Data Protection

Data protection declaration

This data protection declaration clarifies the type, scope and purpose of the processing of personal data (hereinafter referred to as “data”) in the context of the provision of our services and within our online offering and the websites, functions and content associated with it as well as external online presences, such as our Social Media Profile (hereinafter jointly referred to as “online offering”). With regard to the terms used, such as “processing” or “person responsible”, we refer you to the definitions in Art. 4 of the EU General Data Protection Regulation (GDPR).

1. Person responsible
wifag//polytype Group
26, route de la Glâne
1701 Fribourg
E-mail-contact: info(at)polytype.com
WIFAG-Polytype Holding SA, Managing Director: Martin Tschumi
Polytype SA, Managing Director: Julien Bianchi
Mall+Herlan GmbH, Managing Director: Carsten O’Beirne
xtracan GmbH, Managing Director: Carsten O’Beirne

Responsable for Dataprotection:
SüdWest Datenschutz Rechtsanwaltsgesellschaft mbH, Ludwig-Ehrhard-Allee 10, 76131 Karlsruhe
Nicole Schmidt, LL.M.
Nicole.schmidt@suedwest-datenschutz.com

2. Terms used
“Personal data” means any information relating to an identified or identifiable natural person (hereinafter “data subject”); a natural person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, online identifier (e.g. a cookie) or to one or more specific characteristics which express the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person, is regarded as identifiable.

“processing” means any operation carried out with or without the aid of automated processes, or set of operations, involving personal data. The term is broad and covers practically every handling of data.

“Pseudonymisation” means the processing of personal data in such a way that the personal data can no longer be attributed to a specific data subject without the provision of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures ensuring that the personal data are not attributed to an identified or identifiable natural person.

“Profiling” means any automated processing of personal data consisting of the use of such personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects relating to the work performance, economic situation, health, personal preferences, interests, reliability, conduct, whereabouts or movements of that natural person.

The “controller” is the natural or legal person, public authority, agency or other body which alone or jointly with others determines the purposes and means of the processing of personal data.

“processor” means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.

3. Types of data processed

• inventory data (e.g., personal master data, names or addresses).
• Contact data (e.g., e-mail, telephone numbers).
• Content data (e.g., text entries, photographs, videos).
• Usage data (e.g., websites visited, interest in content, access times).
• Meta/communication data (e.g., device information, IP addresses).

4. Categories of data subjects
Visitors and users of the online offer (hereinafter referred to collectively as “users”).

5. Purpose of processing

• Provision of the online offer, its functions and contents.
• Answering contact requests and communicating with users.
• Security measures.
• Range measurement/Marketing

6. Applicable legal bases
If we process data of users from the EU/EWG, the following legal bases of the GDPR apply in each case.
For the rest, we process the data on the basis of Swiss law. I.e. in this case the following explanations apply, but on the basis of Swiss law and not the GDPR standards mentioned.
In accordance with Art. 13 GDPR, we will inform you of the legal basis of our data processing. For users from the area of application of the data protection basic regulation (GDPR), i.e. the EU and the EEC, the following applies if the legal basis is not mentioned in the data protection declaration:
The legal basis for obtaining consent is Art. 6 para. 1 lit. a and Art. 7 GDPR;
The legal basis for the processing for the fulfilment of our services and the implementation of contractual measures as well as the answering of inquiries is Art. 6 para. 1 lit. b GDPR;
The legal basis for the processing to fulfil our legal obligations is Art. 6 para. 1 lit. c GDPR;
Art. 6 para. 1 lit. d GDPR serves as the legal basis in the event that vital interests of the data subject or another natural person necessitate the processing of personal data.
The legal basis for the processing necessary for the performance of a task which is in the public interest or is carried out in the exercise of official authority entrusted to the data controller is Art. 6 para. 1 lit. e GDPR.
The legal basis for the processing to safeguard our legitimate interests is Art. 6 para. 1 lit. f GDPR.
The processing of data for purposes other than those for which they were collected is governed by the provisions of Art. 6 (4) GDPR.
The processing of special categories of data (pursuant to Art. 9 para. 1 GDPR) is governed by the provisions of Art. 9 para. 2 GDPR.

