Privacy Policy

In this Privacy Policy we, PensExpert AG (hereafter «PensExpert» or «we»), inform you (hereafter «the data subject») about how we process personal data on behalf of or together with the PensFlex, PensUnit, PensFree, independent and Pens3a foundations (hereafter referred to as «the foundations») within the framework of the applicable data protection laws (in particular the Swiss Data Protection Act («FADP») and the EU General Data Protection Regulation («GDPR»), if applicable, and make you aware of your rights.

I. Name and address of the controller

The controller within the meaning of the applicable data protection laws which decides on the purposes and methods of processing personal data is:

PensExpert AG

The controller’s data protection officer/data protection coordinator can be contacted using the following contact details:

PensExpert AG, Kauffmannweg 17, 6003 Lucerne (Switzerland).

Telephone: +41 41 226 15 15
Email address: datenschutz@pens-expert.ch

If you have any questions in connection with this Privacy Policy or if you wish to exercise the rights listed in Section XIII (Your rights) or Section XIV (Right to object), please use the contact details provided, unless stated or agreed otherwise. Please note that we have to identify you in order to prevent abuse, for instance via a copy of your ID card or passport, unless we can identify you by other means.

1. Website

Neustadt Agentur AG
Neustadtstrasse 3
6003 Lucerne

II. General information about data processing

PensExpert AG takes the protection of personal data very seriously. Personal data is any information relating to an identified or identifiable individual. This includes, for example, name, address, telephone/fax number and email address, as well as IP address and the date and time at which our website was accessed.

1. Scope of processing

We process your personal data only to the extent necessary to provide a functional website and our content, benefits, products and services. The processing of our users’ personal data takes place on the basis of the agreed purposes or on a legal basis. We only collect personal data that is necessary for the performance and processing of our tasks and services or that you voluntarily provide us with. The processing of your personal data takes place with your consent or, if it is permitted by law or legal obligations, when we or third parties have an overriding private or public interest in the processing or we are processing it for the performance of a contract.

2. Legal basis for the processing of personal data

Where data processing operations take place under the GDPR, we therefore also rely on the following legal bases:

• If we obtain the consent of the data subject for the processing of personal data, Art. 6 (1) (a) of the GDPR serves as the legal basis.

  If we ask for your consent for certain processing operations (e.g. for receiving newsletters and for personalised content or advertising based on your usage behaviour or for processing sensitive data), we process your data on the basis of this consent. You may withdraw your consent at any time with effect for the future by written notification (email is sufficient) – please see our contact details in section I. The withdrawal of your consent does not affect the lawfulness of the processing that we carried out prior to your withdrawal or the processing of your data on the basis of other reasons.

If we have not asked for your consent, we process your data for other legal reasons:

• Art. 6 (1) (b) of the GDPR serves as the legal basis for the processing of personal data that is necessary for the performance of a contract with the data subject. This also applies to processing operations that are necessary to carry out pre-contractual measures.
• Insofar as the processing of personal data is necessary in order to fulfil a legal obligation to which our company is subject, Art. 6 (1) (c) GDPR serves as the legal basis.
• If the vital interests of the data subject or another natural person necessitate the processing of personal data, Art. 6 (1) (d) GDPR serves as the legal basis.

• If the processing is necessary to safeguard a legitimate interest of our company or a third party and if the interests and fundamental rights and freedoms of the data subject do not outweigh the former interest, Art. 6 (1) (f) GDPR serves as the legal basis for the processing. This includes our data processing for marketing and relationship management purposes, for security reasons and as part of our corporate governance and development (including risk management).

3. Data deletion and retention period

In general, we process your data only for as long as is necessary to fulfil the purposes for which we have collected it, including compliance with statutory retention obligations and, insofar as this is necessary for the assertion of or defence against legal claims, until the end of the respective retention period or until the relevant claims have been settled. At the end of the respective retention period, we will securely destroy your data in accordance with the applicable laws and regulations.

 
III. Products and services

1. Description and scope of data processing

We primarily process personal data that we receive directly or from the foundations in the course of the contractual relationship with our insured persons. We may also receive or collect data from business partners or other involved persons. This means that if you make use of a service provided by PensExpert AG and/or the foundations, we will store and process your data, in particular personal, pension and financial data.

We process data when we provide you with advisory services (such as pension and tax advice relating to occupational pensions, advice on investing pension capital, mortgage advice, investment advice, financial planning), draw up pension proposals, carry out general support tasks (e.g. producing pension plans for new business and plan changes, staff orientation, etc.) and perform various coordination tasks.  We also process data for custodian accounts we hold and in discretionary asset management, as part of transaction costs (e.g. buying and selling), in investment advice supported by PensExpert and advised/implemented by external business partners (banks), etc.

