Privacy Policy

Categories of Data Subjects

• Service recipients and clients.
• Prospective clients.
• Communication partners.
• Users.
• Business and contractual partners.

Purposes of Processing

Provision of contractual services and fulfillment of contractual obligations.

• Communication.
• Security measures.
• Direct marketing.
• Audience measurement.
• Office and organizational procedures.
• Organizational and administrative procedures.
• Feedback.
• Marketing.
• Profiles containing user-related information.
• Provision of our online services and user-friendliness.
• IT infrastructure.
• Public relations.
• Sales promotion.
• Business processes and business management procedures.

Relevant Legal Bases

Relevant legal bases under the GDPR: Below is an overview of the legal bases of the GDPR on which we process personal data. Please note that in addition to the regulations of the GDPR, national data protection provisions in your or our country of residence or domicile may apply. If more specific legal bases are applicable in individual cases, we will inform you in this Privacy Policy.

Consent (Art. 6 (1) (a) GDPR)– The data subject has given consent to the processing of his or her personal data for one or more specific purposes.

Performance of a contract and prior inquiries (Art. 6 (1) (b) GDPR)– Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.

Legal obligation (Art. 6 (1) (c) GDPR)– Processing is necessary for compliance with a legal obligation to which the controller is subject.

Legitimate interests (Art. 6 (1) (f) GDPR)– Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject.

Relevant legal bases under the Swiss Data Protection Act:We process your personal data in accordance with the Federal Act on Data Protection, in short “Swiss FADP”. Personal data must be processed lawfully, in good faith, and proportionately (Art. 6 (1) and (2) FADP). It may only be collected for a specific purpose that is recognizable to the data subject and processed in a manner compatible with that purpose (Art. 6 (3) FADP). Unlike the GDPR, the Swiss FADP does not generally make processing by private controllers conditional upon selecting a specific legal basis from a statutory catalog. Therefore, there is generally no general obligation to state such a legal basis in the Privacy Policy for every processing operation.

Applicability of national data protection laws:In the country where the controller is established, national data protection laws apply in addition to the GDPR.

Security Measures

We take appropriate technical and organizational measures in accordance with legal requirements, taking into account the state of the art, implementation costs, and the nature, scope, context, and purposes of processing, as well as the varying probability and severity of the risk to the rights and freedoms of natural persons, to ensure a level of protection appropriate to the risk.

Measures include, in particular, securing the confidentiality, integrity, and availability of data by controlling physical and electronic access to the data, as well as access, entry, disclosure, availability, and separation of data. Furthermore, we have established procedures to ensure the exercise of data subject rights, data deletion, and responses to data security threats. Furthermore, we take the protection of personal data into account as early as the development or selection of hardware, software, and procedures, in accordance with the principle of data protection by design and by default.

Securing Online Connections via TLS/SSL Encryption Technology (HTTPS): To protect user data transmitted via our online services against unauthorized access, we use TLS/SSL encryption technology. Secure Sockets Layer (SSL) and Transport Layer Security (TLS) are the cornerstones of secure data transmission on the Internet. These technologies encrypt the information transmitted between the website or app and the user’s browser (or between two servers), thereby protecting the data from unauthorized access. TLS, as the advanced and more secure version of SSL, ensures that all data transfers meet the highest security standards. When a website is secured with an SSL/TLS certificate, this is indicated by “HTTPS” in the URL, serving as an indicator to users that their data is being transmitted securely and encrypted.

Transmission of Personal Data

In the course of our processing of personal data, it may happen that the data is transmitted to or disclosed to other entities, companies, legally independent organizational units, or persons. Recipients of this data may include, for example, IT service providers or providers of services and content embedded in a website. In such cases, we comply with statutory requirements and, in particular, conclude appropriate contracts or agreements with the recipients of your data to protect your data.

International Data Transfers

Data Processing in Third Countries: If we process data in a third country (i.e., outside the European Union (EU) or the European Economic Area (EEA)) or if this occurs in the context of using third-party services or disclosing/transmitting data to other persons, entities, or companies (as recognizable from the respective provider’s address or explicit reference in the privacy policy), this is always done in compliance with legal requirements.