7. Deletion of data
The data processed by us will be deleted in accordance with legal requirements or their processing will be restricted. Unless expressly stated in this data protection declaration, the data stored by us will be deleted as soon as they are no longer required for their intended purpose and there are no legal obligations to retain them.

If the data are not deleted because they are required for other and legally permissible purposes, their processing will be restricted. This means that the data is blocked and not processed for other purposes. This applies, for example, to data that must be stored for commercial or tax reasons.

8. Safety precautions
We take appropriate technical and organisational measures in accordance with the statutory requirements, taking into account the state of the art, the implementation costs and the type, extent, circumstances and purposes of the processing as well as the different probability of occurrence and severity of the risk to the rights and freedoms of natural persons, in order to ensure a level of protection appropriate to the risk.

In particular, these measures include safeguarding the confidentiality, integrity and availability of data by controlling physical access to the data as well as access to, inputting, forwarding, securing and separating the data. In addition, we have established procedures to ensure the exercise of data subjects’ rights, the deletion of data and the response to data threats. Furthermore, we take the protection of personal data into account as early as the development or selection of hardware, software and processes, in accordance with the principle of data protection through technology design and data protection-friendly default settings.

9. Cooperation with contract processors, jointly responsible persons and third parties
Insofar as we disclose data to other persons and companies (contract processors, jointly responsible persons or third parties) within the scope of our processing, transfer them to them or otherwise grant them access to the data, this shall only take place on the basis of legal permission (e.g. if a transfer of the data to third parties, such as payment service providers, is necessary for the fulfilment of the contract), users have consented, a legal obligation provides for this or on the basis of our legitimate interests (e.g. when using agents, web hosts, etc.).

Insofar as we disclose, transmit or otherwise grant access to data to other companies of our group of companies, this is done in particular for administrative purposes as a legitimate interest and beyond that on a basis corresponding to the legal requirements.

10. Transfers to third countries
If we process data in a third country (i.e. outside the European Union (EU), the European Economic Area (EEA) or the Swiss Confederation) or if this is done in the context of the use of third party services or disclosure or transfer of data to other persons or companies, this only occurs if it is done to fulfil our (pre)contractual obligations, on the basis of your consent, a legal obligation or on the basis of our legitimate interests. Subject to legal or contractual permissions, we process or leave the data in a third country only if the legal requirements are met. I.e. the processing takes place e.g. on the basis of special guarantees, like the officially recognized statement of a data protection level corresponding to the EU (e.g. for the USA by the “EU-US Data Privacy Framework”) or observance of officially recognized special contractual obligations.

11. Cookies
Our website uses cookies. Cookies are text files that are stored in the Internet browser or by the Internet browser on the user’s computer system. When a user accesses a website, a cookie may be stored on the user’s operating system. This cookie contains a characteristic string of characters that enables the browser to be uniquely identified when the website is called up again.

We use cookies to make our website functional. Some elements of our website require that the accessing browser can be identified even after a page change.

The following data is stored and transmitted in the cookies:

(1) Language settings
(2) Log-in information

We also use cookies on our website that enable an analysis of the user’s surfing behaviour.

The following data can be transmitted in this way

(1) Search terms entered
(2) Frequency of page views
(3) Utilisation of website functions

When accessing our website, the user is informed about the use of cookies for analysis purposes and their consent to the processing of the personal data used in this context is obtained. In this context, reference is also made to this privacy policy.

The purpose of using technically necessary cookies is to enable the use of websites for users. Some functions of our website cannot be offered without the use of cookies. For these, it is necessary that the browser is recognised even after a page change.

Analysis cookies are used for the purpose of improving the quality of our website and its content. Through the analysis cookies, we learn how the website is used and can thus constantly optimise our offer.

These purposes also constitute our legitimate interest in the subsequent processing of personal data in accordance with Art. 6 para. 1 sentence 1 lit. f GDPR.

