Privacy Policy for BRACK.CH AG

If any questions regarding interpretation arise with respect to the different language versions of this Privacy Policy, the German version is definitive.

A. Provisions applicable across all sales channels

1. Data controller and content of this Privacy Policy

We, BRACK.CH AG, are the operator of the www.brack.ch, www.business.brack.ch, www.daydeal.ch and www.schochvoegtli.ch websites (hereinafter referred to as "website") and, unless indicated otherwise, are responsible for the data processing listed in this Privacy Policy.

Please take note of the information below so that you know what personal data we collect from you and the purposes for which we use it. With regard to data protection, we are primarily guided by the legal requirements of Swiss data protection law, in particular the Federal Act on Data Protection (FADP).

The following information may be reviewed and amended from time to time. We therefore recommend that you consult this Privacy Policy regularly. Furthermore, other companies are responsible or jointly responsible with us under data protection law for certain data processing operations listed below. Accordingly, the information provided by these providers is also authoritative in such cases.

2. Contact person for data protection

If you have any questions about data protection or wish to exercise your rights, please contact our data protection contact by sending an email to the following address:
mail@brack.ch

3. Your rights

Provided that the relevant legal requirements are met, as a person affected by data processing you have the following rights:

Right of access: You have the right to request access to your personal data stored and processed by us at any time and free of charge. This gives you the opportunity to check what personal data we process about you and that we use it in accordance with applicable data protection regulations.

Right to rectification: You have the right to have inaccurate or incomplete personal data rectified and to be informed of the rectification. In this case, we will inform the recipients of the data concerned of the adjustments made, unless this is impossible or involves disproportionate effort.

Right to deletion: You have the right to have your personal data deleted under certain circumstances. In individual cases, especially in the case of legal retention obligations, the right to deletion may be excluded. In this case, we may block your data instead, provided the conditions are met.

Right to restrict processing: You have the right to request that the processing of your personal data be restricted.

Right to data transfer: You have the right to obtain from us, free of charge, the personal data you have provided to us in a readable format.

Right to object: You can object to the processing of your data at any time, in particular for data processing in connection with direct advertising (e.g. advertising emails).

Right of withdrawal: In principle, where you have given consent you have the right to withdraw that consent at any time. However, processing activities that have already taken place based on your consent do not become unlawful because of your revocation of consent.

To exercise these rights, please send us an email to the following address:
mail@brack.ch

Right of complaint: You have the right to lodge a complaint with a competent supervisory authority, for example against the way your personal data is processed.

4. Data security

We use appropriate technical and organisational security measures to protect your personal data stored with us against loss and unlawful processing, namely unauthorised access by third parties. Our employees and the service companies commissioned by us are obliged by us to maintain confidentiality and data protection. Furthermore, these persons are only granted access to the personal data to the extent necessary for the fulfilment of their tasks.

Our security measures are continuously adapted in line with technological developments. However, the transmission of information via the internet and electronic means of communication always involves certain security risks and we cannot provide an absolute guarantee for the security of information transmitted in this way.

5. Contact us

If you contact us via our contact addresses and channels (e.g. by email, telephone or contact form), your personal data will be processed. The data that you have provided to us, e.g. the name of your company, your name, your role, your email address or telephone number and your request, will be processed. In addition, the time of receipt of the request will be documented. Mandatory data is marked with an asterisk (*) in the relevant contact form.

We process this data exclusively in order to implement your request (e.g. providing information about a product, support in the processing of contracts such as the return of products, incorporating your feedback into the improvement of our service).

6. Use of your data for marketing purposes

6.1 Central data storage and analysis in the CRM system (customer relationship management system)

If it is possible to clearly identify you, we will store and link the data described in this Privacy Policy, in particular your personal details, your contact details, your contract details and your surfing behaviour on our websites, in a central database. This serves the efficient administration of customer data, allows us to adequately respond to your requests and enables the efficient provision of the services you have requested and the processing of the associated contracts.

