H2 Entertainments  AG  Privacy Policy

With this data protection declaration, we inform you which personal data we collect when you visit our website and for what purpose we use the data. The data protection declaration also provides information on data processing when booking via the website operated by us https://arosaexklusiv.ch Personal data are all data that can be related to you personally, e.g. B. Name, address, email addresses. The person responsible for data processing within the meaning of data protection laws is:

H2 Entertainments AG, Poststrasse 144, CH-7050 Arosa

Phone: +41(0)79 676 47 28

E-Mail: mail@arosaexklusiv.ch.

Data protection coordinator for H2 Entertainments AG: Valerie Leu

mail@arosaexklusiv.ch 

Summary

• When you book accommodation via our portal , we collect and use your personal data to process the payment and, where necessary to fulfill the contract, to transmit the data to our partners.
• When you visit this website , we collect data insofar as it is technically necessary. We also collect and use data to carry out range analyzes with Google Analytics.
• We use social media tools and other tools, including the IFacebook plug-in, which allows you to interact with Facebook and other users, Google Maps, Google Adwords, Facebook Custom Audiences and DoubleClick by Google. As a person concerned, you have the right to object, revocation, information and deletion and you are free to complain to a supervisory authority.

Collection and use of your data when booking There are various ways to conclude contracts with us as part of the booking process. Regardless of whether the booking is made via a website operated by us, by telephone, via travel agencies or a partner company connected with us through contracts, the following data will be collected from you, possibly transmitted to us and processed by us:

• Your name and address,
• Your email address,
• Your Address,
• Your phone number and
• In individual cases, additional information about yourself or your booking (request) required for the respective booking (request). In order to carry out and process the bookings, we collect the personal data required for the respective payment method. The provision of further information is voluntary.

As long as the data processing is necessary for the fulfillment of the contract and the initiation of a contract, the processing of your data and, if necessary, the transmission of your data by third parties to us is justified in accordance with Art. 6 Paragraph 1 Letter b GDPR. Due to commercial and tax law requirements, we are obliged to save your address, payment and order data for a period of ten years. However, we limit the processing after two years, i. H. Your data will only be used to comply with statutory retention requirements. A transmission of personal data does not take place in principle. As an exception, the required data will be passed on to public bodies (e.g. within the scope of reporting procedures) or to partners (e.g. arrival time, name and telephone number for the purpose of contacting them for handover), whereby they are advised of the obligation to delete the data immediately after the purpose no longer applies. Booking on the website If you make bookings either via our website, by correspondence (email or post) or by phone call, we need the following data to process the contract: • Title • First and last name • Postal address • Date of birth • Telephone number • Language • Credit card information • E-mail address We will only use this data and other information you voluntarily provide (e.g. expected arrival time, motor vehicle license plate, preferences, comments) to process the contract, unless otherwise stated in this data protection declaration or you have not given your separate consent. We will process the data by name in order to record your booking as requested, to provide the services booked, to contact you in the event of ambiguities or problems and to ensure correct payment. The legal basis for data processing for this purpose is the fulfillment of a contract in accordance with Art. 6 Paragraph 1 lit. b GDPR. Storage and data exchange with third parties

• Booking platforms  If you make bookings via a third-party platform, we receive various personal information from the respective platform operator. In addition, inquiries about your booking may be forwarded to us. We will process this data by name in order to record your booking as requested and to provide the booked services. The legal basis for data processing for this purpose is the fulfillment of a contract in accordance with Art. 6 Paragraph 1 lit. b GDPR. Finally, we may be informed by the platform operators about disputes in connection with a booking. In doing so, we may also receive data on the booking process, including a copy of the booking confirmation as evidence of the actual booking. We process this data to protect and enforce our claims. This is our legitimate interest within the meaning of Art. 6 Para. 1 lit.f GDPR.

• Centralized storage and linking of data  We store the data specified in numbers 2-5 and 8-10 in a central electronic data processing system. The data relating to you are systematically recorded and linked to process your bookings and process the contractual services. The processing of this data in the software is based on our legitimate interest within the meaning of Article 6 (1) (f) GDPR in customer-friendly and efficient customer data management.

