C. Processing of personal data and cookies
Legal framework and general terms
Applicable law
The processing of personal data through the Website is governed by Swiss data protection law, in particular the Cantonal Act of the Canton of Ticino on the Protection of Personal Data (“LPDP”) and the Swiss Federal Act on Data Protection (“FADP”), within their respective fields of application, as well as, where applicable, Regulation (EU) 2016/679 (“GDPR”).
The LPDP applies to activities involving the performance, directly or through third parties, of public tasks established by cantonal or municipal law. Conversely, where the processing of personal data is of an economic nature and does not stem from sovereign authority, such processing is governed by the FADP.
Definition of 'personal data' according to the LPDP
Personal data means indications or information that directly or indirectly make it possible to identify a person, whether a natural or legal person.
Definition of 'personal data' according to the FADP
Personal data means any information relating to an identified or identifiable natural person, such as name, surname, address, date of birth, consumption data, email address, telephone number, IP address (What it is about?), personal preferences and interests, purchases made, websites visited, geolocation data, etc.
Definition of 'sensitive personal data' under the LPDP
This includes information relating to religious, philosophical or political opinions or activities, a person's private sphere, psychological, mental or physical condition, as well as information concerning offences committed, penalties imposed and measures adopted.
Definition of 'sensitive personal data' under the FADP
Sensitive personal data means: (i) data relating to religious, philosophical, political or trade union-related views or activities, health, the private sphere or affiliation to a race or ethnicity, (ii) genetic data, (iii) biometric data that uniquely identifies a natural person, (iv) data relating to administrative and criminal proceedings or sanctions, (vi) data relating to social assistance measures.
Definition of 'profiling'
Profiling means the automated processing of personal data consisting of the use of such data to evaluate certain personal aspects relating to a natural person, particularly to analyse or predict aspects concerning professional performance, economic situation, health, preferences, interests, reliability, behaviour, whereabouts and movements.
Definition of 'high-risk profiling'
Profiling that entails a high risk to the personality or fundamental rights of the data subject because it involves linking data in a way that allows essential aspects of a person's personality to be assessed.
User's obligation to protect access credentials and personal devices
The use of the Internet and e-mail is exposed to security risks. Users are responsible for ensuring the security of their devices and passwords (in particular passwords relating to the Website and their email account) through appropriate technical and organisational measures.
User's obligation to communicate correct data as well as any changes to personal data
Users are responsible for the accuracy of the personal data communicated to the Controller. They must also promptly communicate any changes to such data so that records may remain up to date.
Grounds for justification of personal data processing
The processing of personal data is unlawful when it constitutes a breach of personality. A breach of personality may be justified by the consent of the data subject, by an overriding public or private interest, or by the law. There is an overriding private interest, in particular, if the processing is necessary with a view to the provision of goods and/or services requested by the customer. Where required by law, e.g. in the case of certain marketing or advertising activities involving the profiling of the User or the adoption of automated decisions or the processing of sensitive personal data, the Data Controller shall submit an informed consent request to the User via electronic (online or by e-mail) or analogue (regular mail) channels.
Exclusions of liability
Given the nature of the Internet as an "open network", the Controller cannot guarantee that information provided by Users will not be intercepted or obtained by unauthorised third parties. Users are solely responsible for their choice of email service provider and for the proper and secure handling of their personal data outside the Website
Specialised service providers in contact with personal data
The Controller relies on external IT service providers to ensure the proper functioning of the Website. These providers may access personal data only to the extent strictly necessary for the performance of their duties and are bound by strict confidentiality and non-use obligations regarding personal data. Such providers must be established in Switzerland or, where strictly necessary, in foreign countries benefiting from an adequacy decision issued by the Swiss Federal Council.
A complete and updated list of providers may be inspected at the Controller's premises. For data and system security reasons, certain information may be anonymised or masked. For the providers and subprocessors described below, the general information regarding international transfers is supplemented by the specific safeguards indicated in the relevant sections and in the Newsletter Policy, including the Data Privacy Frameworks and, where necessary, the Standard Contractual Clauses.
