IMPRINT & DATA PROTECTION

This document contains everything you need to know about the data we hold about you, i.e., when and where we collect data, what we do with it, who we are required to give it to, when we will delete it and what you can do about it. First of all, we, the FREITAG lab. AG, the FREITAG national companies, Regroup AG, and their subsidiaries (hereinafter also referred to as «we» or «us») take data protection very seriously, so the language in this document will be more formal than usual.

If you have any questions or complaints, please contact our data protection officer, dataprotection@freitag.ch.

We do our best to store as little data as possible about you and to bother you as little as possible. We do occasionally still need to collect some personal data in order to be able to provide you with the best online information and shopping experience. We may therefore collect the following types of data:

1.1 Information

The information you provide to us when you:

• Search for, subscribe to or purchase products and services;


• Create or manage your account;


• Configure your user settings, grant access permissions to data or otherwise interact with us;


• Register for or participate in an event;


• Communicate with us by telephone, email or any other method;


• Fill out a questionnaire, support ticket or other information request form;


• Post to websites or participate in community features;


• Use notification services.



Examples of information that you can provide are:




• Your name, email address, postal address, telephone number and other similar contact information;


• Payment information including credit card and bank account details;


• Your location information;


• Information about your organization and your contacts, such as colleagues or people within your organization;


• Usernames, aliases, roles and other authentication and security authorization information;


• Information within feedback, testimonials, inquiries, support tickets, phone calls, chat sessions and emails with us or to us;


• Your image, voice and other identifying information that is personally associated with you when you attend an event;


• Identity information, including government-issued identification data;


• Corporate and financial information;


• VAT numbers and other tax identifiers.




1.2 Automatic information





We automatically collect information when you:




• View our online services, interact with them or download content from our website;


• Open emails or click on links in emails from us or when you interact or communicate with us (e.g. when you attend an event or when you request customer support).



Examples of information that we collect automatically are:




• Network and connection information, such as the Internet Protocol (IP) address used to connect your computer or other device to the Internet, and information about your internet service provider;


• Computer data such as device, application, browser type/version, browser plugin type/version, operating system or time zone setting;


• The location of your computer or device;


• Authentication and security authorization information;


• Information about interactions with content, such as content downloads, including duration and number of interactions;


• Email addresses and telephone numbers used to contact us;


• Identifiers and information contained in cookies (see cookie notice).




1.3 Information from other sources




Examples of information we obtain from other sources are:




• Search results and links, including paid posts (such as sponsored links);


• Credit history information from credit bureaus.

2.1 Data processing when using our website

Cookies

Cookies are text files that are stored on your computer in order to collect information about your IP and visitor behavior. This information is used to track visitors’ use of the website and to compile statistical reports on website activity.
For more information, please visit www.aboutcookies.org, www.allaboutcookies.org
You can set your browser not to store cookies; the above websites explain how to remove cookies from your browser. In certain cases, however, this may cause some features of our website to stop working.

[Hosting] AWS

Provided by: Amazon Web Services, Inc., 410 Terry Avenue North, Seattle WA 98109, USA, ("AWS").
Data protection: https://aws.amazon.com/de/privacy/
Legal basis: Legitimate interest

AWS is hosted exclusively at the AWS data center in Frankfurt a.M., Germany. We have entered into an order-processing agreement with AWS based on standard EU contractual clauses. AWS also guarantees that the processing of personal data outside the EU or European Economic Area complies with Swiss and European data protection laws.

[Hosting] Google

Provided by: Google Inc, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA ("Google").
Data protection: https://cloud.google.com/security/privacy
Data collected: IP address, browser type, browser version, operating system used, hostname of client, time, etc.
Legal basis: Legitimate interest

Google's data centers are located in the Netherlands, Finland, Ireland and Belgium. The transmission and storage of data at these data centers are encrypted. The data centers are organized globally and employ high security standards with modern encryption technology. Among other things, all data and information is broken down into small packets, additionally encrypted, and distributed for storage across the data center infrastructure. Access to unencrypted data or even the use of data by Google or its system administrators in the respective data centers is explicitly excluded under the terms of the contract. If data is processed and stored in data centers outside the EU states or the European Economic Area, Google guarantees a level of data protection in compliance with Swiss and European data protection laws as defined by standard EU contractual clauses.

