Privacy Policy

1. Data Controller and Contact Information

The entity responsible for processing personal data in accordance with this Privacy Policy is:

Reigoldswil-Wasserfallen Cable Car Foundation (LRW)
Oberbiel 62
4418 Reigoldswil
Switzerland
Email: marketing@region-wasserfallen.ch
Phone: +41 61 941 18 20

Data Protection Officer: Susanne Schmuckli, Head of Marketing

If you have any questions regarding the processing of your personal data or the exercise of your data protection rights, you can contact us at the address listed above.

To the extent that the LRW Foundation and an external service provider—such as a dining, lodging, activity, or reservation partner—process data for their own purposes, that partner is solely responsible for its own data processing. That partner’s privacy policy applies in addition to this one.

2. Scope and Governing Law

This Privacy Policy explains how we process personal data that we collect through the region-wasserfallen.ch website, the linked online store, when you contact us, make reservations, purchase tickets, place orders, redeem gift certificates, enter contests, newsletter sign-ups, and other related digital offerings.

We process personal data in accordance with the Swiss Data Protection Act (DSG) and other applicable Swiss regulations. To the extent that the European Union’s General Data Protection Regulation (GDPR) applies to such processing, we also comply with its requirements.

3. What Personal Data We Process

Depending on how you use our services, we process the following categories of personal data in particular:

• Contact and personal information, such as last name, first name, address, email address, phone number, and language.
• Reservation, booking, order, and contract data, such as requested services, visit or reservation dates, number of people, correspondence, gift certificate or order information, and details regarding contract fulfillment.
• Online store, ticket, and transaction data, such as tickets purchased, offers, validity periods, the number and category of tickets, order number, shopping cart, time of purchase, billing and contact information, payment status, refunds, cancellations, and details regarding the redemption or use of tickets and gift certificates.
• Payment data, to the extent we receive it, including, in particular, the selected payment method, payment status, transaction or reference number, amount, currency, date and time, and authorization or rejection status. As a general rule, we do not process or store complete credit card or security information ourselves if the payment is made through an external payment service provider.
• Communication data, such as the content of inquiries received via email, contact forms, telephone, or other communication channels.
• Newsletter data, including, in particular, email addresses, the dates of subscription and unsubscription, proof of consent, and—if enabled—information regarding delivery, opening, and clicks within newsletters.
• Contest data, including, in particular, participation details, contact information, the date of participation, and, if applicable, information regarding prize distribution.
• Usage and technical data, such as IP address, date and time of access, pages or files accessed, referrer URL, browser type, operating system, device information, language settings, and log data.
• Cookies and online identifiers, such as cookie IDs, session IDs, pseudonymous user identifiers, and consent settings.

As a general rule, we do not process special-category personal data through the website, unless you voluntarily provide us with such information or such processing is necessary for a specific service you have requested.

4. Purposes of Data Processing

We process personal data primarily for the following purposes:

• Website deployment, operation, maintenance, security, and optimization.
• Processing contact requests and communicating with prospective clients, guests, and customers.
• Initiating, finalizing, and processing reservations, bookings, ticket purchases, orders, gift certificates, contests, and other services.
• Operation and management of the online store, as well as the sale, issuance, shipping, administration, verification, refunds, and cancellations of tickets, gift certificates, and other offers.
• Payment processing, fraud prevention, creditworthiness and risk assessments—to the extent provided for by the respective payment service provider and permitted by law—as well as the resolution of payment disputes.
• Forwarding an inquiry or reservation to the appropriate service provider, to the extent necessary to provide the requested service.
• Sending and analyzing newsletters, provided you have subscribed to them.
• Measuring reach, analyzing website usage, and improving our offerings, provided you have given your consent.
• Detection and prevention of misuse, fraud, security incidents, and technical errors.
• Compliance with statutory obligations regarding retention, disclosure, accounting, taxation, or documentation, as well as the enforcement or defense of legal claims.

Your personal data will only be used for email advertising if we have obtained your valid consent or if there is another legal basis for doing so. You may opt out of direct marketing at any time; for newsletters, you can unsubscribe by clicking the unsubscribe link in each email or by contacting us.

5. Legal Basis Under the GDPR

To the extent that the GDPR applies, we base the processing of your personal data—depending on the purpose of the processing—in particular on the following legal grounds:

• Article 6(1)(b) of the GDPR, if the processing is necessary for the performance of a contract with you or for the implementation of precontractual measures; this applies in particular to orders, ticket purchases, voucher redemptions, reservations, payment processing, and the provision of the purchased service.
• Article 6(1)(c) of the GDPR, if the processing is necessary to comply with a legal obligation, in particular statutory record-keeping, accounting, tax, and retention obligations.
• Art. 6(1)(f) GDPR, if the processing is necessary to protect our legitimate interests, in particular for the secure and efficient operation of our website and online store, communication, combating fraud and abuse, and the enforcement of legal claims, provided that your interests or fundamental rights do not take precedence.
• Article 6(1)(a) of the GDPR, if you have given us your consent for a specific purpose, in particular for newsletters, analytics and marketing cookies, or similar technologies.