In addition, we process data when we perform risk assessments and when we provide our pension benefits, make notifications, register you as a new client/insured person, assist you in the context of the encouragement of home ownership, carry out credit checks, etc., and receive data from you about third parties for the purposes set out in this Privacy Policy.

We process data when you contact us.

We process data that we receive from third parties (e.g. employers) or business partners in order to fulfil our contractual obligations and obligations to you or to comply with legal requirements.

In the case of advisory services (e.g. tax advice), we also receive data from tax offices, fiduciary companies, etc., typically on the basis of powers of attorney granted by you.

We process data to the extent that we are legally obliged or entitled to do so, e.g. for checking in the context of deposits and withdrawals, account opening processes, and the settlement, calculation and/or refusal of benefits.

2. Purpose of data processing

We process your data for the purposes described below:

Contract performance

We process your data in order to conclude, perform and manage a contract with you. For this purpose, we may in particular process communication data, master data and contract data. This may also include data about third parties, e.g. if you order products or services for the benefit of a third party. In certain circumstances, we may receive information about you from third parties as a result of your employment relationship with your employer, e.g. from insurance brokers who, in the course of a mandate with your employer, have been instructed by them to interact directly with us as a potential insurer or provider of various pension solutions in a particular area of occupational pensions. In addition, we may also receive data about potential customers from communication with you, at a trade fair or other business event (for more information on the disclosure of data, please see section III.3 below (disclosure to third parties, section X)). We also process data for the provision of services, clarification of insurance risks, beneficiary arrangements, risk minimisation, early detection, client support, reporting to authorities (e.g. Federal Disability Insurance, IV/AI (IV) agencies, unemployment funds), etc.

As part of the initial contact with you, we use this data to check your creditworthiness and enter into a business relationship with you. For the purpose of managing and performing the contract with you, we may engage third parties, such as logistics companies, advertising service providers, banks, insurance companies or credit information providers, to offer you our products and services.

Marketing and relationship management

We process your data for marketing and relationship management purposes. For example, we send out personalised newsletters for products and services from us and, if applicable, from selected third parties (e.g. advertising partners). Marketing and relationship management may include contacting you by email, telephone or other channels for which we have contact information from you. We and, if applicable, selected third parties will only show you content or advertising tailored to your usage behaviour or send emails for marketing purposes (e.g. newsletters) if and to the extent that you give us your consent, insofar as this is required by the applicable law. You can object to such marketing activities at any time or withdraw your consent (see sections XIII and XIV).

With respect to relationship management, we may use a customer relationship management (CRM) system to store and process your data as described in this Privacy Policy (e.g. about contact persons, products and services offered to you, interactions, interests, marketing activities, newsletters, invitations to events and other information).

Newsletters

We use the «NetMailer» platform, which is operated by PAWECO GmbH, to send out our newsletters. PAWECO is a provider based in Switzerland which is subject to Swiss data protection law. The email addresses of our newsletter recipients and other relevant data are stored on PAWECO’s servers in Switzerland and are used exclusively to dispatch our newsletters and evaluate the customer impact. We have concluded a Data Processing Agreement with PAWECO, in which PAWECO undertakes to protect the data of our users in accordance with data protection regulations and process it on our behalf.

We trust that PAWECO will process our users’ data securely and confidentially and will not use it for its own purposes or pass it on to third parties. If you do not want the analysis from NetMailer, you can unsubscribe from the newsletter at any time. We will provide you with an unsubscribe link in every newsletter message.

NetMailer is also used to analyse our newsletter campaigns. Technical information such as the time of access, IP address, browser type and operating system is recorded for this purpose. When you open an email sent via NetMailer, a file contained in the email (known as a «web beacon») connects to PAWECO’s servers. This makes it possible to determine whether a newsletter message has been opened and which links, if any, have been clicked on.

Data is processed on the basis of your consent in accordance with Art. 6 (1) (a) GDPR. You can revoke this consent at any time by unsubscribing from the newsletter. The revocation does not affect the lawfulness of the data processing that has already taken place.

Product/service improvement and innovation

We also process your data for market research, to improve our services and operations, and for product development.

Safety and security

We process your data to protect our IT and other infrastructure (e.g. buildings). For example, we process data for monitoring, analysing and testing our networks and IT infrastructures, including access control. We may also use surveillance systems, such as cameras, for security purposes. In such a case, we will inform you separately at the appropriate junctures.

