Messe Luzern AG Data Protection Declaration
Status of the Declaration: March 2020
We are delighted that you are interested in our company. Messe Luzern AG takes data protection very seriously. Messe Luzern AG’s Data Protection Declaration applies to quotations, webpages and data processing operations belonging to Messe Luzern AG (you will find more information on this in the following chapter).
Messe Luzern AG’s Data Protection Declaration is addressed equally to men and women. To facilitate reading, however, only male pronouns are used.
We reserve the right to modify this Data Protection Declaration at any time, taking effect for the future. An up-to-date version is always available on the Messe Luzern AG webpages. Please call up the webpages on a regular basis and find out about the valid data protection provisions.
General notes on data protection
With this Data Protection Declaration, our company wishes to provide the public at large with information on the nature, scope and purpose of the personal data that we collect, use and process. In addition, we also wish to draw your attention to the rights that you have by means of this Data Protection Declaration.
It is fundamentally possible to use Messe Luzern AG’s internet pages without specifying any personal data. If an affected person wishes to use specific services offered by our company (in particular: contact forms, purchase of tickets, registration for newsletters or online applications), however, it may be necessary for personal data to be processed. If it is necessary to process personal data and if no legal or contractual basis exists for processing data in this way, we always obtain the consent of the affected person.
The processing of personal data – for example the name, address, e-mail address or telephone number of an affected person – is always conducted in compliance with the national data protection provisions that apply to Messe Luzern AG and, in particular, with the General Data Protection Regulation of the EU and the valid Swiss legislation.
In its capacity as controller, Messe Luzern AG has implemented numerous technical and organizational measures to ensure that protection of processed personal data is as complete as possible. Our employees are also obliged to maintain data confidentiality as specified by law. Despite this, security gaps can fundamentally exist in internet-based data transmission, which means that it is impossible to guarantee absolute protection. You thus have the option of sending personal data to us by other means, such as by post or by telephone.
Definitions of terms
Messe Luzern AG’s Data Protection Declaration is based on the concepts that have been used by the European issuers of Directives and Regulations in issuing the General Data Protection Regulation (GDPR) and by the Swiss legislator in the Swiss Data Protection Law (DSG). Our Data Protection Declaration is intended to be easy to read and easy to understand for both the public at large and for our customers and business partners. To ensure that this is the case, we would like to start by defining the terms that are used.
In this Data Protection Declaration, we use the following terms, among others:
a. Personal data
Personal data is all the information relating to an identified or identifiable natural person (called the “affected person” in what follows). A natural person is regarded as being identifiable if they can be identified either directly or indirectly through reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
b. Affected person
An affected person is any identified or identifiable natural person whose personal data is processed by the data controller in charge of processing the data. We also address you directly in this Data Protection Declaration, however.
Processing means any operation or set of operations which is performed on personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
d. Restriction of processing
Restriction of processing means the marking of stored personal data with the aim of restricting its processing in future.
Profiling is any type of automated processing of personal data which involves the personal data being used to evaluate specific personal aspects of a natural person.
Pseudonymisation means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data is not attributed to an identified or identifiable natural person.
g. Data controller or person in charge of processing
The data controller or person in charge of processing is the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
The processor is a natural or legal person, public authority, agency or another body that processes personal data on behalf of Messe Luzern AG.
The recipient is a natural or legal person, public authority, agency or another body to which the personal data is disclosed, irrespective of whether this is a third party or not. Public authorities which may receive personal data in the context of a specific inquiry in accordance with the law do not, however, count as recipients.
j. Third party
A third party is any natural or legal person, public authority, agency or body other than the affected person, the data controller, the processor and those persons who, under the direct authority of the data controller or processor, are authorised to process the personal data.
Consent is the freely given, informed and unambiguous indication of the affected person’s wishes by which they, through a statement or by a clear affirmative action, signify agreement to the processing of personal data relating to them in the specific case.
