4. For what purposes do we process your data?

We process your data for the purposes we explain below. Further information for the online area can be found in para. 12 and 13. These purposes or the underlying objectives repre-sent legitimate interests of us and, if applicable, of third parties. You will find further infor-mation on the legal basis for our processing in section 5.

We process your data for purposes related to communication with you, in particular to respond to enquiries and to assert your rights (para. 11) and to contact you in the event of queries. For this purpose, we use in particular communication data and master data and, in connection with offers and services used by you, also registration data. We keep this data to document our communication with you, for training purposes, for quality assurance and for enquiries.

We process data for the purpose of entering into, managing and processing contractual relationships. We conclude contracts of various kinds with our business and private customers, with suppliers or other contractual partners such as partners in projects or with parties in legal disputes. In this context, we process in particular master data, contract data and communication data and, depending on the circumstances, also registration data of the customer or the persons to whom the customer provides a service. This includes, for example, the recipients of our products or services who receive vouchers and invitations from our customers for this purpose and who may in turn become our customers when they redeem them. In this case, we process data for the processing of the contract with these recipients, but also with the contractual partners who have invited them.

In the context of initiating business, personal data - in particular master data, contract data and communication data - are collected from potential customers or other contractual partners (e.g. in an order form or contract) or result from a communication. We also process data in connection with the conclusion of a contract to check creditworthiness and to open the customer relationship. In some cases, this information is checked for compliance with legal requirements

As part of the processing of contractual relationships, we process data for the administration of the customer relationship, for the provision and collection of contractual services (which also includes the involvement of third parties, such as logistics companies, advertising ser-vice providers, banks, insurance companies or credit reference agencies, which may then in turn provide us with data), for advice and for customer care. The enforcement of legal claims arising from contracts (debt collection, legal proceedings, etc.) is also part of the processing, as is accounting, termination of contracts and public communication.

We process data for marketing purposes and to maintain relationships, e.g. to send our customers and other contractual partners personalized advertising on products and services from us and from third parties (e.g. from advertising contractual partners). This may take the form of e.g. newsletters and other regular contacts (electronically, by post, by telephone), via other channels for which we have contact information from you, but also as part of individual marketing campaigns (e.g. events, competitions etc.) and may also include free benefits (e.g. invitations, vouchers etc.). You can refuse such contacts at any time (see at the end of this section). 4) or refuse or revoke your consent to be contacted for advertising purposes. With your consent, we can target our online advertising on the internet more specifically to you (see section 12).

We continue to process your data to improve our services and operations and for product development including our website. We strive to continuously improve our products and services and to be able to react quickly to changing needs. We therefore analyze, for example, how you navigate through our website or which products are used by which groups of people in which way and how new products and services can be designed (for further details, see section 12). This gives us information about the market acceptance of existing products and services and the market potential of new products and services. To this end, we process in particular master data, behavioral data and preference data, but also communication data and information from customer surveys, polls and studies and other information, e.g. from the media, from social media, from the Internet and from other public sources. Where possible, we use pseudonymized or anonymized information for these purposes. We may also use media monitoring services or conduct media monitoring ourselves and process personal data in the process in order to conduct media work or to understand and respond to current developments and trends.

We may also process your data for security and access control purposes. We are constantly reviewing and improving the appropriate security of our shop and IT. Like all companies, we cannot rule out data security breaches with absolute certainty, but we do our best to reduce the risks. We therefore process data, for example, for monitoring, controls, analyses and tests of our networks and IT infrastructures, for system and error checks, for documentation purposes and in the context of security copies. Access controls include, on the one hand, controlling access to electronic systems (e.g. logging into user accounts), and on the other hand, physical access control (e.g. access to shop premises). We also use surveillance systems (e.g. security cameras) for security purposes (preventive and to clarify incidents).

We process personal data to comply with laws, directives and recommendations from authorities and internal regulations ("compliance"). This includes, for example, the implementation of health and safety concepts or the legally regulated fight against money laundering and terrorist financing. In certain cases, we may be obliged to make certain inquiries about customers ("Know Your Customer") or to make reports to the authorities. The fulfilment of duties to provide information, disclosure or notification, for example in connection with duties under supervisory and tax law, also requires or entails data processing, e.g. the fulfilment of archiving duties and the prevention, detection and clarification of criminal offences and other violations. This also includes the receipt and processing of complaints and other reports, the monitoring of communications, internal investigations or the disclosure of documents to an authority if we have sufficient reason to do so or are legally obliged to do so. We may also process personal data about you in the course of external investigations, for example, by a law enforcement or regulatory authority or an appointed private body. Furthermore, we process data in order to serve our shareholders and other investors and to fulfil our obligations in this regard. For all these purposes, we process in particular your master data, your contractual data and communications data, but may also process behavioral data and data from the category of other data. The legal obligations may be Swiss law, but also foreign regulations to which we are subject, as well as self-regulations, industry standards, our own "corporate governance" and official instructions and requests.