Compliance with the law

We process your data in order to comply with legal requirements, such as health security concepts, anti-money laundering and anti-terrorist financing measures, tax obligations, etc., to make reports to authorities (e.g. Federal Disability Insurance, (IV/AI) agencies, AHV/AVS offices, etc.), and we may need to request further information from you in order to comply with such requirements («Know Your Customer (KYC)») or as otherwise required by law and the authorities.

Risk management, corporate governance and business development

We process your data as part of our risk management and corporate governance processes in order to protect ourselves from criminal or improper activities. As part of our business development, we may sell or acquire businesses, parts of businesses or companies to others or enter into partnerships, which may result in the exchange and processing of data based on your consent.

3. Disclosure to third parties

As part of our business activities, we may disclose your personal data to third parties for the purposes stated and where appropriate:

Banks, employers, insurers (including reinsurers), brokers/agents, trustees, asset managers, occupational benefits institutions/social security funds and third parties commissioned by you

Based on your authorisation/consent, we may pass on data to reinsurers and occupational benefits institutions to review the risk and entitlement to benefits and process contracts.

If indicated or on the basis of your consent/authorisation, we may also pass on data (e.g. pension information) to the custodian bank, asset manager and the relevant broker or agent. We pass on your personal data to brokers if they, acting as brokers to your employer, are instructed by the latter within the scope of their mandate to interact directly with us as a (potential) insurer or provider of various pension solutions in a particular area of occupational pensions.

We also receive data from employers and other partners or third parties concerning you, which we pass on to banks, insurance companies, social security funds, occupational benefits institutions, brokers, agents and other third parties for processing in order to fulfil the purposes stated in this Privacy Policy.

We may also pass on data that we have collected to fiduciary and consulting companies or other third parties in the context of contractual fulfilment or client care.

Authorities, social security organisations/funds, occupational benefits institutions

In addition, based on your consent, we may obtain information from authorities, social security organisations and third parties in order to assess the risk and entitlement to benefits, in particular from the previous occupational benefits institution about any benefits provided, and process this data if and to the extent that you have released the persons, their auxiliaries and organisations from their duty of confidentiality.

Other third parties

See the explanations under Section X below.

4. Retention period

The personal data we collect is only processed or stored for as long as is necessary to manage the contractual relationship between you and the foundations (from the initiation to the termination of a contract) or for the other purposes for which the data is being processed and/or for as long as a statutory retention and documentation obligation applies or there is an overriding private or public interest in the data processing or the data processing is necessary for the purpose of asserting or defending against legal claims, until the expiry of the retention period in question or until the claims in question have been dealt with. As soon as the personal data we collect is no longer required for the above purpose(s)/the applicable retention period has expired, the data will be deleted or anonymised as far as possible.

5. Categories of data

Master data

The term «master data» refers to the basic data that we need in addition to the contract data (see below) for the processing of our contractual and other business relationships or for marketing and advertising purposes, such as your name, contact data and information like your role and function, details of your bank account(s), your date of birth, client history, powers of attorney, signature authorisations and declarations of consent. We process your master data if you are or work for a client or other business contact (e.g. as a contact person for the business partner), or because we want to contact you for our own purposes or those of a contractual partner (e.g. in the context of marketing and advertising, with newsletters, etc.). We receive master data from you (e.g. when making a purchase or registering), from your employer and from bodies for which you work, or from third parties such as our contractual partners, associations and address traders, and from publicly accessible sources such as public registers or the internet (websites, social media, etc.). We generally retain this data for ten years from the last contact with you, but from no earlier than the end of the contract. This period may be longer if this is necessary for evidence purposes, to comply with statutory or contractual requirements or for technical reasons. For pure marketing and advertising contacts, the retention period is normally much shorter, usually no more than two years since the last contact.

Master data is not collected on a general basis for each contact. Rather, the collection of master data is based on the individual case and the purpose of the processing. In general, it may include:

Contract data

We collect contract data in connection with the conclusion or performance of a contract, e.g. information about the products and services provided or to be provided, as well as data from the period prior to the conclusion of the contract, information required or used for the performance of a contract, and information about feedback (e.g. complaints, satisfaction feedback, etc.). We generally collect this data from you, contractual partners and third parties involved in the performance of the contract (such as employers), but also from third-party sources and from publicly accessible sources. We generally retain this data for ten years from the last contract activity, but from no earlier than the end of the contract. This period may be longer if this is necessary for evidence purposes, to comply with statutory or contractual requirements or for technical reasons.