[Hosting] Platform.sh

Provided by: Platform.sh GmbH, Marienstr 90, 50825 Cologne, Germany, headquarters located at 131 Boulevard de Sébastopol, 75002 Paris, France
Data protection: https://platform.sh/privacy-policy/
Data collected: IP address, browser type, browser version, operating system used, client hostname, time, etc.
Legal basis: Legitimate interest

Our website is hosted by Platform.sh. The website provider automatically collects and stores information in server log files, which your browser sends to us automatically.

[Embed] CookiePro by OneTrust

Provided by: CookiePro by OneTrust, Mühldorfstraße 8, 81671 Munich, Germany
Data protection: https://www.onetrust.com/privacy-notice/
Data collection: IP address
Legal basis: Legitimate interest

CookiePro by OneTrust is the leading user content and cookie compliance management solution for websites. It ensures that users’ stated preferences and consent are implemented securely at all times.

[Embed] Flowbox

Provided by: Flowbox AB, Riddargatan 17D, 114 55 Stockholm, Sweden
Data protection: https://go2flow.ch/datenschutzerklaerung/
Data collected: IP address
Legal basis: Legitimate interest

Our website contains embedded Instagram images that are embedded using Flowbox.

[Embed] Google-YouTube

Provided by: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
Data protection: https://policies.google.com/privacy
Data collected: IP address, pages visited, YouTube account (if relevant)
Legal basis: Legitimate interest

We use YouTube in privacy-enhanced mode. According to YouTube, this mode prevents YouTube from storing information about visitors to this website before they play the video. As soon as you play a YouTube video on our website, a connection with the servers of YouTube is established. The YouTube server is notified of what pages you have visited. If you are logged into your YouTube account, you enable YouTube to attribute your surfing habits directly to your personal profile. You can prevent this by logging out of your YouTube account. Furthermore, YouTube can store various cookies on your device after you start playing a video. With these cookies, YouTube can collect information about visitors to our website. One of the uses of this information is to collect video statistics, improve user-friendliness and prevent attempts at fraud. The cookies will remain on your device until you erase them.

[Plugin] Facebook pixel

Provided by: Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland
Data protection: https://facebook.com/policy
Data collected: IP address
Legal basis: Your consent, which you may revoke at any time

Our website uses the Facebook pixel to analyze the effectiveness of Facebook advertising. When you visit the website, your IP address and user data are transmitted. These cannot be directly associated with you. Additionally, cookies are necessary and used in order to analyze how the website is used. When you visit our website, the Facebook pixel is integrated by Facebook directly and can install a cookie on your device. If you then log into Facebook or visit Facebook while you are already logged in, your visit to our website will be associated with your profile. The data collected from you is anonymous to us and therefore does not enable us to draw any conclusions as to your identity. However, Facebook stores and processes the data, which means that the data can be associated with your profile and can be used by Facebook for its own market research and advertising purposes. Where data is sent to Facebook for cross-checking purposes, the data will be encrypted locally in your browser before it is sent to Facebook over a secure HTTPS connection. The sole purpose of this is to cross-check the data against the data that has been encrypted by Facebook.

[Plugin] Google Analytics

Provided by: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
Data protection: https://policies.google.com/
Data collected: Data collected: IP address, pages visited, usage data, statistics
Legal basis: Legal basis: Your consent, which you may revoke at any time

When you visit our website, Google Analytics may be used and may send usage information to us automatically. Google Analytics anonymizes all visitor data so that no personal information is recorded. We have activated the IP anonymization function on this website, which means that Google will shorten your IP address. Only in exceptional cases is the full IP address sent to a Google server in the USA and shortened there. This website uses the «Demographics» feature of Google Analytics. As such, reports which provide information about the age, gender and interests of visitors to our website can be generated. This data originates from interest-based advertising by Google and visitor data from third-party providers. This data cannot be associated with any individual person. Google uses this information on behalf of the operator of this website for the purposes of evaluating your use of the website, compiling reports on website activity for website operators and providing other services relating to website activity and internet usage. Your IP address sent by your browser through Google Analytics will not be associated with any other data held by Google. User-level and event-level data stored by Google that is associated with cookies, user IDs or advertising IDs is deleted after 14 months. You can prevent the collection of data by Google Analytics by installing the Google Analytics opt-out browser add-on.

