The Swiss Alpine Club SAC (Monbijoustrasse 61, 3000 Bern 14, Switzerland), a private association (Art. 60 et seq. of the Swiss Civil Code), is the operator of the website www.sac-cas.ch and therefore responsible for collecting, processing and using your personal data and ensuring that the data is processed in accordance with Swiss law. 

Your trust is important to us, which is why we take the topic of data protection seriously and ensure that an appropriate level of security is provided. It goes without saying that we adhere to the legal provisions of the Federal Act on Data Protection (FADP), the Ordinance to the Federal Act on Data Protection (DPO), the Telecommunications Act (TCA) and, where applicable, other data protection legislation, particularly the European Union’s General Data Protection Regulation (hereinafter referred to as GDPR).

So that you know what type of personal data we collect from you and what purposes we use it for, please note the information below.

a. when visiting www.sac-cas.ch

When you visit our website, our servers temporarily save a record of every access in a log file. The following data is collected without your involvement and stored by us until it is automatically deleted after twelve months at the latest:

• The IP address of the requesting computer
• The date and time of the visit
• The name and URL of the file accessed
• The website from which it was accessed
• Your computer’s operating system and the browser you used
• The country from which you accessed it and your browser’s language settings
• The name of your Internet access provider

This data is collected and processed for the purpose of making it possible to use our website (establish a connection), to permanently guarantee system security and stability and to enable the optimisation of our website and for internal statistical purposes. Herein lies our legitimate interest in data processing within the meaning of Art. 6 (1)(f) GDPR. The IP address is used in particular to record the country the website user is in and to set the default website language accordingly. Furthermore, in case of any attacks on the network infrastructure of www.sac-cas.ch, the IP address is analysed for statistical purposes.

Over and above this, when you visit our website we use pixels and cookies to display personalised advertising and to use Web analysis services. More details on this are available in sections 2, 6 and 7 of this data protection policy.

b. when using our membership form

You have the option of using a membership form to become a member of our club. The following personal data must be entered without fail:

• Title
• First name and surname
• Date of birth
• E-mail address
• Address (additional address line (optional), street, house number, town, postcode, country)
• Telephone number (optional)
• Other non-personal data which is required for recording membership (membership from, section and membership)

We will flag the mandatory entries: if this information is not made available, this can hinder the provision of our services. Providing other information is optional and has no influence on your use of our website.

We only use this data to activate your membership. We have a legitimate interest within the meaning of Art. 6(1)(f) GDPR where processing your membership application is concerned. You can revoke your consent for processing said data at any time (see section 11 below for contact details).

c. when signing up for our newsletter

On our website, you have the opportunity to sign up for our newsletter. You need to register for this purpose. The following data must be provided as part of the registration process:

• E-mail address
• Title
• First name and surname
• Other non-personal data but which is required to send the newsletter (language)

The above data is required to send the newsletter.

By registering, you are giving us your consent to process the specified data for the purpose of regularly sending you the newsletter to the address specified by you and for the statistical analysis of user behaviour and optimisation of the newsletter. Said consent constitutes our legal basis for processing your e-mail address within the meaning of Art. 6(1)(a) GDPR. We are entitled to commission third parties with the technical execution of advertising measures and are entitled to pass on your data for this purpose (cf. section 3 below).

There is a link at the bottom of every newsletter which allows you to unsubscribe from it at any time. You can voluntarily tell us your reason for unsubscribing during this process. Your personal data will be deleted once you have unsubscribed. Any further processing thereof will only occur in anonymised form for the purpose of optimising our newsletter.

We expressly refer to the data analyses performed in the context of sending the newsletter (see section 9 below).

d. when making a purchase in our online shop, as well as a subscription to our magazine "The Alps".

You can order various SAC items via the online shop (books, season tickets for our touring portal, etc.). The following data must be provided in order to enable payment and delivery of the items ordered:

• Title and/or company
• First name and surname
• Address (street, house number, postcode, town, country)
• Other contact details (e-mail address, telephone number)
• Possibly credit card details

We will flag the mandatory entries: if this information is not made available, this can hinder the provision of the booking services. Providing other information is optional and has no influence on your use of our website.

