figureit
Book a demo

Privacy Policy

I. General

figure it ag is the operator of the website https://figureit.digital/ and the services offered thereon and is therefore responsible for the collection, processing and use of your personal data (referred to in this Privacy Policy as “Personal Data”) and the compliance of the data processing with the applicable data protection law. Your trust is important to us, which is why we take data protection seriously and ensure that an appropriate level of security is provided.

We process your personal data in accordance with the processing principles set out in Art. 6 to 8 of the Data Protection Act. The protection of your privacy is important to us and we attach great importance to compliance with the relevant data protection regulations. In this privacy policy, we provide you with extensive information about how we handle your personal data and explain your rights regarding the processing of personal data at our company. We regulate the processing of our employees’ personal data solely within the framework of the specific contracts.

You can find information about your right to object to the use of your data in section VI “Your Rights”.

A. Scope

This privacy policy applies to all personal data processing activities that occur via our website, when conducting prize draws, using our software-based solutions or conducting our business activities.

Where our offer is directed at visitors and users in Switzerland, the Swiss Federal Act on Data Protection (FADP), as amended, shall apply to us. Where the GDPR applies, European data protection law (Regulation (EU) 2016/679, General Data Protection Regulation) shall apply. For the sake of simplification, GDPR terminology and citation are used in this contract, even where only the Swiss Federal Data Protection Act (FADP) applies. In this case, the GDPR or GDPR interpretation does not apply.

Linked websites of other providers or websites that link to our website are not covered by this privacy policy.

B. Contact Details

Controller

figure it ag
Bahnhofstrasse 4
9100 Herisau

Email: info@figureit.digital

Phone: +41 71 571 51 30

Data Protection Officer

datenschutz@figureit.digital

FADP Data Protection Regulator

Federal Data Protection and Information Commissioner
Feldeggweg 1
3003 Bern, Switzerland

Phone: +41 58 462 43 95

Contact form: Link to external site

II. Processing Activities

Depending on your relationship with us, we process different personal data about you for different purposes and based on different legal bases.

A. Visiting Our Website

Data Processing

When you visit our website, the browser used on your device automatically sends information to the server of our website. This information is temporarily stored in a so-called log file.

Personal Data

The following data is collected without any action on your part and stored until it is automatically deleted:

  • IP address of the requesting computer

  • Owner of the IP address range (usually your Internet access provider)

  • Date and time of access

  • Name and URL of the retrieved file

  • Website from which access is made (referrer URL), with search term used if applicable

  • Status code (e.g. error message)

  • Amount of data sent in bytes

  • Your user name from registration/authentication, if applicable

  • Browser type, version, language settings, location and your operating computer’s system

  • The pages that are accessed via an accessing system on our website

  • Other similar data and information used to avert security threats in the event of an attack on our IT systems

Purpose

The data in question is processed for the following purposes:

  • Ensuring a smooth connection to the website

  • Ensuring convenient use of our website

  • Evaluation of system security and stability, as well as for other administrative purposes

  • Improving and developing our business and services

Ensuring Data Protection

Processing takes place in Switzerland. We have concluded a data processing agreement with our contract processing company.

There exists an overriding private interest in processing your personal data in accordance with Art. 31(1) FADP or Art. 6(1)(1)(f) GDPR.

Necessity

This information is necessary for the functionality of the website.

Retention Period

After your session has ended, the data will be deleted, but we will retain the log file in accordance with legal requirements.

B. Contact

Data Processing

On our website we offer you the opportunity to contact us directly via phone or email. If you would like to contact us by email, you can also click on our email button, which will redirect you directly to your default email program. We have no influence over the processing of personal data on third-party websites.

We do not record conversations.

We also offer you the opportunity to arrange a personal consultation appointment using the Book A Consultation button.

Personal Data

For enquires, we ask you to provide the following information:

  • First and last name

  • Email address

  • Phone number (optional)

  • Your enquiry, which you can submit in writing or verbally.

Purpose

The data in question is processed for the following purposes:

  • Contact

  • Booking an appointment

  • Responding to your inquiry

Processor

For voice and video calls we use Google Voice & Google Meet from Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

We use Google’s Gmail email service as our email service. We use Google Calendar from Google as a booking platform for personal consultation appointments.

