PRIVACY POLICY
Cresta Gstaad-Elite B2B Distribution Partner
https://crestagstaad.com
1. Introduction and Scope
This Privacy Policy provides comprehensive information about the nature, scope and purposes of the collection and use of your personal data by Cresta Gstaad-Elite B2B Distribution Partner, a sole proprietorship.
This Privacy Policy applies to our website https://crestagstaad.com and all related online services, offerings and communication channels.
We take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with Swiss data protection law, including the revised Federal Act on Data Protection (FADP), and the European Union’s General Data Protection Regulation (GDPR).
As a rule, you can use our website without providing personal data. Where personal data is collected on our website, this is generally done on a voluntary basis. We do not disclose this data to third parties without your express consent.
Additional or special privacy policies and other legal documents, such as General Terms and Conditions, terms of use or participation terms, may apply to individual or additional services.
2. Controller
The controller responsible for data processing under applicable data protection law is:
Cresta Gstaad-Elite B2B Distribution Partner
Sole proprietorship
Rheinstrasse 71
7012 Felsberg
Switzerland
Email: info@crestagstaad.com
Website: https://crestagstaad.com
Data protection contact: Bénédicte Faber
If you have any questions about data protection, you may contact our data protection contact at any time.
3. Definitions
To make this Privacy Policy easier to understand, we use the following definitions:
Personal data:
Any information relating to an identified or identifiable natural person. This includes, for example, a name, address, email address, telephone number or IP address.
Processing:
Any operation performed on personal data, regardless of the means or procedures used. This includes collecting, storing, retaining, using, modifying, disclosing, archiving, deleting or destroying data.
Data subject:
The natural person whose personal data is processed.
Controller:
The natural or legal person, public authority, agency or other body that determines, alone or jointly with others, the purposes and means of processing personal data.
Processor:
The natural or legal person, public authority, agency or other body that processes personal data on behalf of the controller.
Consent:
Any freely given, specific, informed and unambiguous indication of the data subject’s wishes, expressed by a statement or by a clear affirmative action.
Cookies:
Small text files stored on your device that may contain certain information. A distinction is made between session cookies, which are deleted when the browser session ends, and persistent cookies, which remain stored for a defined period.
4. Legal Bases
We process personal data in accordance with Swiss data protection law, in particular the revised Federal Act on Data Protection (FADP) of 25 September 2020 and the Data Protection Ordinance (DPO).
Under Swiss law, the processing of personal data is generally permitted provided that:
there is no legal prohibition;
the data subject has given consent;
there is an overriding private or public interest; or
the processing is necessary for the performance of a contract.
Stricter requirements apply when processing particularly sensitive personal data or carrying out high-risk profiling.
Where the European Union’s General Data Protection Regulation applies, for example in connection with services offered to individuals in the EU/EEA, we process personal data on the following legal bases under Article 6(1) GDPR:
a) Consent — Article 6(1)(a) GDPR
The data subject has consented to the processing of their personal data for one or more specific purposes. Consent may be withdrawn at any time with effect for the future.
b) Performance of a contract — Article 6(1)(b) GDPR
Processing is necessary for the performance of a contract or for taking steps at the request of the data subject before entering into a contract.
c) Legal obligation — Article 6(1)(c) GDPR
Processing is necessary for compliance with a legal obligation to which we are subject.
d) Vital interests — Article 6(1)(d) GDPR
Processing is necessary to protect the vital interests of the data subject or another natural person.
e) Public interest — Article 6(1)(e) GDPR
Processing is necessary for the performance of a task carried out in the public interest.
f) Legitimate interests — Article 6(1)(f) GDPR
Processing is necessary for the purposes of our legitimate interests or those of a third party, unless the interests or fundamental rights and freedoms of the data subject override those interests.
5. Types of Data Collected
We collect and process different categories of personal data. The specific data collected depends on the services and functions you use.
Categories of data
Basic identification data
Examples: first name, last name, form of address and title.
Basic personal information used for identification.
Contact data
Examples: email address, telephone number and postal address.