[Plugin] Google Optimize

Provided by: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
Data protection: https://policies.google.com/
Data collected: IP address, usage data
Legal basis: Your consent, which you may revoke at any time

When you visit the website, your IP address and user data will be transmitted. These cannot be directly associated with you. Additionally, cookies are necessary and used in order to analyze how the website is used.

[Plugin] Google Tag Manager

Provided by: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
Data protection: https://policies.google.com/
Data collected: IP address, pages visited, usage data
Legal basis: Your consent, which you may revoke at any time

Google Tag Manager is a solution that enables marketers to manage website tags on a dashboard. The Tag Manager tool itself (which implements the tags) is a cookie-free domain and does not collect personal data. The tool activates other tags which could themselves collect data. Google Tag Manager does not access this data. If recording has been deactivated at domain or cookie level, this setting will remain in place for all tracking tags implemented with Google Tag Manager.

[Plugin] Guuru

Provided by: Provided by: Guuru AG, Bösch 67, 6331 Hünenberg, Switzerland
Data protection: https://guuru.com/de/privacy-policy/
Data collected: IP address, pages visited, usage data
Legal basis: Your consent, which you may revoke at any time

Our website uses Guuru to provide interactive customer support. When you visit the website, your IP address and user data will be transmitted. These cannot be directly associated with you. Additionally, cookies are necessary and used in order to guarantee the service.

[Plugin] Hotjar

Provided by: Hotjar Ltd., Level 2, St. Julian’s Business Centre, 3, Elia Zammit Street, St Julian’s STJ 1000, Malta
Data protection: www.hotjar.com/privacy
Data collected: IP address, mouse movements, scrolling and clicks
Legal basis: Your consent, which you may revoke at any time

Hotjar is a tool designed to analyze how you use the website. For example, we can use Hotjar to track your mouse movements, scrolling, and clicks. Hotjar can even determine how much time you spend mousing over a certain area of the website. Hotjar uses this information to generate “heatmaps” which indicate the areas of a website that a visitor prefers to view. We can also determine how long you spend on a page and when you leave it. We can also see at what point you stop entering information in a contact form (this is known as a conversion funnel). Additionally, Hotjar can be used to obtain direct feedback from visitors to the website. This feature is used to improve the online services of the website operator. If you would like to deactivate the collection of data by Hotjar, please visit this link and follow the instructions there: https://www.hotjar.com/opt-out.

[Plugin] New Relic

Provided by: New Relic Inc., 188 Spear Street, Suite 1200, San Francisco, CA 94105, USA
Data protection: www.newrelic.com/privacy
Data collected: IP address
Legal basis. Legitimate interest

Our website uses a plug-in from the New Relic web analytics service. It enables us to perform statistical evaluations of the speed of the website and determine whether the website can be accessed and how quickly each page loads when it is opened. It is provided by. New Relic uses cookies. When you visit a website containing a plug-in from New Relic, your browser will establish a direct connection with the servers of New Relic. You can accept, block or withdraw your consent to cookies via the cookie banner (opt in/opt out). The plug-in notifies New Relic that a user has opened a specific page of the website. If you are logged in with New Relic, New Relic will also be able to associate the visit with your New Relic account. If you are not a member of New Relic, however, New Relic will store your IP address.

[Lib] Google fonts

Provided by: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
Data protection: policies.google.com/
Data collected: IP address
Legal basis: Legitimate interest

Our website uses Google Fonts to standardize the way in which fonts are displayed. Your browser will download the necessary web fonts to your browser cache in order to display text and fonts correctly.

[Lib] JQuery

Provided by: JQuery Community, hosted by Google
Data protection: policies.google.com/privacy
Data collected: IP address
Legal basis: Legitimate interest

Our website uses the JavaScript library jQuery. When you open the website, your browser will download the external JavaScript file a Google server.