Ensuring Data Protection

Your personal data will generally be processed by Google in Ireland. The transfer of European or Swiss personal data to Google may result in Google transferring this data to its parent company, Google LLC, in the USA or to third parties in a country that does not have an equivalent level of data protection. According to a decision by the Federal Council (CH) and the European Commission (EU), certified companies in the USA guarantee an appropriate level of data protection (see also section IV). We have nevertheless agreed with Google that any transfer to the USA will be based on the EU-US or Swiss-US Data Privacy Framework or, should the Data Privacy Framework be declared invalid, on the basis of so-called standard contractual clauses and appropriate and proportionate technical and organisational measures. By submitting your request, you hereby consent to your personal data being transferred, as required, to insecure third countries in accordance with Art. 17 FADP or Art. 49(1(a) GDPR.

Privacy policy of data processor

https://policies.google.com/privacy?hl=de

This data processing is carried out on the basis of contractual or pre-contractual measures in accordance with Art. 31(2)(a) FADP or Art. 6(1)(b) GDPR.

Necessity

This processing activity is not necessary for the functionality of the website.

Retention Period

Data stored for the purpose of contacting you will be deleted after processing has been completed, unless we are legally obliged to retain the data for a period of 5 or 10 years.

C. Cookies

1. Basics

We use cookies on our website. We use cookies to compile anonymised aggregate statistics that show us how our website is used and to improve the content and functionality of our website.

A cookie is a small piece of data that is stored by a website on a visitor’s computer or mobile device. A cookie does not always mean that we can identify you. You can configure your browser settings so that no cookies are stored on your computer or mobile device. However, please note that completely disabling cookies may mean that you can no longer use all the functions of our website. We process this data in our interest of maintaining a web-based market presence.

2. Types of Cookies

Our website uses session cookies and persistent cookies.

Session cookies are used to make our website more secure, to make our online presentation user-friendly and to analyse the use of our site. A session cookie is automatically deleted when you close your browser or shortly thereafter.

Persistent cookies are used to optimise user-friendliness and speed up your web experience on our site. The next time you visit our website, it will automatically recognise that you have already visited us and which entries and settings you have made so that you do not have to enter them again. Persistent cookies expire after a certain period of time.

3. Managing, Deleting, or Disabling Cookies

By default, most internet browsers automatically accept cookies. If prefer not to have cookies from our website stored on your device, you can configure your browser settings so that you receive a warning before certain cookies are stored. You can configure your browser settings so that your browser blocks most of our cookies, allows only certain cookies, or blocks all cookies. You can also withdraw your consent to certain cookies by deleting the cookies that have already been stored.

Further information on cookies can be found on the relevant browser platform websites:

Internet Explorer: https://support.microsoft.com/de-de/topic/l%C3%B6schen-von-cookiedateien-in-internet-explorer-bca9446f-d873-78de-77ba-d42645fa52fc

Mozilla Firefox: https://support.mozilla.org/de-DE/kb/delete-cookies-remove-info-websites-stored

Google Chrome: https://support.google.com/chrome/answer/95647?co=GENIE.Platform%3DDesktop&hl=de&sjid=8303931592311908957-EU

Safari: https://support.apple.com/de-de/guide/safari/ibrw850f6c51/mac

Opera: https://help.opera.com/de/latest/web-preferences/

Please note that partially or completely disabling cookies may mean that you can no longer use all the functions of our website.

4. Strictly necessary cookies

4.1 Session Identifier

We use cookies on our website to identify your user session. This allows us to save your preferences across the website and offer you the desired user experience.

This cookie is used to store user preferences regarding cookies on our website. User settings that were already configured during a previous visit are stored in this cookie.

Data Processing:

For our cookie banner, we use the consent management service Usercentrics from Usercentrics A/S (“Usercentrics”), Havnegade 39, 1058 Copenhagen, Denmark. This enables us to obtain and manage the consent of website users to data processing.

Personal Data:

Your consent allows us to process the following data:

  • Date and time of access

  • Browser information

  • Device information

  • Location

  • Cookie preferences

  • URL of the site visited

Purpose:

The purpose of processing this data is to legally obtain your consent or refusal to certain privacy settings.

Ensuring Data Protection:

Processing by Usercentrics takes place in the EU or the EEA. We have concluded a data processing agreement with our contract processing company.

Data Protection Declaration of the Processor:

https://usercentrics.com/privacy-policy/

Legal Basis:

The use of a cookie banner is based on our overriding private interest in accordance with Art. 31(1) FADP or Art. 6(1)(1)(f) GDPR.