We evaluate this data in order to further develop our offers in a needs-oriented manner and to display and suggest the most relevant information and offers to you. We also use methods that predict possible interests and potential future orders based on your website use.

6.2 Email marketing and newsletters

If you register for our email newsletter (e.g. when opening or within your customer account), your email address will be stored. Mandatory data is marked with an asterisk (*) in the registration form.

In order to avoid misuse and to ensure that the owner of an email address has actually given their consent, we use a double opt-in procedure for registration in the case of customers who cannot be clearly identified. In this case, once you have submitted the registration, you will receive an email from us containing a confirmation link. In order to definitely register for the newsletter, you must click on this link. If you do not click on the confirmation link within the specified period, your data will be deleted again and our newsletter will not be sent to this address.

When you register, you consent to the processing of this data to receive information from us about our company, our offers from various sectors such as IT & multimedia, home & living, supermarket & chemist, family & baby, DIY & hobbies, sport & leisure, as well as related products and services. This may also include behaviour-based or personalised content as well as invitations to participate in competitions or to rate one of the aforementioned products or services. Collection of the email address enables us to verify whether the registration can be assigned to an existing customer number. The link to a customer account helps us to make the offers and content contained in the newsletter more relevant to you and better tailored to your potential needs.

We will use your data to email you until you revoke your consent. Revocation is possible at any time, in particular via the unsubscribe link in all our marketing emails.

Our marketing emails may contain a so-called web beacon or 1x1 pixel (tracking pixel) or similar technical tools. A web beacon is an invisible graphic that is linked to the user ID of the respective newsletter subscriber. For each marketing email sent, we receive information on which addresses have not yet received the email, to which addresses it was sent and for which addresses the sending failed. We also see which addresses have opened the email and which links they have clicked on. Finally, we receive information about which addresses have unsubscribed. We use this data for statistical purposes and to optimise our marketing emails in terms of frequency, timing, structure and content. This allows us to better tailor the information and offers in our emails to the individual interests of recipients.

The web beacon is deleted when you delete the email. To prevent the use of the web beacon in our marketing emails, please set the parameters of your email program so that HTML is not displayed in messages if this is not already the case by default. The help sections of your email software will provide you with information on how you can configure this setting.

By subscribing to the newsletter, you also consent to the statistical evaluation of user behaviour for the purpose of optimising and adapting the newsletter.

We use the Emarsys email marketing software from emarsys Schweiz GmbH, The Circle 66, 8058 Zurich, Switzerland, for marketing and transaction emails. Your data will be stored in a database of emarsys Schweiz GmbH, which allows emarsys Schweiz GmbH to access your data if this is necessary for the provision of the software and for support in the use of the software.

7. Disclosure to and access by third parties

Without the support of other companies, we would not be able to provide our services in the desired form. In order for us to be able to use the services of these companies, it is also necessary to pass on your personal data to a certain extent. Such a transfer takes place to the extent that it is necessary for the fulfilment of the contract requested by you, for example to the logistics or transport companies that deliver the requested products, or to a manufacturer who is to fulfil your warranty claim.

Furthermore, data is passed on to selected service providers, but only to the extent necessary for the provision of their services. Various third-party service providers are explicitly mentioned in this Privacy Policy, e.g. in the sections on marketing. These are, for example, IT service providers (such as providers of software solutions), advertising agencies and consultancies.

In addition, your data may be disclosed to authorities, legal advisors or debt collection agencies if we are legally obliged to do so or if this is necessary to protect our rights, in particular to enforce claims arising from our relationship with you. Data may also be disclosed if another company intends to acquire our company or parts thereof and such disclosure is necessary to carry out due diligence or to complete the transaction.

