– Privacy Policy

2.1. Personal data

Personal data is all information that can be associated with a specific person, can be attributed to a specific person or identifies a specific person (such as names, addresses, IP numbers, email addresses). A natural person is deemed identifiable if they can be identified directly or indirectly, in particular through assignment to an identifier such as a name, to an identification number, to location data, to an online identifier or to one or more special features that express the physical, physiological, genetic, mental, economic, cultural or social identity of this natural person.

2.2. Processing

Processing is any handling of personal data, irrespective of the means and procedures used, in particular the procurement, storage, retention, use, modification, disclosure, archiving, deletion or destruction of data.

2.3. Controller

The controller is the person who specifies the purpose and means of processing, i.e. who decides whether personal data is to be processed at all and which essential conditions apply for this purpose.

2.4. Order processor

The order processor is the person who arranges for third-party data processing. Although the order processor decides itself whether it operates its business and whether it processes data of the controller, it is ultimately the controller who decides whether this processing is carried out. The controller has the right to issue instructions to the order processor.

The following person is appointed as data protection consultant:

Raphael Ciapparelli
Bracher und Partner Recht AG
Eisenbahnstrasse 11
P.O. Box 1661
4901 Langenthal

+41 62 916 50 00
raphael.ciapparelli@bracherpartner.ch

6.1. Data provided

You often disclose personal data to us yourself, for example by communicating with us, transmitting data and making it available to us.

You do this, for example, in the following situations:

• you conclude a contract with us;
• you request a customer account/login;
• you contact our office;
• you register for other offers (such as events, Annual General Meeting).

You provide personal data primarily on a voluntary basis. However, in order to process and fulfil orders and contracts, we need to collect and process certain personal data. Statutory retention obligations also exist. Otherwise, we will be unable to enter into, fulfil or continue the contract concerned. Processing personal data is generally permitted for the purposes of order/contract fulfilment.

If you provide us with data about other persons (such as work colleagues), we can assume that you are authorised to do so and that this data is correct. You must also ensure that these other persons have been informed of this Privacy Policy.

6.2. Data collected

Personal data can also be collected automatically, for example, online. This often includes behavioural and transaction data as well as technical data (e.g. time of access to the website, etc.).

Personal data may be collected independently in the following cases, for example:

• you request a login for the customer portal of our administration application;
• you interact with our administration application via the customer portal (downloading and uploading documents, etc.);
• you visit our website;
• you disclose your customer account in a communication with us;
• you interact in another way using one of our communication measures (e.g. email).
• We can derive further personal data from existing personal data to evaluate behavioural and transaction data, for example. This type of derived personal data is often preference data.

Aus bereits vorhandenen Personendaten können wir bspw. Auswertung von Verhaltens- und Transaktionsdaten weitere Personendaten ableiten. Bei solchen abgeleiteten Personendaten handelt es sich oft um Präferenzdaten.

6.3. Data received

We may receive personal data from other contractual partners if you consent to their transfer to us. We may also obtain personal data about you from public sources.

The processing of personal data is based on various legal bases depending on the purpose of the processing. Data processing is primarily permitted in Switzerland unless prohibited by law (FADP or GDPR).

Data processing is permissible for fulfilling an order/contract independently or even against the will of the data subject.

Furthermore, legitimate interests allow us to process data. Legitimate interests can be of an ideal or economic nature. One recognised purpose is, for example, direct advertising. This includes contacting people with advertising information, for example, by phone, email or letter.

Any data processing based on your consent or required to comply with Swiss or foreign legal regulations is also permitted.

10.1. Switzerland and EU

We process and store personal data in Switzerland and the European Union. The GDPR guarantees a level of data protection equivalent to that of Switzerland.

In certain cases, we may also disclose personal data to service providers and other recipients who are located outside this territory or who process personal data outside of this territory, generally in any country in the world.

Personal data may only be transferred abroad without problems (or can be accessed from abroad) if the country in question has a level of protection that is appropriate from a Swiss perspective.

The countries concerned outside the EU often do not have laws that protect your personal data to the same extent as in Switzerland or the EU. If we transfer your personal data to one of these countries, we will ensure that your personal data is protected in an appropriate manner.