Necessity:

The functionality of the website cannot be guaranteed without processing the user’s data.

Retention Period:

The data will be deleted after 3 years at the latest.

This cookie is used to store user settings regarding cookies on our website. User settings that were configured during a previous visit are stored in this cookie.

5. Optional Cookies

We only collect your data using the optional (non-essential) cookies with your explicit consent, which you give us by accepting the cookies in the cookie settings displayed on our website. You can change the configuration for your consent at any time via the cookie settings (link in the footer).

5.1 Google Tag Manager

Data Processing:

We use the Google Tag Manager (“GTM”) on our website. GTM is a tag management system that integrates tags in a standardised manner via a user interface. Tags are short sections of source code that can track activities and access other systems in order to centrally control when certain systems are triggered. Google Analytics is integrated into GTM. This means that GTM is merely an interface between the website and the analytics software. You can prevent the setting of tags in your browser settings at any time. Further information on these systems and their data processing can be found in the following sections.

Personal Data:

GTM ensures the activation of other tools, which in turn collect personal data. Depending on the integrated tool, GTM collects:

  • IP addresses of website visitors

  • Transfer of IP addresses to analysis programs

Purpose:

We process your personal data for marketing and analysis purposes. We evaluate your user behaviour, conduct conversion tracking, compile statistics and optimise our advertising channels and approaches.

Processor:

Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

Ensuring Data Protection:

Your personal data will generally be processed by Google in Ireland. The transfer of European or Swiss personal data to Google may result in Google transferring this data to its parent company in the USA or to third parties in a country that does not have an equivalent level of data protection. According to a decision by the Federal Council (CH) and the European Commission (EU), certified companies in the USA guarantee an appropriate level of data protection (see also section IV). We have nevertheless agreed with Google that any transfer to the USA will be based on the EU-US or Swiss-US Data Privacy Framework or, should the Data Privacy Framework be declared invalid, on the basis of so-called standard contractual clauses and appropriate and proportionate technical and organisational measures. By giving your consent via the cookie banner, you also consent to your personal data being transferred to insecure third countries in accordance with Art. 17 FADP or Art. 49(1)(a) GDPR.

Data Protection Declaration of the Processor:

https://policies.google.com/privacy?hl=en

Legal Basis:

The use of GTM is based on our overriding private interest in accordance with Art. 31(1) FADP or Art. 6(1)(1)(f) GDPR. Once you confirm that you have read and agree to the terms of this privacy policy, we will immediately begin to process your personal data with your express consent in accordance with Art. 31(1) FADP or Art. 6(1)(1)(a) GDPR.

Necessity:

This processing activity is not necessary for the functionality of the website.

Retention Period:

Your data will be stored on your device for up to two years unless renewed.

5.2. Google Analytics 4

Data Processing:

We use Google Analytics 4, a web analysis service provided by Google Ireland Limited (“Google”), located at Gordon House, Barrow Street, Dublin 4, Ireland, on our website.

Cookies are used to create pseudonymous user profiles. This data is stored on the device, anonymised, and evaluated in the form of statistics.

Personal Data:

The following data will be processed using the Google Analytics 4 web analysis service:

  • Masked IP address of the requesting computer

  • Date and time of access

  • Website from which access is made (referrer URL)

  • Browser type and version

  • Number of visits/users

  • Session statistics

Google Analytics 4 uses three persistent cookies (_gat, _gid,

_ga) for this purpose, which are automatically deleted after a defined period of time.

The IP addresses recorded are anonymised by Google Analytics (so-called IP masking). Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and truncated there.

Purpose:

We use Google Analytics to analyse errors and to continuously improve our website through statistical evaluation.

Processor:

Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

Ensuring Data Protection:

Your personal data will generally be processed by Google in Ireland. The transfer of European or Swiss personal data to Google may result in Google transferring this data to its parent company, Google LLC, in the USA or to third parties in a country that does not have an equivalent level of data protection. According to a decision by the Federal Council (CH) and the European Commission (EU), certified companies in the USA guarantee an appropriate level of data protection (see also section IV). We have nevertheless agreed with Google that any transfer to the USA will be based on the EU-US or Swiss-US Data Privacy Framework or, should the Data Privacy Framework be declared invalid, on the basis of so-called standard contractual clauses and appropriate and proportionate technical and organisational measures. By giving your consent via the cookie banner, you also consent to your personal data being transferred to insecure third countries in accordance with Art. 17 FADP or Art. 49(1)(a) GDPR.