The legal basis for cookies that are technically absolutely necessary within the meaning of § 25 para. 2 TDDDG in order to provide you with the expressly requested service is Art. 6 para. 1 sentence 1 lit. f GDPR. Any use of cookies that is not absolutely technically necessary for this purpose constitutes data processing that is only permitted with your express and active consent in accordance with Section 25 (1) TDDDG in conjunction with Art. 6 (1) sentence 1 lit. a GDPR. In addition, we will only pass on your personal data processed by cookies to third parties if you have given your express consent in accordance with Art. 6 para. 1 sentence 1 lit. a GDPR. You can revoke your consent to the processing of your data by cookies at any time. After revoking your consent, the use of the website may be restricted. The legality of the data processing operations that have already taken place remains unaffected by the revocation.

The storage period depends on the type of cookie. A distinction is made between transient cookies (especially session cookies), which are deleted as soon as you close your browser, and persistent (permanent) cookies, which are stored beyond the individual session and are automatically deleted after a specified period, which may vary depending on the cookie. You can delete persistent cookies at any time in the security settings of your browser. Third-party cookies can also be set. They can be used to track your movements on the Internet. You can configure your browser settings according to your wishes and, for example, refuse to accept third-party cookies or all cookies.

12. Contractual services
We process the data of our contractual partners and interested parties as well as other clients, customers, or contractual partners (uniformly referred to as “contractual partners”) in accordance with Art. 6 para. 1 lit. b. of the GDPR in order to provide them with our contractual or pre-contractual services. The data processed, the type, scope and purpose and the necessity of their processing are determined by the underlying contractual relationship.

The processed data includes the master data of our contractual partners (e.g., names and addresses), contact data (e.g. e-mail addresses and telephone numbers) as well as contract data (e.g., services used, contract contents, contractual communication, names of contact persons) and payment data (e.g., bank details, payment history).

We do not process any special categories of personal data, unless they are part of a commissioned or contractual processing.

We process data which are necessary for the justification and fulfilment of the contractual services and point out the necessity of their indication, if this is not evident for the contracting parties. Disclosure to external persons or companies shall only take place if it is necessary within the framework of a contract. When processing the data provided to us within the framework of an order, we act in accordance with the instructions of the client and the legal requirements.

The data will be deleted when the data is no longer required for the fulfilment of contractual or statutory welfare obligations and for the handling of any warranty and comparable obligations, whereby the necessity of storing the data is reviewed every three years; otherwise the statutory storage obligations apply

13. Administration, financial accounting, office organisation, contact management
We process data as part of administrative tasks and the organisation of our business, financial accounting and compliance with legal obligations, such as archiving. In doing so, we process the same data that we process as part of the provision of our contractual services. The processing bases are Art. 6 para. 1 sentence 1 lit. c. GDPR, Art. 6 para. 1 sentence 1 lit. f. GDPR. Customers, interested parties, business partners and website visitors are affected by the processing. The purpose and our interest in the processing lies in the administration, financial accounting, office organisation, archiving of data, i.e. tasks that serve to maintain our business activities, perform our tasks and provide our services. Our legitimate interest is limited to the aforementioned purposes. The deletion of data with regard to contractual services and contractual communication corresponds to the information specified in these processing activities.

We disclose or transmit data to the tax authorities, consultants, such as tax consultants or auditors, as well as other fee offices and payment service providers.

Furthermore, on the basis of our business interests, we store information on suppliers, organisers and other business partners, e.g. for the purpose of establishing contact at a later date. This data, which is mainly company-related, is stored permanently.

14. Economic analyses and market research
In order to run our business economically, to be able to recognise market trends, wishes of contractual partners and users, we analyse the data available to us on business transactions, contracts, enquiries, etc. We process inventory data, communication data, contract data, payment data, usage data, metadata on the basis of Art. 6 para. 1 lit. f. GDPR, whereby the persons concerned include contractual partners, interested parties, customers, visitors and users of our online services.

The analyses are carried out for the purpose of economic evaluations, marketing and market research. We can consider the profiles of registered users with information, e.g. on the services they have used. The analyses serve us to increase the user friendliness, the optimization of our offer and the business economy. The analyses serve us alone and are not disclosed externally unless they are anonymous analyses with summarized values.