The data entered by you is as a rule collected directly by the corresponding supplier or forwarded to them by us in case of certain products and services. In such cases, the data protection regulations of the corresponding supplier apply to such further processing of data. The legal basis for processing the aforementioned data lies in performing a contract within the meaning of Art. 6(1)(b) GDPR.

e. when making an entry in “Suche & Biete” (search & offer)

On our website, you have the opportunity to enter an advertisement in the “Suche & Biete” module. The following data must be entered:

• First name and surname
• E-mail address
• Telephone number
• Contact
• Other non-personal data but which is required for entering the advertisement (category, title, description, appendix (voluntary))

The above data is required to guarantee this service correctly.

By entering it, you are giving us your consent to edit the specified data for publishing your advertisement on our website. Said consent constitutes our legal basis for processing your e-mail address within the meaning of Art. 6(1)(a) GDPR.

f. when using our contact form

You have the option of using a contact form to get in touch with us. The following personal data must be entered without fail:

• Title
• First name and surname
• E-mail address
• Telephone number (optional)
• Other non-personal data but which is required for the contact request (comment)

We will flag the mandatory entries: if this information is not made available, this can hinder the provision of our services. Providing other information is optional and has no influence on your use of our website.

We only use this data so that we can provide a personalised response to your contact request in the best possible way. We have a legitimate interest within the meaning of Art. 6(1)(f) GDPR where processing your contact request is concerned. You can revoke your consent for processing said data at any time (see section 11 below for contact details).

g. when registering for a training course

You can register for courses in our course programme. The following data must be provided in order to enable payment and reservation of the relevant course:

• Title and/or company
• First name and surname
• E-mail address
• Address (additional address line (optional), street, house number, town, postcode, country)
• Telephone number (optional)
• Date of birth
• Possibly credit card details

We will flag the mandatory entries. If this information is not made available, this can hinder the provision of the booking services. Providing other information is optional and has no influence on your use of our website.

We only use this data to enter your registration for the course. We have a legitimate interest within the meaning of Art. 6(1)(f) GDPR where processing your registration request is concerned. You can revoke your consent for processing said data at any time (see section 11 below for login credentials).

h. when making a hut reservation

The hut reservation system – a joint venture between the Swiss Alpine Club SAC and other CAA Alpine clubs – is hosted outside the website www.sac-cas.ch and is accessible at https://www.alpsonline.org. That is why the specific privacy policy for using this application is available on the hut reservation system website. We refer to the fact that when making a booking for a private hut (non-SAC hut), the legal basis for processing the aforementioned data lies in the performance of a contract within the meaning of Art. 6 (1)(b) GDPR.

i. when creating and updating a user profile

You have the opportunity to create your login in order to use various services and centrally manage your data. The following personal data must be entered without fail:

• First name and surname
• E-mail address
• Password
• Title
• Address (additional address line (optional), street, house number, town, postcode, country)
• Telephone number
• Other user data

We will flag the mandatory entries: if this information is not made available, this can hinder the provision of our services. Providing other information is optional and has no influence on your use of our website.

j. by registering as an athlete

On our website, you have the opportunity to register as an athlete. The following data must be provided as part of the registration process:

• E-mail address
• First name and surname
• Date of birth
• Address (additional address line (optional), street, house number, town, postcode, country)
• Telephone number (optional)
• Nationality
• Sex
• Profile picture (optional)
• Website, Facebook, Twitter, Instagram, YouTube, Video iframe (optional)
• Other non-personal data but which is required to send the newsletter (SAC Section)

The above data is required for the correct registration of the athlete. 

By registering, you are giving us your consent to process the specified data in an external database for the purpose of regular participations to competitions. Said consent constitutes our legal basis for processing your data within the meaning of Art. 6(1)(a) GDPR, and we are entitled to pass on your data for this purpose (cf. section 3 below). You also consent to the publication of photos and videos taken during the competitions.