Data Protection Declaration of the Processor:

https://policies.google.com/privacy

Legal Basis:

The data processing is based on your express consent in accordance with Art. 31(1) FADP or Art. 6(1)(1)(a) GDPR.

Necessity:

This processing activity is not necessary for the functionality of the website.

Data Transfer to Third Countries:

Your personal data will generally be processed by Google in Ireland. Personal data may also be transferred to Google’s parent company, Google LLC, in the USA. Google LLC is a participant in the EU-U.S. and Swiss-U.S. Data Privacy Frameworks. This means that your personal data can be transferred to Google LLC in the USA without any additional guarantees being required.

Retention Period:

Your data will be stored on your device for up to 2 years.

5.3. HubSpot Plugin for Newsletters

Data Processing:

You have the option of subscribing to our newsletter via the website. A registration page will appear on our website, where you can subscribe to our newsletter by entering your contact details. For the registration page, we use a plugin from HubSpot, Inc., 25 First Street, Cambridge, MA 02141, USA. This company operates the email marketing system for us.

The newsletter registration page will only appear if you have given your consent via the cookie banner.

Further information on the processing of your personal data when registering for our newsletter can be found in section G.

Personal Data:

We process the following data when you use the registration page plugin:

  • We process the following data when you use the registration page plugin:

  • Masked IP address of the requesting computer

  • Date and time of access

  • Website from which access is made (referrer URL)

  • Browser type and version

  • Number of visits/users

  • Session statistics

Purpose:

The data in question is processed for the purpose of sending and analyzing newsletters.

Processor:

HubSpot, Inc., 25 First Street, Cambridge, MA 02141, USA.

Ensuring Data Protection:

The transfer of European or Swiss personal data to HubSpot will result in the transfer of this data to HubSpot, Inc. in the USA or to third parties in a country that does not have an equivalent level of data protection. According to a decision by the Federal Council (CH) and the European Commission (EU), certified companies in the USA guarantee an appropriate level of data protection (see also section IV). We have nevertheless agreed with HubSpot that any transfer to the USA will be based on the EU-US or Swiss-US Data Privacy Framework or, should the Data Privacy Framework be declared invalid, based on so-called standard contractual clauses and appropriate and proportionate technical and organisational measures. By giving your consent via the cookie banner, you also consent to your personal data being transferred to insecure third countries in accordance with Art. 17 FADP or Art. 49(1)(a) GDPR.

Data Protection Declaration of the Processor:

https://legal.hubspot.com/privacy-policy

Legal Basis:

The provision of your data is voluntary. Your personal data will be processed with your express consent in accordance with Art. 31(1) FADP or Art. 6(1)(1)(a) GDPR, which you give via the cookie banner.

Necessity:

This processing activity is not necessary for the functionality of the website.

Retention Period:

Your data will be stored on your device for up to 30 minutes, but no longer than until the browser is closed.

D. Social Media

1. LinkedIn

Data Processing:

As an additional communication channel, we have a social media profile on LinkedIn https://www.linkedin.com/company/figureit-swiss/ by LinkedIn Ireland Unlimited Company (“LinkedIn”), Wilton Plaza, Gardner House, Dublin 2, Ireland. You can contact us via this profile.

We have also installed a LinkedIn social media button on our website so that you can easily link to our profile. This is not a plugin, but just an icon with a link. LinkedIn does not process any of your personal data on our website in this context.

Personal Data:

If you contact us via our social media profile or click on a social media button, the following information will be collected from you:

  • User behaviour

  • IP address

  • Connection data

  • Device and browser information

  • Data about the content accessed when clicking on the social media button

  • Username or first and last name

  • Possibly Photo, data you provide when contacting us

By clicking on the social media button, you will be redirected to the provider’s website. We have no influence over the processing of personal data on third-party websites.

Purpose:

If you contact us via LinkedIn, we will process your data for the purpose of answering your enquiry.

Processor:

LinkedIn Ireland Unlimited Company («LinkedIn»), Wilton Plaza, Gardner House, Dublin 2, Irland

Ensuring Data Protection:

The transfer of European or Swiss personal data to LinkedIn may result in this data being transferred to its parent company, LinkedIn Corp., in the USA or to third parties in a country that does not have an equivalent level of data protection. According to a decision by the Federal Council (CH) and the European Commission (EU), certified companies in the USA guarantee an appropriate level of data protection (see also section IV). We have nevertheless agreed with LinkedIn that any transfer to the USA will be based on the EU-US or Swiss-US Data Privacy Framework or, should the Data Privacy Framework be declared invalid, on the basis of so-called standard contractual clauses as well as appropriate and proportionate technical and organisational measures.