If these analyses or profiles are person-related, they will be deleted or anonymised upon termination by the user, otherwise after two years from the conclusion of the contract. In all other respects, the macroeconomic analyses and general trend determinations are prepared anonymously wherever possible.

15. Contacting us
You have the option of contacting us by telephone, email or via our contact form.

If you contact us by telephone, your telephone number in particular and, if necessary, your name, your e-mail address, the time of the call and details of your request will be processed during the conversation upon request. If you contact us by e-mail, your e-mail address, the time of the e-mail and any data resulting from the message text (including attachments, if applicable) will be processed. If you contact us via our contact form, the information requested there, as well as the date and time of the contact enquiry, will be processed.

The purpose of processing the above-mentioned data is to process your contact enquiry and to be able to get in touch with you to respond to your request.

The legal basis for the storage of your data is your consent pursuant to Art. 6 para. 1 sentence 1 lit. a GDPR. You can withdraw your consent at any time with effect for the future. The legality of the data processing carried out up to that point remains unaffected. Exceptionally, Art. 6 para. 1 sentence 1 lit. b GDPR may be the legal basis for data processing. This is the case if we already have your user consent to data storage – for example, by concluding a contract.

We will only process the personal data for as long as is necessary to process the contact enquiry.

16. Hosting and e-mailing
This website is hosted externally. The personal data collected on this website is stored on the host’s servers. This may include, in particular, inventory data, contact data, content data, contract data, usage data, meta and communication data of customers, interested parties and visitors to this online offering.

Our hoster will only process your data to the extent necessary to fulfil its performance obligations and follow our instructions with regard to this data. We use the following hoster:
Infomaniak Network AG
Rue Eugène Marziano 25
1227 Les Acacias (GE)
Switzerland

External hosting is carried out in the interest of a secure, fast and efficient provision of our online offer by a professional provider (Art. 6 para. 1 sentence 1 lit. f GDPR). Our legitimate interest is limited to the aforementioned purpose. If a corresponding consent has been requested, the processing is carried out exclusively on the basis of Art. 6 para. 1 sentence 1 lit. a GDPR and § 25 para. 1 TDDDG, insofar as the consent includes the storage of cookies or access to information in your end device (e.g. device fingerprinting) within the meaning of the TDDDG.

Unless a more specific storage period has been specified in this privacy policy, your personal data will remain with us until the purpose for data processing no longer applies.

You have the option to withdraw your consent to the processing of personal data at any time. The legality of the processing carried out on the basis of the consent until the revocation remains unaffected. You also have the option to object to the storage of your personal data at any time by sending an e-mail to the address stated under 1. If you assert a justified request for deletion or revoke your consent to data processing, your data will be deleted unless we have other legally permissible reasons for storing your personal data (e.g. retention periods under tax or commercial law); in the latter case, deletion will take place after these reasons no longer apply.

We have concluded a data processing agreement (DPA) for the use of the above-mentioned service. This is a contract prescribed by data protection law, which guarantees that it processes the personal data of our website visitors only in accordance with our instructions and in compliance with the GDPR.

17. Collection of access data and log files
We do not collect any personal data when you use the website for information purposes only, with the exception of the data that your browser transmits to enable you to visit the website. This includes

– Name of the website accessed
– Date and time of access
– Amount of data transferred
– Notification of successful retrieval
– Browser type and version
– Operating system of the user
– Referrer URL
– IP address
– Requesting provider

Within the scope of using our online services, we can store the IP address and the time of the respective user action. The storage takes place on the basis of our justified interests, as well as the interests of the users in the protection from abuse and other unauthorized use. This data will not be passed on to third parties unless it is necessary to pursue our claims pursuant to Art. 6 Para. 1 lit. f. of the GDPR or there is a legal obligation to do so pursuant to Art. 6 Para. 1 lit. c. GDPR.

In order to ensure the functionality of the website, the above-mentioned data is stored in log files. This data is also used to ensure the security of our information technology systems and to optimise the website. The data is neither used to analyse user behaviour nor combined with other data.

The legal basis for the storage of data in log files is Art. 6 para. 1 sentence 1 lit. f GDPR. Our legitimate interest is limited to the aforementioned purposes.