We only use this data in order to be able to create your login for our website. We have a legitimate interest within the meaning of Art. 6(1)(f) GDPR where processing your contact request is concerned. You can revoke your consent for processing said data at any time (see section 11 below for login credentials).

k. when making donations

The SAC collects the following data when donations are made by post or via QR payment slip to our donation account or via e-banking to our donation account: Surname, first name, street, postcode, town, donation amount. For online donations via our website, the following data is collected using the donation form: Surname, first name, street, postcode, town, country, date of birth (voluntary), e-mail address, membership number (voluntary), donation amount. The SAC uses the data for the purpose of business processing. The legal basis is based on the fulfilment of the contract (Art. 6 para. 1 lit. b GDPR or Art. 13 para. 2 lit. a FADP or Art. 31 para. 2 lit. a revFADP). The data will be deleted after the statutory retention period has expired. If deletion is not possible, the data will be archived and access rights will be restricted as far as possible. You can object to the use of the data collected for donation purposes at any time (e-mail to spenden@sac-cas.ch).

l. when using the SAC-CAS App

The following Privacy Policy explains which data is collected and processed when using the SAC-CAS App, and for which purpose.

1. Data collection: what data is collected?

• Push notifications: The user can request to be notified by the SAC-CAS App by means of push notifications. In doing so, the app "subscribes" to the corresponding channel by means of an anonymous token at Apple or Google.  Such a subscription only occurs if the user explicitly agrees to receive push notifications in the app. If the user gives such consent, they will be notified via the notification services provided by Apple or Google when a notification is available. The use of Apple's Push Notification Service or Google's Cloud Messaging Services requires the processing of personal data by the aforementioned companies.
• Firebase Analytics and Crashlytics: The SAC-CAS App may optionally use Google Analytics for Firebase and Firebase Crashlytics. Google Analytics for Firebase is used in order to further develop our products in the most suitable way for you. Firebase Crashlytics is used to improve the stability and reliability of our app. For this purpose, anonymous information is transmitted to Google's servers and stored there. This information does not contain any personal data. Google is certified under the Privacy Shield Agreement and thereby offers a guarantee of compliance with European data protection law. Google will use this information to evaluate your use of the SAC-CAS App, compile activity reports and provide crash data to the SAC as the operator of the app. This usage data forms the basis for statistical, anonymous evaluations to identify trends, which can be used to improve the service accordingly. Google may also transmit this information to third parties.

The user can choose whether Google Analytics for Firebase and Firebase Crashlytics may be used when the app is started for the first time. The user can deactivate the use of Google Analytics for Firebase and Firebase Crashlytics in the app settings at any time.

For further information on data privacy, please refer to the Firebase Privacy Policy: https://firebase.google.com/support/privacy

2. Authorisations (access rights)

The authorisations (access rights) listed below are required for various features:  

• Internet connection (mobile network / WIFI): In order to use the map tiles online and download the map tiles and data for permanent off-line use, internet access is required to download data to your device. An internet connection is also necessary for updating outdated map tiles and data, displaying elevation data, accessing the public transport timetable information for stops, accessing the local weather report, searching for locations and linking to points of interest (POIs).
• Location: The app uses the location services on your device to pinpoint your current location and for track recording. Location services are connected to the app via the standard interface of the operating system. Google location services will also be used if they are allowed on the device. Location data is used by the app for the above-mentioned features only. You can deactivate access to location data in your device settings at any time.
• Camera: Access to the camera is required in order to use some features of the SAC-CAS App. The data is used to operate the app and is not shared, but may however be used for digital purposes.
• Compass: Access to the compass on your device is used specifically for the purpose of accurate map orientation.

3. Deleting data

Users can delete the app themselves. Uninstalling the app will result in all data being deleted from your device. Data that has been explicitly stored in a directory outside the app must be deleted manually.  

4. Disclosure of personal data to third parties

The Swiss Alpine Club uses the data for the sole purpose of operating the SAC-CAS App. Data will not be passed on to third parties, but may be used by the SAC for digital purposes.