Privacy policy of data processor:

https://www.linkedin.com/legal/privacy-policy

Legal Basis:

If you contact us via our social media profile, we will process your data based on our overriding private interest to provide a channel for communication, in accordance with Art. 31(1) FADP or Art. 6(1)(1)(f) GDPR.

Necessity:

This processing activity is not necessary for the functionality of the website.

Retention Period:

Data processed when you reach out to us via our social media profile will be deleted upon your request, unless we are subject to a retention period of 5 or 10 years for the communication. By accepting the terms of this privacy policy, you hereby expressly consent to this retention period.

E. Management of Our Data

Data Processing:

Data processing We use the CRM system HubSpot to process customer orders and manage our data.

In order to carry out and implement projects, we may pass on the required data about your person to HubSpot. We may also forward your data to authorities and courts to obtain permits, etc., or to protect our and your interests and legal rights.

Personal Data:

To process your order, we process the following data:

  • First and last name

  • Address

  • Phone number (optional)

  • Email address

  • Order reference

Purpose:

The purpose of processing your data is to process and deliver your order as well as to enforce any potential legal claims.

Processor:

HubSpot, Inc., 25 First Street, Cambridge, MA 02141 USA.

Ensuring Data Protection:

The transfer of European or Swiss personal data to HubSpot will result in the transfer of this data to HubSpot, Inc. in the USA or to third parties in a country that does not have an equivalent level of data protection. According to a decision by the Federal Council (CH) and the European Commission (EU), certified companies in the USA guarantee an appropriate level of data protection (see also section IV). We have nevertheless agreed with HubSpot that any transfer to the USA will be based on the EU-US or Swiss-US Data Privacy Framework or, should the Data Privacy Framework be declared invalid, on the basis of so-called standard contractual clauses and appropriate and proportionate technical and organisational measures. By giving your consent via the cookie banner, you also consent to your personal data being transferred to insecure third countries in accordance with Art. 17 FADP or Art. 49(1)(a) GDPR.

Privacy policy of data processor:

https://legal.hubspot.com/de/privacy-policy

Legal Basis:

This data processing is carried out on the basis of contractual or pre-contractual measures in accordance with Art. 31(2)(a) FADP or Art. 6(1)(b) GDPR. The provision of your data is voluntary.

Necessity:

Data processing is necessary to process your order.

Retention Period:

For business documents, we are subject to a statutory retention period of 10 years according to Art. 958 et seq. OR (Swiss Code of Obligations).

F. Using steel it

Data Processing:

Data processing «steel it» is a system-independent calculation software designed to quickly and reliably calculate quotes for individual sheet metal parts and automatically generate operation plans, which you can use as an app via your web browser. It can be operated on a central or distributed infrastructure. The application allows you to upload STEP files containing 3D geometry data of sheet metal parts or entire assemblies.

If you choose cloud hosting through us, the software solution will be hosted by Amazon Web Services EMEA SARL (“AWS”), 38 Avenue John F. Kennedy, L-1855, Luxembourg. AWS is responsible for patching and maintaining the underlying infrastructure, including physical servers, network components, the virtualisation layer, and the operating system.

When using steel it, you as a customer have access to personalised user accounts. Whether and to what extent employees are able to enter or access data remains your decision. Should you allow your employees to use personal data, you will be required to independently ensure appropriate organisation of authorisation management, password assignment, etc.

Personal Data:

When using «steel it», the following data may be processed, depending on the use and hosting solution:

  • Title, first and last name

  • Email address

  • Phone number (optional)

Purpose:

The purpose of this processing is to facilitate the use of the software solution «steel it», the setting up of user accounts and providing customer support.

Processor:

We process your data when you use «steel it» and for providing customer support, maintenance and repair. In such cases, we process personal data solely within the scope of the data processing agreement (DPA) and in accordance with the customer’s instructions.

For support services, we may arrange appointments with you via Google Meet, a video conferencing service provided by Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

In the case of cloud hosting by AWS, Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855, Luxembourg, is the processor responsible for processing your data in accordance with the agreed data processing agreement.