8. Transfer of personal data abroad

We are entitled to transfer your personal data to third parties abroad if this is necessary to carry out the data processing mentioned in this Privacy Policy (see in particular Sections 12-15). In doing so, we will of course comply with the statutory provisions on the disclosure of personal data to third parties. If the country in question does not have an adequate level of data protection, we guarantee through contractual regulations that your data is adequately protected by the recipients.

9. Retention periods

We only store personal data for as long as is necessary to carry out the processing explained in this Privacy Policy within the scope of our legitimate interest. In the case of contractual data, storage is required by statutory retention obligations. Requirements that oblige us to retain data result from the provisions on accounting and from tax law regulations. According to these regulations, business communications, concluded contracts and accounting vouchers must be stored for up to 10 years. If we no longer require this data to perform services for you, the data will be blocked. This means that the data may then only be used if this is necessary to fulfil the retention obligations or to defend and enforce our legal interests. The data is deleted as soon as there is no longer any obligation to retain it and we no longer have any legitimate interest in retaining it.

B. Special provisions applicable to use of our website

10. Log file data

Our servers temporarily save the access details of each visit to our website in a log file. The following data is collected without your intervention and stored by us until automatically deleted:

• The IP address of the requesting computer
• The date and time of access
• The name and URL of the requested file
• The status code (e.g. error message)
• The website from which our site was accessed, plus, where applicable, the search term used
• The operating system of your computer or mobile phone and the browser you use (incl. type, version and language setting)
• The transmission protocol used (e.g. HTTP/1.1)
• The device type in case of access by mobile phones
• The screen resolution of the device used,
• The city or region from where the access was made

The collection and processing of this data is carried out for the purpose of enabling the use of our website (connection establishment), to permanently guarantee system security and stability as well as for error and performance analysis and enables us to optimise our website (for information on these last points, also see Section 13).

In the event of an attack on the network infrastructure of the website or a suspicion of other unauthorised or abusive website use, the IP address and the other data will be evaluated for the purpose of clarification and defence and, if necessary, used in the context of criminal proceedings to identify and take civil and criminal action against the users concerned.

When you visit our website, we use cookies as well as applications and tools that are based on the use of cookies. In this context, the data described here may also be processed. You will find more details on this in the subsequent sections of this Privacy Policy, in particular Section 11.

11. Cookies

Cookies are information files that your web browser stores on your computer's hard drive or memory when you visit our website. Cookies are assigned identification numbers that identify your browser and allow the information contained in the cookie to be read.

Among other things, cookies help to make your visit to our website easier, more pleasant and more meaningful. We use cookies for various purposes that are necessary, i.e. "technically required", for your desired use of the website. For example, we use cookies to be able to identify you as a registered user after logging in, without you having to log in again each time when navigating the various sub-pages. The provision of the shopping basket and order function is also based on the use of cookies. Furthermore, cookies also perform other technical functions required for the operation of the website, such as so-called load balancing, i.e. the distribution of the performance load of the page to different web servers in order to relieve the servers. Cookies are also used for security purposes, for example to prevent the unauthorised posting of content. Finally, we also use cookies as part of the design and programming of our website, e.g. to enable the uploading of scripts or codes.

Most internet browsers automatically accept cookies. You can configure your browser to prevent any cookies from being saved on your computer or so that a message always appears whenever you receive a new cookie. On the following pages, you will find explanations of how you can configure the processing of cookies in selected browsers.

• Microsoft Windows Internet Explorer
• Microsoft Windows Internet Explorer Mobile
• Mozilla Firefox
• Google Chrome for desktop
• Google Chrome for mobile devices
• Apple Safari for desktop
• Apple Safari for mobile devices

Deactivating cookies may mean that you are not able to use all the functions of our website.

12. Google SiteSearch / Google Custom Search Engine

Our website uses the Google SiteSearch / Google Custom Search Engine of Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA). This enables us to provide you with an efficient search function on our website.

