Privacy Policy The Five Loyalty Program

This privacy policy describes the processing of your personal data in relation to the Five
Loyalty Program of Grand Hotel des Bains Kempinski St. Moritz AG.

1. Scope
This Privacy Policy applies to the processing of personal data in relation to the Five
Loyalty Program of Grand Hotel des Bains Kempinski St. Moritz AG, only. It does not
apply to any processing of personal data related to the booking, stay, payment and
other aspects of administering your stay in Grand Hotel des Bains Kempinski St.
Moritz AG which is administered by Kempinski AG. If you have booked via a third
party (such as booking.com), this third party will process your data, as well. For any
questions regarding the processing of your personal data by Kempinski AG, please
refer directly to Kempinski and Kempinski’s Privacy Policy
https://www.kempinski.com/en/privacy-policy or the respective third party via which
you booked your stay at Grand Hotel des Bains Kempinski St. Moritz.
Controller, i.e. the person responsible for the processing of your personal data as
defined in Art. 5 of the Swiss Federal Act on Data Protection (FADP) as well as in Art.
4 of the EU General Data Protection Regulation (GDPR) is:
Grand Hotel des Bains Kempinski St. Moritz AG
Via Mezdi 33
7500 St. Moritz

2. Types of Personal Data, Purposes and legal basis for processing
By becoming a Member of the Five Loyalty Program, you consent to our processing
of the following of your personal data:
Name, Postal address, E-Mail address, date of birth, telephone number, preferences
for your stay, additional e-mail and postal address (e.g. business address), number
and duration of stays in our hotel, any revenue items (purchases made in the rooms,
spa and F&B, including date and amount).
We process these personal data in order to provide you with the benefits of the Five
Loyalty Membership as a reward for you for choosing to stay with us.
The legal basis for this data processing is your consent as described in Art. 6 FADP
and in Art. 6 paragraph 1 (a) GDPR.

You can withdraw your consent to the processing described, including to receive our
newsletter and special offers via e-mail, at any time by contacting us and terminating
your membership to the Five Loyalty Programme. Your withdrawal of consent will not
affect the lawfulness of our processing prior to the withdrawal.

3. Transfer of personal data to other persons
We will use your personal data collected in relation to the Five Loyalty Programme
only for the purpose as described above. We will not sell or disclose your personal
data to third parties.
In order to provide and manage the Five Loyalty programme, we work together with
the data processor Dailypoint, Toedt, Dr. Selk & Coll. GmbH, Augustenstr. 79, 80333
München (“dailypoint”). Part of our processing of your personal data happens on
servers of dailypoint in Germany. We have examined dailypoint’s measures taken to
guarantee data security and concluded processing agreements with dailypoint as
mentioned in Art. 9 FDAP in Art. 28 GDPR.
By becoming a Member of the Five Loyalty programme, you consent to this
processing by a data processor outside of Switzerland in the European Union.
We will share your personal data if and insofar as required by law or state authorities.

4. Retention
Your personal data will be saved for as long as it is necessary in view of the purposes
described in this privacy policy and insofar as we are legally required to retain your
personal data or part hereof.
If you terminate your membership in the Five Loyalty Programme or if your
membership has expired, your personal data will no longer be processed,
pseudonymized and deleted no later than one week after you terminated your
membership. Some data resulting from the terminated membership will be retained;
such data can no longer be attributed to you, hence, is not considered personal data
any more.

5. Your rights
You have the following rights:

Regarding you personal data, you are, by law, entitled to

request information on whether personal data relating to you is being
processed (Art. 25 FADP)
under certain circumstances request us to deliver the personal data stored
with us to another controller (Right to data portability, Art. 28 FADP);
request that incorrect personal data be corrected (Art. 32 FADP);
request that a specific data processing activity be prohibited (Art. 32 FADP)
request that a specific disclosure of personal data to third parties be prohibited
(Art. 32 FADP)
request that personal data be deleted or destroyed. (Art. 32 FADP)
take actions to protect your personality governed by Art. 28, 28a and 28g-28l
of the Swiss Civil Code;
withdraw your consent and terminate your membership with the Five Loyalty
Programme.

You may exercise these rights by contacting us, preferably via e-mail to
[email protected]