In particular, cookies allow a browser to be recognised when it next visits our website, enabling us, for example, to measure the website’s reach. Persistent cookies may also be used for online marketing.
Cookies can be disabled, restricted or deleted in whole or in part at any time through the browser settings. Browser settings often also allow cookies to be deleted automatically or otherwise managed. Without cookies, some website functionality may no longer be available. We actively request explicit consent to the use of cookies, at least where and to the extent required by applicable law.
For cookies used to measure performance and reach or for advertising, a general opt-out is available for many services through AdChoices (Digital Advertising Alliance of Canada), the Network Advertising Initiative (NAI), YourAdChoices (Digital Advertising Alliance) or Your Online Choices (European Interactive Digital Advertising Alliance, EDAA).
11.2 Logging
Whenever our website or other digital services are accessed, we may log at least the following information, provided that it is transmitted to our digital infrastructure during access: date and time, including time zone; IP address; access status (HTTP status code); operating system, including user interface and version; browser, including language and version; the individual page of our website accessed, including the volume of data transferred; and the last webpage accessed in the same browser window (referrer).
We record this information, which may also constitute personal data, in log files. It is necessary to provide our digital services on an ongoing, people-friendly and reliable basis. It is also necessary to ensure data security, including through or with the assistance of third parties.
11.3 Tracking pixels
We may incorporate tracking pixels into our digital services. Tracking pixels are also known as web beacons. These tracking pixels, including those from third parties whose services we use, are usually small, invisible images or JavaScript scripts that are retrieved automatically when our digital services are accessed. Tracking pixels can collect at least the same information as logging in log files.
12. Notifications and messages
12.1 Performance and reach measurement
Notifications and messages may contain web links or tracking pixels that record whether an individual message has been opened and which web links have been clicked. These links and tracking pixels may also record the use of notifications and messages in a way that identifies individual recipients. We need these usage statistics to measure performance and reach so that we can send notifications and messages effectively and in a people-friendly, ongoing, secure and reliable manner, based on recipients’ needs and reading habits.
12.2 Consent and objection
You must generally consent to the use of your email address and other contact details unless their use is permitted on other legal grounds. We may use a double opt-in procedure to obtain consent confirmed in two steps. In that case, you will receive a message with instructions for the second confirmation. For evidential and security purposes, we may log the consent obtained, including the IP address and timestamp.
You may generally object to receiving notifications and messages, such as newsletters, at any time. By doing so, you may also object to the statistical recording of usage for performance and reach measurement. Necessary notifications and messages relating to our activities and operations remain unaffected.
12.3 Service providers for notifications and messages
We use specialist service providers to send notifications and messages.
13. Social media
We maintain a presence on social media and other online platforms to communicate with interested individuals and provide information about our activities and operations. In connection with these platforms, personal data may also be processed outside Switzerland and the European Economic Area (EEA).
The general terms and conditions, terms of use, privacy policies and other provisions of the respective platform operators also apply. In particular, these provisions provide information about data subjects’ rights directly in relation to the relevant platform, including the right of access.
14. Third-party services
We use specialist third-party services to conduct our activities and operations on an ongoing, people-friendly, secure and reliable basis. Among other things, these services allow us to embed functionality and content in our website. When such content or functionality is embedded, the services used must, for technical reasons, collect users’ IP addresses, at least temporarily.
For necessary security, statistical and technical purposes, third parties whose services we use may process data relating to our activities and operations in aggregated, anonymised or pseudonymised form. This may include, for example, performance or usage data needed to provide the relevant service.
In particular, we use:
- Google services: Providers: Google LLC (USA) / Google Ireland Limited (Ireland), in some cases for users in the European Economic Area (EEA) and Switzerland; general data protection information: “Privacy and security principles”, “More information on how Google uses personal data”, Privacy Policy, “Google is committed to complying with applicable data protection laws”, “Privacy guide for Google products”, “How we use data from sites or apps that use our services”, “Types of cookies and similar technologies used by Google”, “Ads you can control” (“Personalised advertising”).
- Microsoft services: Providers: Microsoft Ireland Operations Limited (Ireland) for users in the European Economic Area (EEA), Switzerland and the United Kingdom / Microsoft Corporation (USA) for users elsewhere in the world; general data protection information: “Privacy at Microsoft”, “Data protection and privacy”, Privacy Statement, “Data and privacy settings”.
14.1 Digital infrastructure
We use specialist third-party services to provide the digital infrastructure required for our activities and operations. These include, for example, hosting and storage services from selected providers.
