We, the public limited company Glacier Express AG, Bahnhof, 6490 Andermatt, operates the website www.glacierexpress.ch (hereinafter referred to as “website”) as well as provide the services offered there and are thus responsible for the collection, processing and use of your personal data and for the compatibility of the data processing with the respectively applicable data pro-tection law, particularly the Swiss Data protection Act.
Your trust is important to us. We therefore take the issue of data protection seriously and en-sure appropriate security. As a result, we naturally abide by the statutory requirements of the Federal Act on Data Protection (FADP), the Ordinance to the Federal Act on Data Protection (OFADP), the Telecommunications Act (TCA) and other regulations of the Swiss Data Protec-tion Act. We also naturally meet the statutory requirements of the EU General Data Protection Regulation (GDPR).
Please take note of the information below so that you shall know as to which personal data we collect from you and for which purposes it is used.
1. Scope and purpose of the collection, processing and use of personal data
a. When you visit www.glacierexpress.ch
When you visit our website, our servers make a temporary record of each access in a log file. The following data shall be collected, without any action on your part, and stored by us until it is automatically deleted after fourteen days:
- the IP address of the accessing computer,
- the date and time of the access,
- the name and URL of the file called up,
- the website, from which the access was made,
- the operating system of your computer and the browser used,
- the country, from which the access is made,
- the name of your Internet access provider.
This data shall be collected and processed for the purpose of allowing you to use our website (establishing a connection), ensuring system security and stability consistently and allowing optimisation of our Internet offer, as well as for internal statistical purposes.
The aforementioned information shall not be linked with personal data or saved with personal data. Only in the event of an attack on the network infrastructure of the website or if another form of illicit or abusive use of the website is suspected, the IP address shall be analysed for the purposes of clarification and defence and, if necessary, used in criminal proceedings for identification and in civil and criminal proceedings against the users concerned.
Our legitimate interest in the processing of data within the meaning of art. 6 para. 1 lit. f GDPR shall lie in the afore-described purposes.
b. when registering for a user account
The provision of personal data for the creation of your user account on our website shall take place voluntarily. This data shall include:
- First name*
- Last name*
- Date of birth
- E-mail address*
Truthful submission shall be mandatory for certain personal data marked with *. We shall re-quire the data for the handling and administration of our website, for verifying the data entered for plausibility, i.e. for justification, content arrangement, processing and modification of the contractual relationships concluded with you through your user account. The e-mail address and the password shall together form the login data.
The data in the customer account can be viewed and changed by the customer at any time. Finally, a customer can demand complete deletion of the customer account.
The legal basis for the processing of your data for the aforementioned purpose shall lie in the fulfilment of a contract pursuant to art. 6 para. 1 lit. b GDPR as well as in our legitimate inter-est in the optimal administration of the customer relationship with you (art. 6 para. 1 lit. f GDPR). You can object to this data processing at any time; this would however be synony-mous to the deletion of your customer account.
c. when using the website as a registered user
When the website is used by logged-in, registered users, we shall collect data for statistical reasons and to allow smooth functionality of the portal. In particular, the following data shall be collected:
- the type, frequency and intensity of the use of the website
- the duration of your membership
- the orders placed
- the composition of the shopping cart
The legal basis for the processing of your data for this purpose shall lie in the fulfilment of a contract pursuant to art. 6 para. 1 lit. b GDPR as well as in our legitimate interest in optimising our website offer and personalising our offer to you (art. 6 para. 1 lit. f GDPR). You can object to this data processing at any time; this would however be synonymous to the deletion of your customer account.
d. during a purchase
If you want to buy a product or ticket on our website, we shall require different data for pro-cessing the purchase contract. You must enter the following data:
- Last name and first name
- Postal address (street, house number, postcode, place, country)
- E-mail address
- Details related to the payment
- Login data (in case of registered customers)
Data going beyond this can be entered voluntarily.
If you are registered and have a customer account, we shall save your data in the customer account for the next purchase.
In case of certain offers, additional information shall be required from you. In the purchasing process, you shall be pointed to this additional information.
When buying train tickets or special offers, which are linked with a train journey, you must e.g. also enter the first and last names of the passengers, dates of birth, as well as any discounts (e.g. half-fare) besides the aforementioned information.