2.2 Data processing when shopping

In order to process payments, the following systems may be used:

Datatrans

Provided by: Datatrans AG, Kreuzbühlstrasse 26, 8008 Zurich, Switzerland
Data protection: www.datatrans.ch/de/datenschutzbestimmungen/
Data collected: Name, address, telephone number, email, IP address and other payment information
Legal basis: Your consent, which you may revoke at any time

All conventional payment methods can be processed via the interface of the e-payment platform from Datatrans. The payment details you enter will be encrypted and sent to Datatrans and cannot be accessed by us.

PayPal

Provided by: PayPal (Europe) S.à.r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg Data protection: www.paypal.com/ch/webapps/mpp/ua/privacy-full
Data collected: Name, address, email, IP address, credit card or PayPal account information
Legal basis: Your consent, which you may revoke at any time

We offer PayPal as a payment method on our website. If you select payment via PayPal, the payment information you enter will be sent to PayPal.

2.3 Data processing when using forms

In order to process the forms on our website (e.g. contact form, repair form), we use the following systems:
Salesforce
Provided by Salesforce.com Germany GmbH, Erika-Mann-Str. 31, 80636 Munich, Germany
Data protection: www.salesforce.com/eu/company/privacy/

Data collected Last name, first name, email and the information sent to us

Legal basis Your consent, which you may revoke at any time

The data collected from the form is sent from our website to our Salesforce system and processed there as a support ticket.

2.4 Data processing for the newsletter

In order to send out our newsletters, we use the following systems:

Salesforce – Marketing Cloud

Provided by: Salesforce.com Germany GmbH, Erika-Mann-Str. 31, 80636 Munich, Germany
Data protection: www.salesforce.com/eu/company/privacy/
Data collected: Customer number. last name, first name, address, email, telephone number and the information sent to us
Legal basis: Your consent, which you may revoke at any time

Salesforce Marketing Cloud helps us to send out and analyze our newsletter campaigns. We use the following Salesforce modules:
Email Studio

• An open pixel determines whether an email recipient opens a Marketing Cloud email. This data is analyzed in the Marketing Cloud in order to create statistics and reports for emails.
• Link tracking is used in Marketing Cloud to capture information about the links clicked by email recipients. This link tracking data is analyzed in the Marketing Cloud in order to create statistics and reports for emails.

Einstein Marketing Cloud platform

• Einstein imports email templates, standard information tables like data views, some user agent data, and the «members_subscriber» list. The content of the emails is not imported.
• Einstein imports personalization strings, but not the data accessed by those strings.
• Einstein does not import custom object data or data stored in custom data extensions.

If you have consented to us using your email address for advertising purposes, we will send you the newsletter of your choice on a regular basis to make you aware of additional offers and services. Each newsletter contains a link for you to unsubscribe at any time and your email address will no longer be processed for this purpose. In order to be able to tailor the content of our newsletters to suit the interests of each individual recipient, information about clicks on articles within our newsletters is monitored, stored and associated with each respective recipient.




Mandrill




Provided by: Mandrill by Intuit Corp., 2632 Marine Way, Mountain View, CA 94043, USA
Data protection: www.intuit.com/privacy/statement/
Data collected: Email, last name, first name, subscriptions, statistics and usage data
Legal basis: Your consent, which you may revoke at any time




Our website uses the service Mandrill to send newsletters. The service manages data relating to when an email that we sent to you was opened or links in the email were clicked on. Technical and organizational security measures are in place to ensure that your personal data is protected against loss and unauthorized modification and that it cannot be accessed by unauthorized third parties. Furthermore, on our part, only authorized persons have access to your personal data and only to the extent necessary for the purposes of the contract.




2.5 Data processing when using the F-ederation




F-ederation is the name of our loyalty and benefits program. To enable this program, we use the following systems:
Salesforce – Marketing Cloud




Provided by: Salesforce.com Germany GmbH, Erika-Mann-Str. 31, 80636 Munich, Germany
Data protection: www.salesforce.com/eu/company/privacy/
Data collected: Customer number. last name, first name, address, email, telephone number and the information sent to us
Legal basis: Your consent, which you may revoke at any time




You can register on our website in order to make use of additional features. We only use the registration data you provide for the purposes of using the products or services for which you registered. The mandatory information required in the registration process must be provided in full. Otherwise, the registration will be rejected. We use the email address you provide when you register to notify you of important changes, such as to the scope of our services or technically necessary changes. By creating an F-ederation account, you will have access to our F-ederation benefit program, such as the S.W.A.P. exchange platform. If you have consented to us using your email address for marketing purposes (marketing consent), we will send you F-ederation information and marketing offers tailored to you. You can unsubscribe from the respective newsletters at any time in your F-ederation user account or from within the newsletter itself.