One means of ensuring appropriate data protection is contractual in nature, which ensures the necessary data protection of your personal data abroad. Standard contractual clauses (approved by the FDPIC Federal Data Protection and Information Commissioner) are often used. Contractual arrangements often do not fully compensate for weaker legal protection or even a lack of legal protection, so your consent would be required.

10.2. Transfer to third countries (e.g. USA)

Our website may incorporate services from companies based in the USA or with connections to the USA. You must consent to this data processing. In this case, unrestricted access by the US authorities to your personal data cannot be excluded. No legal action may be taken.

In the following cases, we cannot adequately ensure protection of your personal data, even by means of standard data protection clauses.

This list of services and service providers is not exhaustive:

Akismet
www.akismet.com
Datenschutzerklärung: https://automattic.com/privacy-notice/

Cloudflare
www.cloudflare.com
Datenschutzerklärung: https://www.cloudflare.com/security-policy

The accuracy of the above address and group information is not guaranteed and may change in a dynamic economic environment.

However, it cannot be ruled out for all the aforementioned companies that they must grant the US authorities access to your personal data (US CLOUD Act), even if it is not stored in the US.

For this reason, this type of data processing only takes place with your explicit consent.

The information concerning the USA is provided subject to the proviso that Switzerland and the USA still do not have an EU-US data protection framework or an equivalent adequacy decision in terms of a Swiss-US data privacy framework.

10.3. Data is transferred to the following countries

Depending on the order or its self-declaration, data may be transferred to the following countries:

• Belgium
• Germany
• France
• United Kingdom
• Ireland
• Liechtenstein
• Luxembourg
• Netherlands
• Austria
• Portugal
• Spain

Basically, this concerns the following data:

• Login for the Helvecura administration application
• Guarantee Fund contribution invoices
• Compulsory storage compensation
• General correspondence

This only concerns countries with an appropriate level of data protection.

We do not perform profiling, but we will inform you as follows:

Profiling refers to the automated processing of personal data for the purpose of analysing your personal aspects, such as personal interests, preferences, affinities and habits.

We do not perform profiling without your consent.

We take appropriate and state-of-the-art security measures of a technical and organisational nature to uphold the security of your personal data, to protect it against unauthorised or unlawful processing and to counteract the risk of loss, inadvertent alteration, unintended disclosure or unauthorised access.

We also oblige our order processors to take appropriate technical and organisational security measures.

Unfortunately, we cannot rule out breaches of data with absolute certainty. We will inform you and the FDPIC of any data loss or data leaks in the cases provided for by law.

16.1. Purpose

We provide information on how and for what purpose we collect, process, use and store personal data and other data when our website and the customer portal of our administration application are used, in particular with regard to cookies and similar technologies. The term “website” below also refers to the administration application.

16.2. Log data

For technical reasons, every time our website is used, certain data is automatically stored temporarily in log files known as server log files. This includes the following technical data, whereby the list is not exhaustive:

• browser type and version;
• operating system used;
• the user’s Internet service provider;
• host name of the accessing computer;
• the user’s IP address;
• date and time of access;
• amount of data sent in bytes;
• name (according to the user role defined in the management application);
• telephone number;
• email.

With the exception of the customer portal login screen of the administration application, this data cannot be assigned to a specific person and it is not merged with other data sources. This data is processed for the purpose of using our website and establishing a connection as well as to ensure functionality, system security and stability, to optimise our website and for statistical purposes. The data will only be stored for as long as necessary to achieve the purpose for which it was collected. Accordingly, the data will be deleted at the end of each session. The storage of log files is absolutely necessary to operate the website. You will therefore not be able to object to this.

The IP address is also evaluated together with log data and other data in the event of attacks on the IT infrastructure for clarification and defence purposes and, if necessary, used in the context of criminal and civil proceedings, for example, to identify the persons concerned.

16.3. Cookies and similar technologies

Our websites use cookies. Cookies are small text files that are stored on your computer or mobile device via an Internet browser when you visit the websites. If you visit one of the websites again, the website will recognise you without knowing who you are. The purpose of this recognition is to make it easier for you to use the website. By using cookies, we can provide you with more user-friendly services that would not be possible without the cookie setting.