Ensuring Data Protection:

In the case of cloud hosting by AWS or in the case of video conferencing via Google, your personal data will generally be processed in Switzerland or the EU. The transfer of European or Swiss personal data to AWS or Google may result in this data being transferred to their US parent company, Amazon Web Services Inc. and Google LLC in the USA or to third parties in a country that does not have an equivalent level of data protection. According to a decision by the Federal Council (CH) and the European Commission (EU), certified companies in the USA guarantee an appropriate level of data protection (see also section IV). We have nevertheless agreed with AWS and Google that any transfer to the USA will be based on the EU-US or Swiss-US Data Privacy Framework or, should the Data Privacy Framework be declared invalid, based on so-called standard contractual clauses and appropriate and proportionate technical and organisational measures. By giving your consent via the cookie banner, you also consent to your personal data being transferred to insecure third countries in accordance with Art. 17 FADP or Art. 49(1)(a) GDPR.

Privacy policy of data processor:

Legal Basis:

This data processing is carried out on the basis of contractual or pre-contractual measures in accordance with Art. 31(2)(a) FADP or Art. 6(1)(b) GDPR.

Necessity:

This processing activity is necessary for the functionality of the software solution “steel it”.

Retention Period:

We will retain the data required to process your order for at least the duration of the order. We are legally obliged to keep business documents and accounting records for 10 years. We reserve the right to retain data for a longer period to assert our rights.

G. Newsletter

Data Processing:

You have the option of subscribing to our newsletter via the website. Registration for the newsletter is only possible with a double opt-in: After you have registered on our website, you will receive an email in which you must click to confirm your wish to receive our newsletter. If you do not wish to do this, ignore the confirmation request email.

If you would like to unsubscribe from the newsletter at a later date, you can either click on the unsubscribe link that is sent to you with each email newsletter, or you can contact us via email at info@figureit.digital or by post.

Your personal data will be forwarded to the service provider HubSpot, Inc., 25 First Street, Cambridge, MA 02141, USA, to dispatch the newsletter. This company operates the email marketing system for us.

Personal Data:

For the registration and sending of the newsletter, we collect the following information:

  • First and last name

  • Email address

We then process data that can be used to determine whether a newsletter message has been opened and which links, if any, have been clicked. Technical information is also recorded, such as:

  • Delivery data

  • Time of detection

  • Click behaviour

Purpose:

The data in question is processed for the purpose of sending and analysing newsletters.

Processor:

HubSpot, Inc., 25 First Street, Cambridge, MA 02141, USA.

Ensuring Data Protection:

The transfer of European or Swiss personal data to HubSpot will result in the transfer of this data to HubSpot, Inc. in the USA or to third parties in a country that does not have an equivalent level of data protection. According to a decision by the Federal Council (CH) and the European Commission (EU), certified companies in the USA guarantee an appropriate level of data protection (see also section IV). We have nevertheless agreed with HubSpot that any transfer to the USA will be based on the EU-US or Swiss-US Data Privacy Framework or, should the Data Privacy Framework be declared invalid, based on so-called standard contractual clauses and appropriate and proportionate technical and organisational measures. By giving your consent via the cookie banner, you also consent to your personal data being transferred to insecure third countries in accordance with Art. 17 FADP or Art. 49(1)(a) GDPR.

Data Protection Declaration of the Processor:

https://legal.hubspot.com/privacy-policy

Legal Basis:

The provision of your data is voluntary. Your personal data will be processed with your express consent in accordance with Art. 31(1) FADP or Art. 6(1)(1)(a) GDPR, which you give by the double opt-in. In addition, we collect your user data based on our overriding private interest in accordance with Art. 31(1) FADP or Art. 6(1)(1)(f) GDPR.

Necessity:

This processing activity is not necessary for the functionality of the website.

Retention Period:

Data retained for the purpose of the newsletter subscription will be stored by us until you unsubscribe from the newsletter. After unsubscribing, your data will be deleted from our servers and from the HubSpot servers, unless we have the data in connection with other lawful processing.

H. Prize draws

Data Processing:

We occasionally hold prize draws on our website and at trade fairs. Details can be found in the current terms and conditions of participation. To participate in our competitions, you are required to enter your details on the prize draw page of our website or on our participation form. We process the data entered to conduct the competition and determine the winners. The public announcement of the winner will only take place with your express consent. The data you provide may also be used to make you an offer or to send you our newsletter.

