We process your personal data in accordance with applicable data protection law (including the Swiss Data Protection Act, “FADP” and, where applicable, the EU General Data Protection Regulation, “GDPR”; hereinafter collectively “applicable data protection law”) at all times.
“Processing” means any operation or set of operations which is performed on personal data, whether or not by automated means, such as the collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction of your data.
Please note that third-party websites accessible via our own offerings provide information about the data processing they perform in their own privacy policies. We do not accept any responsibility or liability for compliance with data protection requirements by these third parties and recommend that you consult the privacy policies of these third-party websites.
A Who is responsible for the processing of your data?
B How do we collect your data?
We collect your data directly from you or obtain your data from third parties, such as our affiliated companies, public authorities, consultants, our service providers or from publicly available sources.
C Scope, purpose and legal basis for the processing of your data
We process your data if you use our offerings, cooperate with us or otherwise contact us.
In general, we process your data for the following purposes:
- fulfilling and performing contractual or statutory obligations;
- verifying access authorisation and administering the user account (if any);
- combatting fraud;
- developing and maintaining the customer relationship;
- for marketing purposes on our part and that of third parties, i.e. all promotional measures, e.g. newsletters, telephone, online advertising, SMS and push notifications for market research, conducting analyses and surveys, as well as for statistical purposes;
- designing and improving our offerings in order to meet our customers’ needs;
- evaluating user behaviour.
Below, we have summarised in detail for you the data we process in connection with our offerings, the purpose for which we process the data and the legal basis on which we rely for this processing.
I Visiting our offerings (log files)
If you use our offerings without providing any additional information, the web server technology utilised by us automatically logs general technical visit information in something known as log files. This includes but is not limited to the IP address of the device from which the visit is made, information about the type of browser, the internet service provider and the operating system utilised, the offerings requested from us, referring/exit sites, and the time and duration of the visit.
This information is collected and processed for the purpose of enabling the use of our websites (connection setup), ensuring and increasing the security and stability of our systems and websites, analysing the use of our offerings and services, collecting general demographic information and enabling the optimisation of our offerings, as well as for internal statistical purposes. The user is not identified in this process. Furthermore, no link is normally established between this automatically collected information and any personal data stored by us. However, the automatically collected information and the personal data stored with us may be linked if you already have a registered user account on one of our portals or use, as a guest, certain features of our websites, such as our contact form or our request function. This information may be linked in order to analyse the use of our offerings and services, to collect general demographic information and to enable the optimisation of our Internet offerings:
- If you send a message to a third party (for example an advertiser) via a corresponding feature on our portal, your message, including its content, may be stored by us.
- You can also obtain free services on our portal. We may use your personal data provided when using a free service or with a message (e-mail address, telephone number, etc.), for example, for marketing and analysis purposes (see Chapter CIX below).
If any of your personal data is processed for the purposes described above when you visit our offerings, this processing is performed in our legitimate interest of enabling the use of our websites (connection set-up), ensuring and increasing the security and stability of our systems and offerings, analysing, statistically evaluating, adapting and improving the use of our offerings and enabling the optimisation of our internet offerings.
II Registering a user account
For personalised services or secure areas, or to process requests and administer your subscriptions, you may need to register and create a user account. This requires entering certain personal data. This may include, for example,
- your email address, which may also serve as your username,
and, depending on the context and offering, additional details, such as
- first and last name
- address (complete postal address, postcode, city/town)
- telephone number
- date of birth
- information about subscribed newsletters or other advertising
- language preferences
Apart from the details labelled as mandatory for taking advantage of a particular offering, you can also voluntarily enter and store additional personal data. By your confirmation upon completing the registration for collecting and changing your details for the user account, you guarantee that the information collected from you is accurate.
We use such data for processing and administering our digital offerings, verifying the plausibility of the data entered, i.e. establishing, designing the content of, processing and amending the contracts concluded with you via your user account and, in case of fee-based services, proper invoicing. Accordingly, we process your data in this regard in accordance with the applicable data protection law.
III Using our offerings as a registered user
During the use of the offering by registered users, we collect data for statistical purposes in order to enable the smooth functioning of the portal and to analyse and optimise our offerings and services. For example, we collect data about whether and how you use our digital offerings, particularly which features and adverts you take advantage of and how you do so. It is in our legitimate interest to optimise, develop and improve our offering in accordance with applicable data protection law.