Contact: Name and address of the data controller in charge of processing
If you have any questions about data privacy, please email firstname.lastname@example.org or contact:
Messe Luzern AG
Links to other websites
The Messe Luzern AG webpages can contain links to websites of other suppliers. Since we have no control over these websites and have no influence on their contents, we recommend that you take a look at the information on data protection provided on these websites. We are not, under any circumstances, able to guarantee compliance with the statutory data protection requirements by third-party websites.
Statutory or contractual regulations concerning the provision of personal data
We would like to inform you that the provision of personal data is prescribed by law in some cases (e.g. taxation regulations) or can also result from contractual arrangements (e.g. details of the contractual partner). It can happen that, in order to conclude a contract, an affected person must provide us with personal data that we subsequently have to process. The affected person is then obliged to provide us with personal data (contractual duty). If this personal data were not made available, it would not be possible to conclude the contract with the affected person.
No automated decision-making
Messe Luzern AG dispenses with automated decision-making as per Art. 22 of the GDPR.
Transfer of data to third parties
Messe Luzern AG can essentially transfer personal data to the following third parties:
- Public bodies where overriding legal requirements exist
- Companies that acquire an event or a holding from Messe Luzern AG
- Internally, for purposes of internal communication, supervision, administration and for invoicing purposes
- Data processors commissioned by Messe Luzern AG
- Service partners for accompanying services, insofar as the affected person enquires about the corresponding services from Messe Luzern AG
- Exhibitors, organisers and sponsors who have provided the personal data, admission ticket vouchers or invitations then have the visitor data (name, address, communication data, time at which the event was visited) from the redeemed vouchers, tickets, invitations, etc., sent (back) to them, insofar as this is contractually agreed
- Exhibitors, organizers and sponsors who have provided personal data, admission ticket vouchers or invitations then have the visitor data (name, address, communication data, type of ticket, time of the visit to the event, issuer of the voucher, type of ticket used, payment method, amount paid) relating to the redeemed vouchers and invitations, returned to them.
Notices concerning special internet applications
Cookies and analysis tools
Many cookies contain a so-called Cookie ID. A Cookie ID is a unique identifier of the cookie. It comprises a sequence of characters by means of which internet pages and servers can be allocated to the specific internet browser in which the cookie has been stored. This makes it possible for the visited internet pages and servers to distinguish the individual browser of the affected person from other internet browsers containing different cookies. A specific internet browser can be recognised and identified through the unique cookie ID.
The affected person can prevent our internet pages from setting cookies at any time through the corresponding setting in the internet browser that they use, and hence permanently object to cookies being set. In addition, cookies that have already been set can be deleted at any time via an internet browser or other software programs. This can be done in all the standard internet browsers. If the affected person deactivates the setting of cookies in the internet browser they are using, they may, under certain circumstances, not be able to use all the functions of our internet page.
When these analysis tools are used, data can be transmitted to servers located in the USA and processed there. The IP address of a visitor to a web page is anonymized in these analytical tools.
Collection of general data and information
Each time an affected person or an automated system calls up an Messe Luzern AG internet page, the internet page captures a series of general data and information. This general data and information is stored in the server’s logfiles.
When it uses this general data and information, Messe Luzern AG does not draw any conclusions regarding the affected person. This information can be necessary in order (1) to deliver the contents of our internet pages correctly, (2) to optimise the content of our internet pages and the advertising for these, (3) to guarantee the permanent functioning of our information technology systems and the technology of our internet pages and (4) to provide law enforcement authorities with the information required for law enforcement in the event of a cyber attack. This anonymously collected data and information is thus evaluated statistically by Messe Luzern AG on the one hand and also evaluated with the aim of increasing data protection and data security within our company so as to ultimately ensure an optimum level of protection for the personal data that we process. The anonymous data in the server logfiles is stored separately from all the personal data supplied by an affected person and will be deleted within 90 days.
WiFi for visitors
When the free WiFi of Messe Luzern AG is used, the telephone number is recorded. Details regarding data privacy and the GTC for the use of the WiFi can be found directly on the landing page when you log in to gain access.
