Privacy policy

Privacy policy and consent to the use of data on www.bernina-granturismo.com of the company Internationale St. Moritzer Automobilwochen AG.

1. What is this privacy policy about?

Internationale St. Moritzer Automobilwochen AG (hereinafter also referred to as "we", "us") obtains and processes personal data concerning you or other persons (so-called "third parties"). We use the term "data" here synonymously with "personal data".

In this Privacy Policy, we describe what we do with your data when you use www.bernina-granturismo.com, other websites of ours or our apps (hereinafter collectively referred to as "Website"), purchase our services or products, are otherwise in contact with us under a contract, communicate with us or otherwise deal with us. Where appropriate, we will provide you with timely written notice of additional processing activities not mentioned in this Privacy Policy. In addition, we may inform you separately about the processing of your data, e.g. in declarations of consent, contractual terms, additional data protection declarations, forms and notices.

If you transmit or disclose data about other persons, such as family members, work colleagues, etc., we assume that you are authorised to do so and that this data is correct. By transmitting data about third parties, you confirm this. Please also ensure that these third parties have been informed about this privacy policy.

This Privacy Policy is designed to meet the requirements of the EU General Data Protection Regulation ("GDPR"), the Swiss Data Protection Act ("DPA") and the revised Swiss Data Protection Act ("revDSG"). However, whether and to what extent these laws are applicable depends on the individual case.

2. Who is responsible for processing your data?

The Internationale St. Moritzer Automobilwochen AG in St. Moritz is responsible under data protection law for the data processing of www.bernina-granturismo.com described in this data protection declaration, unless otherwise communicated in individual cases, e.g. in other data protection declarations, on forms or in contracts.

You can contact our data protection officer as follows for your data protection concerns and to exercise your rights in accordance with section 11:

Data Protection Officer pursuant to Art. 37 et seq. GDPR, Art. 10 revDSG, EU pursuant to Art. 27 GDPR, Switzerland pursuant to Art. 14 revDSG, United Kingdom (UK) pursuant to Art. 27 UK GDPR:

Internationale St. Moritzer Automobilwochen AG
Data Protection Officer
Via Maistra 7
7500 St. Moritz

info@bernina-granturismo.com

3. What data do we process?

We process different categories of data about you. The most important categories are as follows:

Technical data

When you use our website or other electronic services, we collect technical data from your end device in order to ensure the functionality and security of these services. This data also includes logs in which the use of our systems is recorded. We generally store technical data for [1-14] months. To ensure the functionality of these services, we may also assign you or your end device a personalised code (e.g. in the form of a cookie, see section 12). The technical data itself does not allow any conclusions to be drawn about your identity. However, in the context of user accounts, registrations, access controls or the processing of contracts, they can be linked to other data categories (and thus possibly to your person).

Registration data

Certain offers, e.g. competitions and services (e.g. login areas of our website, newsletter dispatch, free WLAN access, etc.) can generally only be used with a user account or registration, which can be done directly with us or via our external login service providers. In doing so, you must provide us with certain data and we collect data on the use of the offer or service. We generally retain registration data for [1-14] months after the end of the use of the service or the cancellation of the user account. This period may be longer if this is necessary for reasons of proof or to comply with legal or contractual requirements or for technical reasons. This data is generally stored for at least [10] years.

Communication data

If you are in contact with us via the contact form, by email, telephone or chat, by letter or by other means of communication, we record the data exchanged between you and us, including your contact details and the marginal data of the communication. If we record or listen in on telephone conversations or video conferences, e.g. for training and quality assurance purposes, we will make you aware of this. Such recordings may only be made and used in accordance with our internal guidelines. You will be informed if and when such recordings take place, e.g. by a display during the relevant video conference. If you do not wish to be recorded, please let us know or end your participation. If you simply do not wish your image to be recorded, please switch off your camera. If we want or need to establish your identity, e.g. if you request information, apply for media access, etc., we will collect data to identify you (e.g. a copy of your ID). We generally store this data for [1-14] months from the last exchange with you. This period may be longer if this is necessary for reasons of proof or to comply with legal or contractual requirements or for technical reasons. E-mails in personal mailboxes and written correspondence are generally stored for at least [10] years.