If you make use of our offering as a registered user, statistical data may be visible to other registered users. Such data shall only be made available to other registered users in anonymised and/or aggregated form.
IV Using mobile applications
If you use our mobile applications with a mobile device and you have enabled the transfer of your GPS signal data to a third party in your mobile device settings, we may use GPS signal data to collect information about the location of your mobile device (longitude and latitude, horizontal accuracy data).
We will use the location data to enhance your user experience by displaying location-based online advertising and other location-based digital content to you via the mobile application(s) on your mobile device (such as location-based weather information and messages). We request your consent in accordance with applicable data protection law before collecting your location data for the above applications.
Even after you have provided your consent, you may withdraw your consent or deactivate or object to the collection, processing and disclosure of your location data at any time. If you do not wish to receive any location-based online advertising and content, you can either deny access to your location or deactivate the location services in your device’s settings at any time. To deactivate the location services, please follow the directions provided by your device’s manufacturer: for Apple devices: https://support.apple.com/en-us/HT207092, for Android devices: https://support.google.com/accounts/answer/3467281?hl=e.
V Purchasing/receiving a fee-based offering
If you purchase a product on our site or receive a fee-based service from us, the provision of data such as your first and last name, address (complete postal ad-dress, postal code, city/town) and any other data (such as your delivery address, billing address, payment information, etc.) is mandatory because we need it in order to perform our contract with you in accordance with applicable data protection law.
We may store your information collected for the purchase or receipt of a fee-based offering in your user account for the next purchase/contract in accordance with our internal archiving and data protection policies or as required by law. We will use this data to optimise, improve and further develop our offering, for marketing purposes and for statistical purposes. For this purpose, we may store all information about your current and previous purchases and contracts concluded, i.e. the products, services, number of products and services per purchase and the payment amount.
VI Contacting customer service or using the contact form
If you contact our Customer Service, we may process your contact details (such as your title, first and last name, telephone number, email address or postal address) and the content of the conversation in order to answer your request. This is in our legitimate interest, as defined in the applicable data protection law, of providing you with accurate information and processing your request correctly.
Incoming and outgoing consultations with our customer service may be recorded and stored for training and quality purposes if you have consented to this.
If you fill out a contact form on our offerings, we will process the personal data provided (e.g. title, first and last name, telephone number, email address or postal address and the content of the request). This is also in our legitimate interest of providing you with accurate information and processing your request correctly (in accordance with applicable data protection law).
VII Participation in sweepstakes or contests (hereinafter jointly referred to as “Events”)
In order for you to participate voluntarily in events, we use the data you have provided, such as your title, first and last name, email address and postal address. This data is utilised to organise and conduct events, as well as to notify and/or announce the winners via direct notification or on social networks. In this context, your data may also be disclosed in accordance with Chapter E, e.g. if we have engaged a third party to conduct or evaluate the event, or if the event is conducted by a third party through our offerings.
VIII User surveys and market research
If you voluntarily participate in a user survey or other market research activities conducted by us, we collect personal data from you, such as your title, first and last name, contact details and other information requested in the course of the survey. We use the information you provide solely to improve the user experience and to further develop our products, which is a legitimate interest of ours (in accordance with applicable data protection law). The results of the surveys consist solely of aggregated and anonymous data.
IX Marketing and analysis purposes
By registering or placing an order as a guest via one of our offerings, we may also use your data for personalised advertising activities by us, our affiliated companies, third parties and our shareholders. Personalised advertising measures include but are not limited to the personalisation of advertising via digital adverts on our web offerings and mobile applications, by email, such as e-mails with general information or of an advertising nature (newsletters), by telephone, post, fax, text messages, picture messages and on instant messaging services. At the end of every e-mail you receive from us, you will find a link through which you can unsubscribe from the newsletter at any time. You may also unsubscribe from the newsletter at any time by sending an email to email@example.com.
We will only send you newsletters if they relate to similar offerings or if you have expressly consented to them. Otherwise, the delivery of personalised content and advertising, e.g. on our portals or those of our affiliated companies, is in our legitimate interest, under applicable data protection law, of offering you our products or services that may be of interest to you and optimally marketing our offerings. If prior consent is required, particularly for the processing of your data by our affiliated companies or by our shareholders, we will obtain it in advance.