Personal Data:

The following personal data is collected:

  • Title

  • First and last name

  • Email address

  • Street and house number

  • Postcode

  • Town/City

  • Information about the employer

Purpose:

The purpose of the processing is to conduct the competition and determine a winner, as well as to send the newsletter to participants of the competition. Address details will be collected if the prize is a physical one that must be sent to the winner by post.

Processor:

We use HubSpot, Inc., 25 First Street, Cambridge, MA 02141 USA to conduct and manage competitions.

Ensuring Data Protection:

The transfer of European or Swiss personal data to HubSpot will result in the transfer of this data to HubSpot, Inc. in the USA or to third parties in a country that does not have an equivalent level of data protection. According to a decision by the Federal Council (CH) and the European Commission (EU), certified companies in the USA guarantee an appropriate level of data protection (see also section IV). We have nevertheless agreed with HubSpot that any transfer to the USA will be based on the EU-US or Swiss-US Data Privacy Framework or, should the Data Privacy Framework be declared invalid, on the basis of so-called standard contractual clauses and appropriate and proportionate technical and organisational measures. By giving your consent via the cookie banner, you also consent to your personal data being transferred to insecure third countries, as required, in accordance with Art. 17 FADP or Art. 49(1)(a) GDPR.

Privacy policy of data processor:

https://legal.hubspot.com/de/privacy-policy

Legal Basis:

Your personal data will be processed with your express consent in accordance with Art. 31(1) FADP or Art. 6(1)(1)(f) GDPR.

Necessity:

This processing activity is not necessary for the functionality of the website.

Retention Period:

Data retained for the purpose of the prize draw will be stored in accordance with the relevant legal provisions and for as long as is necessary to fulfil the aforementioned purposes.

I. Widgets and Fonts

1. Google Fonts static solution

Data Processing:

Our website uses a font from Google Fonts, a font service provided by Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

Personal Data:

The font is loaded from our own storage space when requested and is thus integrated locally into our website. No connection to Google servers is established for this procedure. Consequently, your data will not be processed through the use of Google Fonts on our website, either by us or Google.

J. Using AI systems or large language models (LLM)

Data Processing:

Some of the aforementioned service providers may also provide their services using so-called artificial intelligence systems. We only use such AI systems as tools for our stated purposes and do not operate or train our own large-language model. Since such services are used only as supporting tools, e.g. for drafting formulations, there is no high risk to the personal data concerned. Your personal data may be processed, for example, by an AI system integrated into the program or service or by input into an LLM. We do not use AI systems that are listed as prohibited AI practices in Art. 5 of the AI Act (which is not applicable in Switzerland).

Personal Data:

The personal data previously mentioned in the individual processing activities may be processed.

Purpose:

For the purposes stated above.

Processor:

We only use the service providers already mentioned.

Ensuring data protection:

Your personal data will be processed by the service providers in the countries mentioned above. With respect to the use of AI systems, we do not transfer any personal data to a third country without an adequate level of data protection and do not process or include any LLM or services that are operated in a third country without an adequate level of data protection.

Legal basis:

This data processing is carried out on the basis of contractual or pre-contractual measures in accordance with Art. 31(2)(a) FADP or Art. 6 (1)(b) GDPR or on the basis of your consent in accordance with Art. 31(1) FADP or Art. 6(1)(a) GDPR. Data processing may also be based on an overriding private interest in the processing in accordance with Art. 31(1) FADP or Art. 6(1)(1)(f) GDPR.

Necessity:

The reasons given above shall apply.

Retention period:

The respective retention periods given above shall apply.

III. Transfer of data to third parties

With respect to the above-mentioned processing activities, we will transmit your personal data to the recipients or categories of recipients listed. In addition, if necessary or due to a legal obligation, we may transfer personal data for further purposes such as communication, initiation or processing of contracts, fulfilment of security requirements, compliance with legal and regulatory requirements or obligations, business management, application procedures or other purposes such as administrative purposes to the following category of recipients: Service providers, employees, integrated third parties, payment providers/payment processors, parcel/shipping service providers, authorities and courts, or third parties whose involvement arises from the aforementioned purposes or is necessary to carry out such purposes.