Relationship with European data protection law
Switzerland is not a Member State of the European Union (EU), so European law is not directly applicable. Article 3(2) of the General Data Protection Regulation (EU) 679/2016 (hereinafter "GDPR") specifies that the Regulation applies to entities not established in the Union, where the processing activities are related to: (i) the offering of goods or services to data subjects in the Union or (ii) the monitoring of their behaviour within the Union.
The Data Controller does not direct business to the Union, nor does it monitor the behaviour of data subjects who are in the Union, so the GDPR is inapplicable. Swiss law offers adequate protection of personal data, as determined by the European Commission on July 26, 2000 (the adequacy decision can be downloaded here).
In the (exceptional) case of being subject to the GDPR, this document is valid as Privacy Notice pursuant to and for the purposes of Articles 13 and 14. In addition to benefitting from all the protections provided for by the GDPR, the User may assert his or her rights as expressed in Articles 15, 16, 17, 18, 19, 20, 21, 22 GDPR, by contacting the Data Controller. The User has the right, at any time, within the limits and under the conditions established by the GDPR, to request access to his or her personal data, rectification, erasure of personal data, restriction of processing concerning him or her or to object to processing as well as the right to data portability. If the processing is based on Article 6(1)(a) or Article 9(2)(a) GDPR, the User has the right to withdraw consent at any time. The User also has the right to lodge a complaint with the competent supervisory authority. In the event of a request for data portability, the Data Controller shall provide, in a structured, commonly used and machine-readable format, the personal data concerning the User, subject to paragraphs 3 and 4 of Article 20 GDPR.
Without prejudice to any other administrative or judicial appeal, should the User consider that the processing of his or her personal data violates the provisions of the GDPR, he or she has the right to lodge a complaint with the competent Data Protection Supervisory Authority (EU: list of national authorities).
Under no circumstances are references to the GDPR to be understood as voluntary subjection to such legislation, respectively to the supervision and/or decision-making power of any foreign authority (with respect to Switzerland).
Per la Newsletter e per le analisi facoltative descritte di seguito, il consenso costituisce la base del trattamento ai sensi dell’articolo 6, paragrafo 1, lettera a), GDPR, ove applicabile; per il funzionamento tecnico del Sito e per la gestione dei collegamenti brevi, la base è l’interesse legittimo del Titolare a garantire la fruibilità e la sicurezza del Sito e a misurare l’efficacia delle proprie comunicazioni (articolo 6, paragrafo 1, lettera f), GDPR). La revoca non pregiudica la liceità del trattamento effettuato prima della revoca.
1. Navigating the Website
1.1 Technical Operation and Security
- identity and contact details of the Data Controller: see paragraph A. above;
- purpose of processing and grounds for justification (where the LPDP applies): enabling access to and use of the Website, redirection from connected domains, and the secure operation of the infrastructure
- categories of processed personal data: (i) IP address of the device used by the User (What it is about?); (ii) pages visited by the User; (iii) demographic and interest based on proprietary data and data from users who have logged into Google and given their consent;
- recipients or categories of recipients of personal data: Providers responsible for the Website's development, hosting and maintenance, including Tinext where relevant, strictly within the limits necessary for the performance of their duties;
- cross-border disclosure of personal data and protection guarantees adopted (in relation to Switzerland): No international transfers. The Website hosting infrastructure managed by Tinext is located in Switzerland. Processing carried out through external services is described separately below;
- rights of the data subject: see paragraph D. below;
- retention and transparency: IP addresses stored in server logs are deleted after 28 days according to the applicable infrastructure standard. Additional retention information may be requested by contacting privacy@luganoregion.com. This retention period does not apply to Google Analytics, Short.io or Mailchimp data
1.2 Statistical Analysis with Google Analytics 4
- Purpose and legal basis: To analyse Website usage and improve Website content. Google Analytics 4 (GA4) is used only after obtaining the User's consent through the cookie management system. The Ente Turistico del Luganese does not use these analytics for personalised advertising, interest profiling or integration with Google Ads.
- Categories of personal data processed: online identifiers; information on visited pages and interactions; browser and device information; approximate geographic area information. Advertising interests are not collected, nor are Newsletter form data transmitted to GA4.
