In this privacy policy, we describe what we do with your data when you use www.domain.ch, our other websites or our apps (collectively referred to below as the “website”), obtain our services or products, otherwise are connected with us in the context of a contract, communicate with us, or otherwise have dealings with us. Where applicable, we will inform you in a timely manner by written notice about additional processing activities not mentioned in this privacy policy. In addition, we may inform you separately about the processing of your data, e.g. in consent declarations, contractual terms, additional privacy policies, forms and notices.

If you provide or disclose to us data about other persons, such as family members, work colleagues, etc., we assume that you are authorised to do so and that this data is correct. By transmitting data about third parties, you confirm this. Please also ensure that these third parties have been informed about this privacy policy.

For the data processing described in this privacy policy, Cécile Grüebler, 8400 Winterthur, is responsible under data protection law, unless otherwise communicated in the individual case.

You can contact us regarding data protection matters and to exercise your rights under Section 11 as follows:

moc.relbeeurgelicecobfsctd-471e08@ofni

We process various categories of data about you. The most important categories are as follows:

• Technical data: When you use our website or other electronic services (e.g. free Wi-Fi), we collect the IP address of your device and other technical data to ensure the functionality and security of these services. This data also includes logs in which the use of our systems is recorded. We generally retain technical data for 12 months. To ensure the functionality of these services, we may also assign you or your device an individual code (e.g. in the form of a cookie; see Section 12). Technical data in itself generally does not allow any conclusions to be drawn about your identity. However, in the context of user accounts, registrations, access controls or the performance of contracts, it may be linked to other categories of data (and thus, where applicable, to you as a person).

  Technical data includes, among other things, the IP address and information about your device’s operating system, the date, region and time of use, and the type of browser you use to access our electronic services. This can help us deliver the correct formatting of the website or, for example, display a website adapted to your region. While the IP address tells us which provider you use to access our services (and thus also the region), we generally cannot infer who you are from it. This changes, for example, if you create a user account, because personal data can then be linked to technical data (e.g. we can see which browser you use to access an account via our website). Examples of technical data also include logs that arise in our systems (e.g. the log of user logins to our website).

• Registration data: Certain services, e.g. competitions and services (e.g. login areas of our website, newsletter distribution, free Wi-Fi access, etc.), can only be used with a user account or registration, which can be completed directly with us or via our external login service providers. In doing so, you must provide us with certain data, and we collect data about the use of the service or offering. We generally retain registration data for 12 months after the end of use of the service or the deletion of the user account.

  Registration data includes, among other things, the information you provide when creating an account on our website (e.g. username, password, name, email). Registration data also includes data we may require from you before you can use certain free services, such as our Wi-Fi service—in this case: name, email and telephone number; or the redemption of vouchers—in this case: name, address, contact details, time of redemption. You must also register if you wish to subscribe to our newsletter.

• Communication data: If you contact us via the contact form, by email, telephone or chat, by letter, or via other means of communication, we record the data exchanged between you and us, including your contact details and the metadata of the communication. If we record or monitor telephone calls or video conferences, e.g. for training and quality assurance purposes, we will specifically inform you. Such recordings may only be made and used in accordance with our internal requirements. You will be informed whether and when such recordings take place, e.g. by a notice during the relevant video conference. If you do not wish to be recorded, please let us know or end your participation. If you only do not want your image to be recorded, please switch off your camera. If we want or need to establish your identity, e.g. in the case of an information request submitted by you, an application for media access, etc., we collect data to identify you (e.g. a copy of an ID document). We generally retain this data for 12 months from the last exchange with you. This period may be longer where this is required for evidentiary reasons or to comply with legal or contractual requirements, or for technical reasons. Emails in personal mailboxes and written correspondence are generally retained for at least 10 years.

  Communication data includes your name and contact details, the manner, place and time of communication and, as a rule, its content (i.e. the content of emails, letters, chats, etc.). This data may also contain information about third parties. For identification purposes, we may also process your ID number or a password set by you.

• Master data: Master data refers to the basic data that we require, in addition to contract data (see below), for the handling of our contractual and other business relationships or for marketing and advertising purposes, such as name, contact details and information, for example, about your role and function, your bank details, your date of birth, customer history, powers of attorney, signature authorisations and declarations of consent. We process your master data if you are a customer or other business contact, or act for such a person (e.g. as a contact person of a business partner), or because we wish to contact you for our own purposes or the purposes of a contractual partner (e.g. in the context of marketing and advertising, with invitations to events, vouchers, newsletters, etc.). We receive master data from you yourself (e.g. in the case of a purchase or as part of a registration), from entities for which you work, or from third parties such as our contractual partners, associations and address dealers, and from publicly accessible sources such as public registers or the internet (websites, social media, etc.). As part of master data, we may also process health data and information about third parties. We may also collect master data from our shareholders and investors. We generally retain this data for 10 years from the last exchange with you, but at least from the end of the contract. This period may be longer where this is required for evidentiary reasons or to comply with legal or contractual requirements, or for technical reasons. For purely marketing and advertising contacts, the period is usually significantly shorter, generally no more than 2 years since the last contact.