Master data

We define master data as the basic data that we require in addition to the contractual data (see below) for the processing of our contractual and other business relationships or for marketing and advertising purposes, such as name, contact details and information, e.g. about your role and function, your bank account(s), your date of birth, customer history, powers of attorney, signature authorisations and declarations of consent. We process your master data if you are a customer or other business contact or work for one (e.g. as a contact person of the business partner), or because we want to contact you for our own purposes or the purposes of a contractual partner (e.g. as part of marketing and advertising, with invitations to events, with vouchers, with newsletters, etc.). We receive master data from you (e.g. when you make a purchase or register), from organisations for which you work or from third parties such as our contractual partners, associations and address dealers and from publicly accessible sources such as public registers or the internet (websites, social media, etc.). We may also process health data and information about third parties as part of master data. We may also collect master data from our shareholders and investors. We generally retain this data for [10] years from the last exchange with you, but at least from the end of the contract. This period may be longer if this is necessary for reasons of proof or to comply with legal or contractual requirements or for technical reasons. In the case of pure marketing and advertising contacts, the period is normally much shorter, usually no more than [2] years from the last contact.

Contract data

This is data that arises in connection with the conclusion or processing of a contract, e.g. information on contracts and the services to be provided or provided, as well as data from the run-up to the conclusion of a contract, the information required or used for processing and information on reactions (e.g. complaints or information on satisfaction, etc.). We generally collect this data from you, from contractual partners and from third parties involved in the fulfilment of the contract, but also from third-party sources (e.g. providers of creditworthiness data) and from publicly accessible sources. As a rule, we store this data for [10] years from the last contractual activity, but at least from the end of the contract. This period may be longer if this is necessary for reasons of proof or to comply with legal or contractual requirements or for technical reasons.

Behavioural and preference data

Depending on the relationship we have with you, we try to get to know you and better tailor our products, services and offers to you. To do this, we collect and use data about your behaviour and preferences. We do this by evaluating information about your behaviour in our area, and we may also supplement this information with data from third parties, including from publicly accessible sources. Based on this, we can, for example, calculate the probability that you will use certain services or behave in a certain way. Some of the data processed for this purpose is already known to us (e.g. when you use our services), or we obtain this data by recording your behaviour (e.g. how you navigate our website or on our social media portals). We anonymise or delete this data when it is no longer relevant for the purposes pursued, which can be between [2-3] weeks and [24] months (for product and service preferences), depending on the type of data. This period may be longer if this is necessary for reasons of proof or to comply with legal or contractual requirements or for technical reasons. We describe how tracking works on our website in section 12.

Other data

We also collect data from you in other situations. In connection with official or court proceedings, for example, data is collected (such as files, evidence, etc.) that may also relate to you. We may also collect data for health protection reasons (e.g. as part of protection concepts). We may receive or produce photos, videos and audio recordings in which you may be recognisable (e.g. at events, through security cameras, etc.). We may also collect data about who enters certain buildings or has access rights to them and when (including during access controls, based on registration data or visitor lists, etc.), who takes part in events or campaigns (e.g. competitions) and when, or who uses our infrastructure and systems and when. Finally, we collect and process data about our shareholders and other investors; in addition to master data, this includes information for the relevant registers, regarding the exercise of their rights and the organisation of events (e.g. general meetings). The retention period for this data depends on the purpose and is limited to what is necessary. This ranges from a few days for many of the security cameras and usually a few weeks for contact tracing data to visitor data, which is usually stored for [3] months, to reports on events with images, which can be stored for several years or longer.

You provide us with much of the data mentioned in this Section 3 yourself (e.g. via forms, in the context of communication with us, in connection with contracts, when using the website, etc.). You are not obliged to do so, subject to individual cases, e.g. in the context of binding protection concepts (legal obligations). If you wish to conclude contracts with us or make use of services, you must also provide us with data as part of your contractual obligation in accordance with the relevant contract, in particular master data, contract data and registration data. When using our website, the processing of technical data is unavoidable. If you wish to gain access to certain systems or buildings, you must provide us with registration data.

Insofar as this is not unauthorised, we also obtain data from publicly accessible sources (e.g. debt collection registers, land registers, commercial registers, media or the Internet, including social media) or receive data from other companies within our group, from authorities and from other third parties (such as credit agencies, address dealers, associations, contractual partners, Internet analysis services, etc.).