When buying train tickets, the data shall be shared with the Swiss Federal Railways, Wyler-strasse 127/128, 3000 Bern 65 as well as, if necessary, with other transport service providers via a technical interface.
The legal basis for the processing of your data for the aforementioned purposes shall lie in the fulfilment of a contract pursuant to art. 6 para.1 lit. b GDPR.
e. purchases in the souvenir shop
You can also buy souvenirs via our website. As soon as you access the page with souvenirs, you shall be directed to another website. This website is operated by Pandinavia AG, Industri-estrasse 30, CH-8302 Kloten, on our behalf. The data, which you enter during the purchase, shall be saved on servers of Pandinavia AG.
Within the scope of the purchasing process, Pandinavia AG shall inform you as to which in-formation must be entered as mandatory fields. This shall include, e.g., the contact type (pri-vate person, company), first and last name, address, telephone number and e-mail address.
Solely Pandinavia AG shall be responsible for the souvenir shop. Accordingly, even the Gen-eral Terms and Conditions and data protection guidelines of Pandinavia AG shall be applicable for the purchases in the souvenir shop.
2. Use of your data for advertising purposes
a. Newsletter / e-mail advertisement / online advertisement
You shall receive a newsletter from us only upon an explicit request. Registration on the web-site shall be necessary for this. The following data must be entered within the scope of the reg-istration:
- E-mail address
We shall use your data for sending newsletters until you revoke your consent. You can revoke your consent at any time. You shall also find an unsubscribe link in all newsletter e-mails.
When sending the newsletter, we work with e-mail marketing software from Alturos Destinations, Lakeside B03, 9020 Klagenfur, Austria. For this, the e-mail address is saved on a database system of Braze.
Our newsletter can contain a so-called web beacon (tracking pixel) or similar technical means. A web beacon is a 1x1 pixel, invisible graphic, which is linked with the user ID of the respec-tive newsletter subscriber.
For every newsletter sent, there is information about the address file used, the subject and the number of newsletters sent. It can also be seen as to which addresses have not yet received the newsletter, to which address it was sent and in case of which addresses the dispatch has failed. It is also evident as to which addresses have opened the newsletter. Finally, the infor-mation as to which addresses have unsubscribed. We use this data for statistical purposes and for optimising the newsletter with reference to its content and structure. This allows us to align the information and offers in our newsletter better with the individual interests of the re-cipients. The tracking pixel shall be deleted if you delete the newsletter.
To prevent the use of the web beacon in our newsletter, please set your mail programme such that no HTML is displayed in messages if this is already not the case by default. On the follow-ing pages, you shall find explanations as to how you can make this setting for the most com-mon e-mail programmes.
- Mail for Mac (“Load remote content in messages”)
With the registration, you shall give us your consent to the processing of the data entered for the regular dispatch of the newsletter to the address specified by you and for the statistical analysis of the usage behaviour as well as optimisation of the newsletters. This consent shall represent our legal basis for the processing of the data for the newsletter within the meaning of art. 6 para. 1 lit. a GDPR.
We use so-called re-targeting technologies. Your usage behaviour on our website shall there-by be analysed so that advertisement that is individually tailor-made for you can be offered even on partner websites. Your usage behaviour shall be recorded pseudonymously.
Most of the re-targeting technologies work with cookies (for this, refer to section 7 below).
This website uses Doubleclick by Google, a service from Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (“Google”), for placing advertisements based on the use of previously visited websites. For this, Google uses the so-called DoubleClick cookie, which allows recognition of your browser when visiting other websites. The information gener-ated by the cookie about the visit to these websites (including your IP address) is transferred to a Google server in the USA and saved there (you shall find additional information on trans-fers of personal data into the USA below in section 8).
Google shall use this information to evaluate your use of the website with respect to the adver-tisements to be placed, to compile reports about the website activities and advertisements and to provide other services that are associated with the website use and the Internet use. If nec-essary, Google shall also transfer this information to third parties if this is legally prescribed or if third parties process this data on behalf of Google. Google shall however, under no circum-stances, link your IP address with other data of Google. Google is listed as a Privacy Shield participant. The Privacy Shield agreement between the EU and the USA guarantees minimum standards for data protection. More information on Google’s data protection can be found here.