We also process data for the purposes of our risk management and as part of prudent corporate governance, including operational organization and corporate development.

We may process your data for other purposes, such as our internal operations and administration or for training and quality assurance purposes. These other purposes include, for example, training and educational purposes, administrative purposes (such as the administration of master data, accounting and data archiving and the testing, administration and ongoing improvement of IT infrastructure), the protection of our rights (e.g. to enforce claims in court, in or out of court and before authorities in Switzerland and abroad or to defend ourselves against claims, for example by preserving evidence, legal clarifications and participation in legal or official proceedings) and the evaluation and improvement of internal processes. The protection of other legitimate interests is also one of the other purposes that cannot be named exhaustively.

5. On what basis do we process your data?

Insofar as we ask for your consent for certain processing (e.g. for the processing of particularly sensitive personal data, for marketing mailings, for the creation of personalized movement profiles and for advertising control and behavioral analysis on the website), we will inform you separately about the corresponding purposes of the processing. You can revoke your consent at any time with future effect by written notification (by post) or, where not otherwise stated or agreed, by e-mail to us; you will find our contact details in para. 2. For the revocation of your consent in the case of online tracking, see para. 12. Where you have a user account, revocation or contacting us may also be possible via the relevant website or other service. Once we have received notification that you have withdrawn your consent, we will no longer process your data for the purposes to which you originally consented unless we have another legal basis for doing so. The revocation of your consent does not affect the lawfulness of the processing carried out on the basis of the consent until the revocation.

Where we do not ask for your consent to process your personal data, we base the processing of your personal data on the fact that the processing is necessary for the initiation or performance of a contract with you (or the entity you represent) or that we or third parties have a legitimate interest in doing so, in particular in order to fulfill the obligations set out in section 4 above and related objectives and to be able to take appropriate action. Our legitimate interests also include compliance with legal regulations, insofar as this is not already recognized as a legal basis by the respective applicable data protection law (e.g. in the case of the GDPR, the law in the EEA and in Switzerland). However, this also includes the marketing of our products and services, the interest in better understanding our markets and in managing and further developing our company, including operations, safely and efficiently.

If we receive sensitive data (e.g. health data, information on political, religious or ideological views or biometric data for identification purposes), we may also process your data on the basis of other legal grounds, e.g. in the event of disputes due to the necessity of the processing for a possible lawsuit or the enforcement or defence of legal claims. In individual cases, other legal grounds may come into play, which we will communicate to you separately where necessary.

6. What applies to profiling and automated individual decisions?

We may add certain of your personal attributes to those listed in para. 4 using your data for the purposes set out in section 3 ("profiling"), if we want to determine preference data, but also to determine abuse and security risks, to carry out statistical evaluations or for operational planning purposes. For the same purposes, we can also create profiles, i.e. we can combine behavioral and preference data, but also master and contract data and technical data assigned to you, in order to better understand you as a person with your different interests and other characteristics. We may also create anonymous and - with your consent - personalized movement profiles of you. Who do we disclose your data to?

In connection with our contracts, the website, our services and products, our legal obligations or otherwise in order to protect our legitimate interests and the other interests set out in section 4 we also transfer your personal data to third parties, in particular to the following categories of recipients:  

• Service providers: We work with service providers in Germany and abroad who process data about you on our behalf or in joint responsibility with us or who receive data about you from us in their own responsibility (e.g. IT providers, shipping companies, advertising service providers, login service providers, cleaning companies, security companies, banks, insurance companies, debt collection companies, credit agencies or address checkers).

• In order to provide our products and services efficiently and to be able to concentrate on our core competences, we procure services from third parties in numerous areas. These services concern, for example, IT services, the dispatch of information, marketing, sales, communication or printing services, facility management, security and cleaning, the organization and holding of events and receptions, debt collection, credit agencies, address checkers (e.g. for updating address lists in the event of relocations), anti-fraud measures and services from consulting firms, lawyers, banks, insurers and telecom companies. We disclose to these service providers in each case the data required for their services, which may also concern you. These service providers may also use such data for their own purposes, e.g. information on outstanding debts and your payment history in the case of credit agencies or anonymized data to improve services. In addition, we enter into contracts with these service providers that include provisions for the protection of data where such protection does not arise from the law. Our service providers may also process data on how their services are used and other data that arise in the course of using their services as independent data controllers for their own legitimate interests (e.g. for statistical evaluations or billing). Service providers inform about their independent data processing in their own data protection statements.