For data transfers to the USA, we primarily rely on the Data Privacy Framework (DPF), which was recognized as a secure legal framework by an adequacy decision of the EU Commission dated July 10, 2023. Additionally, we have concluded Standard Contractual Clauses with the respective providers, which comply with the requirements of the EU Commission and establish contractual obligations to protect your data.

This dual safeguard ensures comprehensive protection of your data: the DPF forms the primary level of protection, while the Standard Contractual Clauses serve as additional security. Should changes occur within the DPF, the Standard Contractual Clauses act as a reliable fallback option. This ensures your data remains adequately protected even in the event of political or legal shifts.

For individual service providers, we inform you whether they are DPF-certified and whether Standard Contractual Clauses are in place. Further information on the DPF and a list of certified companies can be found on the U.S. Department of Commerce website at https://www.dataprivacyframework.gov/.

For data transfers to other third countries, corresponding security measures apply, in particular Standard Contractual Clauses, explicit consent, or legally required transfers. Information on third-country transfers and applicable adequacy decisions can be found on the EU Commission website: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection_en.

Disclosure of Personal Data Abroad (Swiss FADP): In accordance with the Swiss FADP, we only disclose personal data abroad if an adequate level of protection for data subjects is guaranteed (Art. 16 Swiss FADP). If the Federal Council has not determined an adequate level of protection, we take alternative security measures.

For data transfers to the USA, we primarily rely on the Data Privacy Framework (DPF), which was recognized as a secure legal framework by an adequacy decision of Switzerland on September 15, 2024. In addition, we have concluded standard data protection clauses with the respective providers that have been approved by the Federal Data Protection and Information Commissioner (FDPIC).

This dual safeguard ensures comprehensive protection of your data: the DPF forms the primary level of protection, while the standard data protection clauses serve as additional security.

For data transfers to other third countries, appropriate security measures apply, including international treaties, specific guarantees, standard data protection clauses approved by the FDPIC, or binding corporate rules recognized in advance by the FDPIC or a competent data protection authority of another country.

General Information on Data Storage and Deletion

We delete personal data processed by us in accordance with statutory provisions as soon as consent is revoked or no further legal bases exist for processing. This applies to cases where the original purpose of processing no longer applies or the data is no longer needed. Exceptions to this rule exist where statutory retention obligations or special interests require longer retention or archiving.

In particular, data that must be retained for commercial or tax law reasons, or whose storage is necessary for legal prosecution or protection of rights of other natural or legal persons, must be archived accordingly.

Our privacy policy contains additional information on data retention and deletion applicable to specific processing operations. If multiple retention periods apply to a piece of data, the longest period is decisive. Data no longer stored for its original purpose, but due to statutory requirements or other reasons, is processed exclusively for the reasons justifying its retention.

Data Retention and Deletion (Swiss Law): The following general periods apply to retention and archiving under Swiss law:

• 10 years – Retention period for account books and records, annual financial statements, inventories, management reports, opening balance sheets, accounting vouchers, and invoices, as well as all necessary working instructions and other organizational documents (Art. 958f of the Swiss Code of Obligations (CO)).

• 10 years – Data necessary to account for potential claims for damages or similar contractual claims and rights, as well as processing associated inquiries based on past business experience and standard industry practices, is stored for the statutory limitation period of ten years, unless a shorter period of five years applies in specific cases (Art. 127, 130 CO). Claims for rent, leases, capital interest, food supplies, board, craftsmanship, retail trade, medical care, professional work of attorneys, legal agents, and notary services, as well as employment relationships, lapse after five years (Art. 128 CO).

Start of Period at the End of the Year: If a period does not explicitly begin on a specific date and is at least one year, it automatically starts at the end of the calendar year in which the triggering event occurred. In ongoing contractual relationships, the triggering event is the effective date of termination or other conclusion of the legal relationship.

Rights of Data Subjects

Rights under the GDPR

As a data subject under the GDPR, you have various rights, arising in particular from Art. 15 to 21 GDPR:

• Right to Object: You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is based on Art. 6(1)(e) or (f) GDPR, including profiling based on those provisions. Where personal data is processed for direct marketing purposes, you have the right to object at any time to processing of personal data concerning you for such marketing, including profiling.

• Right to Withdraw Consent: You have the right to withdraw consent at any time.