2.6 Data processing when using F-Cut




In order to ensure the functionality of our online customizing tool F-Cut, we use the following systems:




Dato srl server




Provided by: Dato srl, Via Francesco Botticini 3, 50143 Firenze, Italy with servers located in Europe, spread across Ireland, the UK, the Netherlands and Germany
Data collected: Customer number, order ID number and data needed to create the bags
Legal basis: Your consent, which you may revoke at any time




No personal data is stored in order to create your F-Cut bag. We only store the data needed to create your F-Cut bag (position of templates in the design) and the corresponding order ID number in Salesforce (see F-ederation). Cookies are stored in order to enable the user to pick up where they last left off and to show them content in the relevant language/currency. We also use Google Analytics for F-Cut so that we can tell how many people visit us and where they come from (in an anonymized format).




2.7 Data processing on social media channels/of social media users




Facebook fan page




Provided by: Facebook Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland
Data protection: www.facebook.com/about/privacy
Data collected: IP address, operating system, cookies, usage data
Legal basis: Legitimate interest




Facebook collects and uses data in order to provide website operators with analytics services known as Page Insights, so that the website operators learn how people interact with their websites and the content on their websites. This data includes information about the types of content viewed or interacted with by users or the actions they take, as well as information about the users’ devices such as their IP address, operating system, browser type, language settings and cookie data.




2.8 Processing of applicant data




Onlyfy by Xing




Provided by: New Work SE, Am Strandkai 1, 20457 Hamburg, Germany
Privacy policy: onlyfy.com/en/datenschutz
Applicant data collection
Legal basis: Consent




OnlyFy by Xing is a talent acquisition platform that makes all-inclusive recruitment possible. Thanks to the integration of active sourcing, passive sourcing and efficient applicant management under one roof, Onlyfy maps the entire recruitment process in a single solution.

3.1 Use of personal data

Among other things, we use personal data for the following purposes:

• Provision of services: We use your personal data in order to provide services and process transactions relating to services, including registrations, subscriptions, purchases and payments.


• Measurement, support and improvement of services: We use your personal data to measure the use of services, analyze their performance, troubleshoot any issues, provide support and improve and develop services.


• Recommendations and personalization: We use your personal data to recommend services that may be relevant to you, to identify your preferences, and to personalize the services offered to you.


• Compliance with legal obligations: In certain cases, we are required by law to collect, use, or store your personal data.


• Communication with you: We use your personal data to communicate with you about services through various channels (e.g. phone, email, chat) and to respond to your inquiries.


• Protection against fraud, misuse, and credit risks: We use your personal data to prevent and detect fraud and misuse and to protect the safety of our customers and of others.


• Purposes for which we obtain your consent: We may also ask for your consent to use your personal data for a specific purpose that we disclose to you.

3.2. Data retention

We retain your personal data in order to enable you to continuously access our services. We retain your data for as long as necessary in order to fulfill the purposes set out in this data protection notice as required by law (including for tax and accounting purposes). Any deviations from this will be disclosed to you. The period for which we retain certain personal data depends on its intended use. We will delete your personal data in accordance with applicable law.

3.3. Data minimization

We only collect, process, and use personal data to the extent necessary in order to process customer orders. We only collect, process, and use personal data concerning the use of our web service where necessary in order to enable the user to use the service or charge the user for the service.

3.4. Locations and transfers

Your data is located at the sites of our named external data processors. Depending on the extent of your interactions with our services, your personal data may be stored or accessed in multiple countries. Whenever we transfer personal data to other countries, we will ensure that the data is transferred in accordance with this privacy policy and in accordance with the applicable data protection laws.