• Contractual partners including clients: First of all, this refers to our customers (e.g. service recipients) and other contractual partners, because this data transfer results from these contracts. For example, they receive registration data on issued and redeemed vouchers, invitations, etc. If you work for such a contractual partner yourself, we may also transfer data about you to them in this context. The recipients also include contractual partners with whom we cooperate or who advertise on our behalf and to whom we therefore transmit data about you for analysis and marketing purposes (these may again be service recipients, but also e.g. sponsors and providers of online advertising). We require these partners to send you advertising or to play it out based on your data only if you have consented to this (for the online area, see para. 12).

• Authorities: We may pass on personal data to offices, courts and other authorities in Switzerland and abroad if we are legally obliged or entitled to do so or if this appears necessary to protect our interests. The authorities process data about you that they receive from us on their own responsibility. Cases of application are, for example, criminal investigations, police measures (e.g. health protection concepts, combating violence, etc.), regulatory requirements and investigations, legal proceedings, reporting obligations and pre- and extra-judicial proceedings as well as legal obligations to provide information and to cooperate. Data may also be disclosed if we wish to obtain information from public bodies, e.g. to justify an interest in information or because we need to say about whom we require information (e.g. from a register).

• Other persons: This refers to other cases where the inclusion of third parties arises from the purposes set out in para. 4 results. Other recipients are, for example, delivery addressees or third-party payees specified by you, other third parties also in the context of agency relationships (e.g. if we send your data to your lawyer or your bank) or persons involved in official or legal proceedings. If we cooperate with the media and send them material (e.g. photos), you may also be affected by this under certain circumstances. The same applies when we publish content (e.g. photos, interviews, quotes etc.) for example on our website or in other publications. In the course of business development, we may sell or acquire businesses, parts of businesses, assets or companies or enter into partnerships, which may also result in the disclosure of data (including data about you, e.g. as a customer or supplier or as a supplier representative) to the persons involved in these transactions. Communications with our competitors, industry organizations, associations and other bodies may also result in the exchange of data that also relates to you.

All these categories of recipients may in turn involve third parties, so that your data may also become accessible to them. We can restrict processing by certain third parties (e.g. IT providers), but not by other third parties (e.g. authorities, banks, etc.).

7. Does your personal data also end up abroad?

As described in para. 7 we also disclose data to other bodies. These are not only located in Switzerland. Your data can therefore be processed in Europe as well as in the USA; in exceptional cases, however, in any country in the world.

If a recipient is located in a country without adequate legal data protection, we contractually oblige the recipient to comply with the applicable data protection (for this purpose, we use the revised standard contractual clauses of the European Commission, which can be accessed here, insofar as it is not already subject to a legally recognized set of rules to ensure data protection and we cannot rely on an exemption provision. An exception may apply in particular in the case of legal proceedings abroad, but also in cases of overriding public interests or if the performance of a contract requires such disclosure, if you have consented or if it is a matter of data that you have made generally accessible and you have not objected to its processing. ​​

Please also note that data exchanged via the internet is often routed via third countries. Your data can therefore end up abroad even if the sender and recipient are in the same country.

8. How long do we process your data?

We process your data for as long as our processing purposes, the statutory retention periods and our legitimate interests in processing for documentation and evidence purposes require or storage is technically necessary. Further information on the respective storage and processing periods can be found under the individual data categories in section 3 or for the cookie categories in para. 12. If there are no legal or contractual obligations to the contrary, we will delete or anonymize your data after the storage or processing period has expired as part of our normal processes.

9. How do we protect your data?

We take reasonable security measures to maintain the confidentiality, integrity and availability of your personal data, to protect it against unauthorized or unlawful processing and to protect against the risks of loss, accidental alteration, unauthorized disclosure or access.

10. What rights do you have?

Applicable data protection law grants you the right to object to the processing of your data in certain circumstances, in particular for direct marketing, direct marketing profiling and other legitimate processing interests.

To help you control the processing of your personal data, you also have the following rights in connection with our data processing, depending on the applicable data protection law:

• The right to request information from us as to whether and which of your data we are processing;
• the right to have us correct data if it is inaccurate;
• the right to request the deletion of data;
• the right to request that we provide certain personal data in a commonly used electronic format or transfer it to another controller;
• the right to withdraw consent insofar as our processing is based on your consent;
• the right to obtain, on request, further information necessary for the exercise of these rights.
  

