Data protection declaration of Comitas AG

Comitas AG, Wiesenstrasse 10A, CH-8952 Schlieren (hereinafter "Comitas"), is the author of this privacy policy and owner of the information (data) collected about you under this privacy policy.

We know that the careful handling of your personal information is important to you. Therefore, we appreciate your trust that Comitas will handle this information responsibly. Comitas is responsible for the collection, processing, transfer, storage, and protection of your personal information and ensures compliance with the Swiss Federal Act on Data Protection (FADP) insofar as data of Swiss customers is concerned, as well as compliance with the EU General Data Protection Regulation (GDPR) insofar as data of customers from the EU is concerned.

The consent you have given with this privacy policy can be revoked at any time with effect for the future (see section 10, last paragraph).

1. Contact details

The entity responsible for data processing is:

Courtesy AG
Wiesenstrasse 10A
8952 Schlieren
Switzerland
+41 (0)44 745 17 77

You can reach the data protection officer of Comitas AG at: info@comitas.com

2. Applicable Law

Data processing by Comitas is subject to the following law:

Data from Swiss customers and Swiss visitors to our website
The processing of data from Swiss customers is governed exclusively by Swiss law, in particular the Federal Act on Data Protection (FADP, SR 235.1) and the associated Ordinance to the Federal Act on Data Protection (SR 235.11). The EU General Data Protection Regulation (GDPR) does not apply. The applicability of the GDPR remains reserved (i) to the extent that it is expressly provided for in this privacy policy for specific areas, and (ii) to the extent that the GDPR is mandatory for data from Swiss customers due to special circumstances.

Data from customers and visitors from the EU to our website

In addition to Swiss law, the processing of data from customers within the EU is subject to Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, GDPR). See also section 12 (Additional provisions for customers within the EU).

3. Type and scope of personal data collected when visiting our website (without login)

When you visit our website, the web server technology we use automatically logs general technical information about your visit. This includes, among other things, your IP address (which is anonymized by Google before being stored, so that it can no longer be associated with you. Google uses the _anonymizeIp() method for this), information about the device you are using, your browser type, your internet service provider, and your operating system.

When using cloud software (with login)

During free access as well as during paid use of Comitas software within the login-protected area, all data entered or submitted by the user during the registration process and while using the software will also be stored. This is particularly the case when you register, place orders, fill out online forms, participate in surveys or competitions, correspond with us online or offline, or interact with us via social media, blogs, or other interactive media.

Here, your personal data (name, address, email address) and the settings required for the respective service are usually collected.

By submitting your information (registration), you consent to the processing, use and disclosure of your personal data within the scope and for the purposes described in this privacy policy.

Partner Functions When using any optionally available partner functions of Comitas Cloud products or when connecting your own account to a partner, data is exchanged between Comitas and the partner in question.

4. Data security 

We employ technical and organizational security measures in accordance with recognized market standards to protect personal data stored with us against accidental, unlawful, or unauthorized manipulation, deletion, alteration, access, disclosure, or use, and against partial or complete loss. Comitas' servers are located in a multi-certified and secure data center operated by Swisscom (Switzerland) Ltd. Swisscom regularly performs backups of customer data. To prevent data loss even in extreme cases (e.g., destruction of the data center by an earthquake), encrypted backups are stored in parallel in multiple data centers both domestically and internationally. Our security measures are continuously adapted and improved in line with technological developments. We assume no liability for the loss of data or its disclosure and use by third parties. Furthermore, we cannot guarantee the security of data transmission over the internet; in particular, there is a risk of third-party access when transmitting data via email. However, access is protected by HTTPS. If explicitly requested by the customer, they can opt for two-factor authentication at any time.

5. Purpose of processing personal data / Recipients of the data 

We process the collected data to continuously improve the products and services you request, to manage your use of and access to our applications, products, and information, to maintain our business relationship with you, to monitor and improve the performance of our offerings, to detect, prevent, or investigate illegal activities, and to send you offers, information, or marketing materials about products or services that we believe, based on the data, may be of interest to you. The data may also be shared with partner companies and service providers, selected third-party companies, institutions, and/or legally authorized government authorities, both domestically and internationally, for processing, storage, and use within the scope of the aforementioned purposes. If the processing or storage of personal information takes place in countries that do not guarantee an adequate level of data protection compared to Swiss data protection law, we contractually require the data processor to fully comply with the relevant provisions of the Swiss Federal Act on Data Protection (FADP) or – insofar as data from customers within the EU is concerned – the General Data Protection Regulation (GDPR).