When using our search fields, your browser may transmit the log file data listed in Section 10 (including your IP address) as well as the search term you entered to Google, if you have installed JavaScript in your browser. If you would like to prevent the transmission of data, you can deactivate JavaScript in your browser settings (usually in the "Privacy" menu). Please note that the search function and other functions of the website may be impaired in this case.

For further processing of data by Google, please refer to Google's privacy policy on its home page.

13. Tracking and web analysis tools

13.1 General information on tracking

For needs-based design and continuous optimisation of our website, we use the web analysis services listed below. In this context, pseudonymised usage profiles are created and cookies are used (please also refer to Section 11). The information generated by the cookie about your use of our website is usually transferred together with the log file data listed in Section 10 to a server of the service provider, where it is stored and processed. This may also result in a transfer to servers abroad, e.g. the USA (for information on this point, in particular on the guarantees taken, see Section 8).

In processing this data, we obtain information including the following:

• Navigation path followed by a visitor on the site (including content viewed and products selected or purchased)
• Amount of time spent on the website or subpage
• Subpage from which the visitor exits the website
• The country, region or town/city from where the website is accessed
• End device (type, version, colour depth, resolution, width and height of browser window)
• Whether the user is a repeat or new visitor

The provider will use this information on our behalf to evaluate the use of the website, to compile reports on website activities for us and to provide other services related to website and internet use for the purposes of market research and needs-based design of these internet pages. For these processing operations, we and the providers may to a certain extent be considered joint data controllers.

You can disable (opt out of) all tracking links at once by following this link. Please note that a cookie will be placed on your computer for this purpose. Opting out will not affect use of the online shop. You can reject or deactivate the relevant cookies in the settings of your web browser (see Section 11) or make use of the service-specific options described below.

For the further processing of your data by the respective provider as the (sole) data protection controller, in particular also any forwarding of this information to third parties such as authorities on the basis of national legal regulations, please refer to the respective data protection information of the provider.

13.2 Google Analytics

We use the web analytics service Google Analytics from Google Ireland Limited (Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland) or Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA) ("Google").

The data described about the use of the website may be transmitted to the servers of Google LLC in the USA for the processing purposes explained (see Section 13.1). The IP address is shortened before transmission within the member states of the European Union or in other contracting states to the Agreement on the European Economic Area.

Users can prevent the collection of the data generated by the cookie and related to their website use and its transmission to and processing by Google by downloading and installing a browser plugin under the following link:
https://tools.google.com/dlpage/gaoptout?hl=en. You will find further information on data protection at Google on its home page.

13.3 Hurra

We use Hurra from Hurra Communications GmbH, Wollgrasweg 27, 70599 Stuttgart, Germany, to manage Google Ads. Data regarding the user behaviour of customers on our website is collected and stored for optimisation and marketing purposes. This data is used to create pseudonymous usage profiles. For this purpose, cookies are used which enable an internet browser to recognise a user when they visit a website again. The usage profiles compiled by hurra.com technology are however not associated with personal data pertaining to the holder of the pseudonym without the customer's express consent. The IP addresses of customers are shortened before being stored so that personal identification is not possible and usage profiles can no longer be associated with IP addresses.

You can object to the data being collected and stored by hurra.com for the website at any time by means of an opt-out here. From a technical perspective, the opt-out is tied to the specific device and browser that you are using to disable the tracking. To disable tracking for other browsers and devices, you must carry out the opt-out process in/on the relevant browser and devices as well.

An opt-out cookie called "__coo" is used to disable tracking. In order for tracking and – in turn – storage of your data – to continue being blocked effectively, you must not delete this cookie.

13.4 Facebook pixel tracking / Facebook advanced matching

We use Facebook pixel tracking and Facebook advanced matching. If you are already logged into Facebook when you visit our online shop, data will be sent to Facebook allowing targeted advertising to be shown. You can disable the related authorisation in your Facebook profile.