The contract data includes, among other things:

• Information about the conclusion of the contract and about your contracts, e.g. contract type, date and duration
• The performance and administration of the contracts, e.g. information in connection with billing, client service, technical support and the assertion of contractual claims
• Information about defects, complaints and contract amendments, as well as information about client satisfaction that we may collect through surveys, for example.
• Financial data, such as information on creditworthiness (i.e. information that allows conclusions to be drawn about the likelihood that amounts owed will be paid), dunning and payment collection information.

We receive some of this data from you (e.g. when you make payments), but also from credit agencies and payment collection companies and from public sources (e.g. commercial registers).

Communication data

If you contact us via the contact form, email, telephone, chat, letter or other communication channels, we will collect the data exchanged between you and us, including your contact details and the peripheral data on the communication. When we record telephone conversations or video conferences, we will draw your attention to this separately. If we want or need to ascertain your identity, e.g. when you make a request for information, we collect data to identify you (e.g. a copy of your ID). We generally store this data for [12] months from the last contact with you. This period may be longer if we process your communication data in connection with the performance of a contract, or if this is necessary for evidence purposes, to comply with legal or contractual requirements or for technical reasons. Emails in personal mailboxes and written correspondence are generally kept for at least [ten] years. Chats are usually stored for [two] years.

Communication data includes:

• Your name, contact details, email address, telephone number, home address

Other data

We also collect your data in other situations. In connection with official or court proceedings, for example, data (such as files, evidence, etc.) is generated that may also relate to you. We may also collect data for reasons of health protection (e.g. as part of protection concepts). We may receive or produce photos, videos and sound recordings in which you may be recognisable (e.g. at events, security camera footage, etc.). We may also collect data about who enters certain buildings and when they do so, or has corresponding access rights (including access controls, based on registration data or visitor lists, etc.), who participates in events or campaigns, and who uses our infrastructure and systems when. The retention period for this data depends on the purpose and is limited to what is necessary. This ranges from a few days for security cameras and typically a few weeks for contact tracing data, to visitor data, which is usually kept for [three] months, to several years or more for event reports with images.

You disclose much of the aforementioned data to us yourself (e.g. via forms, in the context of communication with us, in connection with contracts, when using the website, etc.). Except in individual cases, e.g. within the framework of binding protection concepts (statutory obligations), you are not obliged to do so. If you wish to conclude contracts with us or make use of services, you must also provide us with data as part of your contractual obligation in accordance with the relevant contract, in particular master, contract and guest access or registration data. The processing of technical data is unavoidable during the use of our website. If you wish to gain access to certain systems or buildings, you must provide us with registration information. In the case of behavioural and preference data, however, you have the option of objecting or refusing to give your consent.

Insofar as it is not prohibited, we may also obtain data from publicly available sources (e.g. debt enforcement registers, land registers, commercial registers, media or the internet including social media) or obtain data from other companies within our Group, authorities and other third parties (e.g. credit agencies, address traders, associations, contractual partners, internet analytics services, etc.).

As part of our marketing measures and their optimisation, Hub Spot may collect and process the following data:

• Geographic location
• Browser type
• Navigation information
• Reference URL
• Performance data
• Information about how often the application is used
• Mobile app data
• Login information for the HubSpot subscription service
• Files that are displayed locally
• Domain name
• Pages viewed
• Aggregated use
• Operating system version
• Internet service provider
• IP address
• Device identifier
• Duration of the visit
• Where the application was downloaded from
• Operating system
• Events occurring within the application
• Access times
• Clickstream data
• Device model and version
• Technical data
  

Every time our website is accessed, our system automatically collects data and information from the computer system of the accessing computer (cf. section IV/AI below).

6. Possibility of objection and deletion

As part of our business relationship, you must provide all personal data that is necessary for the commencement and performance of our service and the fulfilment of the associated contractual obligations. Without this data, we will generally not be able to conclude or perform a contract with you (or the insured person who is employed by you).

You have the option to revoke your consent to the processing of your personal data at any time.

IV/AI. Provision of the website and creation of log files

1.    Description and scope of data processing

As already mentioned above, we also process technical data. This is the case, for example, each time our website is accessed, when our system automatically collects data and information from the computer system of the accessing computer. The following data is collected:

• Information about the browser type and version used
• The user’s operating system
• The user’s internet service provider
• The user’s IP address
• Date and time of access
• Websites from which the user’s system accesses our website
• Websites accessed by the user’s system via our website
• Data volumes transferred.

2.    Purpose of data processing

The temporary saving of the user’s IP address by the system is necessary to enable the website to be delivered to the user’s computer. To this end, the IP address has to be saved for the duration of the session.  The data is also stored in the log files of our system.