You may revoke your consent at any time, effective for the future. The lawfulness of the processing that took place prior to the revocation remains unaffected.

6. Recipients and Service Providers

We may disclose personal data to third parties to the extent necessary for the purposes described. This includes, in particular:

• IT, hosting, maintenance, and security service providers.
• Providers of website, form, online store, reservation, ticket, gift certificate, payment, and booking platforms, including payment service providers and technical payment processors, to the extent that these are used on the website or in the linked online store.
• Newsletter and email marketing service providers.
• Providers of analytics, cookie consent, and statistics services.
• Relevant tourism, dining, or other service providers, if you wish to make a reservation, submit an inquiry, or request a service.
• Government agencies, courts, consultants, or other entities, to the extent required by law or necessary to protect our rights.

To the extent that service providers process personal data on our behalf, we contractually require them to process personal data only in accordance with our instructions, for the agreed-upon purposes, and subject to appropriate technical and organizational security measures.

7. Disclosure Abroad

Our service providers and their subcontractors may also process personal data outside of Switzerland or the European Economic Area. In such cases, we ensure, to the extent necessary, that adequate data protection safeguards are in place, for example through an adequacy decision, recognized standard contractual clauses, or other legally prescribed safeguards.

When data is transferred abroad, we provide information in this Privacy Policy about the relevant country or the service providers involved, to the extent that this is possible and necessary based on the services actually used.

8. Cookies, Similar Technologies, and Consent Management

We use cookies and similar technologies such as pixels, local storage, and script tags. Cookies are small files that can be stored on your device. They enable, for example, the technical operation of the website, the saving of your settings, the measurement of usage, and—if enabled—the evaluation of marketing activities.

In particular, we distinguish the following categories:

• Essential cookies and technologies: These are required for the operation, security, basic functionality, or storage of your cookie settings. They cannot be disabled via the cookie settings, as they are technically necessary.
• Statistics and analytics cookies: They help us understand how visitors use our website so that we can improve our content, navigation, and technical performance.
• Marketing cookies: These may be used to measure the effectiveness of advertising campaigns, create target audiences, or display interest-based content to you. This category is used only if it is actually enabled on the website.
• External media and services: These may include embedded maps, videos, social media content, or other external offerings. When you activate such content, data may be transmitted to the respective third-party providers.

You can delete, block, or restrict cookies in your browser settings. If you disable cookies, some features of the website may be limited.

The specific list of cookies used, their providers, purposes, retention periods, and categories is displayed in the cookie banner or in the cookie settings and forms part of this Privacy Policy. For the online store, additional technically necessary cookies may be used, in particular to manage the shopping cart, session, login, purchase process, fraud prevention, and payment processing. These are used only to the extent necessary.

9. Google Analytics 4

This website uses Google Analytics 4, a web analytics service provided by Google. Generally, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, is the relevant contractual partner for users in the European Economic Area and Switzerland. Depending on the nature of the processing, data may also be processed by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, or other companies affiliated with Google or third-party processors.

Google Analytics 4 helps us analyze how our website is used, make technical and content-related improvements, and measure the effectiveness of our online offerings. In particular, information regarding pages visited, interactions, time spent on the site, approximate geographic region, browser, operating system, device type, language settings, referrer URL, online identifiers, cookie IDs, as well as the time and duration of the visit may be processed.

According to Google, Google Analytics 4 does not log or store individual IP addresses. For visits from the EU, IP address data is used to derive general location information and is then immediately discarded. The location data derived in this way may include, for example, city, region, country, or continent. However, this protective measure does not replace the consent required for analytics cookies.

The legal basis for the use of Google Analytics 4, to the extent that the GDPR applies, is your consent pursuant to Article 6(1)(a) of the GDPR. Under Swiss law, we base the use of Google Analytics 4 on the consent you provided via the cookie banner or on the transparent information and choice required by law.

Data may be transferred to countries outside Switzerland and the EEA, in particular to the United States. For such transfers, Google relies on the applicable legal safeguards. You can find Google’s current privacy policy at: https://policies.google.com/privacy?hl=de

The retention period for user- and event-related data in Google Analytics 4 is x months. Aggregated statistics may remain available for a longer period.

10. Newsletter with Brevo

When you subscribe to our newsletter, we process, in particular, your email address, your name (if applicable), the date and time of your registration and confirmation, proof of your consent, as well as information regarding delivery and—if enabled—your interactions with the newsletter, such as opens and clicks.

We use Brevo to manage newsletter subscriptions and send emails.
Privacy Policy: https://www.brevo.com/de/legal/privacypolicy/

The legal basis for sending the newsletter, to the extent that the GDPR applies, is your consent pursuant to Article 6(1)(a) of the GDPR. You may revoke your consent at any time with future effect by sending a notice to marketing@region-wasserfallen.ch.

We generally retain newsletter data until you unsubscribe. After you unsubscribe, we retain records of your subscription and unsubscription only for as long as necessary to comply with legal obligations or to defend against or enforce legal claims.

Brevo processes data on our behalf. If Brevo or its subprocessors process data outside of Switzerland or the EEA, the necessary data protection safeguards set forth in Section 7 of this Privacy Policy apply.