- Recipients and transfers: Google Ireland Limited and providers involved in delivering Google Analytics services. The service uses international infrastructure and may involve processing in the United States. Transfers are covered by the Swiss-U.S. and EU-U.S. Data Privacy Frameworks or, where necessary, by Google's contractual safeguards.
- Retention and user choices: Data are retained for the period necessary to assess Website traffic and Zaubersee-related initiatives within the service configuration. Data no longer needed are deleted or anonymised. Cookie duration is separately specified in the Cookie Policy. Consent may be modified or withdrawn at any time by reopening the cookie preferences.
Further information: data processing by Google and safeguards for data transfers. For information on your rights, see section D.
2. Management of short links (Short.io)
- identity and contact details of the data controller: see paragraph A. above;
- purpose of processing and the relevant legal basis (where the LPDP applies): (i) to generate and manage short links that redirect to pages of the Website, specifically information and promotional pages intended for tourists; (ii) to facilitate the sharing of such links on the Data Controller’s communication channels (social media, newsletters, promotional material); (iii) to measure, overall, the effectiveness of communication campaigns (number of clicks);
- categories of personal data processed: (i) the IP address of the device used by the User; (ii) technical data of the device and browser (user agent, operating system, language); (iii) source of the click (referrer) and approximate geolocation data derived from the IP address (country/region); (iv) date and time of the click;
- recipients or categories of recipients of personal data: have outsourced the processing of personal data in connection with the link shortening and tracking service to the following IT service provider: SHORT.IO (https://short.io/):
- SHORT.IO provides and manages the short link creation service and records the associated clicks;
- SHORT.IO collects the following personal data: IP address of the device used by the User; technical data relating to the device and browser; source of the click; approximate geolocation data; date and time of the click;
- transfers abroad and safeguards adopted (in relation to Switzerland): no third parties, with the exception of SHORT.IO (as Data Processor), limited to the data specified in the previous paragraph; country of destination: Germany (a country with an adequate level of data protection under Swiss data protection law);
- rights of the data subject: see paragraph D. below;
- additional measures promoting transparency: (i) you may request detailed information on the personal data retention policy relating to a specific processing operation by writing to privacy@luganoregion.com; (ii) detailed click data (clickstream data) is retained by the provider for 12 months, whilst compiled statistical data is retained for 26 months, after which it is automatically deleted; (iii) the data is stored exclusively in the provider’s data centres in Germany (Frankfurt) and is not transferred to the United States.
3. Newsletter
- identity and contact details of the Data Controller: see paragraph A. above;
- Purpose and Legal Basis:The Newsletter is a free and optional service providing updates regarding the Zaubersee event and its future editions. It may include information concerning activities and offers within the region that are relevant to the event and visitor stays, including links to the Lugano Region website. Subscription to the Zaubersee Newsletter does not result in inclusion in the general Lugano Region mailing list. Subscription is based on consent and is confirmed through a double opt-in procedure. The mailing list is maintained independently: contacts are not imported from Salesforce or other mailing lists, and subscribers are not transferred to Salesforce;
- Categories of Personal Data Processed: (i) Email address; (ii) First and last name; (iii) Language preference; (iv) Device IP address, date and time of registration and confirmation; Information regarding email openings and link clicks, under the conditions described below. The subscription form clearly distinguishes mandatory and optional fields.
- Statistical Tracking: Monitoring of email openings and clicked links for measuring Newsletter effectiveness is carried out only following separate and optional consent distinct from Newsletter subscription. Such information may be associated with the recipient’s email address. The Controller does not use these data: to profile recipients based on interests; to segment users; to personalise content. Refusing or withdrawing this consent does not prevent receipt of the Newsletter. Consent may be withdrawn through the mechanisms indicated in each Newsletter or by contacting privacy@luganoregion.com.
- Processors Acting on Our Behalf: The Newsletter is managed through Mailchimp, a service provided by The Rocket Science Group LLC, part of the Intuit group and headquartered in Atlanta, United States. For Newsletter subscription management and delivery, Mailchimp processes personal data on behalf of the Controller under a Data Processing Addendum (DPA).
- International Transfers and Safeguards: Use of Mailchimp involves transfer and storage of personal data in the United States. The Rocket Science Group LLC is included in Intuit's certification under: Swiss-U.S. Data Privacy Framework; EU-U.S. Data Privacy Framework. Where additional safeguards are required, the DPA incorporates Standard Contractual Clauses.