We also use the Google Tag Manager to manage the services for usage-based advertisement. The Tag Manager tool itself is a cookieless domain and does not record any personal data. The tool rather serves for triggering other tags, which record data under certain circumstances (for this, refer above). If you have made a deactivation at the domain or cookie level, this shall be retained for all tracking tags that have been implemented with Google Tag Manager.
For managing the services for usage-based advertisement, we also use adwebster, a service from Adwebster AG, Geroldstrasse 31, 8005 Zurich, Switzerland. adwebster uses user track-ing to mainly record the type of the websites visited by you as well as the websites of compa-nies that place advertisements with adwebster, which are called up by you. If you do not want the behaviour data to be recorded, you can deactivate the tracking. For this, visit the website: http://adwebster.com/Pages/about/opt-out.aspx.
You can prevent the re-targeting at any time by rejecting or deactivating the relevant cookies in the menu bar of your web browser (for this, refer to section 7 below).
The legal basis for the processing of the data for the aforementioned purposes shall lie in our legitimate interest in the interest-related and personalised advertising communication with you (art. 6 para. 1 lit. f GDPR).
3. Forwarding of data to third parties or granting of data access to third parties
We shall forward your personal data only if you have explicitly consented to this, if there is a legal obligation to do so or if this is necessary to enforce our rights, particularly to enforce claims resulting from the contractual relationship.
We shall also forward your data to third parties if this is necessary within the scope of the use of the website and the contract processing, namely the processing of your orders, the pro-cessing of your purchases, the delivery of your ordered products and the payment for them, to provide the services requested by you as well as to analyse your user behaviour. The use of the forwarded data by the third parties shall be limited strictly to the specified purposes.
A service provider, to which the personal data collected through the website shall be forwarded or which has or can have an access to such data, is our web host iWay AG, Badenerstrasse 569, 8048 Zurich. The website is hosted on servers in Switzerland.
We shall also forward your personal data to insurance companies if you have booked cancel-lation insurance via our website. The legal basis for the forwarding shall lie in the fulfilment of a contract pursuant to art. 6 para.1 lit. b GDPR.
A service provider, which shall get access to our web shop and the personal data, is our web shop operator Peaksolution GmbH, Lakeside B03, 9020 Klagenfurt am Wörthersee, Austria.
4. Transmission of personal data abroad
We shall be authorised to forward your personal data even to third-party companies abroad if this is necessary in connection with the processing of your bookings, inquiries, the provision of services and marketing campaigns. The legal provisions on the forwarding of personal data to third parties shall naturally be adhered to while doing so. The third parties shall be obligated for data protection to the same extent as that applicable for the provider itself. If the level of data protection in a country does not correspond to that in Switzerland or the EU data protec-tion law, we shall ensure by contractual means that the protection of your personal data corre-sponds to that in Switzerland or in the European Economic Area (EEA) at all times.
5. Right to information, correction, deletion and restriction of processing; right to data portability; right to appeal to a supervisory authority
You can any time object to data processing, particularly to data processing in connection with direct advertisement (e.g. against advertising e-mails). You shall also have the following rights:
Right to information: You shall have the right to demand an insight into your personal data saved with us any time and free of charge if we are processing this data. You can check as to which of your personal data is being processed by us, and that we are using it according to the applicable data protection regulations.
Right to correction: You shall have the right to have incorrect or incomplete personal data corrected and to be informed about the correction. In this case, we shall inform the recipients of the data concerned about the corrections made unless this is impossible or associated with disproportionate effort.
Right to deletion: You shall have the right to have your personal data deleted under certain circumstances. In the individual case, the right to deletion can be ruled out.
Right of restriction of processing: Under certain conditions, you shall have the right to de-mand restriction of the processing of your personal data.
Right to data transfer: If you have your domicile in an EU or EEA member state, you shall, under certain circumstances, have the right to get the personal data that was provided to us by you free of charge in a readable format.
Right of appeal: If you have your domicile in an EU or EEA member state, you shall have the right to appeal to a competent supervisory authority against the method of the processing of your personal data.
Right of revocation: You shall basically have the right to revoke an issued consent at any time. Processing activities in the past based on your consent shall however not become illegal through your revocation.
