Privacy Policy of ANALYSIT AG

The protection of your privacy is very important to us. We respect your personality and privacy and ensure their protection as well as the lawful processing of your personal data. In this privacy policy, we explain how we collect and otherwise process personal data. Personal data refers to all information relating to an identified or identifiable person. If you provide us with personal data of other persons (e.g., family members, colleagues‘ data), please ensure that these persons are aware of this privacy policy and that you are authorized to share their personal data and that the data is correct. This privacy policy is designed to meet the requirements of the EU General Data Protection Regulation („GDPR“), the Swiss Federal Act on Data Protection („FADP“), and the revised Swiss Federal Act on Data Protection („revFADP“). Whether and to what extent these laws apply depends on the individual case.

1. Controller

The controller for the data processing described here is ANALYSIT AG. If you have any data protection concerns, you can address them to the following contact address for all of the companies listed below: ANALYSIT AG  Data Protection Officer  Riedmattstrasse 9  8153 Rümlang, Switzerland Or by email to: admin@analysit.ch

2. Collection and Processing of Personal Data

We primarily process the personal data that we receive from our customers and other business partners in the context of our business relationships or that we collect from users when operating our websites, apps, and other applications. Where permitted, we also obtain certain data from publicly accessible sources (e.g., debt collection registers, land registries, commercial registers, press, internet) or receive such data from other companies, authorities, and other third parties. In addition to the data that you provide to us directly, the categories of personal data that we obtain from third parties about you include, in particular, information from public registers, information that we learn in connection with official and legal proceedings, information relating to your professional roles and activities (so that we can conclude and process transactions with your assistance), information about you in correspondence and discussions with third parties, credit information (insofar as we conduct business with you personally), information about you provided to us by people from your environment (family, advisors, legal representatives, etc.) so that we can conclude or process contracts with you or involving you (e.g., references, your address for deliveries, powers of attorney), information for compliance with legal requirements such as anti-money laundering and export restrictions, information from banks, insurers, distribution and other contractual partners of ours for the use or provision of services by you (e.g., payments made, purchases made), information from media and the internet about your person (insofar as this is appropriate in the individual case, e.g., in the context of an application, press review, marketing/sales, etc.), your addresses and, if applicable, interests and other sociodemographic data (for marketing), data relating to the use of the website (e.g., IP address, MAC address of the smartphone or computer, information about your device and settings, cookies, date and time of the visit, pages and content retrieved, functions used, referring website, location information).

3. Purposes of Data Processing and Legal Bases

We primarily use the collected personal data to conclude and process our contracts with our customers and business partners, in particular in the context of the collection, analysis, and simulation of data concerning the movement of people and traffic, with our customers and the procurement of products and services from our suppliers and subcontractors, as well as to comply with our legal obligations at home and abroad. If you are working for such a customer or business partner, you may also be affected in this role with your personal data. In addition, we process personal data of you and other persons, where permitted and where it appears appropriate to us, also for the following purposes in which we (and sometimes also third parties) have a legitimate interest corresponding to the purpose:

• Offering and further developing our offers, services, and websites, apps, and other platforms on which we are present;
• Communicating with third parties and processing their inquiries (e.g., applications, media inquiries);
• Reviewing and optimizing needs analysis procedures for the purpose of direct customer approach and collecting personal data from publicly accessible sources for customer acquisition;
• Advertising and marketing (including conducting events), unless you have objected to the use of your data (if we send you advertising as an existing customer, you can object at any time, and we will put you on a blocking list against further advertising);
• Market and opinion research, media monitoring;
• Asserting legal claims and defending in connection with legal disputes and official proceedings;
• Preventing and investigating criminal offenses and other misconduct (e.g., conducting internal investigations, data analyses to combat fraud);
• Ensuring our operations, in particular IT, our websites, apps, and other platforms;
• Video surveillance to safeguard domiciliary rights and other measures for IT, building, and facility security and protection of our employees and other persons and values belonging to or entrusted to us (such as access controls, visitor lists, network and mail scanners, telephone recordings);
• Purchase and sale of business divisions, companies, or parts of companies and other corporate transactions and the associated transfer of personal data as well as measures for business management and, where necessary, compliance with legal and regulatory obligations and internal regulations of ANALYSIT;
• If you have given us consent to process your personal data for specific purposes (e.g., when registering to receive newsletters or conducting a background check), we will process your personal data within the scope of and based on this consent, unless we have another legal basis and we need one. A given consent can be withdrawn at any time, but this does not affect data processing that has already taken place.