We outsource some of the aforementioned processes and services to data protection-compliant service providers located within the EU or Switzerland. These include companies in the categories of IT services, payment processing, printing services, billing, debt collection and consulting, as well as sales and marketing, and service providers that we engage under data processing agreements.

Contacting us

Data collected:

We collect and process the data you provide, such as your contact details, your name, and your request, when you contact us via a contact form or email. All data you transmit to us is encrypted between your browser and our server.

Purposes of data processing:

Data processing by our customer service is carried out exclusively on the basis of and for the purpose of processing your request.

Storage time:
The criterion for the duration of the storage of personal data is the respective statutory retention period. After the period has expired, the relevant data is routinely deleted, provided that it is no longer required to fulfill the contract or to initiate a contract.

customer survey

Data collected
For the purposes of online surveys, Comitas processes user data solely for survey evaluation purposes, provided that no personal data, such as names or email addresses, is requested. In such cases, the data is anonymized, meaning it is processed without the user's IP address. If the survey requests personal data beyond the survey topic (e.g., name, address, company, etc.), we will explicitly indicate within the survey that this is additional, voluntary information that we collect and use..

Purposes of data processing:
We use customer surveys to design and optimize our products and services to meet customer needs.

Legal basis:
We conduct customer surveys when you fill out a corresponding questionnaire. By submitting your answers, you give your consent.

Storage time:
The criterion for the duration of the storage of personal data is the respective statutory retention period. After the period has expired, the relevant data is routinely deleted, provided that it is no longer required to fulfill the contract or to initiate a contract.

MailerLite

Data collected:

We use solutions and technologies from MailerLite Ltd. (UAB “MailerLite”, J. Basanavičiaus 15, LT-03108 Vilnius, Lithuania)

Purposes of data processing:

MailerLite creates email marketing campaigns with features such as automation, landing pages, and customer surveys. We process your data to create campaigns and collect information about website visitors who may have reached us through our campaigns on LinkedIn or our website.

Legal basis:
We temporarily store this data based on legitimate interests (Art. 6 para. 1 f GDPR). Our legitimate interest lies in achieving the purposes described above.

Storage duration and control options:
MailerLite stores the data for up to 13 months. If you do not wish to participate in conversion tracking, you can delete the cookie from [MailerLite]. MailerLite This can be deactivated via your browser at https://www.mailerlite.com/legal/privacy-policy.

6. Cookie policy

Cookies help make your visit to our website easier, more enjoyable, and more meaningful. Cookies are information files that your web browser automatically stores on your computer's hard drive when you visit our website and use our services.

You can manage your browser security settings yourself and thereby block or disable cookies used by us, although certain services with third-party providers may then no longer be (fully) usable.

Tracking and analysis tools / social media

The use of our digital services is measured and analyzed using various technical systems, primarily from third-party providers such as Google Analytics. These measurements can be anonymous or personalized. It is possible that the collected data may be further processed by us or the third-party providers of such technical systems by third parties both domestically and internationally. The most frequently used and well-known analytics tool is Google Analytics, a service provided by Google Inc. This means that the collected data can, in principle, be transmitted to a Google server in the USA.

Our website uses Google Analytics, a web analytics service provided by Google Inc., located at 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA ("Google"). Google Analytics uses "cookies," which are text files placed on your computer, to help the website analyze how users use the site. The information generated by the cookie about your use of the website (including your IP address, which is anonymized by Google before being stored so that it can no longer be associated with you) will be transmitted to and stored by Google on servers in the United States. Google will use this information for the purpose of evaluating your use of the website, compiling reports on website activity for us, and providing other services relating to website activity and internet usage. Google may also transfer this information to third parties where required to do so by law, or where such third parties process the information on Google's behalf. Google will not associate your IP address with any other data held by Google.