For this purpose, user-specific historical and future data available to us can be continuously linked with each other using various analysis tools, and user behaviour can be analysed, aggregated, pseudonymised and anonymised across our offerings. In order to improve our database, we may use data that is publicly available or obtained from third-party providers. The findings based on your use of our offering may be utilised and exploited in the analysis of user behaviour at other participating companies. Such data processing generally takes place using pseudonymised or anonymised data. You may object to this processing of your data at any time by sending an email to firstname.lastname@example.org.
In addition, we process your data for analysis purposes, e.g. in order to continuously improve our offerings and to make them more responsive to your needs and more secure. This is in our legitimate interest, under applicable data protection law, of tailoring our offerings to the needs of our customers, improving them in line with the market and guaranteeing their security.
Upon registering a user account, you generally also automatically subscribe to one of our newsletters, and your email address may accordingly also be used to advertise our own similar offerings until you unsubscribe from the newsletter in question.
For the purposes described here, we may also engage data processors to carry out the technical processing of advertising measures and advertising for our-selves, who process your data at our instruction exclusively for the purposes described above (see section E below).
X Combatting fraud, legal disputes and legal processing obligations
We may also process your data that we collect and process in accordance with Chapters CI-CIX in order to combat fraud or in the event of a legal dispute, which is in our legitimate interest, under applicable data protection law, of protecting our business and enforcing or asserting any claims we may have. We may also process your data in order to fulfil our legal obligations in accordance with applicable data protection law.
D Profiling and personality profiles
In connection with the stated purposes, it is possible that personality profiles will be created and/or profiling will be conducted. If personality profiles are to be shared with third parties, we will obtain your express consent in advance.
E Disclosure of your data to third parties
The foregoing shall be subject to the disclosure of your data based on mandatory legal obligations.
I Disclosure to companies of the SMG Group
Disclosure to companies of the SMG Group in accordance with this Chapter E generally takes place using pseudonymised or anonymised data.
To the extent compatible with the purposes described in Chapter C above, your data and usage data concerning you or your user account, as the case may be, may be used and disclosed to companies of the SMG Group for the purpose of evaluating and improving our offerings and making them more responsive to our customers’ needs, for customer care and personalisation, as well as for marketing purposes.
If your consent is required for this, we will obtain it from you in advance. Such consent can be withdrawn at any time. If consent is not required, the sharing of your data is based on our legitimate interest, or the legitimate interest of a company of the SMG Group, companies affiliated with the SMG Group or joint ventures of the SMG Group, in enabling the use of our websites (connection setup), guaranteeing and increasing the security and stability of our systems in accordance with applicable data protection law, to analysing, statistically evaluating, adapting and improving the use of our offerings, showing or sending you advertising, and enabling the optimisation of our internet offerings.
II Disclosure to Shareholders of the SMG Group
We may disclose your data to the Shareholders of the SMG Group in accordance with this Chapter E. The Shareholders may disclose the data to their Subsidiaries, provided that they process your data only for the same purposes (described below) as the Shareholders themselves are permitted to process them.
Disclosure is made for the purpose of evaluating, improving and tailoring the products and services of our Shareholders to meet their needs, for personalisation, for marketing purposes and to combat fraud and misuse. Data will only be disclosed as described herein if permitted by law or if we have obtained your consent in advance. Such consent can be withdrawn at any time.
III Disclosure to service providers
Furthermore, we may disclose your data to third parties if this is required for the purpose of performing the contract in accordance with applicable data protection law. For this purpose, we may disclose the necessary data to transport companies, banks and other service providers, such as hardware and software providers. These services will use your data exclusively for processing the contract but not for other purposes. If this is required for the purposes mentioned in sentence 1 of this paragraph, your data may even be disclosed to providers abroad, for instance to enable the delivery of goods. For more information on transfers abroad, see Chapter G.
IV Disclosure to other third parties
If you click on integrated third-party offerings or use integrated third-party contact forms, we may disclose your data in accordance with the offering or contact form. In addition, we may disclose your data to third parties if they wish to place personalised advertising or adverts on our offerings. In addition, your data may be disclosed to third parties if we present an offering together with a third party.
Apart from the disclosure of your data as described above, we will only disclose your data if you have either expressly consented to it in accordance with applicable data protection law, if there is a statutory obligation to do so, or if this is necessary to enforce our rights, particularly to enforce claims arising from the contractual relationship, which is an overriding interest of ours.
In case of a sale, merger or other reorganisation of any or all of our company assets, personal data may be assigned, sold or otherwise shared with third parties as part of this transaction or reorganisation.