11. Contact Forms, Email, and Reservations

If you contact us via a contact form, by email, by phone, or by any other means, we will process the data you provide in order to handle your inquiry and communicate with you. This includes, in particular, your contact information, the content of your message, and any communication data generated in connection with the inquiry.

For reservations, booking requests, orders, or inquiries about services, we may share your information with the service provider responsible for the requested service. The recipient—for example, a restaurant, lodging, leisure, or activity partner—may process the data as an independent data controller in accordance with its own privacy policy. We only share the data necessary to process the specific inquiry or service.

The legal basis, to the extent that the GDPR applies, is Article 6(1)(b) of the GDPR if the processing is necessary for entering into or performing a contract, or Article 6(1)(f) of the GDPR for the processing of general inquiries and business communications.

12. Online Store, Ticket Sales, and Payment Processing

Through the online store linked from our website, you can purchase tickets for the gondola lift as well as tickets, gift certificates, and other offers in the Wasserfallen region. When you make a purchase, we process the personal data necessary to initiate, conclude, and fulfill the purchase agreement.

This includes, in particular, contact and billing information, details about the tickets or services ordered, order and transaction data, communication data, payment status, and information regarding cancellations, refunds, or the redemption of tickets and gift certificates.

The online store is operated by n-tree solutions schweiz GmbH, Winterhaldenstrasse 14A, 3627 Heimberg, Switzerland. The parent company is n-tree solutions Ticketsysteme GmbH, located at Brosswaldengasse 12, 6900 Bregenz, Austria. Services are provided from both locations.

To the extent that the GDPR applies, the processing of data required for the sale of tickets and gift certificates is based on Article 6(1)(b) of the GDPR, as such processing is necessary for the performance of the sales contract and the provision of the ordered service. To the extent that processing is necessary to comply with legal obligations, we rely on Article 6(1)(c) of the GDPR. Processing for the purposes of fraud prevention, system security, the enforcement of claims, or the optimization of processes may be based on Article 6(1)(f) of the GDPR, provided that our legitimate interests do not override your interests or fundamental rights.

Providing the information marked as required fields is necessary to complete the purchase. Without this information, a ticket or gift certificate contract may not be concluded or fulfilled.

13. Credit Card Payments and Payment Service Providers

Depending on the technical process, you will either be redirected to a payment page operated by the payment service provider to enter your payment information, or a payment form from that provider will be integrated into the online store. The payment service provider processes, in particular, the data required for payment authorization and processing, such as the cardholder’s name, card details, security and authentication data, payment amount, currency, time, transaction number, IP address, device or browser data, and payment status.

Full credit card details and security codes are always processed directly by the payment service provider. We generally do not receive full card details, but rather information indicating whether a payment was successful, declined, refunded, or canceled, as well as a transaction or reference number.

The payment service provider may process the data for payment processing, authentication, fraud prevention, risk assessment, compliance with legal requirements, and the resolution of payment disputes. To the extent that the payment service provider processes this data for its own purposes or to comply with its own legal obligations, it is solely responsible for such processing; its privacy policy also applies.

In the case of payment service providers headquartered or processing data outside of Switzerland or the European Economic Area, personal data may be transferred to other countries. In this case, the information provided by the respective payment service provider regarding the recipient countries and the data protection safeguards in place applies. To the extent that we are responsible for the transfer, we ensure that the legal requirements for disclosure abroad are met.

14. Retention and Deletion

We retain personal data only for as long as is necessary for the respective processing purposes or as required by statutory retention obligations. Once the purpose no longer applies, the data is deleted or anonymized, provided that no legal obligations or legitimate interests—in particular for law enforcement purposes—prevent this.

15. Your Privacy Rights

In accordance with applicable data protection laws, you have the following rights, among others:

• To find out whether we process any personal data about you, and if so, what data we process.
• To request the correction of inaccurate or incomplete personal data.
• To request the deletion of your personal data, provided that there are no legal retention requirements or overriding legitimate interests that would prevent it.
• To object to the processing of your personal data, in particular processing for direct marketing purposes.
• To revoke consent that has been given at any time, with effect for the future.
• To the extent that the GDPR applies, to request the restriction of processing.
• To the extent that the GDPR applies, to request the disclosure or transfer of the data you have provided in a commonly used machine-readable format, provided that the legal requirements are met.

To exercise your rights, please contact us at marketing@region-wasserfallen.ch. We may request appropriate proof of identity to the extent necessary to prevent unauthorized access to your information.

Individuals in Switzerland may contact the Federal Data Protection and Information Commissioner (FDPIC) with any questions or complaints. Individuals in the European Economic Area also have the right, to the extent that the GDPR applies, to file a complaint with a competent data protection supervisory authority.

16. Data Security

We take appropriate technical and organizational measures to protect personal data from unauthorized access, loss, misuse, alteration, or unauthorized disclosure. However, data transmission over the Internet may involve security risks; absolute security cannot be guaranteed.

17. Changes to This Privacy Policy

We may update this Privacy Policy if there are changes to our data processing practices, the services we use, or legal requirements. The version currently published on this website is the one that applies.

As of August 23, 2026