We only store your data for as long as we need it for the intended purpose. The law does not specify any time limits. As a rule, the data is deleted after seven days. If legal requirements permit longer storage, we can also store the data beyond these seven days.

18. Online presences in social media
We operate our social media sites in order to achieve the broadest possible presence on the Internet and to provide information on current topics as part of sustainable communication and to adapt our offers to the needs of users. This is a legitimate interest within the meaning of Art. 6 para. 1 lit. f GDPR.

The analysis processes initiated by the social networks may be based on different legal bases, which must be specified by the operators of the social networks (e.g. consent within the meaning of Art. 6 para. 1 sentence 1 lit. a GDPR). Social networks are generally able to comprehensively analyse your user behaviour when you visit their website or a website with integrated social media content (e.g. like buttons or advertising banners). If you are logged into your social media account and visit our social media presence, the operator of the social media portal can assign this visit to your user account. Under certain circumstances, however, your personal data may also be collected if you are not logged in or do not have an account with the respective social media portal. In this case, data is collected, for example, by recording your IP address via cookies that are stored on your end device. Operators of social media portals can use the data collected in this way to create user profiles in which your preferences and interests are stored. If you have an account with the respective social network, interest-based advertising can be displayed on all devices on which you are logged in or were logged in.

In principle, we are jointly responsible with the operator of the respective social network for the data processing operations within the meaning of Art. 26 GDPR. You can assert your rights (right of access pursuant to Art. 15 GDPR, right to rectification pursuant to Art. 16 GDPR, right to erasure pursuant to Art. 17 GDPR, right to restriction of processing pursuant to Art. 18 GDPR, right to data portability pursuant to Art. 20 GDPR and right to lodge a complaint pursuant to Art. 77 GDPR) both against us and against the operator of the respective social network. Please note that despite our joint responsibility with the operators of social networks in accordance with Art. 26 GDPR, we do not have full influence on the data processing and the assertion of data subject rights of the individual social networks. To assert your rights as a data subject, please contact the respective operator of the social network directly. If you address your enquiry to us, we will forward it to the respective operator.

The data collected directly by us will be deleted from our systems as soon as the purpose for storing it no longer applies, you ask us to delete it or you object or withdraw your consent. Stored cookies remain on your end device until you delete them. Legal provisions, in particular retention periods, remain unaffected. We have no knowledge of and no influence on the storage period of your data that is stored by the operators of social networks for their own purposes. For details, please contact the operators of the social networks directly.

Depending on the provider, further processing operations may therefore be carried out by the operators of the social media portals, including in the USA or other third countries; details on this can be found in the terms of use and data protection provisions of the respective social media portals:

– Google/ YouTube (Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA) – Datenschutzerklärung: policies.google.com/privacy , Opt-Out: adssettings.google.com/authenticated , Privacy Shield: www.privacyshield.gov/participant .
– LinkedIn (LinkedIn Ireland Unlimited Company Wilton Place, Dublin 2, Irland) – Datenschutzerklärung www.linkedin.com/legal/privacy-policy , Opt-Out: www.linkedin.com/psettings/guest-controls/retargeting-opt-out , Privacy Shield: www.privacyshield.gov/participant .
– Xing (XING AG, Dammtorstraße 29-32, 20354 Hamburg, Deutschland) – Datenschutzerklärung/ Opt-Out: https://privacy.xing.com/de/datenschutzerklaerung .

You can declare your objection at any time by sending a message to the above-mentioned contact details. You may then no longer be able to use the full functionality of the website. Alternatively, you can contact us using the contact options provided on the website.

19. Integration of third-party services and content
Within our online offer, we use content or service offers from third parties on the basis of our legitimate interests (i.e. interest in the analysis, optimisation and economic operation of our online offer within the meaning of Art. 6 Para. 1 lit. f. GDPR) content or service offers from third parties in order to integrate their content and services, such as videos or fonts (hereinafter uniformly referred to as “content”).