6. Data security
We take appropriate technical and organisational security measures to protect your personal data that is stored with us from manipulation, partial or complete loss and unauthorised access by third parties. Our security measures are constantly being improved in line with technologi-cal developments.
When you register yourself with us as a customer, the access to your customer account shall be possible only upon entering your personal password in each case. You should always treat your payment information as confidential and close the browser window once you have ended the communication with us, particularly if you are using a shared computer.
We also take data protection within our organisation very seriously. Our employees and the service providers commissioned by us are obligated by us to maintain confidentiality and to comply with our data protection regulations. Moreover, they are granted access to personal data only to the necessary extent.
Cookies help in many ways to make your visit to our website easier, more pleasant and more meaningful. Cookies are information files that your web browser automatically stores on your computer’s hard drive when you visit our website. Cookies neither damage your computer’s hard drive nor do they transfer the users’ personal data to us.
Most Internet browsers accept cookies automatically. It is possible, however, to configure your browser such that no cookies are stored on your computer or such that a message shall al-ways appear when you receive a new cookie. On the following pages, you shall find explana-tions as to how you can configure the processing of cookies in the most common browsers.
- Microsoft Windows Internet Explorer
- Mozilla Firefox
- Google Chrome for Desktop
- Google Chrome for Mobile
- Apple Safari for Desktop
If you deactivate cookies, you may not be able to use all functions on our website.
8. Tracking tools
a. Google Analytics
For the purpose of needs-based designing and continuous optimisation of our websites, we use the web analysis service Google Analytics from Google. In this connection, pseudony-mised usage profiles shall be created and small text files that are stored on your computer (“cookies”) shall be used. The information generated by the cookie about the use of this web-site by you such as
- browser type/version
- the operating system used
- referrer URL (the previously visited page)
- host name of the accessing computer (IP address)
- time of the server request
shall be transferred to Google servers in the USA and saved there. Since IP anonymisation (“anonymizeIP”) has been activated on this website, the IP address shall be shortened before the transmission within European Union member states or in other signatory states of the Agreement on the European Economic Area. The anonymised IP address sent by your brows-er within the scope of Google Analytics shall not be grouped with other Google data. Only in exceptional cases, the full IP address shall be transferred to a Google server in the USA and shortened there. In these cases, we shall ensure through contractual guarantees that Google adheres to a sufficient level of data protection.
This information shall be used to analyse the website usage, to compile reports on the website activities and to provide other services associated with the website and Internet usage for the purposes of market research and designing of these websites according to the users’ needs. If necessary, this information shall also be transferred to third parties if this is legally prescribed or if third parties process this data on order. According to Google, the IP address shall never be linked with other data concerning the user.
Users can prevent the collection of the data generated by the cookie about the website usage by the user concerned (including the IP address) for Google as well as to the processing of this data by Google by downloading and installing the browser plugin that is available under the following link:
The legal basis for the processing of the data for the aforementioned purposes shall lie in our legitimate interest in the optimisation and personalisation of our website and the services of-fered there (art. 6 para. 1 lit. f GDPR).
For reasons pertaining to completeness, we would like to point out that monitoring measures are taken in the USA by US authorities, which generally allow the storage of all the personal data of all persons, whose data has been transmitted from the Union into the USA. This takes place without differentiation, restriction or exception by means of the purpose pursued and without an objective criterion that allows to restrict the access of the US authorities to the data and its subsequent use to certain, strictly limited purposes, which justify the intervention that is associated with the access to this data as well as with its use.
We would like to point out to the users domiciled in an EU member state that the USA does not have a sufficient level of data protection from the point of view of the European Union – mainly due to the topics mentioned in this section. As long as have stated in this Privacy Poli-cy that recipients of data (e.g. Google) have their registered office in the USA, we shall make sure either through contractual regulations with these companies or by ensuring the certifica-tion of these companies under the EU- or Swiss-US Privacy Shield that your data is appropri-ately protected with our partners.
b. Crazy Egg
We use the web tracking tool Crazy Egg on our website. Crazy Egg is operated by Crazy Egg Inc., 6220 E. Ridgeview Lane, La Mirada, CA, 90638, USA.