If we provide an advance delivery, for instance in case of a purchase on account, we may obtain a credit check based on mathematical and statistical processes from a credit agency in order to preserve our legitimate interests in concluding a contract with solvent customers (in accordance with applicable data protection law). To this end, we will send a credit agency the personal data required for a credit check and will use the information received concerning the statistical probability of non-payment to make a decision whether to establish, implement or terminate the contractual relationship. The credit check may contain probability values (scores) calculated on the basis of a scientifically recognised mathematical and statistical process and which incorporate, in particular, contact details into the calculation. Your legitimate interests will be taken into account as specified by law.
No other disclosure, transfer or sale of your personal data to third parties outside the SMG Group and our Shareholders will take place unless this is necessary for the performance of a contract you have concluded with us, or you have expressly consented to it.
Cookies help to make your visit to our websites easier, more pleasant and more meaningful, and to ensure the functioning of our offerings and portals. They also serve to provide you with interest-based advertising. Cookies are data files that your web browser automatically stores on your computer’s hard drive when you visit our website. In general, our digital offerings can also be utilised without accepting cookies, but this may restrict the use of certain features.
When you use our website, the cookies set by us may collect and store usage data, such as the IP address of your device, pages visited, browser used, date, time, etc. As a general rule, this data cannot be used to identify you unless you are logged into your user account.
When the browser is closed, cookies are stored in a text file on the computer and called up the next time the web server is queried again. Cookies do not damage your computer’s hard drive or send personal user data to us.
Most internet browsers accept cookies automatically. However, you can always configure your browser so that it does not store cookies on your computer or so that it displays a notification whenever you receive a new cookie (please check the relevant settings in your browser). You can also delete cookies on your computer or mobile end device by using the appropriate feature in your browser.
You can decide at any time whether or not you wish to take advantage of targeted ads matched to your potential interests. However, opting out does not mean that no further online ads will be displayed to you. Rather, it only means that the ads displayed to you on our websites are not tailored to your presumed interests and may therefore be less relevant to you.
Most of the cookies that we use are temporary session cookies that are automatically deleted by your computer or mobile device at the end of your browser session. Apart from that, however, we also use permanent cookies. These cookies remain stored on your computer or mobile device after the end of your browser session. These permanent cookies remain stored on your computer or mobile device for a period between one month and ten years, depending on the type of cookie, and are automatically deactivated only at the end of the programmed time period.
II Tracking and analysis tools
The use of our digital offerings is also measured and analysed by means of a variety of technical systems, primarily from third parties such as Google Analytics. These measurements may be made anonymously and in reference to specific persons. In the process, the data collected by us or by the third-party providers of these technical systems may be disclosed to third parties for processing.
We use Google Analytics, a service provided by Google Inc. This means that the collected data can generally be transferred to one of Google’s servers in the USA. However, the IP addresses are anonymised through IP anonymisation so that they cannot be associated with their owners. The IP address transmitted from your browser in connection with Google Analytics is not combined with other data held by Google. The collection and processing of this data by Google Analytics may be objected to by setting an opt-out cookie, which prevents the further collection of your data when visiting this website in future: https://tools.google.com/dlpage/gaoptout?hl=en-GB.
The tool “Hotjar” is utilised on the websites for the non-person-specific analysis of the use of our portals and for statistical evaluations. In the process, information is recorded concerning your operating system, browser, geographical origin (country only), the pages called up during the current visit, as well as the interactions (e.g., mouse movements, clicks and entries made on the website).
III Plug-ins and other integrated third-party offerings
Our digital offerings are interconnected in a variety of ways with third-party functions and systems, for example by integrating plug-ins of third-party social networks such as Facebook, Google+, YouTube or Twitter.
If you have a user account with these third parties, they may under certain circumstances also be able to measure and analyse your user of our digital offerings. In the process, additional personal data, such as your IP address, personal browser settings and other parameters may be transmitted to and stored by these third parties. When using a social login service such as Facebook Connect, the provider may send us personal data that it has stored with regard to you, such as your name, email address and profile picture. However, we have no control over the use of such personal data collected by third parties, nor do we assume any responsibility or liability for such use. In this regard, please see the additional detailed information linked above. You will find information about third-party providers’ collection and use of the data in the data protection provisions of the respective third-party providers.
G Transfer of personal data abroad
H How long will we store your data?
We will store your data only for as long as required by law or in accordance with the purpose of processing, particularly for fulfilling the order or contract and for complying with our statutory obligations.