Information used to contact and communicate with you.
Technical data
Examples: IP address, browser type and version, operating system, device type and screen resolution.
Information automatically collected when you use our website.
Usage data
Examples: pages visited, time spent on pages, click paths and access times.
Information about how you use our website.
Content data
Examples: text entered into forms, messages and files.
Information actively submitted by you.
Data sources
Data may be collected in the following ways:
directly from you, for example when you complete forms, send emails or register;
automatically, through technical logging when you visit our website; or
from third parties, such as payment service providers or advertising partners, where applicable.
6. Purposes of Processing
We process your personal data for the following purposes:
Providing and operating our website
To make our website and its functions available to you.
Legal basis: legitimate interest.
Ensuring IT security
To protect our systems against misuse, attacks and technical disruptions.
Legal basis: legitimate interest.
Processing contact requests
To respond to your enquiries and communicate with you.
Legal basis: taking steps before entering into a contract / legitimate interest.
Complying with legal obligations
To comply with statutory retention and documentation requirements.
Legal basis: legal obligation.
7. General Data Processing
Contact forms
When you contact us using a contact form, the information you provide, such as your name, email address, telephone number and message, is processed and stored to handle your enquiry.
Processed data: Name, email address, optional telephone number and message content.
Legal basis: Performance of a contract or taking steps before entering into a contract under Article 6(1)(b) GDPR and Article 31(2)(a) FADP, or legitimate interest under Article 6(1)(f) GDPR and Article 31(1) FADP.
Storage period: The data is deleted as soon as it is no longer required for the purpose for which it was collected and provided that there are no statutory retention obligations.
Server log files
Each time our website is accessed, technical data is automatically recorded in server log files. This is necessary for technical and security reasons.
Processed data: IP address, date and time of access, page or file accessed, amount of data transferred, browser type and version, operating system used, referrer URL and hostname of the accessing computer.
Legal basis: Legitimate interest under Article 6(1)(f) GDPR and Article 31(1) FADP, in particular to ensure system security and analyse errors.
Storage period: Log files are automatically deleted after 30 days unless longer storage is required for evidentiary purposes.
8. Cookies and Tracking Technologies
Cookies and similar technologies
Our website uses cookies and similar technologies to ensure functionality and provide you with an optimal user experience.
What are cookies?
Cookies are small text files stored on your device by your browser. They contain information that may be retrieved during a later visit.
Types of cookies
Technically necessary cookies — essential cookies
These cookies are strictly necessary for operating the website. They enable basic functions such as page navigation, secure areas and the storage of your cookie preferences. These cookies cannot be deactivated.
Functional cookies
These cookies enable enhanced functionality and personalisation, such as storing your language and user preferences.
Analytics cookies
These cookies help us understand how visitors interact with our website by collecting and reporting information anonymously.
Marketing cookies
These cookies are used to display relevant advertising to visitors and measure the effectiveness of our advertising campaigns.
Consent management
We use Wix as a consent management platform to obtain and manage your consent to the use of cookies and similar technologies.
When you first visit our website, a cookie banner is displayed. It allows you to set your preferences. You may change your settings at any time using the cookie settings link in the footer of our website.
Please note: Before you provide your express consent, only technically necessary cookies are loaded.
Browser settings
You can configure your browser to notify you when cookies are placed, allow only certain cookies or block cookies generally. Please note that disabling cookies may limit the functionality of our website.
Legal basis: For technically necessary cookies: legitimate interest under Article 6(1)(f) GDPR. For all other cookies: consent under Article 6(1)(a) GDPR.
9. Retention Periods
We store your personal data only for as long as necessary to fulfil the purposes for which it was collected or as required by statutory retention obligations.
General principles
The storage period depends on:
the purpose of the processing;
statutory retention obligations;
legitimate interests, such as defending against legal claims; and
the type of data and the risk to the data subjects.
Specific retention periods
Contact enquiries: 12 months, for fulfilment of the purpose and legitimate interests.
Server log files: 30 days, for IT security.