• Right of Access: You have the right to obtain confirmation as to whether data concerning you is being processed, access to that data, and further information and a copy of the data in accordance with statutory requirements.

• Right to Rectification: You have the right to request completion or rectification of inaccurate personal data concerning you.

• Right to Erasure and Restriction of Processing: You have the right to demand that data concerning you be erased immediately, or alternatively, to demand restriction of processing in accordance with statutory requirements.

• Right to Data Portability: You have the right to receive personal data concerning you, which you provided to us, in a structured, commonly used, and machine-readable format, or to demand its transmission to another controller.

• Right to Lodge a Complaint with a Supervisory Authority: You have the right to lodge a complaint with a supervisory authority, in particular in the EU Member State of your habitual residence, place of work, or place of the alleged infringement.

Rights under the Swiss FADP

As a data subject under the Swiss FADP, you have the following rights:

• Right of Access: You have the right to request confirmation as to whether personal data concerning you is being processed and to receive information required to assert your rights under this Act and ensure transparent processing.

• Right to Data Disclosure or Transfer: You have the right to request the disclosure of your personal data provided to us in a common electronic format.

• Right to Rectification: You have the right to request rectification of inaccurate personal data concerning you.

• Right to Object, Erasure, and Destruction: You have the right to object to the processing of your data and demand that personal data concerning you be erased or destroyed.

Commercial Services

We process personal data of our contractual and business partners (e.g., customers, clients, interested parties, suppliers) to initiate, carry out, and process contractual relationships and comparable legal relationships. This includes pre-contractual measures upon request and communication related to the relationship.

Processing serves the fulfillment of our main and ancillary contractual duties (e.g., agreed services, updates, warranty handling, cancellations, refunds). Data processed includes master data (name, address), contact details (email, phone), contract data (subject matter, duration, order numbers), usage data, payment data, and communication history.

Data is disclosed to third parties only as required for contract performance, pre-contractual measures, legitimate interests, or legal obligations (e.g., IT providers, logistics, banks, tax advisors).

Legal Bases: Art. 6(1)(b) GDPR (contract performance), Art. 6(1)(c) GDPR (legal obligations), and Art. 6(1)(f) GDPR (legitimate interests in business organization, IT security, and protection against fraud).

• Data Types Processed: Master data, payment data, contact data, contract data.

• Data Subjects: Service recipients/clients, interested parties, business/contractual partners.

• Purposes: Performance of contractual obligations, communication, office/administrative procedures, business processes.

• Retention/Deletion: Deleted once no longer needed and legal retention obligations expire.

Provision of the Online Offer and Web Hosting

We process user data to provide our online services. For this purpose, we process the user’s IP address, which is necessary to deliver content to the user’s browser or device.

• Data Types Processed: Usage data, meta/communication/procedural data, log data, content data.

• Data Subjects: Users (website visitors).

• Purposes: Provision of online offering, IT infrastructure, security measures.

• Legal Basis: Legitimate interests (Art. 6(1)(f) GDPR).

Services Used:

• Server Logfiles: Logged for security (e.g., preventing DDoS attacks) and server stability. Saved for up to 30 days and then deleted or anonymized.

• WordPress.com: Web hosting and software provider (Aut O’Mattic A8C Ireland Ltd.). Based on legitimate interests (Art. 6(1)(f) GDPR). Uses DPF and Standard Contractual Clauses for transfers.

Provision of the Online Offer and Web Hosting

We process user data to provide our online services. For this purpose, we process the user’s IP address, which is necessary to deliver content to the user’s browser or device.

• Data Types Processed: Usage data, meta/communication/procedural data, log data, content data.

• Data Subjects: Users (website visitors).

• Purposes: Provision of online offering, IT infrastructure, security measures.

• Legal Basis: Legitimate interests (Art. 6(1)(f) GDPR).

Services Used:

• Server Logfiles: Logged for security (e.g., preventing DDoS attacks) and server stability. Saved for up to 30 days and then deleted or anonymized.

• WordPress.com: Web hosting and software provider (Aut O’Mattic A8C Ireland Ltd.). Based on legitimate interests (Art. 6(1)(f) GDPR). Uses DPF and Standard Contractual Clauses for transfers.