When analysing your data, we store your data until the analysis has been completed or you have objected to further processing. If we store data based on a contractual relationship with you, this data will remain stored for at least as long as the contractual relationship exists and at the latest for as long as any limitation periods for possible claims by us or any statutory or contractual retention obligations exist.
By law, the contents of the contact form and the subsequent e-mail correspondence must be retained by us for six months. Data collected via the contact form on the icasa.ch platform shall be retained for 13 months in order to combat fraud.
Subsequently, we strive to anonymise the data in order to continue using them for statistical purposes. If this is not possible for any reason, it will be erased if we no longer need your data for the processing purposes indicated and are no longer required by law to retain it.
I How do we protect your data?
We take appropriate technical and organisational precautions to conscientiously protect your data against loss, destruction, falsification, manipulation or unauthorised access. We operate secure data networks that adhere to the technical standards applicable in each case. Our security measures are continuously adapted and improved in line with technological developments.
If you register as a user on our website, you will only be able to access your user account after entering your personal password. You should always treat payment and access information confidentially and close your browser window whenever you end a communication session with us, particularly if you share your computer with others.
Our staff and contracted service providers undertake to maintain confidentiality and comply with the provisions of data protection law.
J What rights do you have in relation to your data?
Under applicable data protection law, you have the following rights:
Right to information:
You have the right to find out at any time whether and which of your personal data is being processed by us.
Right to rectification of your data:
You have the right at any time to have your personal data rectified if you notice that we are processing erroneous data about you.
Right to erasure of your data:
If the processing of your data is no longer necessary, e.g., because your contractual relationship with us has ended or because you no longer consent to the processing of your data, you may request the erasure of your personal data. We will erase your personal data, provided we have no other relevant obligation (e.g. a statutory retention obligation) or overriding interest (e.g. in connection with legal proceedings) in continuing to retain or process your personal data for a certain period of time. In this case, we store your data exclusively for these purposes and will not process it otherwise.
Please note that the erasure of your personal data may mean that you can no longer obtain or use the services registered by you.
Right to restrict or block the processing of your data:
You have the right to restrict or block the processing of your data at any time, provided that we are not under any other obligation to retain and process your data for a certain period of time.
Right to disclose your data:
Under certain circumstances, you are entitled to have us disclose your personal information to you or a third party designated by you in a commonly used format or to provide your data to you in a commonly used format.
Right to object:
You may object to the processing of your data for marketing and analysis purposes and to the disclosure of your data within the SMG Group in accordance with Chapter CIX at any time by sending an email to email@example.com.
Such an objection does not entirely preclude the collection of personal data, but only for marketing and analysis purposes and for the disclosure of your data within the SMG Group in accordance with Chapter CIX.
You may also object to any data processing that is based on a legitimate interest of ours by sending an email to firstname.lastname@example.org, indicating the reasons relating to your particular situation.
Withdrawing your consent:
You always have the right to withdraw at any time any consent previously given. Once we have received notice that you are withdrawing your consent, we will no longer process your personal data for those particular purposes unless there is another legitimate interest in continuing to process it. Please note that the withdrawal of your consent has no effect on data processing that took place prior to the withdrawal.
Complaint to a supervisory authority:
In addition, you have the right to lodge a complaint regarding data processing with the appropriate supervisory authority. In Switzerland, this authority is known as the Federal Data Protection and Information Commissioner. You can lodge a complaint with the supervisory authority at your place of residence, place of work or at the location of the alleged data breach.
You may exercise your rights at any time by giving written notice and proof of your identity to the address below.
To do this, please use the e-mail account that you used to register with us. This allows us to verify your identity. In addition, we reserve the right to verify your identity by means of a copy of your passport, a copy of the front and back of your ID card or a copy of your Swiss driving licence or by any other means. We may correspond with you in response to your initial contact about exercising your rights.
Please note that, in some cases, the granting of your rights may be refused or restricted for legal reasons or based on data protection law. Where legally required or permitted, we will inform you of the reasons for our decision.
K How can you contact us?
If you have any questions about the processing of your data, would like to re-quest information or the erasure of your data, please email our Data Protection Contact at email@example.com.
The contact details of our Data Protection Officer are as follows:
Data Protection Officer
For requests from the EU area, you can contact our representative (Art. 27 GDPR):
Grosse Bleichen 21
As of January 1, 2022