  Master data includes, for example, data such as name, address, email address, telephone number and other contact details, gender, date of birth, nationality, information on related persons, websites, social media profiles, photos and videos, copies of ID documents; furthermore, information about your relationship with us (customer, supplier, visitor, recipient of services, etc.), information about your status with us, allocations, classifications and distribution lists, information about our interactions with you (possibly a history thereof with corresponding entries), reports (e.g. from the media) or official documents (e.g. extracts from the commercial register, permits, etc.) relating to you. As payment details, we collect, for example, your bank details, account number and credit card data. Consent or blocking notes also form part of master data, as does information about third parties, e.g. contact persons, recipients of services, advertising recipients or representatives.

  For contact persons and representatives of our customers, suppliers and partners, we process as master data, for example, name and address, information on role and function within the company, qualifications and, where applicable, information about superiors, employees and subordinates, as well as information about interactions with these persons.

  Master data is not collected comprehensively for all contacts. The specific data we collect depends in particular on the purpose of the processing.

• Contract data: This is data that arises in connection with the conclusion of a contract and/or the performance of a contract, e.g. information about contracts and the services to be provided or provided, as well as data from the period prior to the conclusion of a contract, information required or used for processing, and information about reactions (e.g. complaints or satisfaction information, etc.). This also includes health data and information about third parties, e.g. about hereditary diseases in the family. We generally collect this data from you, from contractual partners and from third parties involved in the performance of the contract, but also from third-party sources (e.g. providers of creditworthiness data) and from publicly accessible sources. We generally retain this data for 10 years from the last contractual activity, but at least from the end of the contract. This period may be longer where this is required for evidentiary reasons or to comply with legal or contractual requirements, or for technical reasons.

  The contract data includes information about the conclusion of the contract, about your contracts, e.g. the type and date of the contract conclusion, information from the application process (such as an application for our products or services) and information about the relevant contract (e.g. its term) and the handling and administration of contracts (e.g. information in connection with invoicing, customer service, support with technical matters and the enforcement of contractual claims). Contract data also includes information about defects, complaints and amendments to a contract, as well as information on customer satisfaction, which we may collect, for example, through surveys. Contract data also includes financial data such as information about creditworthiness (i.e. information that allows conclusions to be drawn about the likelihood that claims will be settled), reminders and debt collection. We receive this data partly from you (e.g. when you make payments), but also from credit agencies and debt collection companies and from publicly accessible sources (e.g. a commercial register).

We only provide certain services to you if you provide us with registration data because we or our contractual partners want to know who uses our services or has accepted an invitation to an event, because it is technically necessary, or because we want to communicate with you. If you, or a person you represent (e.g. your employer), wish to conclude or perform a contract with us, we must collect the relevant master, contract and communication data from you, and we process technical data, if you wish to use our website or other electronic services for this purpose. If you do not provide us with the data required for the conclusion and performance of the contract, you must expect that we will refuse to conclude the contract, that you will be in breach of contract, or that we will not be able to perform the contract. Likewise, we can only send you a response to an enquiry if we process the relevant communication data and—if you communicate with us online—where applicable also technical data . Use of our website is also not possible without us receiving technical data .

We process your data for the purposes explained below. Further information for the online area can be found in Sections 12 and 13. These purposes, or the objectives on which they are based, constitute legitimate interests of ours and, where applicable, of third parties. You can find further information on the legal bases for our processing in Section 5.

We process your data for purposes related to communication with you, in particular to respond to enquiries and to assert your rights (Section 11), and to contact you in case of follow-up questions. For this purpose, we use in particular communication data and master data, and in connection with services and offerings you use, also registration data. We retain this data in order to document our communication with you, for training purposes, for quality assurance and for follow-up questions.

This concerns all purposes in connection with which you and we communicate, whether in customer service or consulting, for authentication in the event of using the website, or for training and quality assurance (e.g. in customer service). We also process communication data so that we can communicate with you by email and telephone, as well as via messaging services, chat, social media, letter and fax. Communication with you usually takes place in connection with other processing purposes, e.g. so that we can provide services or respond to an information request. Our data processing also serves to provide evidence of the communication and its content.
We process data for the establishment, administration and handling of contractual relationships.