4. For what purposes do we process your data?

We process your data for the purposes explained below. Further information for the online area can be found in sections 12 and 13. These purposes and the underlying objectives represent legitimate interests on our part and, where applicable, on the part of third parties. You will find further information on the legal basis of our processing in Section 5.

We process your data for purposes related to communication with you, in particular to respond to enquiries and assert your rights (Section 11) and to contact you in the event of queries. In particular, we use communication data and master data for this purpose and, in connection with offers and services used by you, also registration data. We retain this data in order to document our communication with you, for training purposes, for quality assurance and for enquiries. We process data for the initiation, administration and processing of contractual relationships.

We process data for marketing purposes and to maintain relationships, e.g. to send our customers and other contractual partners personalised advertising about our products and services and those of third parties (e.g. advertising contractual partners). This may, for example, take the form of newsletters and other regular contacts (electronically, by post, by telephone), via other channels for which we have contact information from you, but also as part of individual marketing campaigns (e.g. events, competitions, etc.) and may also include free services (e.g. invitations, vouchers, etc.). You can refuse such contacts at any time (see the end of this section 4) or refuse or revoke your consent to be contacted for advertising purposes. With your consent, we can target our online advertising on the Internet more specifically to you (see section 12). We also process your data for market research, to improve our services and operations and for product development. We may also process your data for security purposes and for access control. We process personal data to comply with laws, instructions and recommendations from authorities and internal regulations ("compliance"). We also process data for the purposes of our risk management and in the context of prudent corporate governance, including business organisation and corporate development.

5. On what basis do we process your data?

If we ask for your consent for certain processing, we will inform you separately about the corresponding purposes of the processing. You can revoke your consent at any time with effect for the future by sending us written notification (by post) or, unless otherwise stated or agreed, by e-mail; our contact details can be found in Section 2. For the revocation of your consent for online tracking, see Section 12. If you have a user account, revocation or contact with us can also be carried out via the relevant website or other service. Once we have received notification of the withdrawal of your consent, we will no longer process your data for the purposes to which you originally consented, unless we have another legal basis for doing so. The withdrawal of your consent does not affect the lawfulness of processing based on consent before its withdrawal.

Where we do not ask for your consent for processing, we base the processing of your personal data on the fact that the processing is necessary for the initiation or execution of a contract with you (or the entity you represent) or that we or third parties have a legitimate interest in it, in particular in order to pursue the purposes and associated objectives described above under Section 4 and to be able to implement corresponding measures. Our legitimate interests also include compliance with statutory provisions, unless this is already recognised as a legal basis by the applicable data protection law (e.g. in the case of the GDPR, the law in the EEA and Switzerland).

If we receive sensitive data, we may also process your data on the basis of other legal grounds, e.g. in the event of disputes due to the necessity of processing for possible litigation or the enforcement or defence of legal claims. In individual cases, other legal grounds may apply, which we will communicate to you separately if necessary.

6. What applies to profiling and automated individual decisions?

We may automatically evaluate certain of your personal characteristics for the purposes mentioned in Section 4 using your data (Section 3) ("profiling") if we want to determine preference data, but also to determine risks of misuse and security risks, to carry out statistical analyses or for operational planning purposes. For the same purposes, we can also create profiles, i.e. we can combine behavioural and preference data, but also master and contract data and technical data assigned to you in order to better understand you as a person with your different interests and other characteristics.

If you are one of our customers, we can, for example, use "profiling" to determine which other products you are likely to be interested in based on your purchases. We can also use this to check your creditworthiness before offering you a purchase on account. For your protection, an automated analysis of data can also check the likelihood of a particular transaction being fraudulent. This allows us to stop the transaction for clarification. This is to be distinguished from "profiles". This refers to the linking of various data in order to gain information about key aspects of your personality (e.g. what you like or how you behave in certain situations) from the totality of this data. Profiles can also be used for marketing and security purposes, for example.

We use anonymous movement profiles in a non-personalised manner, for example to provide our contractual partners with recommendations on how to avoid peak times. For personalised movement profiles, we use personal data, e.g. to draw attention to interesting offers and products in your vicinity, to infer your interests from the position data (dwell time) and to inform you which products and services other contractual partners with similar interests have used.