• Retention period We only store personal data for as long as it is necessary to use the above tracking services and further processing within the scope of our legitimate interests. We keep contract data longer, as this is required by statutory retention requirements. Retention obligations that oblige us to retain data result from regulations on the right to report, on accounting and tax law. According to these regulations, business communications, concluded contracts and accounting documents must be kept for up to 10 years. If we  longer need this data to carry out the services for you, the data will be blocked.

• Disclosure of data to third parties  We only pass on your personal data if you have given your express consent, if there is a legal obligation to do so or if this is necessary to enforce our rights, in particular to enforce claims from the contractual relationship. In addition, we pass on your data to third parties, insofar as this is necessary in the context of the use of the website and the execution of the contract (also outside the website), namely the processing of your bookings. A service provider to whom the personal data collected via the website is passed on or who has or can have access to it is our web host www.webland.ch. The website is hosted on servers in Switzerland. The data is passed on for the purpose of providing and maintaining the functionality of our website. This is our legitimate interest within the meaning of Art. 6 Para. 1 lit.f GDPR. Finally, if you pay by credit card on the website, we forward your credit card information to your credit card issuer and to the credit card acquirer. If you decide to pay by credit card, you will be asked to enter all the necessary information. The legal basis for the transfer of data is the fulfillment of a contract in accordance with Art. 6 Para. 1 lit. b GDPR. With regard to the processing of your credit card information by these third parties, we ask you to also read the general terms and conditions and the data protection declaration of your credit card issuer. Please also note the information in sections 7-8 and 10-11 regarding the transfer of data to third parties.

Use of cookies When you use our website, cookies are also stored on your computer. Cookies are small text files that are stored on your browser’s computer. We use cookies to enable you to use individual functions and to make our website more user-friendly and effective (the legal basis is Article 6 (1) (f) GDPR). In detail, we use the following cookies:

• Transient cookies, such as session cookies that save a session ID. This, in turn, can be used to assign various requests from your browser to the joint session so that your computer can be recognized when you visit our website again. Session cookies and transient cookies are deleted when you close the browser or log out;
• Persistent cookies for the “memo” function so that you do not lose the content of your memo and you can also look at your selected holiday properties again at a later point in time. These cookies are automatically deleted from your hard drive after 28 days. Regardless of this, you have the option at any time to delete the cookies in the security settings of your browser. You have the option of using the appropriate settings in your browser, for example, to prevent the acceptance of third-party cookies or all cookies. However, this may mean that you may not be able to use all the functions of our website.

Contact form and e-mail If you contact us by e-mail or using the contact form on our website, the data you provide (e-mail address, if applicable your first and last name, your telephone number or other data you have provided) will be used ) processed by us to answer your questions (the legal basis is Art. 6 Paragraph 1 Sentence 1 Letter b GDPR or Article 6 Paragraph 1 Sentence 1 Letter f GDPR). We delete the data arising in connection with the establishment of contact after the storage is no longer required or we restrict the processing if there are statutory retention requirements. For the purpose of optimizing our offer and the functionality and design of our website, for the purpose of ensuring the integrity and security of the website as well as for the purpose of range measurement and statistical analysis, we use the legal basis of Art. 6 Paragraph 1 Letter 1 f GDPR analysis tools (“tracking tools”). Before using an analysis tool, we check its legality under data protection law based on the guidance of the supervisory authorities (Conference of the independent data protection supervisory authorities of the federal and state governments – DSK) from March 2019 by assess the

• legitimate interests of H2 Entertainments AG,
• consider the existence of the necessity and take into account the interests of the data subjects and
• carry out a weighing of interests in individual cases.