If you wish to exercise any of the above rights against us, please contact us in writing, at our premises or, unless otherwise stated or agreed, by email; our contact details are set out in para. 2. In order for us to be able to exclude abuse, we must identify you (e.g. with a copy of your identity card, unless otherwise possible).
 
Please note that conditions, exceptions or restrictions apply to these rights under applicable data protection law (e.g. to protect third parties or trade secrets). We will inform you accordingly if necessary.

If you do not agree with our handling of your rights or data protection, please let us know. In particular, if you are in the EEA, the UK or Switzerland, you also have the right to complain to the data protection supervisory authority in your country. A list of authorities in the EEA can be found here. You can reach the UK supervisory authority here. You can reach the Swiss supervisory authority here.​​​​​​​
​

​

11. Do we use online tracking and online advertising techniques?

We use various technologies on our website that enable us and third parties we have engaged to recognize you when you use our website and, in some circumstances, to track you across multiple visits. We inform you about this in this section.

In essence, this is so that we can distinguish accesses by you (via your system) from accesses by other users, so that we can ensure the functionality of the website and carry out evaluations and personalization. In doing so, we do not want to infer your identity, even if we can do so insofar as we or third parties engaged by us can identify you through a combination with registration data. Even without registration data, however, the technologies used are designed in such a way that you are recognized as an individual visitor each time you access the site, for example by our server (or the servers of the third parties) assigning you or your browser a specific identification number (so-called "cookie").

Cookies are individual codes (e.g. a serial number) that our server or a server of our service providers or advertising contract partners transmits to your system when you connect to our website and that your system (browser, mobile) accepts and stores until the programmed expiry time. With each subsequent access, your system transmits these codes to our server or the server of the third party. In this way, you are recognized even if your identity is unknown.

Whenever you access a server (e.g. when using a website or an app or because an image is visibly or invisibly integrated in an email), your visits can therefore be "tracked" (traced). If we integrate offers from an advertising contractor or provider of an analysis tool on our website, they may track you in the same way, even if you cannot be identified in individual cases. 

We use such techniques on our website and allow certain third parties to do so as well. You can program your browser to block, deceive or delete existing cookies from certain cookies or alternative techniques. You can also enhance your browser with software that blocks tracking by certain third parties. You can find more information about this on the help pages of your browser (usually under the keyword "data protection") or on the websites of the third parties that we list below.

A distinction is made between the following cookies (techniques with comparable functions such as fingerprinting are included here):

• Necessary cookies: Some cookies are necessary for the website to function as such or for certain functions. For example, they ensure that you can switch between pages without losing information entered in a form. They also ensure that you remain logged in. These cookies are only temporary ("session cookies"). If you block them, the website may not work. Other cookies are necessary so that the server can save decisions or entries made by you beyond one session (i.e. one visit to the website) if you request this function (e.g. language selected, consent given, the function for automatic login etc.). These cookies have an expiry date of up to 24 months.

• Performance cookies: In order to optimize our website and corresponding offers and to better adapt them to the needs of users, we use cookies to record and analyze the use of our website, possibly even beyond the session. We do this through the use of third-party analytics services. We have listed these below. Performance cookies also have an expiry date of up to 24 months. Details can be found on the websites of the third-party providers.

• Marketing cookies: We and our advertising partners have an interest in targeting advertising, i.e. displaying it only to those we want to target. We have listed our advertising partners below. For this purpose, we and our advertising partners also use cookies - if you consent - which can be used to record the content accessed or contracts concluded. This allows us and our advertising partners to display advertisements that we think you may be interested in on our website, but also on other websites that display advertisements from us or our advertising partners. These cookies have an expiry date of between a few days and 12 months depending on the situation. If you consent to the use of these cookies, you will be shown appropriate advertising. If you do not consent to these cookies, you will not see less advertising, but simply any other advertising.

We currently use offers from the following service providers (insofar as they use data from you or cookies set on your computer for advertising purposes):

• Google Analytics: Google Ireland (based in Ireland) is the provider of the "Google Analytics" service and acts as our order processor. Google Ireland relies on Google LLC (based in the USA) as its order processor (both "Google"). Google uses performance cookies (see above) to track the behavior of visitors to our website (duration, frequency of pages viewed, geographical origin of access, etc.) and compiles reports for us on the use of our website on this basis. We have configured the service in such a way that the IP addresses of visitors are shortened by Google in Europe before being forwarded to the USA and thus cannot be traced. We have switched off the "Data sharing" and "Signals" settings. Although we can assume that the information we share with Google is not personal data for Google, it is possible that Google can draw conclusions about the identity of visitors from this data for its own purposes, create personal profiles and link this data to the Google accounts of these individuals. If you consent to the use of Google Analytics, you explicitly agree to such processing, which also includes the transfer of personal data (in particular usage data for the website and app, device information and individual IDs) to the USA and other countries. Information on the data protection of Google Analytics can be found here and if you have a Google account, you can find further details on processing by Google here​. ​​