You can configure your browser’s settings so as to block certain cookies or similar technologies or to delete existing cookies and other data previously saved in your browser. You can also expand your browser with software (known as “plug-ins”) that blocks tracking by certain third parties. You can access information on this using the help pages of your browser, which can often be found under Data Privacy.

However, if you block cookies and similar technologies, our website may no longer be able to function fully.

16.4. Akismet

Our website uses Akismet software from Automattic Inc., 60 29th Street #343, San Francisco, CA 94110, United States of America. Akismet is a service that protects the website from spam messages as comments under blog posts, content pages and other types of content. To check whether a comment qualifies as spam, Akismet collects the input data of the website user as well as technical information such as IP address, country of residence, browser, screen resolution and related information. This data is transmitted to the USA, where the servers of the service are located, for automatic verification. The data will be processed, then further processed, shared and deleted in accordance with the privacy policy of Automattic Inc.

16.5. Cloudflare

We use DNS services and a Content Delivery Network (CDN) from Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA for our website. Cloudflare is certified under the Privacy Shield Agreement and thereby offers a guarantee of compliance with European data protection law (https://www.privacyshield.gov/participant?id=a2zt0000000GnZKAA0&status=Active). CDNs are services with which content, in particular larger media files such as graphics and videos, can be delivered more quickly using regionally distributed servers. User data processing takes place solely for the aforementioned purposes and to maintain the security and functionality of the CDN. DNS (Domain Name System) services help the browser to find the appropriate IP address of the server hosting and delivering this page for an entered domain such as www.example.com. Use is based on our legitimate interests, i.e. interest in the secure and efficient provision, analysis and optimisation of our online offer.

16.6. Matomo

Matomo, formerly Piwik, is an open-source web application for web analytics. It is the successor of the now discontinued phpMyVisites project and an alternative to Google Analytics. Matomo can be hosted in the cloud or locally with the provider. On this website, Matomo is used to collect statistical evaluations about the performance of individual pages with the aim of optimising user experience. The following data is processed: the browser type and version you use, your operating system, your country of origin, the date and time of the server request, the number of visits, the length of time you spend on the website and any external links you use. The user’s IP address is anonymised before it is stored. Matomo uses cookies stored on the user’s computer, which enable an analysis of the use of our website by users. This can involve creating pseudonymous user profiles from the processed data. The information generated by the cookie regarding your use of this website is only stored on our server and is not passed on to third parties.

16.7. Mapbox

On our website we embed, amongst other things, or exclusively, maps from the “Mapbox” service of the provider Mapbox, Logan Exchange 2nd Floor 1509 16th Street Northwest Washington, DC 20036, USA. The processed data may include mainly IP addresses and the users’ location data. The data may be processed in the USA and/or Europe. Mapbox Privacy Policy: https://www.mapbox.com/privacy/. For more information, please contact privacy@mapbox.com.

18.1. Right to information

You have the right to request a confirmation from us as to whether personal data concerning you is processed by us. In this case, you have the right to information about this personal data and to further information. Please submit the request for information together with proof of your identity.

18.2. Right to rectification

You have the right to demand from us the rectification of your inaccurate personal data without undue delay. Taking into account the purposes of processing, this also includes the right to demand the completion of incomplete personal data – including by means of a supplementary declaration.

18.3. Right to erasure

You have the right to demand the erasure or anonymisation of all your personal data without delay, unless we are legally obliged to retain it.

18.4. Right to data portability and surrender

You also have the right to receive the data you have provided to us in a common file format.

18.5. Revocation of consent

You can revoke your consent at any time with future effect. Please note that exercising these rights may conflict with contractual agreements and this may, for example, have cost implications.

18.6. Objection

You can object to data processing, particularly if we process your personal data based on a legitimate interest and the other applicable requirements are met.

18.7. Legal recourse

You can also assert your rights in court or file a report with the competent supervisory authority. The Fed-eral Data Protection and Information Commissioner (FDPIC) is responsible for this in Switzerland. You can find more information at: https://www.edoeb.admin.ch.