In particular, we use:
- Microsoft Azure: Storage and other infrastructure; provider: Microsoft; Azure-specific information: “Privacy in Azure”.
14.2 Automation and integration of apps and services
We use specialist platforms to integrate and connect existing third-party apps and services. These no-code platforms also allow us to automate processes and activities involving third-party apps and services.
14.3 Appointment scheduling
We use specialist third-party services to arrange appointments online, for example for meetings. In addition to this privacy policy, any directly displayed terms of the services used, such as terms of use or privacy policies, also apply.
14.4 Online collaboration
We use third-party services to enable online collaboration. In addition to this privacy policy, any directly displayed terms of the services used, such as terms of use or privacy policies, also apply.
In particular, we use:
- Microsoft Teams: A platform for productive collaboration, particularly through audio and video conferencing; provider: Microsoft; Teams-specific information: “Security and compliance in Microsoft Teams”, particularly “Privacy”.
- Miro: A whiteboard platform; provider: RealtimeBoard Inc. (USA); data protection information: Privacy Policy, “Miro Trust Center”.
14.5 Social media functionality and content
We use third-party services and plugins to embed functionality and content from social media platforms and to enable content to be shared on social media platforms and through other channels.
14.6 Maps
We use third-party services to embed maps in our website.
14.7 Digital content
We use specialist third-party services to embed digital content in our website. Digital content includes, in particular, images and videos, music and podcasts.
In particular, we use:
- YouTube: A video platform; provider: Google; YouTube-specific information: “Privacy and Safety Centre”, “Your data in YouTube”.
14.8 Advertising
We may display targeted advertising on third-party services, such as social media platforms and search engines, to promote our activities and operations.
In particular, we want this advertising to reach people who are already interested in our activities and operations or may be interested in them (remarketing and targeting). For this purpose, we may transmit relevant information, which may include personal data, to third parties that enable such advertising. We may also determine whether our advertising is successful, particularly whether it leads to visits to our website (conversion tracking).
Third parties on whose services we advertise and with whom you are logged in may be able to link your use of our website to your profile on their services.
In particular, we use:
- Google Ads: Search engine advertising; provider: Google; Google Ads-specific information: advertising based, among other things, on search queries, with various domain names used for Google Ads, particularly doubleclick.net, googleadservices.com and googlesyndication.com; Advertising privacy information, “Manage ads directly from the ads you see”.
15. Website extensions
We use website extensions to provide additional functionality. We may use selected services from suitable providers or operate these extensions on our own digital infrastructure.
16. Performance and reach measurement
We seek to measure the performance and reach of our activities and operations. This may also involve measuring the impact of third-party referrals or examining how different parts or versions of our digital services are used (A/B testing). In particular, the results of performance and reach measurement allow us to correct errors, develop popular content and make improvements.
In most cases, the IP addresses of individual users are collected for performance and reach measurement. These IP addresses are generally truncated (“IP masking”) so that the resulting pseudonymisation supports the principle of data minimisation.
Performance and reach measurement may involve cookies and the creation of user profiles. Any such profiles may include, for example, the individual pages visited or content viewed on our digital services, information about the size of the screen or browser window, and the user’s location, at least approximately. User profiles are generally created exclusively in pseudonymised form and are not used to identify individual users. Individual third-party services with which users are logged in may be able to link use of our online services to the user’s account or profile with the relevant service.
In particular, we use:
- fusedeck: Performance and reach measurement; provider: cptr AG (Switzerland); data protection information: “Privacy policy and information on the right to object” (website), “Data & privacy” (fusedeck), Privacy policy (fusedeck).
- Google Marketing Platform: Performance and reach measurement, particularly using Google Analytics; provider: Google; Google Marketing Platform-specific information: measurement across different browsers and devices (cross-device tracking) using pseudonymised IP addresses, which are transmitted in full to Google in the USA only in exceptional cases; Google Analytics privacy information, “Google Analytics opt-out browser add-on”.
- Google Tag Manager: Integration and management of Google and third-party services, particularly for performance and reach measurement; provider: Google; Google Tag Manager-specific information: Google Tag Manager privacy information. Further data protection information is provided for each service integrated and managed.
17. Final notes on this privacy policy
We created this privacy policy using the privacy policy generator provided by Datenschutzpartner.
We may update this privacy policy at any time. We will communicate updates in an appropriate manner, particularly by publishing the current version on our website.