Crazy Egg uses “cookies”, i.e. text files that are stored on your computer and that allow an analysis of the website usage by you (for this, refer to section 7 above). The information gen-erated by the cookie about your use of this website is usually transmitted to a Crazy Egg serv-er in the USA and saved there. You can prevent the storage of the cookies using a corre-sponding setting of your browser software. You can also prevent the collection and forwarding of the data generated by the cookie about your use of the website (including the IP address) to Crazy Egg as well as the processing of this data by Crazy Egg by following the instructions under this link: http://www.crazyegg.com/opt-out.
The legal basis for the processing of the data for this purpose shall lie in our legitimate interest pursuant to art. 6 para. 1 lit. f GDPR.
9. Links to our social media presences and social plugins
a. Links to social media networks
On our website, you shall find links to social media networks. These are not plugins provided by the service provider, which already transmit data to the service provider when loading the website without influence of the users. The interfaces to the social media networks shall only contain a link to the social media network including transfer of the website to be shared. No user data shall be transmitted from the website to the social media network.
The links shall lead to the following networks:
- Facebook Inc., 1601 S. California Ave, Palo Alto, CA 94304, USA,
- LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland (only www.matterhorngotthardbahn.ch)
- Instagram LLC, 1601 Willow Rd, Menlo Park CA 94025, USA
- Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (only www.matterhorngotthardbahn.ch)
- YouTube LLC, 901 Cherry Ave, San Bruno, CA 94066, USA
When you call up a link to one of our social media profiles, a direct connection shall be estab-lished between your browser and the server of the social network concerned. The network shall thus receive the information that you, with your IP address, have visited our website and called up the link. When you call up a link to a network while being logged in to your account with the network concerned, the contents of our website can be linked with your profile with the network; this means that the network can directly assign your visit to our website to your user account. If you want to prevent this, you should log out before using the corresponding links. An assignment shall take place in any case if you log in with the network concerned after using the link.
b. Social Plugins
On our websites, social plugins of Facebook are also used to make the online shop more per-sonal. For this, we use the “SHARE” button. This is an offer of the American company Face-book Inc. (1601 S. California Ave, Palo Alto, CA 94304, USA).
When you call up a page of our web presence, which contains such a plugin, your browser creates a direct connection with the Facebook servers. The content of the plugin is directly transmitted from Facebook to your browser and integrated into the Website from the browser.
Through the integration of the plugins, Facebook receives the information that your browser has called up the corresponding page of our web presence even if you do not have a Face-book account or are not logged in to Facebook at the moment. This information (including your IP address) is directly transmitted from your browser to a Facebook server in the USA and saved there.
If you have logged in to Facebook, Facebook can directly assign the visit to our website to your Facebook account. If you interact with the plugins, for example use the “SHARE” button, the corresponding information is also directly transmitted to a Facebook server and saved there. The information is also published on Facebook and shown to your Facebook friends.
Facebook can use this information for the purpose of advertisement, market research and needs-based designing of the Facebook pages. For this, Facebook creates usage, interest and relationship profiles, e.g. to analyse your use of our website with respect to the advertise-ments faded in for you on Facebook, to inform other Facebook users about your activities on our website and to provide other services associated with the use of Facebook.
If you do not want Facebook to assign the data collected through our web presence to your Facebook account, you must log out from Facebook before visiting our website.
Please refer to the data protection information of Facebook for the purpose and scope of the data collection and the further processing and use of the data by Facebook as well as your related rights and setting options for the protection of your private sphere.
If you do not want Twitter to assign the visit to our websites, please log out from your Twitter user account.
10. Retention periods
We shall save personal data only as long as this is necessary to execute the afore-mentioned tracking services and to carry out the further processing activities within the scope of our legit-imate interest. We shall retain contractual data for a longer period, as this is prescribed by le-gal retention obligations. Retention obligations that require us to retain data shall result from accounting regulations and tax regulations. According to these regulations, business commu-nication, concluded contracts, and accounting records must be retained for up to 10 years. If we no longer need this data to execute the services for you, the data shall be blocked. This means that the data may then only be used for billing and tax purposes.
10. Contact person
If you have questions regarding the data protection on our website, want to demand infor-mation or apply for the deletion of your data, please contact our contact person for the data protection law by sending an e-mail to
As of: August 2019