5. Responsibilities

The Swiss Alpine Club SAC is responsible for data privacy.

a. Creating pseudonymised user profiles

In order to provide you with personalised services and information on our website (on-site targeting), we use and analyse the data which we collect about you when you visit the website. When processing said data, cookies may also be used (see section 6 below for details). Analysing your user behaviour can lead to the creation of a user profile. Merging of user data only occurs with pseudonymous personal data but never with non-pseudonymised personal data.

In order to enable personalised marketing on social networks, we incorporate remarketing pixels of Facebook and Twitter on our website. If you have an account with a social network integrated in this way and are logged in to said social network when you visit our website, this pixel will associate the page visit with your account. Log out of your corresponding account before visiting our website in order to prevent any such link being made. You can change other advertising settings in your accounts with the respective social networks. We base the creation of pseudonymised user profiles for advertising and analysis purposes on a legitimate interest within the meaning of Art. 6(1)(f) GDPR. This applies to all data processing procedures listed in section 2 of this document. The legitimate interest consists of the direct marketing and analysis of the use of our website.

b. Retargeting

We use retargeting technologies on our website. Your user behaviour on our website is analysed during this process, in order to subsequently be able to also offer you personalised advertising on partner websites. Your user behaviour is recorded pseudonymously during this process.

Most retargeting technologies work with cookies (see section 6 below for more information).

This website uses Google AdWords Remarketing and DoubleClick by Google, both of which are services offered by Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (hereinafter referred to as “Google”), to display advertisements based on the use of websites previously visited. To that end, Google uses a DoubleClick cookie, which enables your browser to be recognised when you visit other websites. The information generated by the cookie on your visits to these websites (including your IP address) is transferred to a Google server in the USA and stored there (additional information on the transfer of personal data to the USA is available in section 10 hereof).

Google will use this information to evaluate your use of the website with a view to determining the advertisements to be displayed, to compile reports on website activity and advertisements for website operators and to provide other website use and Internet use-related services. Google may also pass on this information to third parties if it is a legal requirement to do so or where such third parties process this data on Google's behalf. Google will not, however, associate your IP address with any other data held by Google under any circumstances.

We also use Google Tag Manager to manage the user-based advertising services. The Tool Tag Manager itself is a cookieless domain and does not capture any personal data, but rather the tool triggers other tags which for their part possibly capture data (see above for more details). If you have disabled anything on domain or cookie level, it stays in place for all tracking tags which are implemented using the Google Tag Manager.

You can prevent retargeting at any time by disabling or turning off the relevant cookies in your browser’s menu bar (cf. section 6 below). In addition, you can visit the website of the Digital Advertising Alliance at http://optout.aboutads.info to request an opt-out for the other specified advertising and retargeting tools.

We only pass on your personal data if you have expressly consented to this, if there is a legal obligation to do so or if this is required to enforce our rights, in particular to enforce claims arising from the relationship between you and the Swiss Alpine Club SAC.

Over and above this, we pass on your personal data to third parties, insofar as this is required in the context of using the website to provide you with the desired services and to analyse your user behaviour. Insofar as this is required for the purposes specified in sentence 1 above, said data may also be passed on to authorised third parties abroad. If the website contains links to third-party websites and you click on any of them, Swiss Alpine Club has no more influence over the capture, processing, storage or use of personal data by the relevant third parties and no responsibility whatsoever in this respect.

Swiss Alpine Club SAC is also entitled to transfer your personal data to third-party companies (contracted service providers) abroad, insofar as this is required for processing data as defined in this Privacy Policy. Said service providers undertake to guarantee data protection within the same scope as ourselves. If the data protection level in a particular country does not match Swiss or European standards, we shall ensure by means of a contract that protection of your personal data matches the level stipulated by legislation of Switzerland or the EU.

We make use of suitable technical and organisational security measures, in order to protect your personal data stored by us against manipulation, partial or total loss and unauthorised access by third parties. Our security measures are being continually improved in line with technological developments.

You should always treat your payment information confidentially and close the browser window when you have completed the transaction with us, especially if you share the computer with others.

We also take in-house data protection very seriously. We have obliged our employees and the service providers contracted by us to maintain secrecy and adhere to data protection legislation.