Further information can be found in the privacy policy of Google >

https://support.google.com/analytics/answer/6004245?hl=de.

If you do not want your website activity to be available to Google Analytics, you can use the browser add-on to deactivate it. Google Analytics to install:

https://support.google.com/analytics/answer/181881?hl=en.

This prevents activity data from being shared with Google Analytics via the JavaScript (ga.js, analytics.js and dc.js) executed on websites.

We temporarily store this data based on legitimate interests (Art. 6 para. 1 f GDPR). Our legitimate interest lies in achieving the purposes described above.

The analysis of data by other tools of the website owner is not prevented when you use the add-on. Data may still be sent to the website or to other web analytics services.

The comitas.com website also uses a web analytics tool to analyze user behavior and identify companies' IP addresses for marketing purposes. Using this service means that data about user behavior (e.g., IP address, time of access, user activity, browser request, etc.) is transmitted directly to the analytics servers and made available exclusively to comitas.com. The collected data is treated with strict confidentiality and is neither sold nor shared with third parties. If you no longer wish to be identified in the future, please email optout@permagroup.ch.

Finally, we collect certain information via our website in so-called server log files, which your internet browser automatically transmits to us. This includes, among other things, the user agent (browser type and version, operating system used), HTTP header information (referrer URL, IP address of the accessing computer), and the time of the server request. These server log files are only combined with other data sources for error analysis.

Integration of third-party offers / social media

Our digital services are interconnected with third-party functions and systems in various ways, for example, through the integration of plugins from third-party social networks such as Facebook, Twitter, etc. If you have a user account with these third parties, they may also be able to measure and analyze your use of our digital services. In this process, further personal data, such as IP address, browser settings, and other parameters, may be transmitted to and stored by these third parties. We have no control over the use of such personal data collected by third parties and assume no responsibility or liability for it. Furthermore, Comitas has no detailed knowledge of what data is transmitted to the third-party providers, where it is transmitted, or whether it is anonymized.

7. Automated decisions
   Comitas does not use profiling or automated decision-making techniques. Should Comitas use these methods in individual cases, you will be informed separately, provided this is required by law.

8. Communication by E-Mail
   You can unsubscribe from receiving electronic mailings at any time or adjust the type and scope of this marketing service. Each electronic mailing contains a corresponding link for this purpose.

9. Duration of storage
   Comitas processes and stores your personal data for as long as you use the service. Please note that the contractual relationship is an ongoing obligation that is intended to last for several years.
   If the data is no longer required for the fulfillment of contractual or legal obligations, it will be regularly deleted, unless its – temporary – further processing is necessary for the following purposes:

• Compliance with commercial, tax and other retention obligations in Switzerland: Of particular note is the ten-year period for keeping and maintaining business records (OR 958f); longer periods may also result from special laws.
• Compliance with commercial, tax, and other retention obligations in Germany: The German Commercial Code (HGB) and the German Fiscal Code (AO) are particularly relevant. The retention and documentation periods stipulated therein range from two to ten years; longer periods may also apply under special laws.
• Fulfillment of commercial, tax and other retention obligations in other countries, insofar as and to the extent that Comitas operates there.
• Preservation of evidence within the framework of the respective statutory limitation periods, whereby such limitation periods can be up to 30 years or more.

10. Information, correction, deletion, blocking, consent
    With regard to your personal data, you have the following rights. Comitas explicitly grants these rights contained in the GDPR to Swiss customers as well, insofar as they do not already have analogous rights under the Swiss Federal Act on Data Protection (FADP):

• the right to information pursuant to Article 15 GDPR,
• the right to rectification pursuant to Article 16 GDPR,
• the right to erasure under Article 17 GDPR,
• the right to restriction of processing pursuant to Article 18 GDPR,
• the right to data portability under Article 20 GDPR, as well as
• the right to object under Article 21 GDPR.

Information:
You can request at any time that we provide you with information about which of your personal data we process and how, and provide you with a copy of the personal data we hold about you, Art. 15 GDPR.