4. Cookies / Tracking and Other Technologies Related to the Use of Our Website

We typically use „cookies“ and similar technologies on our websites and applications to identify your browser or device. A cookie is a small file sent to your computer or automatically stored on your computer or mobile device when you visit our website or use our applications. When you visit our website again or use our applications, we can recognize you, even if we do not know who you are. In addition to cookies used only during a session and deleted after your website visit („session cookies“), cookies may also be used to store user settings and other information for a certain period (e.g., two years) („permanent cookies“). However, you can configure your browser to reject cookies, store them for one session only, or delete them early. Most browsers are preset to accept cookies. We use permanent cookies to save user settings (e.g., language, autologin) and to better understand how you use our offers and content (which may also occur on third-party websites; these third parties do not learn who you are from us, even if we know, as they only see that the same user visited their site who also visited a particular page on ours). Some cookies are set by us, others by our partners. If you block cookies, some functionalities (such as language selection, shopping cart, order processes) may no longer work. Google Analytics We may use Google Analytics or similar services on our websites. These services are provided by third parties, which may be located anywhere in the world (for Google Analytics, it is Google Ireland with headquarters in Ireland, relying on Google LLC, based in the USA). These services help us measure and analyze website usage (not personal data). Permanent cookies are also used for this. We have configured the service so that visitors’ IP addresses are shortened in Europe before being forwarded to the USA, thus preventing identification. We have disabled „data sharing“ and „signals.“ While we assume that the information we share with Google is not personal data for Google, it is possible that Google may draw conclusions about the identity of visitors, create personal profiles, and link this data with the Google accounts of those individuals. The processing of your personal data by Google is Google’s responsibility under their privacy policies. Social Media Plug-ins We may also use social media plug-ins on our websites, such as Facebook, Twitter, YouTube, Pinterest, or Instagram. These are indicated by corresponding icons. We have configured these elements to be deactivated by default. If you activate them (by clicking), the operators of the respective social networks can detect that you are on our website and where, and may use this information for their purposes. The processing of your personal data is then the responsibility of these operators under their privacy policies. We do not receive any information about you from them.

5. Data Disclosure

In the course of our business activities and for the purposes mentioned in section 3, we disclose personal data to third parties as permitted and appropriate, either because they process it on our behalf or because they use it for their own purposes. This applies in particular to the following recipients:

• Service providers (within ANALYSIT and externally, such as banks, insurers), including processors (e.g., IT providers);
• Resellers, suppliers, subcontractors, and other business partners;
• Customers;
• Domestic and foreign authorities, offices, or courts;
• Media;
• The public, including visitors to websites and social media;
• Competitors, industry organizations, associations, and other bodies;
• Buyers or prospective buyers of business units, companies, or other parts of ANALYSIT.

These recipients may be located within Switzerland or abroad. You should particularly expect your data to be transferred to any country where ANALYSIT has group companies, branches, or other offices, as well as to other European countries and the USA, where our service providers are located (e.g., Microsoft, SAP, Amazon, Salesforce.com). If a recipient is in a country without adequate data protection, we contractually obligate them to comply with data protection (using the revised Standard Contractual Clauses of the European Commission, available here: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj), unless they are already subject to a recognized legal framework ensuring data protection, or we can rely on an exception. Exceptions may apply particularly in legal proceedings abroad, in cases of overriding public interests, if the processing of a contract requires such disclosure, if you have consented, or if the data is generally accessible and you have not objected to its processing.

6. Duration of Personal Data Storage

We process and store your personal data as long as it is necessary for the fulfillment of our contractual and legal obligations or other processing purposes, i.e., for the duration of the entire business relationship (from initiation and processing to termination of a contract) and beyond, in accordance with statutory retention and documentation obligations. It is possible that personal data may be retained for the period in which claims can be asserted against our company and insofar as we are otherwise legally obliged to do so or have a legitimate business interest (e.g., for evidence and documentation purposes). Once your personal data is no longer required for the above purposes, it will be deleted or anonymized, where possible. For operational data (e.g., system logs), shorter retention periods of twelve months or less generally apply.

7. Obligation to Provide Personal Data

In the context of our business relationship, you must provide the personal data necessary to initiate and conduct a business relationship and fulfill the associated contractual obligations (you generally do not have a legal obligation to provide us with data). Without this data, we will usually not be able to conclude a contract with you (or the entity or person you represent) or process it. Certain website functions also cannot be used without disclosing technical data (such as IP addresses).

8. Person Rights of the Data Subject

You have rights under applicable data protection law, including the GDPR, namely the right to access, rectify, delete, and restrict the processing of your personal data, the right to object to our data processing, particularly for direct marketing, and the right to data portability. Please note, however, that we reserve the right to assert the legally provided restrictions, for example, if we are obliged to retain or process certain data, have an overriding interest, or need the data to assert legal claims. If costs arise for you, we will inform you in advance. We have already informed you about the possibility of withdrawing your consent in section 3. Note that exercising these rights may conflict with contractual agreements and may have consequences such as premature contract termination or cost implications. In such cases, we will inform you in advance, unless already contractually regulated. Exercising these rights generally requires you to clearly prove your identity (e.g., by providing a copy of your ID, where your identity is not otherwise clear or verifiable). To exercise your rights, please contact us at the address provided in section 1. Every data subject also has the right to enforce their claims through the courts or to lodge a complaint with the relevant data protection authority. In Switzerland, the competent authority is the Federal Data Protection and Information Commissioner (https://www.edoeb.admin.ch).

9. Changes

This privacy policy may be changed at any time without prior notice. The current version published on our website applies. If the privacy policy forms part of an agreement with you, we will notify you of the change by email or other suitable means in the event of an update.