13.5 Adobe Analytics

Our website uses technology from Adobe Experience Cloud to gather information on how users interact with the website and its content. On the basis of our legitimate interest, the cookies required are placed on the computer when anyone visits the website for the first time so that we can better understand the user behaviour of our site visitors and can further develop the site.

The Adobe Experience Cloud technologies we currently use are Adobe Analytics (reporting and analysis of user behaviour) and Adobe Target (A/B testing of different variants of the website to improve the user experience). These services collect data on user behaviour and process and store it in Adobe data centres in Europe. If you wish to object to all data collection by Adobe, please click here.

13.6 Getback

We use conversion optimisation technology to improve targeted communication with our customers. Using this technology, we record website usage and – when our customers visit our website – we can, for example, remind them about any orders they may have forgotten to place, make them aware of special offers or enable our customers to subscribe to notifications and communications, such as newsletters in particular, make use of support, participate in competitions and have their shopping basket sent to them. To do this, we use email, instant messaging and other communication channels. We require these types of conversion optimisation technology to manage our website in an effective and user-friendly manner on a permanent basis.

You can object to the use of conversion optimisation technology on our website here and we will record your objection with a corresponding cookie in the browser you are currently using.

To use this technology, we integrate Getback from adfocus GmbH, Blegistrasse 9, 6340 Baar, Switzerland, into our website. As our service partner, adfocus can obtain access to the following data:

• Email address
• Contact address
• Orders
• Operating system
• Browser
• IP address

adfocus processes data pertaining to our customers exclusively on our behalf. adfocus may only process data pertaining to our customers in the same way as we are permitted to process it. adfocus stores data within the context of Getback in Switzerland and Germany only. Swiss and German data protection law ensures appropriate data protection for our customers. You will find further information in the adfocus privacy policy.

14. Social media

14.1 Social media profiles

On our website, we have included links to our profiles in the social networks of the following providers:

• Meta Platforms Inc., 1601 S California Ave, Palo Alto, CA 94304, USA
• Instagram Inc., 1601 Willow Road, Menlo Park, CA 94025, USA
• X, 1355 Market Street, Suite 900, San Francisco, CA 94103, USA
• LinkedIn Unlimited Company, Wilton Place, Dublin 2, Ireland
• TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland

When you click on the icon of a social network on our website, you are automatically redirected to our profile in the respective network. This establishes a direct connection between your browser and the server of the respective social network. This provides the network with the information that you have visited our website with your IP address and clicked on the link.

If you click on a link to a network while you are logged into your user account with the network in question, the content of our website may be linked to your profile so that the network can assign your visit to our website directly to your account. If you want to prevent this, you should log out before clicking on the relevant links. A connection between your access to our website and your user account takes place in any case if you log into the respective network after clicking on the link. The respective provider is responsible under data protection law for the associated data processing. Please note the information on the relevant network's website.

14.2 Social media plugins

On our website, you can use social plugins from the providers listed below:

• Meta Platforms Inc., 1601 S California Ave, Palo Alto, CA 94304, USA
• X, 1355 Market Street, Suite 900, San Francisco, CA 94103, USA
• LinkedIn Unlimited Company, Wilton Place, Dublin 2, Ireland
• Tumblr Inc., 60 29th Street #343, San Francisco, CA 94110, USA
• Reddit Inc., 1455 Market Street, Suite 1600, San Francisco, CA 94103, USA
• Pinterest Inc., San Francisco, CA 94103, USA

You will find the privacy policies of the providers listed above on their home pages.

We use the social plugins to make it easier for you to share content from our website. The social plugins help us to increase the visibility of our content on social networks and thus contribute to better promotion of our offerings.

The plugins are deactivated by default on our websites and therefore do not send any data to the social networks when you simply call up our website. To increase data protection, we have integrated the plugins in such a way that a connection is not automatically established with the network's servers. Only when you activate the plugins and thus give your consent to the transmission and further processing of data by the providers of the social networks, does your browser establish a direct connection to the servers of the respective social network.