Overview of cookies used on the SAC website.

Cookies make your visit to our website simpler, more pleasant and more meaningful in many respects. Cookies are information files which your browser automatically stores on your computer's hard drive when you visit our website. Cookies neither damage your computer's hard drive nor do they transfer to us personal user data.

For example, we use cookies to better tailor the information, offers and advertising to your personal interests. The use thereof does not result in us receiving new personal data about you as a visitor to our website. Most Web browsers accept cookies automatically. However, you can configure your browser in such a way that no cookies are stored on your computer or you are always notified when you receive a new cookie.

Disabling cookies may mean that you cannot use all of our website’s functions.

We are not able to guarantee the quality of our services on our website if you do not accept cookies, but we guarantee the anonymization of personal data.

We use various tracking tools on our website. These tracking tools are used to track your browsing behaviour on our website. This tracking is performed for the purpose of tailoring our website to users’ needs and continuously optimising it. In this context, pseudonymised user profiles are created and small text files which are stored on your computer (cookies) are used.Our website uses Google Analytics by Google Inc., 1600 Amphitheatre Parkway Mountain View, CA 94043, USA, to analyse website usage. The measurements can be performed anonymously or in a way which identifies individual users. Cookies are used during this process which are stored on your device. The information collected by cookies is sent to a Google server in the USA and stored there.

This website uses IP anonymisation. Your IP address is shortened within Member States of the EU and the European Economic Area. This means that you cannot be identified based on your IP address. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and shortened there. In the context of the agreement on the order data agreement, which the website operators have concluded with Google Inc., the latter compiles an assessment of website usage and activity with the help of the information collected and provides Internet usage-related services.

You can disable the use of these cookies by changing the relevant settings in your browser. To do so, download and install the browser plug-in by following the link below: http://tools.google.com/dlpage/gaoptout.

More detailed information on the terms of use and privacy policy is available via the Google Analytics conditions under the Google Analytics overview.

The social plug-ins described below are used on the website. The plug-ins are disabled by default on our website and do not therefore send any data. You can enable the plug-ins by clicking on the relevant social media button.
If these plug-ins are enabled, your browser will establish a direct connection with the servers of the social network in question as soon as you visit one of our websites. The social network sends the content of the plug-in directly to your browser which incorporates it into the website. The plug-ins can be disabled again with one click.

Further information can be found in the privacy policies of Facebook, Twitter and Google respectively.

a. Social plug-ins of Facebook

Social plug-ins of Facebook are used on this website to make our website more personal. We use the “LIKE” or “SHARE” button for this purpose. This is an offer of the American company Facebook Inc., 1601 S. California Ave, Palo Alto, CA 94304, USA.

By integrating the plug-ins, Facebook is informed that your browser displayed the relevant page of our website, even if you do not have a Facebook account or are not currently logged in to Facebook. This information (including your IP address) is sent directly by your browser to a Facebook server in the USA and stored there.

If you are logged in to Facebook, Facebook can directly link your visit to our website with your Facebook account. If you interact with the plugins, for example by pressing the “LIKE” or “SHARE” button, the relevant information is sent directly to a Facebook server and stored there. The information is also published on Facebook and shown to your Facebook friends.

Facebook can use this information for the purpose of marketing, market research and needs-based design of the Facebook pages. To that end, Facebook creates user profiles based on interests and relationships, e.g. in order to evaluate your use of our website as regards the advertisements shown to you on Facebook, to inform other Facebook users about your activities on our website and to provide other services associated with using Facebook.

If you do not want Facebook to associate the data collected via our website with your Facebook account, you need to log out of Facebook before visiting our website.

Please see Facebook’s Privacy Policy for the purpose and scope of the data captured and the further processing and use of the data by Facebook, as well as your associated rights and configuration options to protect your privacy.

To send our newsletter, we use the e-mail marketing services of MailChimp, a marketing automation service of the Rocket Science Group LLC, 675 Ponce de Leon Ave NE, Suite 5000, Atlanta, GA 30308, USA. Our newsletter may therefore contain a Web beacon (tracking pixel) or similar technical aids. A Web beacon is an invisible graphic image 1x1 pixels in size which is linked to the user ID of the relevant newsletter subscriber.