IV. International disclosure to third countries

No disclosure will be made to third countries without an adequate level of data protection or only subject to appropriate guarantees, e.g. under a contractual obligation to comply with an adequate level of data protection (so-called standard contractual clauses). Personal data will only be transferred to third countries if the data protection requirements of Art. 9 and 16 FADP or Art. 44 et seq. GDPR are met.

A third country is defined as a country outside Switzerland or the European Economic Area (EEA) in which Swiss data protection law or the European GDPR is not directly applicable. A third country is deemed insecure if, according to the Federal Council or the EU Commission, the state does not have an adequate level of data protection.

A Data Privacy Framework exists between Switzerland and the USA and between the EU and the USA. According to a decision by the Federal Council (CH) and the European Commission (EU), certified companies in the USA guarantee an appropriate level of data protection. You can find out whether a data processor in the USA participates in this framework by visiting the following website:www.dataprivacyframework.gov/s/. In addition, you can find more information about the processing of user data in the privacy policies of the respective data processors.

In this data protection information, we inform you when and how we transfer personal data to the USA or other third countries.

V. Data Security

We take appropriate technical and organisational measures to ensure that your personal data cannot be accessed or stolen by unauthorised third parties. In particular, through appropriate technical (e.g. firewall, password protection, SSL encryption, etc.) and organisational (e.g. restriction of authorised persons, training of authorised persons, etc.) measures to ensure that only authorised persons have access to this data. Our data processing and security measures are continuously updated in line with technological developments.

We use SSL encryption for security reasons and to protect the transmission of confidential content, such as the enquiries you send to us as the website operator. You can recognise an encrypted connection by the fact that the address line of the browser changes from «http://» to «https://» and by the lock symbol in the address bar. If SSL encryption is activated, the data you transmit to us cannot be read by third parties.

VI. Your Rights

As a data subject, you can assert various claims against us in accordance with the applicable law. We may process your personal data again to fulfil these claims.

Depending on the applicable law, data subjects may assert the following rights, whereby only the rights listed below can be asserted and these only to the extent that they exist under the respective applicable law (FADP or GDPR). The following GDPR rights only apply if the GDPR is applicable:

Right to Information:

To request information about your personal data processed by us. In particular, information pursuant to Art. 25 et seq. FADP or Art. 15 GDPR may contain information:

  • On the purposes of the processing

  • The category of personal data

  • The categories of recipients to whom your data has been or will be disclosed

  • The planned retention period

  • The existence of the right to rectification, erasure, restrict processing and to object

  • The existence of the right of lodge a complaint

  • The origin of your data if it was not collected by us

  • The existence of automated decision-making, including profiling, and, where appropriate, meaningful information on its details

Right to rectification:

To immediately request the correction of incorrect or incomplete personal data stored by us (Art. 6(5) FADP or Art. 16 GDPR).

Right to restrict processing:

To request the restriction of the processing of your personal data if the accuracy of the data is disputed by you, the processing is unlawful but you refuse to delete it and we no longer need the data, but you need it to assert, exercise or defend legal claims or you have objected to the processing in accordance with Art. 21 GDPR (Art. 32 FADP or Art. 18 GDPR);

Right to Data Portability:

To obtain your personal data, which you have provided to us, in a structured, commonly used and machine-readable format or to request that it be transferred to another controller (Art. 28 FADP and Art. 20 GDPR);

Right to Erasure:

To request to have your personal data stored by us erased, unless the processing is necessary to exercise the right to freedom of expression and information, to fulfil a legal obligation, for reasons of public interest or to assert, exercise or defend legal claims (Art. 32 FADP in conjunction with Art. 28 ZGB, Swiss Civil Code, or Art. 17 GDPR);

Right to Revoke Consent:

To revoke your consent given to us at any time. As a result, we may no longer continue the data processing that was based on this consent in the future (Art. 30(2)(b) FADP and Art. 7(3) GDPR);

Right to Object:

To object to the processing if your personal data is processed on the basis of legitimate interests in accordance with Art. 6(1)(1)(f) GDPR (Art. 21 GDPR) and if there are reasons for doing so that arise from your particular situation or if the objection is directed against direct advertising. In the latter case, you have a general right to object, which we will implement without the need to specify a particular situation;

Right to Lodge a Complaint:

To lodge a complaint with the relevant data protection regulator (see above) (Art. 49 FADP or Article 77 GDPR).

VII. Current Status and Changes to This Privacy Policy

We reserve the right to change this privacy policy at any time or to adapt it to new processing methods. The current privacy policy can be accessed at any time.