12. What data do we process on our social network pages?

We may operate pages and other online presences ("fan pages", "channels", "profiles", etc.) on social networks and other platforms operated by third parties and use the services described in section 3 and hereinafter described data about you. We receive this data from you and the platforms when you come into contact with us via our online presence (e.g. when you communicate with us, comment on our content or visit our presence). At the same time, the platforms evaluate your use of our online presences and link this data with other data about you known to the platforms (e.g. on your behavior and preferences). They also process this data for their own purposes under their own responsibility, in particular for marketing and market research purposes (e.g. to personalize advertising) and to control their platforms (e.g. which content they show you).

We receive data about you when you communicate with us via online presences or view our content on the corresponding platforms, visit our online presences or are active in them (e.g. publish content, submit comments). These platforms also collect from you or about you, among other things, technical data, registration data, communication data, behavioral data and preference data (for the terms, see para. 3). These platforms regularly evaluate the way you interact with us, how you use our online presences, our content or other parts of the platform (what you look at, comment on, "like", forward, etc.) and link this data to other information about you (e.g. information about age and gender and other demographic information). In this way, they also create profiles about you and statistics on the use of our online presences. They use this data and profiles to show you our or other advertising and other content on the platform in a personalized way and to control the behavior of the platform, but also for market and user research and to provide us and other bodies with information about you and the use of our online presence. We may partially control the analyses that these platforms produce regarding the use of our online presences.

We process this data for the purposes described in para. 4 in particular for communication, for marketing purposes (including advertising on these platforms, cf. 12) and for market research. You will find information on the relevant legal basis in section 5. Content published by you (e.g. comments on an announcement) may be disseminated by us (e.g. in our adver-tising on the platform or elsewhere). We or the platform operators may also delete or restrict content from or about you in accordance with the usage guidelines (e.g. inappropriate comments).

For further information on the processing of the platform operators, please refer to the data protection notices of the platforms. There you will also find out in which countries they process your data, which rights of access, deletion and other data subjects you have and how you can exercise these or obtain further information. We currently use the following platforms:

•  Facebook: The responsible body for the operation of the platform for users from Europe is Facebook Ireland Ltd, Dublin, Ireland. Their privacy policy can be found at www.facebook.com/policy. Some of your data will be transferred to the USA. You can object to advertising here. With regard to the data collected and processed when visiting our site for the creation of "Page Insights", we are jointly responsible with Facebook Ireland Ltd, Dublin, Ireland. As part of Page Insights, statistics are compiled about what visitors do on our site (comment on posts, share content, etc.). This is described at
  www.facebook.com/legal/terms/information_about_page_insights_data
  It helps us understand how our site is used and how we can improve it. We only receive anonymous, aggregated data. We have regulated our responsibilities regarding data protection in accordance with the information on www.facebook.com/legal/terms/page_controller_addendum.​​​​​​​

• LinkedIn: When visiting our LinkedIn page, LinkedIn, LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland as the responsible party, collects personal data of the users, for example through the use of cookies. Such data collection by LinkedIn may also occur for visitors to the LinkedIn site or this channel who are not logged in or registered with LinkedIn. Information on data collection and further processing by LinkedIn can be found in LinkedIn's privacy policy at https://www.linkedin.com/legal/privacy-policy?. We cannot trace which user data LinkedIn collects. Nor do we have full access to the data collected or your profile data. We can only see the public information of your profile. You decide what this is specifically in your LinkedIn settings. We would like to point out that we are not responsible for the data processing carried out by LinkedIn and cannot influence this.​​

• YouTube: We use a YouTube channel with Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland as the responsible party. We cannot track which user data Google collects. Nor do we have full access to the data collected or your profile data. We can only see the public information of your profile. You decide what this is specifically in your YouTube settings. You use the YouTube channel and its functions on your own responsibility. Information on which data is processed by Google and for which purposes can be found in Google's privacy policy: https://policies.google.com/privacy?hl=de&gl=de#infocollect.​

13. Can this privacy policy be changed?

This Privacy Policy does not form part of any contract with you. We may amend this privacy policy at any time. The version published on this website is the current version.   

Last update: October 23, 2023