We enter into contracts of various kinds with our business and private customers, with suppliers, subcontractors or other contractual partners, such as project partners or parties to legal disputes. In doing so, we process in particular master data, contract data and communication data and, depending on the circumstances, also registration data of the customer or of the persons to whom the customer arranges a service.

In the context of initiating business, personal data—especially master data, contract data and communication data—is collected from potential customers or other contractual partners (e.g. in an order form or contract) or results from communication. Also in connection with the conclusion of the contract, we process data to check creditworthiness and to establish the customer relationship. Some of this information is reviewed to comply with legal requirements.

In the context of handling contractual relationships, we process data to manage the customer relationship, to provide and collect contractual services (which also includes involving third parties), for consulting and customer support. The enforcement of legal claims arising from contracts (debt collection, court proceedings, etc.) is also part of handling, as are accounting, termination of contracts and public communication.

We process data for marketing purposes and for relationship management, e.g. to send our customers information about our services. This may take the form of newsletters and other regular contacts (electronically, by post, by telephone), via other channels for which we have your contact information, but also as part of individual marketing campaigns (e.g. events, competitions, etc.) and may include free services (e.g. invitations, vouchers, etc.). You can refuse such contacts at any time (see at the end of this Section 4) or refuse or withdraw consent to be contacted for advertising purposes.

For example, with your consent we send you information and product offers from us in print, electronically or by telephone. For this purpose, we process primarily communication and registration data. Like most companies, we personalise communications so that we can provide you with individual information and make offers that match your needs and interests. To do so, we link data that we process about you, determine preference data and use this data as the basis for personalisation (see Section 3).

Relationship management also includes approaching existing customers and their contacts—where applicable personalised on the basis of behavioural and preference data. As part of relationship management, we may also operate a customer relationship management system (“CRM”), in which we store the data required to maintain relationships with customers, suppliers and other business partners, e.g. about contact persons, relationship history (e.g. products and services obtained or delivered, interactions, etc.), interests, wishes, marketing measures (newsletters, invitations to events, etc.) and other information.

All of this processing is important to us not only to promote our offerings as effectively as possible, but also to make our relationships with customers more personal and positive, to focus on the most important relationships and to use our resources as efficiently as possible.

We also process your data for market research, for improving our services and operations and for product development.

We strive to continuously improve our products and services (including our website) and to be able to respond quickly to changing needs. We therefore analyse, for example, how you navigate through our website or which products are used by which groups of people and in what way, and how new products and services can be designed (for further details see Section 12). This gives us indications of market acceptance of existing products and the market potential of new products and services. For this purpose, we process in particular master data, behavioural data and preference data, but also communication data and information from customer surveys, polls and studies, as well as other information, e.g. from the media, from social media, from the internet and from other public sources. Where possible, we use pseudonymised or anonymised information for these purposes. We may also use media monitoring services or conduct media monitoring ourselves and, in doing so, process personal data in order to carry out media work or to understand and respond to current developments and trends.

With your consent, we use non-anonymised location data to inform you, based on your location, about interesting offers and products nearby, to infer your interests from location data (length of stay), and to tell you which products and services other contractual partners with similar interests have used.

We may also process your data for security purposes and for access control.

We continuously review and improve the appropriate security of our IT and our other infrastructure (e.g. buildings). Like all companies, we cannot completely rule out data security breaches, but we do our part to reduce risks. We therefore process data, for example, for monitoring, controls, analyses and tests of our networks and IT infrastructures, for system and error checks, for documentation purposes and as part of backups. Access controls include, on the one hand, controlling access to electronic systems (e.g. logging into user accounts) and, on the other hand, physical access control (e.g. building access).

We process personal data to ensure compliance with laws, directives and recommendations from authorities, and internal regulations (“compliance”).

This includes, for example, the implementation of health and safety concepts or the legally regulated combating of money laundering and terrorist financing. In certain cases, we may be obliged to carry out specific checks on customers (“Know Your Customer”) or to make reports to authorities. The fulfilment of duties to provide information, disclose information or report, for example in connection with supervisory and tax obligations, also requires or entails data processing, e.g. the fulfilment of archiving obligations and the prevention, detection and investigation of criminal offences and other violations. This also includes receiving and processing complaints and other reports, monitoring communications, internal investigations, or disclosing documents to an authority if we have sufficient reason to do so or are legally obliged to do so. In the case of external investigations, e.g. by a law enforcement or supervisory authority or a commissioned private entity, personal data about you may also be processed under certain circumstances. For all these purposes, we process in particular your master data, your contract data and communication data, but in some circumstances also behavioural data and data from the category of other data. The legal obligations may be Swiss law, but also foreign provisions to which we are subject, as well as self-regulations, industry standards, our own corporate governance and official instructions and requests.