With the analysis tools used by H2 Entertainments AG, we assume on the basis of such a check that after their use is lawful according to Art. 6 Paragraph 1 Letter 1 f GDPR, whereby the individual concerned has a right of objection according to Art. 21 GDPR . In detail, these are the following tools: Google Analytics We use the web analysis service Google Analytics from Google Inc. (“Google”) on our website. Google Analytics uses cookies, which enables your use of the website to be analyzed. We are thus interested in analyzing our website, regularly improving it and making it more interesting for you (the legal basis is Art. 6 Paragraph 1 Sentence 1 Letter f GDPR). The information generated in this way is regularly transmitted to a Google server in the USA and stored there. Google has submitted to the EU-US Privacy Shield, https://www.privacyshield.gov/EU-US-Framework . We have commissioned Google to evaluate the information obtained in this way about your use of our website, to compile reports on website activity and to provide us with other services related to website and internet usage. However, the IP address transmitted by your browser is not merged with other Google data. If you want to prevent cookies from being stored, you can do this via the appropriate setting in your browser. However, this can mean that not all functions of our website can be used to their full extent. You can also prevent Google from collecting and processing data relating to your use of the website (including your IP address) by downloading and installing the browser plug-in available under the following link: http: // tools. google.com/dlpage/gaoptout?hl=en . This website uses Google Analytics with the extension “_anonymizeIp ()”, whereby IP addresses are further processed in abbreviated form. This means that personal references can be ruled out. If the data collected about you can be linked to a person, this will be excluded immediately and the personal data will be deleted immediately. (6) You can find information about Google at: Google Dublin, Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland, Fax: +353 (1) 436 1001. Terms of use: http://www.google.com/analytics/terms/en.html , Overview of data protection: http://www.google.com/intl/en/analytics/learn/privacy.html Data protection declaration: http://www.google.com/intl/en/policies/privacy . Facebook plug-in (1) On our website we use social media plug-ins from Facebook Inc., 1601 S California Ave, Palo Alto, California 94304, USA, and thus offer you the opportunity to interact with Facebook and other users to interact. This helps us to improve our offer and make it more interesting for you as a user (the legal basis is Art. 6 Paragraph 1 Sentence 1 Letter f GDPR). (2) When using the plug-in, we use the so-called two-click solution, so that initially no personal data is passed on to Facebook. If you click the respective Facebook button (see Facebook logo) on our website and thereby activate it, you have the option of communicating directly with Facebook. In this case, Facebook receives the information which (sub) page of our website you have accessed and, if applicable. have shared or liked. The data mentioned under Information about the collection of personal data when you visit our website are also transmitted and stored in the USA; By activating the plug-in, your personal data will be passed on to Facebook. (3) The data collected about you is saved by Facebook as a user profile and used for advertising, market research and / or needs-based design of the Facebook website. The evaluation takes place in particular (also for users who are not logged in) to display needs-based advertising and for the purpose of informing other Facebook users about your activities on our website. (4) You have the right to object to the creation of these user profiles, although you must contact Facebook to exercise this right. (5) The data will also be passed on if you do not have a Facebook account or are not logged in there. However, if you are logged in, the data that we have collected will be assigned directly to your Facebook account. For example, if you activate the button, then click it and link our website, Facebook saves this information about you in your user account and shares it publicly with your contacts. In order to avoid this assignment, we recommend that you log out of your Facebook account before activating the button. (6) If you live outside the USA or Canada, Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbor, Dublin 2, Ireland, is responsible for the processing of personal data. Further information on the processing of your data as well as on the purpose and scope of the data collection by Facebook and on your rights as well as setting options for the protection of your privacy under