The content of the plugin is transmitted directly to your browser by the social network and integrated into the website by it. This provides the respective provider with the information that your browser has accessed the corresponding page of our website, even if you do not have an account with this social network or are not currently logged into it. This information (including your IP address) is transmitted from your browser directly to a server of the provider (usually in the USA) and stored there. We have no influence on the scope of the data that the provider collects with the plugin, although from a data protection perspective we can to a certain extent be considered jointly responsible with the relevant social network provider.

If you are logged into the social network, it can assign your visit to our website directly to your user account. If you interact with the plugins, the corresponding information is also transmitted directly to a server of the provider and stored there. The information (e.g. that you like a product of ours) may also be published on the social network and possibly displayed to other users of the social network. The provider of the social network may use this information for the purpose of placing advertisements and designing a respective offering according to your interests. For this purpose, usage, interest and relationship profiles could be created, e.g. to evaluate your use of our website with regard to the advertisements displayed to you on the social network, to inform other users about your activities on our website and to provide other services associated with the use of the social network. The purpose and scope of the data collection and the further processing and use of the data by the providers of the social networks, as well as your rights in this regard and options for changing your settings to protect your privacy can be found directly in the data protection information of the respective provider.

If you do not want the provider of the social network to assign the data collected via our website to your user account, you must log out of the social network before activating the plugins. You can revoke your consent at any time by declaring your revocation to the provider of the plugin in accordance with the information in their data protection notice.

15. Online advertising and targeting

15.1 In general

We use services of various companies to provide you with interesting offers online. In the process of doing this, your user behaviour on our website and websites of other providers is analysed in order to subsequently be able to show you online advertising that is individually tailored to you.

Most technologies for tracking your user behaviour and targeting advertisements work with cookies (see also Section 11), which can be used to recognise your browser across different websites. Depending on the service provider, it may also be possible for you to be recognised online even when using different end devices (e.g. laptop and smartphone). This may be the case, for example, if you have registered for a service that you use with several devices.

In addition to the data already mentioned, which is collected when websites are called up ("log file data", see Section 10) and the use of cookies (Section 11) and which may be passed on to the companies involved in the advertising networks, the following data in particular is used to select the advertising that is potentially most relevant to you:

• Information about you that you provided when registering or using a service from advertising partners (e.g. your gender, age group)
• User behaviour (e.g. search queries, interactions with advertising, types of websites visited, products viewed and purchased, newsletters subscribed to)

We and our service providers use this data to identify whether you belong to the target group we address and take this into account when selecting the advertisements. For example, after you have visited our site, you may be shown advertisements of the products you have consulted when you visit other sites ("re-targeting"). Depending on the scope of the data, a user's profile may also be created, which is evaluated automatically, and the ads are selected according to the information stored in the profile, such as membership of certain demographic segments or potential interests or behaviours. Such ads may be presented to you on various channels, which include, in addition to our website or app (as part of on-site and in-app marketing), ads provided through the online advertising networks we use, such as Google.

The data may then be analysed for the purpose of billing the service provider and assessing the effectiveness of advertising measures in order to better understand the needs of our users and customers and to improve future campaigns. This may also include information that the taking of an action (e.g. visiting certain sections of our website or sending information) is due to a particular advertising ad. We also receive aggregated reports from service providers of ad activity and information about how users interact with our website and ads.

You can revoke your consent at any time by rejecting or deactivating the relevant cookies in the settings of your web browser (see Section 11). You can also find further options for blocking advertising in the information provided by the respective service provider.

15.2 Google Ads

Our website uses the services of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA ("Google"), for online advertising. Google uses cookies for this purpose, such as the so-called DoubleClick cookie, which enable your browser to be recognised when visiting other websites. The information generated by the cookies about your visit to these websites (including your IP address) will be transmitted to and stored by Google on servers in the United States (please refer to Section 8). You will find further information on data protection at Google on its home page.