The log files contain IP addresses or other data that can be assigned to a user. This could be the case, for example, if the link to the website from which the user accesses our website or the link to the website the user goes to after leaving our site contains personal data.

The data is stored in log files in order to ensure that the website functions correctly. In addition, the data enables us to optimise the website and ensure the security of our IT systems. However, no data is evaluated for marketing purposes in connection with this.

3.    Retention period

This data is deleted as soon as it is no longer required for the purpose it was originally collected for. In the case of data collected for the purpose of providing the website, this is the case when the respective session has ended.

If the data is stored in log files, this is the case after seven days at the latest. The data may be retained beyond this period. In this case, the users’ IP addresses are deleted or altered in such a way that attribution to the accessing client is no longer possible. However, this data is not stored together with other personal data of the user.

4.   Possibility of objection and deletion

The collection of data for the provision of the website and the storage of the data in log files is essential for the operation of the website. Consequently, there is no possibility to object to this kind of data collection.

4.   Pixels

Provided you have given your consent, we may use tracking pixels when you visit our website. In technical terms, pixels are small image elements that are integrated into the website to collect and evaluate data from website users.

V. Use of cookies

1.     Description and scope of data processing

Our website uses cookies. Cookies are text files that are stored in or by the internet browser on the user’s computer system. When you access a website, a cookie may be stored on your operating system. This cookie contains a characteristic string of characters that enables the browser to be uniquely identified when the website is accessed again.

2.     Purpose of data processing

We only store necessary cookies, i.e. cookies that are necessary for the functioning of the website as such or for certain functions. For example, some cookies ensure that you can switch between pages without losing the information entered in a form, or that you will remain logged in. These cookies only exist temporarily («session cookies»). Session cookies are deleted automatically when you leave our website. If you block them, the site may not work properly. Other cookies are necessary for the server to store options or information (that you have entered) beyond the end of a session (i.e. a visit to the site) when you use this function (language settings, consent, automatic log-in functions, etc.).

3.    Retention period

Technically necessary cookies have an expiry period of up to 12 months.

VI.    Simulation calculator

1.     Description and scope of data processing

On our website you will find simulation calculators, such as purchase and withholding tax calculators, which allow you to simulate the effects of certain actions on assets, capital, savings and the like. In particular, we collect the following data from you for the simulation calculators:

• Year of birth
• Gender
• Marital status
• Confession
• Postcode and place of residence
• Net income per year/income
• Purchase amount
• Lump-sum payment amount
• Number of children/children in initial education
• Registered office of your vested benefits foundation

2.   Purpose of data processing

The data is processed for the purpose of performing the simulation/simulation calculation requested by you. Based on the information you provide in the input screen, we calculate or simulate (possible) scenarios (such as tax savings, additional retirement lump-sum capital, savings opportunities, etc.).

3.    Retention period

The data is processed temporarily for the execution of the simulation. The data is not stored and is deleted automatically when you leave the website.

4.    Possibility of objection and deletion

As we do not store your data, or the data is processed exclusively for the execution of the simulation and the use of our simulation calculator is voluntary, there is therefore no possibility of objection or removal.

VII.    Contact form and email contact

1.    Description and scope of data processing

On our website there is a contact form which can be used to contact us electronically. If a user makes use of this option, the data entered in the input mask is transmitted to us and stored. The following data is processed and stored when the message is sent:

• The user’s IP address
• Date and time of the enquiry
• Whether you are already a client
• First name and surname
• Postcode
• Email address/telephone no.
• Contract number
• Subject area selected
• Comments made
• Name of the company

Your consent to the processing of the data is obtained as part of the sending process and reference is made to this Privacy Policy. Alternatively, you can contact us using the email address provided. In this case, the user’s personal data transmitted with the email will be stored.

Data will not be passed on to third parties in this context. The data is used exclusively for processing the conversation.

2.    Legal basis for data processing

If the user has given his or her consent, the legal basis for processing the data is Art. 6 (1) (a) GDPR.

The legal basis for processing data transmitted via email is Art. 6 (1) (f) GDPR. If the purpose of the email contact is to conclude a contract, the additional legal basis for processing is Art. 6 (1) (b) GDPR.

3.  Purpose of data processing

We process the personal data from the input screen solely for the purpose of processing the contact. If you contact us by email, this also constitutes the necessary legitimate interest in processing the data. The other personal data processed during the sending process serves to prevent misuse of the contact form and to ensure the security of our IT systems.