The provider may engage subprocessors in accordance with its DPA. Their locations are specified in the updated subprocessor list made available by the service provider.
- Retention: Subscriber data are retained as long as the subscription remains active. Upon unsubscription: personal data are deleted within 30 days; minimal information necessary to document consent and withdrawal and to prevent further mailings may be retained. The Controller periodically reviews the mailing list considering the continuity of the event and the frequency of communications. Should the event no longer be organised, the mailing list will be permanently deleted within 12 months from the last edition.
- Rights and Additional Information: Subscribers may unsubscribe at any time through the unsubscribe link included in every Newsletter. The Controller does not sell or transfer email addresses to third parties for their own marketing activities. Processing by the service providers described in this Notice remains unaffected.
Potential future activities
Should competitions, prize draws, or additional data collection forms be introduced, specific privacy information and, where required, consent requests will be provided before personal data are collected. Participation in a competition does not automatically result in Newsletter subscription.
Use of cookies and their management
What are cookies?
Cookies are small text files stored on the User's system by servers during web browsing. Thanks to cookies, the servers are able to recognise the User's navigator (browser) during the browsing activity and on subsequent visits.
Types of cookies
Cookies are divided into various types.
- When the party depositing the cookie on the User's system coincides with the website visited, the cookie is called a 'first party' cookie. Otherwise, it is called a 'third-party' cookie.
- 'Session' cookies are automatically deleted when the User closes the browser, while 'persistent' cookies are stored until their expiry date. 'Technical' cookies are used to browse the web safely and easily and provide User with the services and content requested.
- 'Analytical-statistical' cookies are assimilated to technical cookies when they are used directly by the Website to collect information, in aggregate form, on the number of Users and how they interact with the Website.
- “Tracking / profiling” cookies are cookies, generally third-party cookies, used to track and analyse the User's online usage behaviour, in particular for the purpose of serving him or her personalised advertisements.
What cookies does the Website implement?
The complete list of cookies currently used, together with information regarding providers, purposes and duration, is available in the Zaubersee Cookie Policy accessible via the link displayed in the footer of the Website.
The Controller remains responsible for providing information concerning any data processing activities performed through data collected by means of cookies.
How to disable/delete cookies?
The User may, through the cookie management banner on the home page of the Website, freely choose which cookies to authorise and which to reject. It is possible to refuse consent to cookies that are not strictly necessary (including statistical-analytical cookies) with one click, while keeping technical cookies active. The User also has the opportunity to manage cookie blocking through his or her browser’s set-up (generally or by type of cookie or by website of origin) or set his or her browser so that he or she will be advised of the receipt of cookies. It is important to know, however, that by disabling cookies generally, as this also applies to technical cookies, some of the features of the Website may not be applicable. We recommend deleting the cookies from the browser when closing the program, either manually or automatically through the browser set-up options.
By default, browsers automatically accept cookies. Instructions for disabling or deleting cookies can be found on the website of the browser’s developer (to which we refer).
There are additional methods to reduce the risk of online tracking (which can be used cumulatively):
Consent Management Through Cookiebot
To collect, store and respect cookie preferences, the Controller uses Cookiebot, a service provided by Usercentrics A/S in Denmark. Cookiebot processes: consent preferences; consent identifier; date and time of the choice; technical information necessary for consent management, including visited page, language, browser information and IP address. The purpose of such processing is to document and honour Users' preferences and does not require acceptance of analytics or marketing cookies.
The service DPA specifies hosting in Ireland and the Netherlands and may, depending on the technical configuration used, involve processing in the United States. The provider indicates periodic deletion of end-user data 12 months after registration. Cookie retention periods are separately specified in the Website Cookie Policy.
Further information: DPA Cookiebot and the provider’s privacy policy.
Link to the Instagram Profile
The Website contains only a simple link to the Instagram profile and does not embed an Instagram feed or widget. By activating the link, Users are redirected to the external platform where the privacy policies of the relevant provider apply. Accessing the Instagram profile does not result in subscription to the Zaubersee Newsletter.
Supplier information: Instagram privacy policy.