The use of such services enables an assessment to be made as to whether or not the e-mails were opened with our newsletter. Over and above this, it can also be used to record and evaluate the click patterns of newsletter recipients. We use this data for statistical purposes and to optimise the newsletter in terms of its content and structure. This enables us to better tailor the information and offers in our newsletter to the relevant recipient’s personal interests. The tracking pixel is deleted when you delete the newsletter.

In order to disable tracking pixels in our newsletter, please change your e-mail client’s settings so that no HTML text is displayed.

In order to be fully transparent, we would like to point out to users with their place of residence or registered office in Switzerland that there are monitoring measures in place in the USA by the US Authorities which generally enable the storage of all personal data of anyone whose data has been transferred from Switzerland to the USA. This occurs without any distinctions, limitations or exceptions based on the stated objective and without any objective criteria which would make it possible to limit the US authorities’ access to the data and later use thereof to a very specific, strictly limited purpose which would legitimise the intervention associated with accessing said data and the use thereof. We would also like to point out that there are no legal remedies available in the USA to persons from Switzerland affected by this which would allow them to receive access to the relevant data and to have it corrected or deleted; there is also no effective judicial legal protection against general access rights on the part of the US authorities. We explicitly point out this legal situation and these facts to those affected, so that they can consequently make an informed decision on whether or not to give their consent for their data to be used in this way.

We would like to point out to users residing in an EU Member State that – from the point of view of the European Union – the USA does not have an adequate level of data protection, due among other things to the issues dealt with in this paragraph. Insofar as we have explained in this Privacy Policy that data recipients (such as Google, Facebook, MailChimp and Twitter) have their registered office in the USA, we will ensure that your data held by our partners is given an adequate level of protection – either through contractual regulations on these companies or by ensuring that they are certified under the EU-US Privacy Shield.

You have the right to receive free information on request about your personal data stored by us. In addition, you have the right to have incorrect data corrected and the right to have your personal data deleted, unless this is in direct conflict with any legal retention obligation or where the law specifically allows us to process the data. In accordance with articles 18 and 21 GDPR, you also have the right to request limited data processing or to object to any data processing whatsoever.

You also have the right to request that we return to you any data which you gave to us (right to data portability). On request, we will also pass the data on to a third party of your choice. You have the right to receive the data in a common file format.

You can contact us for the aforementioned purposes via the e-mail address datenschutz(at)sac-cas.ch.  We may at our own discretion request proof of your identity before we process your requests.

You can also tell us what you would like to happen to your data after your death by giving us relevant instructions.

We only store personal data for as long as is necessary

• to use the above-mentioned tracking, advertising and analysis services in the context of our legitimate interest;
• to provide services within the above-mentioned scope which you requested or consented to (e.g. to receive newsletters pursuant to section 9);
• to meet our legal obligations.

We retain contractual data for a longer period as this is required of us by our legal retention obligations. Retention obligations which oblige us to retain data arise from accounting regulations and tax legislation. In accordance with these regulations, business communications, contracts entered into and accounting documents must be retained for up to 10 years. Users residing in France must retain said documents for up to five years. Insofar as we no longer require said data to perform services for you, access to said data will be blocked. This means that said data will then only be allowed to be used for purposes relating to accounting and taxes.

If you are residing in an EU Member State, you have the right to lodge an appeal with a data protection supervisory authority at any time.

Amending the Privacy Policy

We reserve the right to amend this Privacy Policy at any time. We therefore recommend that you review this Policy on a regular basis. This page was last amended on 12 July 2020.

General points

If you have any questions or comments about our legal disclaimer or this Privacy Policy, please contact us by sending an e-mail to: datenschutz(at)sac-cas.ch.

Netiquette

We do not want to read any illegal, offensive or punishable statements and discussions on our website. In the event that any users, our organisation or third parties are defamed, we reserve the right to delete such contributions without making any comment.