4.    Retention period

This data is deleted as soon as it is no longer required for the purpose it was originally collected for. For the personal data from the input screen of the contact form and that sent by email, this is the case when the respective conversation with the user has ended. The conversation ends when it can be inferred from the circumstances that the matter in question has been conclusively clarified.

The additional personal data collected during the sending process will be deleted after a period of seven days at the latest.

5.    Possibility of objection and deletion

You may withdraw your consent to the processing of your personal data at any time (see contact details in Section I). If you contact us by email, you can object to the storage of your personal data at any time. In such a case, the conversation cannot be continued.

In this case, all personal data stored during the contact with you will be deleted.

VIII.    Web analysis by Google Analytics

Based on your consent, we use tracking tools to ensure a needs-based design and continuous optimization of our website and other electronic services (e.g., app). We also use tracking tools to statistically record the use of our website and to evaluate it for the purpose of optimizing the content and offers we present to you.

We use Google services on the basis of your consent.

Google Ireland (based in Ireland) is the provider of the services “Google Analytics”, “Floodlight” and “Google Campaign Manager 360” (collectively “Google services”) and acts as our data processor. For this purpose, Google Ireland relies on Google LLC (based in the USA) as its processor (both “Google”). Google uses cookies (see above) to track the behavior of visitors on our website and their use of our electronic services (duration, frequency of pages accessed, geographic origin of access, conversions, etc.) and, on this basis, creates reports for us on the use of our website and services. We have configured the service so that the IP addresses of visitors are shortened by Google in Europe before being transferred to the USA and therefore cannot be traced back. We have disabled the “data sharing” and “signals” settings. Although we may assume that the information we share with Google does not constitute personal data for Google, it is possible that Google may draw conclusions about the identity of visitors from this data, create personal profiles, and link this data with the Google accounts of these individuals for its own purposes. If you consent to the use of Google services, you explicitly consent to such processing, which also includes the transfer of personal data (in particular usage data relating to the website and app, device information, and individual IDs) to the USA and other countries. Information on data protection for Google services can be found at https://policies.google.com/privacy / https://support.google.com/analytics/answer/6004245 and, if you have a Google account, further information on processing by Google can be found at https://policies.google.com/technologies/partner-sites?hl=de.

IX.    Profiling and automated decision-making

We may perform automated evaluations of certain personal characteristics of yours for the purposes named in this Privacy Policy on the basis of your data («profiling») in order to ascertain preference data, assess fraud and security risks, perform statistical evaluations or for operational planning purposes. We may also draw up profiles for the same purposes, i.e. we may combine behavioural and preference, master, contract and technical data attributed to you in order to understand you better as a person with your different interests and other characteristics. We may also use profiling to assess your creditworthiness. We do not do any profiling that could have legal implications or a similar negative impact for you without human verification.

For reasons of efficiency and consistency in decision-making processes, it may be necessary in certain situations for us to automate discretionary decisions related to you with legal implications or potentially significant disadvantages («automated individual decisions»). We will inform you accordingly if this is the case and take the measures necessary under the applicable law.

X. Disclosure of data to third parties

In connection with our contracts, the website, our products and services and our legal obligations, or to safeguard our legitimate interests and for the other purposes listed in this Privacy Policy, we also transfer your personal data to third parties (see also Section III.3 above), in particular to the following categories of recipients:

Foundations

We may disclose data to our Foundations, which use the data for the same purposes as set out in this Privacy Policy, including advertising their own products and services.

Service providers

We work with service providers in Switzerland and abroad who process data about you on our behalf or under joint responsibility with us or who receive data about you from us on their own responsibility (e.g. IT providers, shipping companies, advertising service providers, login service providers, cleaning companies, security firms, banks, insurers, telecommunications companies, credit agencies, address verification providers, lawyers) or whom we commission to process personal data on our behalf for one of the above purposes and only in accordance with our instructions.

Contractual partners including clients

If required by the respective contract, we pass on your data to other contractual partners. When we sell or purchase a business or asset, we may disclose your information to the potential seller or buyer of such a business or asset to whom we assign or transfer our rights and obligations.

We may pass on data to banks, asset managers, brokers, intermediaries, occupational benefits institutions, social security funds, reinsurers, employers, etc. in order to fulfil our contractual or legal obligations to you or, where applicable, your employer. This may be based on your consent, an express instruction from your employer or if there is a legitimate interest in doing so.

Authorities

We may pass on personal data to administrative bodies, courts and other authorities (e.g. Federal Disability Insurance (IV/AI)offices, AHV/AVS offices, etc.) in Switzerland or other countries if we are legally obliged or entitled to do so or it appears necessary to protect our interests. The authorities process your data that they receive from us on their own responsibility.