You can revoke your consent at any time by rejecting or deactivating the relevant cookies in the settings of your web browser (see Section 11). You can find further options for blocking advertising on Google's support homepage.

We use Google Customer Match. This is a function that is provided as part of Google Ads and can be used to reach potential and existing customers more effectively and in a personalised manner in Google Search, on the Google Shopping tab, in Gmail, on YouTube and in the Google Ads networks. Google Customer Match is particularly used for remarketing, for optimising campaigns and for increasing the conversion rate.

Personalisation of Google Ads is based on allocation to a target group. Google carries it out using information from your Google account and on the basis of the activities and interests that emerge from your use of Google products and your interaction with Google Ads partners. In our capacity as a Google Ads partner, using the Google Customer Match function allows us to target our audience more exactly and ensures, for example, that the advertising distributed via Google Ads is more precisely tailored to the interests of specific target groups as revealed by their use of our shop. Google Customer Match does not require any separate cookies for this. Google needs a list of customer data from us in order to identify whether you are already known to Google as a user. However, no profiles are created or extended during this process. Nor does Google receive your actual data (such as your email address or telephone number); rather, it only receives what are known as hashed codes, which have been created using one-way encryption. Google compares these hashed codes against its own user database. Google is not able to decrypt these codes unless the relevant data is already present within its own user database anyway. Thus, Google does not receive the customer data that has been uploaded but can only determine whether or not the data is already held by Google. If the data is not held by Google, it will not be able to decrypt the hashed codes that have been created on the basis of the customer data. In the opposite scenario, the hashed codes will match what Google already knows and it will be able to correlate the data for the purpose of creating target groups. Once the target groups have been created, the uploaded data will be deleted.

16. Use of our chat function

If you contact us via chat, your personal data will be processed. The data that you have provided to us, e.g. the name of your company, your name, your role, your email address and your request, will be processed. In addition, the time of receipt of the request will be documented. Mandatory data is marked with an asterisk (*).

We process this data exclusively in order to implement your request (e.g. providing information about a product, support in the processing of contracts such as the return of products, incorporating your feedback into the improvement of our service). To provide the chat function, we use a tool from GUURU Solutions GmbH, Rothusstrasse 21, 6331 Hünenberg, Switzerland. Your data will be stored in a database of GUURU Solutions GmbH, which may allow it to access your data if necessary for the provision of the software and for the support in the use of the software.

17. Registration for a customer account

If you open a customer account on our website, we collect the following data, whereby mandatory data is marked with an asterisk (*) in the corresponding form:

• Personal data:
  • Title
  • Last name
  • First name
  • Invoice and delivery address
  • Date of birth
  • Company name and address
  • Telephone number (optional)
• Login data:
  • Email address
  • Password
• Further information:
  • Languages
  • Gender

We use the personal details to establish your identity and to check the requirements for registration. The email address and password are used as login details to ensure that the correct person is using the website under your account. We also need your email address to verify and confirm the opening of your account and for future communication with you as required to process the contract. In addition, this data is stored in the customer account for conclusion of future contracts. For this purpose, we also enable you to store further details in the account (e.g. your preferred means of payment).

We also use the data to provide an overview of the products ordered and services received (see Sections 18 and Fehler! Verweisquelle konnte nicht gefunden werden.) and as a simple way to manage your personal data, to administer our website and our contractual relationships, i.e. to establish, define the content of, process and amend the contracts concluded with you via your customer account.

We process the information on language and gender in order to display offer suggestions on the website that are best tailored to your profile or your personal needs, for statistical recording and evaluation of the selected offers and thus to optimise our suggestions and offers.

To avoid misuse, you must always keep your login details confidential and should close the browser window when you have finished communicating with us, especially if you share the computer with others.

By using two-factor authentication and the partner app from Nevis, no personal data will be shared with third-party companies or organisations. You can activate or deactivate the function in your customer account at any time.