Accreditation of journalists/press distribution list
With their accreditation for an event, journalists, editors, photographers and video producers are entitled to take photographs, make video recordings and shoot films in Messe Luzern's halls and rooms. Such photographs, recordings and films may be used for editorial publication, broadcasting on television or for other advertising purposes on the part of Messe Luzern AG. In the event of the above provisions being breached, accreditation for all Messe Luzern AG events can be withdrawn. If so requested by an exhibitor or a visitor, the bodies of Messe Luzern AG are entitled to check photographs/films that have been taken/shot without consent for their admissibility and, if appropriate, to confiscate these. Further legal action by the affected exhibitor, visitor or the exhibition management is reserved.
Use of social plug-ins
Our websites use social plugins, e.g. from Facebook (Facebook Inc. 1601 South California Avenue, Palo Alto, CA 94304, USA ), Twitter (Twitter Inc., 1355 Market Street, Suite 900, San Francisco, CA 94103, USA) and Insagram (Instagram Inc., 1601 Willow Road, Menlo Park, CA 94025, USA. )
If you call up our internet pages which contain such a plugin, the provider receives the information via plugin that you have called up our internet page. If you are logged in at the same time, the provider can assign the visit to your profile. If you interact with the plugins, the corresponding information is transmitted directly from your browser to the provider and stored there.
If you do not want the providers to collect data about you, you can select the “Block third-party cookies” function in your browser settings. In this case, the browser does not send any corresponding information to the provider's server in the case of embedded content. With this setting, however, other content on our website may no longer function in certain cases.
Messe Luzern AG sends out newsletters to provide information about the company's offerings. For this purpose, Messe Luzern AG processes only that personal data for which a legal basis pursuant to Swiss or EU law is applicable (contractual relationship, consent, legitimate interest).
The web pages of Messe Luzern AG offer you the option of subscribing to newsletters. By registering for the newsletter of Messe Luzern AG, a data subject gives us explicit consent for the use of their personal data for advertising purposes. As long as this consent is not revoked by the data subject, we will continue to use the data for advertising purposes.
The personal data that is transferred to the controller when ordering a newsletter is determined by the input mask used for this purpose. Fields flagged with an asterisk on the registration form require mandatory entries.
Personal data collected in connection with registration for a newsletter is used solely for advertising/promotional purposes. We reserve the right to make use of evaluation tools that allow us to ascertain whether and when a newsletter was opened and which articles in the newsletter were accessed. The purpose of this analysis is to provide our subscribers with targeted information about our services.
A subscription to a newsletter and therefore the processing of personal data can be terminated by the data subject at any time. A link for the purpose of terminating the subscription is included in every newsletter. It is also possible to contact the controller at any time to arrange for the erasure of personal data. Please contact us for these purposes.
Ticket purchases via websites
For some events and trade fairs, you can purchase an entrance ticket via our websites or by redeeming a voucher.
In order to process support cases and to fulfill the contract, and also for ticket dispatch, billing and accounting purposes, we process and store the data that is entered in the order mask. Fields flagged with an asterisk on the order mask require mandatory entries.
If an exhibitor distributes vouchers to their customers and these vouchers are redeemed via a website of Messe Luzern AG, the exhibitor concerned receives the personal data of the relevant customer that was stored by Messe Luzern AG when the voucher was redeemed. If Messe Luzern is not itself the organizer of an event or trade fair, the personal data collected when the ticket was sold is forwarded by Messe Luzern AG to the relevant organizer in order to fulfill the contract. In this case, Messe Luzern AG acts in the capacity of processor (as defined by the law) in accordance with the same criteria as a controller.
If we advertise a job, you have the option of sending us your application documents online. If you are not recruited for the job and the application process has been completed, all documents received from you are erased.
Contact opportunities via internet pages
Messe Luzern AG’s internet pages contain data that permits contact to be made electronically with our company and allows direct communication with us, which similarly includes a general e-mail address. If you contact Messe Luzern AG by e-mail or via a contact form, the personal data that is transmitted will be saved automatically. Personal data of this type transmitted on a voluntary basis will be saved for purposes of processing or making contact.