In both cases, we pay attention to the proportionality and reliability of the results and take measures to prevent misuse of these profiles or profiling. If these can have legal consequences or significant disadvantages for you, we always provide for a manual review.

7. To whom do we disclose your data?

In connection with our contracts, the website, our services and products, our legal obligations or otherwise to protect our legitimate interests and the other purposes listed in Section 4, we also transfer your personal data to third parties, in particular to the following categories of recipients:

Service provider

We work with service providers in Germany and abroad who process data about you on our behalf or under joint responsibility with us or who receive data about you from us under their own responsibility.

To enable us to provide our products and services efficiently and focus on our core competences, we procure services from third parties in numerous areas. These services include IT services, the dispatch of information, marketing, sales, communication and printing services, building management, security and cleaning, the organisation and staging of events and receptions, debt collection, credit agencies, address verifiers (e.g. to update address databases when relocating), anti-fraud measures and services from consulting firms, lawyers, banks, insurers and telecommunications companies. We provide these service providers with the data required for their services, which may also relate to you. These service providers may also use such data for their own purposes, e.g. information about outstanding debts and your payment behaviour in the case of credit agencies or anonymised information to improve services. In addition, we conclude contracts with these service providers that include provisions for the protection of data, insofar as this does not arise from the law. Our service providers may also process data on how their services are used and other data generated in the course of using their services as independent controllers for their own legitimate interests (e.g. for statistical analyses or billing). Service providers provide information about their independent data processing in their own data protection declarations.

Contractual partners including customers

This initially refers to customers (e.g. service recipients) and other contractual partners of ours, because this data transfer arises from these contracts. For example, you receive registration data for vouchers issued and redeemed, invitations, etc. If you work for such a contractual partner yourself, we may also transmit data about you to them in this context.

Authorities

We may disclose personal data to offices, courts and other authorities in Switzerland and abroad if we are legally obliged or authorised to do so or if this appears necessary to protect our interests. The authorities process data about you that they receive from us on their own responsibility.

Other people

This refers to other cases where the involvement of third parties arises from the purposes in accordance with section 4

All these categories of recipients may in turn involve third parties, so that your data may also become accessible to them. We can restrict the processing by certain third parties (e.g. IT providers), but not by other third parties (e.g. authorities, banks, etc.).

8. Will your personal data also be sent abroad?

As explained in section 7, we also disclose data to other organisations. These are not only located in Switzerland. Your data may therefore be processed in Europe, but in exceptional cases in any country in the world.

If a recipient is located in a country without adequate statutory data protection, we contractually oblige the recipient to comply with the applicable data protection regulations (we use the revised standard contractual clauses of the European Commission, which are available here: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?), unless the recipient is already subject to a legally recognised set of rules to ensure data protection and we cannot rely on an exemption clause. An exception may apply in particular in the case of legal proceedings abroad, but also in cases of overriding public interests or if the fulfilment of a contract requires such disclosure, if you have given your consent or if the data in question has been made generally accessible by you and you have not objected to its processing.

Please also note that data exchanged via the Internet is often routed via third countries. Your data may therefore be sent abroad even if the sender and recipient are located in the same country.

9. How long do we process your data?

We process your data for as long as required by our processing purposes, the statutory retention periods and our legitimate interests in processing for documentation and evidence purposes or if storage is technically necessary. Further information on the respective storage and processing periods can be found for the individual data categories in section 3 or for the cookie categories in section 12. If there are no legal or contractual obligations to the contrary, we will delete or anonymise your data after the storage or processing period has expired as part of our normal processes.

Documentation and evidence purposes include our interest in documenting processes, interactions and other facts in the event of legal claims, discrepancies, IT and infrastructure security purposes and proof of good corporate governance and compliance. Retention may be required for technical reasons if certain data cannot be separated from other data and we therefore need to retain it with this data (e.g. in the case of backups or document management systems)

10. How do we protect your data?

We take appropriate security measures to protect the confidentiality, integrity and availability of your personal data, to protect it against unauthorised or unlawful processing and to counteract the risks of loss, unintentional modification, unwanted disclosure or unauthorised access.