Correction:
You can request the rectification of inaccurate personal data as well as the completion of incomplete personal data, Art. 16 GDPR.

Deletion:
Regarding the deletion of your personal data: Please note that data required for the performance and processing of contracts and for the establishment, exercise and defense of legal claims, as well as data for which there are statutory, regulatory or contractual retention obligations, are excluded from deletion (Art. 17 GDPR).

Restriction of processing:
Under certain circumstances, you can request the restriction of processing, for example, if you believe your data is inaccurate, if the processing is unlawful, or if you have objected to the data processing. This means that your data may only be processed to a very limited extent without your consent, for example, for the establishment, exercise, or defense of legal claims or for the protection of the rights of other natural or legal persons (Article 18 GDPR).

Objection to data processing:
You have the right to object to the processing of your data for direct marketing purposes at any time. Furthermore, you may object at any time to data processing based on legitimate interests, pursuant to Article 21 of the GDPR, if there are specific grounds for doing so.

Data portability:
You have the right to receive the data you have provided to us and which we process on the basis of your consent or for the performance of a contract in a commonly used, machine-readable format and, within the scope of what is technically feasible, to request the direct transfer of this data to third parties, Art. 20 GDPR.

The aforementioned rights are subject to any restrictions under the GDPR and the applicable national data protection laws or other national laws.

If you are asked to give your consent in connection with Comitas' services, you give this consent by clicking the corresponding checkbox, allowing Comitas to collect, process, use and pass on your personal data accordingly.

You can, of course, withdraw your consent at any time without affecting the lawfulness of the processing carried out based on your consent before its withdrawal. The withdrawal can be sent in writing to the Comitas address mentioned above. However, an email to info@comitas.com is also sufficient. Please note that some services and functions will no longer be available to you afterwards.

Who we share your personal data with:
To achieve the purposes described in this privacy policy, it may be necessary for us to share your personal data with other companies. These are the following:
Categories of recipients:

-other group companies;

-external service providers;

-other female customers;

-Female suppliers and business partners;

-(where applicable) authorities and courts.

Place of processing:
We primarily store and process your personal data in Switzerland and the EU. However, we may also transfer your personal data to recipients in countries outside of Switzerland or the EU (worldwide, particularly the USA). Data transfers to countries without adequate data protection are based on standard data protection clauses or legal exceptions (e.g., necessity for contract fulfillment).

11. Links to other websites
    The Comitas website contains hyperlinks to third-party websites that are not operated or controlled by Comitas. Comitas is not responsible for their content or data protection practices.

12. Additional regulations for customers from the EU
    The following provisions apply only to customers from the EU area; they do not apply to Swiss customers.

Legal basis for processing

Your data will be processed for the purposes stated in section 5 in accordance with Article 6(1)(b) GDPR for the performance of the contract. The subject of the contract is the aforementioned services.

Your data is also processed, as described above, to protect Comitas' legitimate interests (Article 6(1)(f) GDPR). These interests include improving products and services (including the delivery of direct marketing), monitoring and improving the performance of the service, and detecting, preventing, or investigating illegal activities.

Furthermore, the data is processed in accordance with Article 6 Paragraph 1 Letter c GDPR for the fulfillment of legal obligations (e.g. retention and documentation obligations). This includes, in particular, your personal data.

If you believe that one or more of the purposes listed under point 5 are not covered by the legal bases mentioned above, you can request that we no longer process your personal data for specific individual purposes (opt-out). You can send such an opt-out request in writing to the Comitas address mentioned above. However, an email to info@comitas.com is also sufficient.

Revocation of Consent

You may withdraw any consent you have given for the processing of your personal data at any time with effect for the future. Please note that the withdrawal does not affect the lawfulness of the data processing carried out before the withdrawal and that it does not extend to data processing for which there is a legal basis for processing and which may therefore be carried out even without your consent.

Right of appeal

If you believe that the processing of your personal data violates the GDPR, you have the right to lodge a complaint with a competent supervisory authority pursuant to Article 77 GDPR. Comitas is happy to answer any questions or address any concerns you may have before you file a complaint. Please contact us by email at info@comitas.com.

Version: August 2023