3.5. Exchange with third parties

In order to provide our offers and services, we sometimes collaborate with third-party providers. In this case, we will only share personal data with partners if they are either subject to this following data protection notices or have practices that are at least as secure as those described in this data protection notice.

• Transactions involving third parties: we provide you with services, content and software provided by third parties for use in or through offers. You may notice when a third party is involved in your transactions, and will we share information related to any transactions with a third party.


• Third-party service providers: we engage other companies and individuals to perform functions on our behalf. Examples of this include dispatch of communications, marketing and sales support, processing of payments, customer relationship management, and training. These third parties have access to personal data necessary for them in order to perform their tasks, but they are not permitted to use it for any other purposes. In addition, they are obliged to process this data in accordance with this privacy policy and within the scope of applicable data protection laws.


• Protection of ourselves and others: we release account information and other personal data when we believe it is appropriate in order to comply with the law, enforce or apply our terms and other agreements, or to protect the rights, property, or safety of our customers or others. This includes sharing information with other companies and organizations to prevent and detect fraud and reduce credit risk.


• At your discretion: Except as provided for above, you will be notified when personal data about you may be disclosed to third parties, and you will have the opportunity to opt out of such disclosure.

4.1 Data processors

We have concluded the necessary contracts (DPA/SCC) with our external data processors in order to properly ensure data security.

4.2 State of the art

Security is our top priority. We develop our products and services with your security and privacy in mind. We implement technical and organizational security measures in order to ensure that the data collected remains confidential and is protected from accidental or unlawful access, alteration or disclosure and from loss or destruction. Access to data is only granted on a need-to-know basis to the individuals who need to access the personal data because of their role and duties.

4.3 Encryption

Industry-standard secure server connections are used to ensure that your personal data stored by us and by our third-party data processors is encrypted both while being stored and while being securely transferred over the Internet.

4.4 Security measures

We implement physical, electronic, and procedural security measures during the collection, storage, and disclosure of your personal data. Due to our security measures, we may require proof of identity before disclosing personal data to you.

5.1. Switzerland and the EU

Legal basis
We process your personal data for one or more of the following legal bases:

• If it is necessary to enter into a contract with you or a legal entity you represent, to fulfill our contractual obligations, to provide our services, to respond to your inquiries, or to provide customer support;

If we have a legitimate interest as described in this privacy policy;

• If it is necessary in order to comply with laws and legal obligations, including responding to lawful requests;


• With your consent.

Your rights
Subject to applicable law, you have the right:

• To inquire whether we hold personal data about you and to request copies of such personal data and information about how it is processed;


• To request that inaccurate personal data be corrected;


• To request the deletion of personal data that is no longer necessary for the purposes for which it was collected, for which consent to processing has been revoked or that is processed in violation of applicable law;


• To request that we restrict the processing of personal data if it is not appropriate;
  To object to the processing of personal data;


• To request the portability of the personal data you have provided to us.

If you wish to do so, you can contact us at the address below at any time. It may take up to 30 days for us to respond to your inquiry.
If you have consented to the processing of your personal data for a specific purpose, you may withdraw your consent at any time and we will cease any further processing of your data for that purpose.
Complaints and supervisory authority
If you believe that we have not adequately addressed your complaints or concerns, you have the right to file a complaint with a competent data protection authority.

Responsible body
FREITAG lab. ag / Regroup ag
Binzmühlestrasse 170b
8050 Zurich
Switzerland
Telephone: +41 43 210 33 33

5.2. Japan

All personal data provided to Freitag lab. Japan is or collected by Freitag lab. Japan is primarily controlled by Freitag lab. Japan. All personal data collected by Freitag lab. AG is primarily controlled by Freitag lab. AG. We use your personal data for the purposes described in this privacy policy together with domestic and foreign subsidiaries of Freitag lab. AG, including Freitag lab. Japan. Freitag lab. Japan is the business operator primarily responsible for managing shared information.

We may create de-identified information using your email address, name, address, customer ID, order ID, session ID and/or other data.

Responsible body
FREITAG lab. Japan KK
3-5-14-7F, Kita-Aoyama
Minato-ku
107-0061 Tokyo
Japan