This always presupposes that the third-party providers of this content perceive the IP address of the user, since they would not be able to send the content to their browser without the IP address. The IP address is therefore required for the presentation of this content. We make every effort to use only those contents whose respective providers only use the IP address to deliver the contents. Third party providers may also use so-called pixel tags (invisible graphics, also known as “web beacons”) for statistical or marketing purposes. Pixel tags” can be used to evaluate information such as visitor traffic on the pages of this website. The pseudonymous information may also be stored in cookies on the user’s device and may contain, among other things, technical information about the browser and operating system, referring web pages, visit times and other information about the use of our online services, as well as may be linked to such information from other sources.

a. Google Fonts
We use Google Fonts, a service provided by Google LLC. To enable Google to provide the fonts, we automatically load the fonts via a Google server in the USA each time you visit our website. Google sets a cookie for this purpose and can thus analyse personal data of website visitors. This data includes

– The browser
– The website visited by the user
– The user’s operating system
– The user’s screen resolution
– The user’s IP address
– The language setting of the browser

This data is stored by Google and used for tracking purposes. We use Google Fonts to optimise our online service. The legal basis for data processing is Art. 6 para. 1 lit. a GDPR. You can revoke your consent at any time with effect for the future. The legality of the data processing carried out up to that point remains unaffected. Google stores requests for CSS assets for one day. The font files are stored by Google for one year.

b. Google Maps
We use the services of Google Maps. When you visit the website, Google receives the information that you have accessed the corresponding subpage of our website (including your IP address). This occurs regardless of whether Google provides a user account through which you are logged in or whether no user account exists. If you are logged in to Google, this data is assigned directly to your account. If you do not wish to be associated with your Google profile, you must log out before activating the button.
Google Maps allows us to show you interactive maps directly on the website, thus enabling you to conveniently use the map function.

The legal basis for the transfer of data is Art. 6 para. 1 sentence 1 lit. a GDPR. You can revoke your consent at any time. The legality of the data processing carried out up to that point remains unaffected.

c. Google Analytics
We use Google Analytics. Google Analytics uses ‘cookies’, which are text files placed on your computer, to help the website analyse how users use the site. The information generated by the cookie about your use of this website is usually transmitted to a Google server in the USA and stored there.

We use Google Analytics to analyse and regularly improve the use of our website. We can use the statistics obtained to improve our offer and make it more interesting for you as a user.

The legal basis for the use of Google Analytics is your consent in accordance with Art. 6 para. 1, sentence 1 lit. a GDPR. You can revoke your consent at any time with effect for the future. The legality of the data processing carried out up to that point remains unaffected.

The data is deleted as soon as it is no longer required for our recording purposes.

We have activated the IP anonymisation function on our website. This means that your IP address will be truncated by Google within member states of the European Union or in other signatory states to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and truncated there. On behalf of the operator of this website, Google will use this information to analyse your use of the website, to compile reports on website activity and to provide the website operator with other services relating to website activity and internet usage.

20. Rights of users
a. Right to information
You have the right to request confirmation as to whether the data in question is being processed and to request information about this data as well as further information and a copy of the data in accordance with the legal requirements.

b. Right to rectification
In accordance with the legal requirements, you have the right to request the completion of data concerning you or the correction of incorrect data concerning you.

c. Right to erasure or restriction of processing
In accordance with the legal requirements, you have the right to demand that the data in question be deleted immediately or, alternatively, to demand that the processing of the data be restricted in accordance with the legal requirements.

d. Right to data portability
You have the right to request to receive the data concerning you that you have provided to us in accordance with the legal requirements and to request its transfer to other responsible parties.

e. Right to lodge a complaint
You also have the right to lodge a complaint with the competent supervisory authority in accordance with the statutory provisions.

f.Right of cancellation
You have the right to withdraw your consent with effect for the future.

g.Right to object
You can object to the future processing of data concerning you at any time in accordance with the legal requirements. In particular, you may object to processing for direct marketing purposes.

21. Changes and Updates to the Data Protection Declaration
We ask you to inform yourself regularly about the content of our data protection declaration. We will adapt the data protection declaration as soon as the changes to the data processing carried out by us make this necessary. We will inform you as soon as the changes require your cooperation (e.g. consent) or other individual notification.