18. Ordering products

If you wish to order products or to book services on the website, we require various data for the processing of the contract. If you do not log in with your customer account (see Section 17), we collect the following data – depending on the product or service – whereby mandatory data is marked with an asterisk (*) in the corresponding form:

• Title
• Last name
• First name
• Invoice and delivery address
• Email address
• Date of birth
• Company name and address

We use the data to establish your identity before concluding a contract. We also need your email address to confirm your order and for future communication with you that is necessary to process the contract. We store your data together with the marginal data of the order (e.g. time, order number), the data regarding the ordered/booked services (e.g. designation, price and features of the product; "product data"), the data on payment (e.g. selected payment method, confirmation of payment and time; see also Section 19) as well as the data on the processing and fulfilment of the contract (e.g. return of products, use of service or warranty services) in our CRM database (see also Section 6.1) so that we can ensure correct order processing and contract fulfilment.

Insofar as this is necessary for the fulfilment of the contract, we will also pass on the required information to any third-party service providers (e.g. transport companies).

The provision of data that is not marked as mandatory is voluntary. We process this data in order to tailor our offering to your personal needs in the best possible way, to facilitate the processing of contracts, to contact you via an alternative communication channel if necessary with a view to fulfilling the contract, or for statistical collection and evaluation to optimise our offerings.

19. Payment processing online

If you purchase services or products against payment via our website, depending on the product or service and the desired method of payment – in addition to the information mentioned in Section 18 – you may be required to provide data, such as your credit card information or the login to your payment service provider. This information, as well as the fact that you have purchased a service from us for the amount and at the time in question, is forwarded to the respective payment service providers (e.g. payment solution providers, credit card issuers and credit card acquirers). In doing so, please always also note the information provided by the respective company, in particular the privacy policy and the general terms and conditions.

In cases where we make delivery prior to payment, e.g. in the case of purchase on account, we may – where applicable – obtain a credit report from a credit agency based on mathematical statistical methods in order to protect our legitimate interests. This also happens in the case of age-restricted items. For this purpose, we send the necessary personal data to the credit agency CRIF AG, Hagenholzstrasse 81, 8050 Zurich, Switzerland, and use the information obtained about the statistical probability of a default on payment to reach a balanced decision on whether to establish, effect or terminate the contractual relationship. The credit report may contain probability values (scores) that have been calculated on the basis of scientifically recognised mathematical statistical methods and with the aid of various items of information, including address data. Your interests meriting protection will be taken into account in accordance with the legal provisions.

20. Submitting ratings or comments

In order to help other users with their purchase decision and to support our quality management (in particular the processing of negative feedback), you have the opportunity to rate ordered products on our website. The data that is processed and published on the website is the data that you have made available to us, i.e. in addition to your rating and its time of submission, possibly also any comment that you have added to your rating or the name that you have given as a nickname. The nickname may be a freely chosen invented name so that it is not possible to identify you as a person or your real name. If necessary, the nickname can be amended in the customer account.

When you publish comments and posts on our website, you confirm that – as the author – you agree to your comment, nickname and any photos and videos you upload

• being visible on the website and
• that we may use these freely and free of charge for advertising purposes.

We reserve the right to delete unlawful ratings and to contact you in case of suspicion and ask you to comment.

C. Special provisions applicable to our collection centres

21. Video surveillance

To prevent abuse and to take action against illegal behaviour (especially theft and damage to property), the entrance area and the publicly accessible areas of our collection centres are monitored by cameras. The image data is only viewed if there is a suspicion of unlawful behaviour. Otherwise, the images are deleted automatically after 30 days (in Willisau) or 60 days (in Mägenwil).

Should the suspicion of illegal behaviour be substantiated, the data may then be passed on to our advisors (in particular our legal advisors) and authorities to the extent necessary to enforce claims or file charges.