Social plug-ins

Our website uses social plug-ins from social media sites such as LinkedIn and X and integrates them as follows:

When you visit our website, the social plug-ins are deactivated, i.e. no data is transmitted to the operators of these networks. If you wish to use one of the networks, you must establish a direct connection to the network’s server by clicking on the respective social plug-in, i.e. the integration only takes place with your consent.

The social media provider stores the data collected about you as usage profiles and uses it for the purposes of advertising, market research and/or needs-based design of its website. Such an evaluation is carried out in particular (including for users who are not logged in) to show needs-based advertising and to inform other users of the social network about your activities on our website. Your connection to a social network, the data transfers between the network and your system and your interactions on this platform are subject exclusively to the privacy policy of the respective social media provider. Further information on the purpose and scope of data collection and processing by the social media provider can be found in the privacy policies of these providers, which are provided below. There you will also find further information about your rights in this regard and settings options to protect your privacy.

Data is passed on regardless of whether you have an account with the social media provider and are logged in there. If you are logged in to the social media provider, your data collected from us is assigned directly to your account with the social media provider. If you click the activated button and, for example, link to the page, the social media provider also stores this information in your user account and publicly shares it with your contacts.

We recommend that you log out regularly after using a social network. In particular, we recommend deactivating social media buttons, as this will prevent data from being assigned to your profile with the social media provider.

If you activate a social plug-in, personal data may reach providers in countries outside the European Economic Area that, from the point of view of Switzerland or the European Economic Area (EEA), may not guarantee an adequate level of protection for the processing of personal data in accordance with Swiss/EU standards. Accordingly, if you activate a social plug-in, you also consent to such transmission.

You may withdraw your consent at any time, although this will not affect the lawfulness of the data processing up to the time of withdrawal. The easiest way to revoke your consent is to use the functions of the social media providers.

Integration of YouTube videos

Our online offering includes integrated YouTube videos, which are stored on YouTube.com and can be played directly from our website. These are all integrated in «extended data protection mode», i.e. no data about you as a user is transmitted to YouTube if you do not play the videos. The following data is only transmitted when you play the videos. We have no control over this data transmission. The legal basis for viewing the videos is your consent, i.e. the integration only takes place with your consent.

When you visit the website, YouTube is informed that you have accessed the corresponding subpage of our website. In addition, the above-mentioned basic data such as IP address and time stamp is transmitted. This is done regardless of whether YouTube provides a user account through which you are logged in or whether there is no user account. If you do not want the data to be assigned to your YouTube profile, you must log out before activating the button. YouTube stores your data as user profiles and uses it for the purposes of advertising, market research and/or needs-based design of its website. Such an evaluation is carried out in particular (even for users who are not logged in) to provide needs-based advertising and to inform other users of the social network about your activities on our website. You have the right to object to the creation of these user profiles; you must contact YouTube to exercise this right.

The information collected is stored on Google servers, including in the US. In such cases, the provider states that it has imposed on itself a standard which corresponds to the former EU-US Privacy Shield and has undertaken to comply with applicable data protection laws when transmitting data internationally.

Further information on the purpose and scope of data collection and processing by YouTube can be found in its privacy policy. There you will also find further information about your rights and settings options to protect your privacy.

Our social media presence

We have a presence on various social media platforms. We operate these pages with the following providers: LinkedIn, YouTube.

We receive this data from you and the platforms when you contact us via our websites (e.g. when you communicate with us, comment on our content or visit our page). At the same time, the platforms evaluate your use of our online presence and link this data with other data about you that is known to the platforms (e.g. about your behaviour and preferences). They also process this data for their own purposes on their own responsibility, in particular for marketing and market research purposes (e.g. to personalise advertising) and to manage their platforms (e.g. what content they display to you).

Please note that when you use our pages on social media platforms and their functions, you do so at your own responsibility. This applies in particular to the use of interactive functions (e.g. commenting, sharing, rating).

The individual data processing operations and their scope vary depending on the operator of the social network in question. For details about the collection and storage of your personal data as well as the nature, scope and purpose of its use by the operator of the respective social media platform, please refer to the privacy policy of the respective operator.

The data collected about you in this context is processed by the platforms and may be transferred to countries outside the European Union, in particular the US. Many of the aforementioned providers state that they have an adequate level of data protection equivalent to that of the former EU-US Privacy Shield, and in addition, these platforms or we, where necessary, have concluded what are known as standard data protection clauses with the companies.