Security measures of a technical and organisational nature may include measures such as encryption (e.g. SSL, TLS) and pseudonymisation of data, logging, access restrictions, storage of backup copies, instructions to our employees, confidentiality agreements and controls. We protect your data transmitted via our website in transit using suitable encryption mechanisms. However, we can only secure areas that we control. We also oblige our contract processors to take appropriate security measures. However, security risks cannot be completely ruled out; residual risks are unavoidable.

11. What rights do you have?

Under certain circumstances, the applicable data protection law grants you the right to object to the processing of your data, in particular for the purposes of direct marketing, profiling for direct advertising and other legitimate interests in processing.

To make it easier for you to control the processing of your personal data, you also have the following rights in connection with our data processing, depending on the applicable data protection law:

The right to request information from us as to whether and which of your data we process;
the right to have us correct data if it is incorrect;
the right to request the deletion of data;
the right to obtain from us the personal data concerning you in a commonly used electronic format or to transmit those data to another controller;
the right to withdraw consent where our processing is based on your consent;
the right to receive, upon request, further information necessary for the exercise of these rights;
the right to express your point of view on automated individual decisions (point 6) and to request that the decision be reviewed by a natural person.

If you wish to exercise the above-mentioned rights against us, please contact us in writing, at our premises or, unless otherwise stated or agreed, by e-mail; our contact details can be found in Section 2. In order for us to rule out misuse, we must identify you (e.g. with a copy of your ID, unless otherwise possible).

Please note that these rights are subject to conditions, exceptions or restrictions under the applicable data protection law (e.g. to protect third parties or business secrets). We will inform you accordingly if necessary.

If you do not agree with our handling of your rights or data protection, please let us or our data protection officer (Section 2) know. In particular, if you are located in the EEA, the United Kingdom or Switzerland, you also have the right to lodge a complaint with the data protection supervisory authority in your country.

12. Do we use online tracking and online advertising techniques?

We use various technologies on our website with which we and third parties engaged by us can recognise you when you use our website and, under certain circumstances, track you over several visits. We will inform you about this in this section.

In essence, we want to be able to distinguish between access by you (via your system) and access by other users so that we can ensure the functionality of the website and carry out analyses and personalisation. We do not want to infer your identity, even if we can, if we or third parties engaged by us can identify you by combining this with registration data. Even without registration data, however, the technologies used are designed in such a way that you are recognised as an individual visitor each time you visit the website, for example by our server (or the servers of third parties) assigning you or your browser a specific identification number (so-called "cookie").

Cookies are individual codes (e.g. a serial number) that our server or a server of our service provider or advertising contract partner transmits to your system when you connect to our website and that your system (browser, mobile) receives and stores until the programmed expiry date. Each time you access our website again, your system transmits these codes to our server or the server of the third party. This allows you to be recognised, even if your identity is unknown.

Other techniques can also be used to recognise you with a greater or lesser degree of probability (i.e. to distinguish you from other users), e.g. "fingerprinting". Fingerprinting combines the browser you use, screen resolution, language selection and other information that your system communicates to each server, resulting in a more or less unique fingerprint. In this way, cookies can be dispensed with.

Whenever you access a server (e.g. when using a website or an app or because an image is visibly or invisibly integrated in an email), your visits can therefore be "tracked" (traced). If we integrate offers from a contractual advertising partner or provider of an analysis tool on our website, this partner can track you in the same way, even if you cannot be identified in individual cases.

We use such technologies on our website and allow certain third parties to do the same.

You can programme your browser to block or deceive certain cookies or alternative technologies or delete existing cookies. You can also add software to your browser that blocks tracking by certain third parties. You can find more information about this on the help pages of your browser (usually under the heading "Data protection") or on the websites of the third parties listed below.

A distinction is made between the following cookies (technologies with comparable functions such as fingerprinting are also included here):

Necessary cookies

Some cookies are necessary for the functioning of the website as such or for certain functions. For example, they ensure that you can switch between pages without losing the information entered in a form. They also ensure that you remain logged in. These cookies are only temporary ("session cookies"). If you block them, the website may not work. Other cookies are necessary so that the server can save decisions or entries made by you beyond a session (i.e. a visit to the website) if you use this function (e.g. selected language, consent given, the function for automatic log-in, etc.). These cookies have an expiry date of up to [24] months.