Rights of the affected person
Right to confirmation
- Each affected person is entitled to request confirmation from Messe Luzern AG as to whether Messe Luzern AG processes personal data relating to them.
Right to information
Any person affected by the processing of personal data is entitled to obtain free-of-charge information from Messe Luzern AG on the personal data saved on them and to receive a copy of this information. In addition, information can be provided on the following aspects, where appropriate:
- the purposes of the processing;
- the categories of personal data that are processed;
- the recipients to whom the personal data has been disclosed or is still being disclosed;
- if possible, the planned duration for which the personal data is being stored or, if this is not possible, the criteria for determining this duration;
- the existence of a right to rectification or erasure of the personal data relating to them, or to the restriction of processing by the data controller in charge of processing, or of a right of objection to this processing;
- the existence of a right to complain to a supervisory authority;
- if the personal data have not been collected from the affected person: all the available information on the origin of the data;
Right to rectification
Any person affected by the processing of personal data is entitled to request the immediate rectification of incorrect personal data that relates to them. In addition, the affected person has the right, with due consideration to the purpose of the data processing, to request the completion of incomplete personal data – including by means of a supplementary declaration.
Right to erasure (right to be forgotten)
Any person affected by the processing of personal data is entitled to request the data controller in charge of processing to delete the personal data relating to them without delay insofar as one of the following reasons applies, and insofar as the data processing is not necessary:
- The personal data was collected for purposes or processed in other ways for which it is no longer needed.
- The affected person revokes their consent, which provided the basis for the processing, and there is no other legal basis for the processing.
- The affected person, for reasons arising from their particular situation, submits an objection to the processing and there are no overriding legitimate reasons for the processing, or the affected person submits an objection to processing in the case of direct advertising and the profiling associated with this.
- The personal data has been processed unlawfully.
- The erasure of the personal data is necessary in order to fulfil a legal obligation under EU law, or the law of its member states, to which the data controller in charge of processing the data is subject.
- The personal data was collected in relation to information society services that were offered directly to a child.
Right to restriction of processing
Any person affected by the processing of personal data has the right to request the data controller in charge of processing the data to restrict the processing of their data if one of the following conditions is fulfilled:
- The correctness of the personal data is disputed by the affected person for a duration which enables the data controller to check the correctness of the personal data.
- The processing is unlawful, the affected person rejects the erasure of the personal data and, instead, requests a restriction on the use of the personal data.
- The data controller no longer requires the personal data for the purpose of the processing but the affected person requires the data for asserting, exercising or defending legal claims.
- The affected person, for reasons arising from their particular situation, has submitted an objection to the processing and it is not yet clear whether the legitimate reasons of the data controller carry more weight than those of the affected person.
Right to data portability
Any person affected by the processing of personal data has the right to receive the personal data relating to them in a structured, commonly used and machine-readable format. The affected person also has the right to have this data transmitted to another data controller providing the statutory requirements are fulfilled.
In addition, the affected person has the right to arrange for the personal data to be transmitted directly from one data controller to another, insofar as this is technically feasible, and insofar as this does not impair the rights and freedoms of other persons.
Right to object
Any person affected by the processing of personal data has the right, at any time, to object to the processing of the personal data relating to them for reasons arising from their particular situation.
In the event of an objection, Messe Luzern AG will no longer process the personal data, unless we can provide evidence of compelling reasons, worthy of protection, for this data to be processed which override the interests, rights and freedoms of the affected person, or unless the processing serves the assertion, exercise or defence of legal claims.
Right to revoke consent to the processing of data
Any person affected by the processing of personal data is entitled to revoke, at any time, the consent they have given to the processing of personal data.
Contact and Questions
If you have any further questions or comments regarding our data protection concerns, our webpages and our security concept, we would ask you to contact us at the following address by e-mail: email@example.com
If the wording of the present Data Protection Declaration gives rise to differences of opinion as regards their interpretation, the German language version shall be decisive.