Provision of the Online Offer and Web Hosting

We process user data to provide our online services. For this purpose, we process the user’s IP address, which is necessary to deliver content to the user’s browser or device.

• Data Types Processed: Usage data, meta/communication/procedural data, log data, content data.

• Data Subjects: Users (website visitors).

• Purposes: Provision of online offering, IT infrastructure, security measures.

• Legal Basis: Legitimate interests (Art. 6(1)(f) GDPR).

Services Used:

• Server Logfiles: Logged for security (e.g., preventing DDoS attacks) and server stability. Saved for up to 30 days and then deleted or anonymized.

• WordPress.com: Web hosting and software provider (Aut O’Mattic A8C Ireland Ltd.). Based on legitimate interests (Art. 6(1)(f) GDPR). Uses DPF and Standard Contractual Clauses for transfers.

Contact and Inquiry Management

When contacting us (via post, contact form, email, phone, or social media), submitted details are processed to handle and answer the request.

• Legal Bases: Contract fulfillment / pre-contractual requests (Art. 6(1)(b) GDPR) and legitimate interests (Art. 6(1)(f) GDPR).

Newsletter and Electronic Notifications

We send newsletters and electronic notifications only with recipient consent or legal authorization. An email address is required; names may be requested for personalization.

• Unsubscribing / Opt-Out: Recipients can unsubscribe at any time using the link at the bottom of the newsletter or by contacting us.

• Logging and Blocklist: We may store unsubscribed email addresses for up to three years in a blocklist based on legitimate interests to prove former consent or prevent future mailings.

• Performance Measurement: Newsletters contain web beacons to measure open and click rates.

• Service Provider: KLICK-TIPP Ltd., London, UK. Legal basis: Legitimate interests (Art. 6(1)(f) GDPR).

Promotional Communication via Email, Post, Fax, or Phone

We process personal data for direct promotional communications in compliance with legal requirements. Recipients can revoke consent or object to promotional contact at any time free of charge.

Following revocation or objection, necessary proof data may be stored for up to three years to defend against potential claims.

Web Analysis, Monitoring, and Optimization

Web analysis (reach measurement) evaluates visitor traffic, behavior, interests, and demographic information using pseudonyms. IP masking/anonymization is applied.

• Google Analytics: Provider: Google Ireland Limited. Measures user interactions via a pseudonymous ID. Does not log individual IP addresses for EU traffic; IP addresses are used solely for coarse geolocation derivation and then deleted immediately on EU servers. Legal basis: Consent (Art. 6(1)(a) GDPR). Opt-out plugin: https://tools.google.com/dlpage/gaoptout?hl=en.

• Google Tag Manager: Simplifies integration and management of website tags. Does not create user profiles or store cookies itself, but transmits IP addresses to Google for technical execution. Legal basis: Consent (Art. 6(1)(a) GDPR).

Social Media Presence

We maintain online presences in social networks to communicate with users. Data may be processed outside the EU, which may present risks regarding user rights enforcement.

• LinkedIn: Provider: LinkedIn Ireland Unlimited Company. Joint controller agreement (“Page Insights Joint Controller Addendum”) in place for gathering statistical page insights. Legal basis: Legitimate interests (Art. 6(1)(f) GDPR). Opt-out: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out.

Plugins and Embedded Functions/Content

We integrate third-party functional and content elements (e.g., graphics, videos, maps). Third-party providers require the user’s IP address to deliver content.

• Google Fonts (Hosted Locally): Fonts served from our own server; no data is sent to Google. Legal basis: Legitimate interests (Art. 6(1)(f) GDPR).

• Google Fonts (Fetched from Google Server): Fetches fonts directly from Google servers. Transmits IP address, requested URL, user-agent, and referrer URL. Legal basis: Legitimate interests (Art. 6(1)(f) GDPR).

• Google Maps: Embedded maps. Provider: Google Cloud EMEA Limited. Legal basis: Consent (Art. 6(1)(a) GDPR).

• LinkedIn Plugins: Content sharing buttons. Legal basis: Consent (Art. 6(1)(a) GDPR).

• Vimeo Video Player: Video embedding. Provider: Vimeo Inc., USA. Legal basis: Legitimate interests (Art. 6(1)(f) GDPR).