Performance cookies

In order to optimise our website and corresponding offers and to better tailor them to the needs of users, we use cookies to record and analyse the use of our website, possibly even beyond the session. We do this by using third-party analytics services. We have listed these below. Performance cookies also have an expiry date of up to [24] months. Details can be found on the websites of the third-party providers.

Marketing cookies

We and our advertising contract partners have an interest in targeting advertising precisely, i.e. only displaying it to those we want to address. We have listed our advertising contract partners below. For this purpose, we and our advertising contract partners also use cookies with which the content accessed or contracts concluded can be recorded. This enables us and our advertising partners to display adverts that we believe will be of interest to you, both on our website and on other websites that display adverts from us or our advertising partners. Depending on the situation, these cookies have an expiry period of a few days to [12] months.

In addition to marketing cookies, we use other techniques to control online advertising on other websites and thereby reduce wastage. For example, we can transmit the email addresses of our users, customers and other people to whom we want to display adverts to operators of advertising platforms (e.g. social media). If these people are registered there with the same email address (which the advertising platforms determine through a comparison), the operators display the adverts we have placed to these people in a targeted manner. The operators do not receive personal email addresses of people who are not already known. In the case of known email addresses, however, they will learn that these people are in contact with us and what content they have accessed.

We may also integrate other third-party offers on our website, in particular from social media providers. If you have an account with the social media provider, they can assign this information to you and thus track your use of online services. These social media providers process this data on their own responsibility.

We currently use offers from the following service providers and advertising contract partners:

Google Analytics

Google Ireland (based in Ireland) is the provider of the service and acts as our processor. Google Ireland relies on Google LLC (based in the USA) as its processor (both "Google"). Information on data protection can be found here [https://policies.google.com/].

Google Ads

Google Fonts

Google reCaptcha

Google Maps

Google Tag Manager

OneSignal Push Notification

OneSignal, Inc. (based in the USA) is the provider of the service and acts as our processor. Information on data protection can be found here [https://onesignal.com/privacy/].

13. What data do we process on our pages in social networks?

We may operate pages and other online presences ("fan pages", "channels", "profiles", etc.) on social networks and other platforms operated by third parties and collect the data about you described in Section 3 and below. We receive this data from you and the platforms when you come into contact with us via our online presence (e.g. when you communicate with us, comment on our content or visit our presence). At the same time, the platforms evaluate your use of our online presence and link this data with other data about you known to the platforms (e.g. about your behaviour and preferences). They also process this data for their own purposes under their own responsibility, in particular for marketing and market research purposes (e.g. to personalise advertising) and to control their platforms (e.g. which content they display to you).

We process this data for the purposes described in section 4, in particular for communication, for marketing purposes (including advertising on these platforms, see section 12) and for market research. You will find information on the relevant legal bases in section 5. We may redistribute content published by you (e.g. comments on an announcement) ourselves (e.g. in our advertising on the platform or elsewhere). We or the operators of the platforms may also delete or restrict content from or about you in accordance with the usage guidelines (e.g. inappropriate comments).

For further information on the processing carried out by the platform operators, please refer to the platforms' data protection notices. There you can also find out in which countries they process your data, which rights of access, erasure and other rights of data subjects you have and how you can exercise these or obtain further information.

We currently use the following platforms:

Facebook

Here we operate the website www.facebook.com/St-Moritz-Automobile-Week/100072001998743/#. The entity responsible for operating the platform for users from Europe is Meta Ireland Ltd, Dublin, Ireland. Their privacy policy is available at www.facebook.com/policy.

Youtube

Here we operate the website www.youtube.com/internationalest.moritzera9827. The controller for the operation of the platform for users from Europe is Google Ireland. Their privacy policy is available at https://www.youtube.com/howyoutubeworks/policies/.

Instagram

Here we operate the website www.instagram.com/stmoritzautomobileweek. The entity responsible for operating the platform for users from Europe is Meta Ireland Ltd, Dublin, Ireland. Their privacy policy is available at https://privacycenter.instagram.com/policy.

14. Can this privacy policy be amended?

This privacy policy is not part of any contract with you. We may amend this privacy policy at any time. The version published on this website is the current version.

Last update: April 2025