We also process data for purposes of our risk management and as part of prudent corporate governance, including operational organisation and corporate development.

For these purposes, we process in particular master data, contract data, registration data and technical data, but also behavioural and communication data. For example, as part of our financial management we must monitor our debtors and creditors, and we must avoid becoming victims of offences and abuse, which may require evaluating data for corresponding patterns. For these purposes, and to protect you and us from criminal or abusive activities, we may also carry out profiling and create, process and use profiles (see also Section 6). As part of planning our resources and organising our operations, we must evaluate and process data on the use of our services and other offerings, or exchange information about this with others (e.g. outsourcing partners), which may also include your data. The same applies with regard to services provided to us by third parties. As part of corporate development, we may sell or acquire businesses, parts of operations or companies, or enter into partnerships, which may also lead to the exchange and processing of data (including yours, e.g. as a customer or supplier or as a supplier’s representative).

We may process your data for additional purposes, e.g. as part of our internal processes and administration.

If we ask you for your consent for certain processing activities, we will inform you separately about the relevant purposes of the processing. You may withdraw your consent at any time by written notice (by post) or, where not otherwise stated or agreed, by email to us, with effect for the future; you can find our contact details in Section 2. For withdrawal of your consent for online tracking, see Section 12. Where you have a user account, withdrawal or contacting us may also be carried out via the relevant website or other service. Once we have received notice of the withdrawal of your consent, we will no longer process your data for the purposes to which you originally consented, unless we have another legal basis for doing so. Withdrawal of your consent does not affect the lawfulness of processing carried out on the basis of consent up to the time of withdrawal.
Where we do not ask you for your consent for processing, we base the processing of your personal data on the fact that the processing is necessary for the initiation or performance of a contract with you (or the entity you represent), or that we or third parties have a legitimate interest in doing so, in particular in order to pursue the purposes described above in Section 4 and the associated objectives and to be able to implement appropriate measures. Our legitimate interests also include compliance with legal requirements, insofar as these are not already recognised as a legal basis by the applicable data protection law (e.g. under the GDPR, the law in the EEA and in Switzerland).

In connection with our contracts, the website, our services and products, our legal obligations, or otherwise to safeguard our legitimate interests and the other purposes listed in Section 4, we also disclose your personal data to third parties, in particular to the following categories of recipients:

• Service providers: We work with service providers in Switzerland and abroad who process data about you on our behalf or in joint responsibility with us, or who receive data about you from us under their own responsibility (e.g. IT providers, shipping companies, advertising service providers, login service providers, cleaning companies, security companies, banks, insurers, debt collection companies, credit agencies, or address verifiers). This may also include health data.
• Contractual partners including customers: This primarily refers to our customers (e.g. recipients of services) and other contractual partners, because such data disclosure results from these contracts. If you work for such a contractual partner, we may also disclose data about you to them in this context. This may also include health data. Recipients also include contractual partners with whom we cooperate.
• Authorities: We may disclose personal data to offices, courts and other authorities in Switzerland and abroad if we are legally obliged or entitled to do so, or if this appears necessary to safeguard our interests. This may also include health data. The authorities process data about you under their own responsibility that they receive from us.
• Other persons: This refers to other cases where the involvement of third parties results from the purposes under Section 4, e.g. recipients of services, media and associations in which we participate, or if you are part of one of our publications.

All of these categories of recipients may in turn involve third parties, so that your data may also become accessible to them. We can restrict processing by certain third parties (e.g. IT providers), but not that of other third parties (e.g. authorities, banks, etc.).

We also reserve the right to make these disclosures of data even if they concern confidential data (unless we have expressly agreed with you that we will not disclose this data to certain third parties, unless we are legally obliged to do so). Regardless of this, your data remains subject to adequate data protection in Switzerland and the rest of Europe even after disclosure. For disclosures to other countries, the provisions of Section 8 apply. If you do not want certain data to be disclosed, please let us know so that we can check whether and to what extent we can accommodate your request (Section 2).

We also enable certain third parties to collect personal data from you on our website and at our events (e.g. media photographers, providers of tools that we have integrated into our website, etc.). To the extent that we are not decisively involved in these data collections, these third parties are solely responsible for them. For concerns and to exercise your data protection rights, please contact these third parties directly. See Section 12 for the website.