Booking documents and invoices: 10 years, pursuant to Article 958f of the Swiss Code of Obligations.
Contracts and business correspondence: 10 years after the end of the contract, pursuant to Article 958f of the Swiss Code of Obligations and applicable limitation periods.
Statutory retention obligations in Switzerland
Under Swiss law, the following retention obligations apply in particular:
Article 958f of the Swiss Code of Obligations requires business books, accounting records, annual reports and audit reports to be retained for ten years.
Tax regulations may provide for additional retention obligations.
After the applicable retention periods expire, the data is routinely deleted unless it is still required for other purposes.
10. Data Security
We take appropriate technical and organisational security measures to protect your personal data against unauthorised access, loss, misuse or destruction. The specific measures used are based on the current state of technology and are regularly reviewed and adjusted.
Depending on the risks and the required level of protection, our security measures may include:
encrypted data transmission, such as TLS/SSL;
access restrictions and authorisation systems;
suitable security systems to protect our IT infrastructure;
regular data backups;
maintenance and updating of our systems;
confidentiality obligations for employees;
careful selection and contractual engagement of service providers; and
processes for detecting and handling security incidents.
Limitation
Despite all precautionary measures, the complete security of data transmission over the internet cannot be guaranteed.
If a data breach is likely to result in a high risk to your rights and freedoms, we will inform you without undue delay and notify the competent authorities where required.
11. Rights of Data Subjects
As a data subject, you have various rights regarding your personal data. These rights arise from the Swiss Federal Act on Data Protection and, where applicable, the General Data Protection Regulation.
Right of access
You have the right to request confirmation as to whether we process personal data concerning you. If this is the case, you have the right to access that data and receive further information, including the purposes of processing, the categories of data, recipients and the planned storage period.
Right to rectification
You have the right to request the correction of inaccurate personal data or the completion of incomplete personal data.
Right to erasure — right to be forgotten
Under certain conditions, you have the right to request the deletion of your personal data. This applies in particular where the data is no longer necessary for the purposes for which it was collected or where you withdraw your consent.
Right to restriction of processing
Under certain conditions, you have the right to request that the processing of your data be restricted, for example if you dispute the accuracy of the data or believe that the processing is unlawful.
Right to data portability
You have the right to receive the personal data concerning you that you have provided to us in a structured, commonly used and machine-readable format and to transmit that data to another controller.
Right to object — Article 21 GDPR
You have the right to object, on grounds relating to your particular situation, at any time to the processing of personal data concerning you where that processing is based on legitimate interests.
Where personal data is processed for direct marketing, you may object at any time without providing reasons.
Right to withdraw consent
Where processing is based on consent, you have the right to withdraw that consent at any time with effect for the future. The lawfulness of processing carried out before consent was withdrawn remains unaffected.
Right to lodge a complaint with a supervisory authority
You have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data violates applicable data protection law.
Competent supervisory authority in Switzerland
Federal Data Protection and Information Commissioner (FDPIC)
Feldeggweg 1
CH-3003 Bern
Switzerland
Telephone: +41 58 462 43 95
Website: www.edoeb.admin.ch
For services offered to individuals in the EU/EEA, you may also contact the data protection supervisory authority responsible for your country.
Exercising your rights
To exercise your rights, you may contact us at any time:
Email: info@crestagstaad.com
To process your request, we may require proof of identity to ensure that the request comes from the authorised person. We generally process requests within one month.
12. Updates and Contact
Updates to this Privacy Policy
We may amend and update this Privacy Policy from time to time to reflect changes to our data processing practices, new legal requirements or other developments.
Changes will be published on our website. Where significant changes affect your rights or the nature of the processing, we will inform you separately where possible and appropriate.
We recommend that you review this Privacy Policy regularly to remain informed about the current status of our data protection practices.
Contact
If you have any questions about this Privacy Policy or the processing of your personal data, you may contact us at any time:
Cresta Gstaad-Elite B2B Distribution Partner
Email: info@crestagstaad.com
Status of this Privacy Policy: 16 October 2026