the links provided below: Facebook Inc., 1601 S California Ave, Palo Alto, California 94304, USA http://www.facebook.com/policy.php ; Further information on data collection: http://www.facebook.com/help/186325668085084, http://www.facebook.com/about/privacy/your-info-on-other#applications and http://www.facebook.com/about/privacy/your-info#everyoneinfo . Facebook has submitted to the EU-US Privacy Shield, https://www.privacyshield.gov/EU-US-Framework . Google Maps (1) We use Google Maps on our website to be able to show you interactive maps on our website. In addition, we can enable you to use the map function (the legal basis is Art. 6 Paragraph 1 Sentence 1 Letter f GDPR). (2) When you visit our website, Google receives information about which (sub) page of our website you have accessed. The data mentioned under Information about the collection of personal data when you visit our website is also transmitted – regardless of whether you have a Google user account and are logged in or whether there is no user account. However, if you are logged in, your data will be assigned directly to your Google account. In order to avoid this assignment, we recommend that you log out of your Google account before activating the button. (3) The data collected about you is saved by Google as a user profile and used for advertising, market research and / or needs-based design of the Google website. The evaluation is carried out in particular (also for users who are not logged in) to display needs-based advertising and for the purpose of informing other Google users about your activities on our website. (4) You have the right to object to the creation of these user profiles, although you must contact Google to exercise this right. (5) Further information on the processing of your data as well as on the purpose and scope of the data collection by Google and on your rights as well as setting options for the protection of your privacy under the links provided below: Google LLC., 1600 Amphitheater Parkway, Mountainview, California 94043, USA; https://www.google.com/policies/privacy/partners/?hl=en . https://policies.google.com/privacy?hl=en Google has submitted to the EU-US Privacy Shield, https://www.privacyshield.gov/EU-US-Framework Google Tag Manager We use the Google Tag Manager. This is a solution with which we can manage website tags via one interface. The Tag Manager itself (which implements the tags) is a cookie-free domain and does not process any personal data from users. The tool triggers other tags, which in turn may collect data. According to Google, Google Tag Manager does not access this data. You can find more information on this in the usage guidelines for Google Tag Manager at https://www.google.com/intl/en>>/tagmanager/use-policy.html . Google Adwords (1) We use Google Adwords to draw attention to our offers on external websites and can thus determine how successful the individual advertising measures are. Our legitimate interest in this is to make our website more interesting for you and to show you advertisements that are of interest to you. We would also like to use it to calculate our advertising costs (the legal basis for processing your data is Art. 6 Paragraph 1 Letter f GDPR). (2) Google Adwords are delivered via ad servers. Here, ad server cookies are used, with the help of which certain parameters for measuring success, such as the insertion of advertisements or clicks by the user, can be measured. So if you reach our website via a Google ad, Google Adwords saves a conversion cookie with a limited validity (30 days) on your PC, which, however, does not serve to identify you personally. The following analysis values ​​are usually saved for this cookie: Unique cookie ID, number of ad impressions per placement (frequency), last impression (relevant for post-view conversions) and opt-out information (marking that the user no longer wants to be addressed). (3) With the help of the cookie, Google can recognize your browser. If the cookie has not yet expired, we and Google can see that you have clicked on an ad and have been redirected to our site and whether you have generated revenue. However, it is not possible for us to identify you as a user. We only receive a statistical evaluation from Google to check the effectiveness of the advertising measures used. (4) Due to the marketing tools used, each time you visit our website, personal data is transferred to Google in the United States of America and saved. These include, for example, the websites you have visited and your IP address. Google may pass this personal data on to third parties. In addition, if you are registered with a Google service, Google can assign the visit to your account. (5) If you want to prevent this from happening, there are several ways you can do it:

• Suppression of third-party cookies by setting in your browser
• Blocking of cookies from the domain www.googleadservices.com ,
• www.googleadservices.com, https://www.google.de/settings/ads , whereby this setting will be deleted if you delete your cookies;
• by deactivating the interest-based advertisements of the providers who are part of the self-regulation campaign “About Ads” via the link http://www.aboutads.info/choices , whereby this setting is deleted when you delete your cookies;
• through permanent deactivation in your browser : http://www.google.com/settings/ads/plugin .

(6) You can find more information on data protection at Google here: http://www.google.com/intl/en/policies/privacy and https://services.google.com/sitestats/en.html . Google has submitted to the EU-US Privacy Shield, https://www.privacyshield.gov/EU-US-Framework Facebook Custom Audiences Using this function, you as a user of our website can be shown interest-related advertisements (“Facebook Ads”) when visiting the social network Facebook or other websites that also use the process. Our interest in this is to show you advertising that is of interest to you and to make our website more interesting for you (the legal basis for processing your data is Article 6 (1) (f) GDPR). The use of this function means that your browser automatically establishes a direct connection with the Facebook server. It is beyond our precise knowledge and our influence to what extent the data collected in this way is actually collected and used. However, we are aware that Facebook always receives the information that you have accessed the relevant website on our website or that you have clicked on an ad from us. If you are registered on Facebook, Facebook can assign the visit to your account. Even in the event that you do not have an account with Facebook or are logged out, there is the possibility that Facebook will find out and save your IP address and other identification features. You can deactivate the “Facebook Custom Audiences” function by using the following link (only for logged-in users): https://www.facebook.com/settings/?tab=ads#_ You can find more information about Facebook and data processing by Facebook at https://www.facebook.com/about/privacy DoubleClick by Google (1) This website uses the online marketing tool DoubleClick by Google. DoubleClick uses cookies to show ads that are relevant to users, to improve reports on campaign performance, or to prevent a user from seeing the same ads multiple times. Google uses a cookie ID to record which ads are shown in which browser and can thus prevent them from being displayed multiple times. In addition, DoubleClick can use cookie IDs to record what are known as conversions, which are related to ad requests. This is the case, for example, when a user sees a DoubleClick ad and later visits the advertiser’s website with the same browser and buys something there. According to Google, DoubleClick cookies do not contain any personal information. (2) Due to the marketing tools used, your browser automatically establishes a direct connection with the Google server. We have no influence on the scope and further use of the data that is collected by Google through the use of this tool and therefore inform you according to our level of knowledge: By integrating DoubleClick, Google receives the information that you have accessed the corresponding part of our website or have clicked on one of our advertisements. If you are registered with a Google service, Google can assign the visit to your account. Even if you are not registered with Google or have not logged in, there is a possibility that the provider will find out your IP address and save it. (3) You can prevent participation in this tracking process in various ways: a) by setting your browser software accordingly; in particular, by suppressing third-party cookies, you will not receive any advertisements from third-party providers; b) by deactivating the cookies for conversion tracking by setting your browser so that cookies from the domain “www.googleadservices.com” are blocked, https://www.google.com/settings/ads , with this setting is deleted when you delete your cookies; c) by deactivating the interest-based advertisements of the providers who are part of the self-regulation campaign “About Ads” via the link http://www.aboutads.info/choices, whereby this setting is deleted when you delete your cookies; d) by permanent deactivation in your Firefox, Internet Explorer or Google Chrome browsers under the link https://www.google.com/settings/ads . We would like to point out that in this case you may not be able to use all functions of this offer to their full extent. (4) the legal basis for the processing of data is Art. 6 , para. 1 p.1 literally. F DS-GMO. Further information on DoubleClick by Google is available at https://www.google.de/doubleclick and http://support.google.com/adsense/answer/2839090 , as well as general data protection at Google: https: // www. google.de/intl/en/policies/privacy . Alternatively, you can visit the Network Advertising Initiative (NAI) website at http://www.networkadvertising.org . Google has submitted to the EU-US Privacy Shield, https://www.privacyshield.gov/EU-US-Framework . Your rights as a data subject You have the following rights towards us in relation to your personal data:

• You can request confirmation from us as to whether we are processing personal data about you and, if this is the case, you have a right to information about this personal data and the information listed in Art. 15 GDPR.
• According to Art. 16 GDPR, you have the right to immediately request the correction of incorrect personal data concerning you and, if necessary, the completion of incomplete personal data
• You have the right to demand that we delete your personal data immediately, provided that one of the reasons listed in Art. 17 GDPR applies
• You have the right to request that processing be restricted if one of the conditions listed in Art. 18 GDPR is met
• As long as the requirements of Art. 20 GDPR are met, you have the right to request data transfer.
• If we process your data on the basis of a consent that you have given us, you can revoke this consent at any time. The revocation does not affect the legality of the processing carried out on the basis of the consent up to the revocation, ie the revocation affects the permissibility of the processing of your personal data only after it has been explained to us.
• You also have the right to lodge a complaint with a supervisory authority if you are of the opinion that the processing of your personal data violates the GDPR (Art. 77 GDPR). You can assert this right with a supervisory authority in the member state of your place of residence, your place of work or the place of the alleged violation.
• According to Art. 21 GDPR, you have the right to object to processing, which is based on Art. 6 Paragraph 1 Sentence 1 Letter f GDPR. Processing is then based on Art. 6 Paragraph 1 Sentence 1 Letter f GDPR, for example if the processing is not necessary to fulfill a contract, but is based on a weighing of interests.

Status: November 2021[/vc_column_text][/vc_column][/vc_row]