We process your data for as long as our processing purposes, the statutory retention periods and our legitimate interests in processing for documentation and evidentiary purposes require, or where storage is technically necessary. Further information on the respective storage and processing duration can be found for each data category in Section 3 and for cookie categories in Section 12. If there are no legal or contractual obligations to the contrary, we delete or anonymise your data after the storage or processing period has expired as part of our usual processes.

Documentation and evidentiary purposes include our interest in documenting processes, interactions and other facts in the event of legal claims, discrepancies, purposes of IT and infrastructure security, and proof of good corporate governance and compliance. Storage may be technically necessary if certain data cannot be separated from other data and we therefore have to retain it together with that other data (e.g. in the case of backups or document management systems).

We take appropriate security measures to safeguard the confidentiality, integrity and availability of your personal data, to protect it against unauthorised or unlawful processing, and to counter the risks of loss, accidental alteration, unintended disclosure or unauthorised access.

Technical and organisational security measures may include, for example, measures such as encryption and pseudonymisation of data, logging, access restrictions, storing backups, instructions to our employees, confidentiality agreements and controls. We protect data transmitted via our website during transport by means of suitable encryption mechanisms. However, we can only secure areas that we control. We also oblige our processors to take appropriate security measures. Security risks cannot be completely ruled out in general; residual risks are unavoidable.

• The right to request information from us as to whether and which data we process about you;
• the right to have data corrected if it is incorrect;
• the right to request deletion of data;
• the right to request that we provide certain personal data in a common electronic format or transfer it to another controller;
• the right to withdraw consent, insofar as our processing is based on your consent;
• the right to receive further information upon request that is necessary to exercise these rights;

• Necessary cookies: Some cookies are necessary for the functioning of the website itself or for specific features. For example, they ensure that you can move between pages without losing information entered in a form. They also ensure that you stay logged in. These cookies are only temporary (“session cookies”). If you block them, the website may not function properly. Other cookies are necessary for the server to save decisions or entries you have made beyond a session (i.e., a visit to the website) if you use this function (e.g., selected language, consent given, the automatic login function, etc.). These cookies have an expiration date of up to 24 months.
• Performance cookies: In order to optimize our website and corresponding offers and to better adapt them to the needs of users, we use cookies to record and analyze the use of our website, potentially even beyond the session. We do this by using third-party analysis services. We have listed these below. Performance cookies also have an expiration date of up to 24 months. Details can be found on the websites of the third-party providers.

We may operate pages and other online presences on social networks and other platforms operated by third parties (“fan pages”, “channels”, “profiles”, etc.) and collect the data about you described in Section 3 and below. We receive this data from you and the platforms when you come into contact with us via our online presence (e.g., when you communicate with us, comment on our content, or visit our presence). At the same time, the platforms evaluate your use of our online presences and link this data with other data about you known to the platforms (e.g., regarding your behavior and preferences). They also process this data for their own purposes under their own responsibility, in particular for marketing and market research purposes (e.g., to personalize advertising) and to manage their platforms (e.g., which content they show you).

We receive data about you when you communicate with us via online presences or view our content on the corresponding platforms, visit our online presences, or are active within them (e.g., publish content, post comments). These platforms also collect technical data, registration data, communication data, behavior, and preference data from you or about you (for terms, see Section 3). These platforms regularly evaluate the way you interact with us, how you use our online presences, our content, or other parts of the platform (what you look at, comment on, “like”, share, etc.) statistically and link this data with other information about you (e.g., information on age and gender and other demographic information). In this way, they also create profiles about you and statistics on the use of our online presences. They use this data and profiles to show you personalized advertising and other content on the platform and to control the behavior of the platform, but also for market and user research and to provide us and other entities with information about you and the use of our online presence. We can partially control the evaluations that these platforms create regarding the use of our online presences.

We process this data for the purposes described in Section 4, in particular for communication, for marketing purposes (including advertising on these platforms, see Section 12), and for market research. Information on the corresponding legal bases can be found in Section 5. Content published by you (e.g., comments on an announcement) may be redistributed by us (e.g., in our advertising on the platform or elsewhere). We or the operators of the platforms may also delete or restrict content from or about you in accordance with the usage guidelines (e.g., inappropriate comments).

For further information on the processing by the platform operators, please refer to the privacy notices of the platforms. There you will also find out in which countries they process their data, what rights of access, deletion, and other data subject rights you have, and how you can exercise these or obtain further information.

This privacy policy is not part of a contract with you. We may adjust this privacy policy at any time. The version published on this website is the current version.