We are not aware of how the social media platforms use the data from your visit to our account and the interaction with our posts for their own purposes, how long this data is stored and whether data is passed on to third parties. Data processing may vary depending on whether you are registered and logged in to the social network or are visiting the site as a non-registered and/or non-logged-in user. When accessing a post or an account, the IP address assigned to your end device is transmitted to the provider of the social media platform. If you are currently logged in as a user, a cookie on your end device may be used to track your movements in the network. Using buttons integrated into websites, the platforms are able to record your visits to these websites and assign them to your respective profiles. This data can then be used to offer you tailored content or advertising. If you want to prevent this from happening, you should log out or disable the «Stay logged in» function, delete the cookies on your device and restart your browser.

To exercise your rights as a data subject, you can contact both us and the provider of the social media platform.

The providers describe what information the social media platform receives and how it is used in their data protection statements (see above overview for link). There you will also find information about contact possibilities and settings options for advertisements.

Integration of Google Maps

This website uses the services of Google Maps. This allows us to show you interactive maps directly on the website and allows you to conveniently use the map function. The legal basis for the use of the maps is your consent, i.e. the integration only takes place with your consent.

When you visit the website, Google is informed that you have accessed the corresponding sub-page of our website. In addition, the above-mentioned basic data such as IP address and time stamp is transmitted. This is done regardless of whether Google provides a user account through which you are logged in or whether there is no user account. If you are logged in to Google, your data will be assigned directly to your account. If you do not want the data to be assigned to your Google profile, you must log out before activating the button. Google stores your data as user profiles and uses it for the purposes of advertising, market research and/or needs-based design of its website. Such an evaluation is carried out in particular (even for users who are not logged in) to provide needs-based advertising and to inform other users of the social network about your activities on our website. You have the right to object to the creation of these user profiles; you must contact Google to exercise this right.

The information collected is stored on Google servers, including in the US. For such cases, we have agreed standard data protection clauses with Google, the purpose of which is to maintain an appropriate level of data protection in the third country.

Further information on the purpose and scope of data collection and processing by the plug-in provider can be found in the privacy policies of the provider.

XI.    Transmission of data outside Switzerland

As explained in sections III.3 and X, we also disclose data to other recipients. These recipients are not only located in Switzerland.

If we transfer data to countries without adequate statutory data protection, we will only do so if it is necessary to perform a contract or to assert or defend legal claims, or if such transfer is based on your express consent or is subject to safeguards to protect your data, such as the standard contractual clauses approved by the European Commission.

XII.    Security of your personal data

We take suitable security measures to preserve the confidentiality, integrity and availability of your personal data in order to protect you against unjustified or illegal processing thereof and reduce the risks of loss, unintentional alteration, unwanted disclosure or unauthorised access.

Despite this, it is still possible that we and your personal data will fall victim to cyber attacks, cyber crime, brute force methods, hacking and other fraudulent and malicious activities, including but not limited to viruses, forgeries, malfunctioning and disruptions, which are out of our control and responsibility.

However, we have no control over how third-party providers store your personal data under their own responsibility. This information can also be found in their own privacy policies.

XIII.   Your rights

Depending on the applicable data protection law, you have various rights in relation to our processing of your personal data:

Right to information

You have the right to request information from us about whether we process your data and if so, which data of yours it is.

Right to rectification

We endeavour to keep your personal data correct, up-to-date and complete. Please contact us and inform us if your personal data is incorrect or changes so that we can keep it up-to-date.

Right to deletion

You have the right to request that we delete your personal data if that data is no longer required for the purpose for which it was collected or if your personal data has been processed unlawfully.

Right to restrict processing

You have the right to ask us to restrict the processing of your personal data under certain circumstances.

Right to data portability

You have the right to request that we return certain personal data to you in a common electronic format or pass it on to another controller.

Right to revoke consent

If we process data on the basis of your consent, you have the right to revoke your consent. As soon as we receive the notification that you have revoked your consent, we will cease processing your data for the purpose(s) to which you originally agreed, unless there is another legal reason for us to continue processing it.

Complaint

If you believe that your data protection rights could have been breached, please notify us and contact the responsible supervisory authority.

XIV.    Right to object

According to applicable data protection law, you have the right to object to the processing of personal data relating to you at any time under certain circumstances, particularly if your data is being processed in the public interest, on the basis of a balancing of interests or for direct marketing purposes.

XV.    Validity of this Privacy Policy

Due to the continuous development of our website and its content, and in light of changes in the law or regulatory requirements, we may need to amend this Privacy Policy from time to time. The version published on this website is the latest version.

Last updated: May 2025