Privacy Policy

‍
• Master data: This includes basic information (e.g., name, contact information), additional information about you (e.g., regarding roles and functions), and your relationship with us (e.g., customer, supplier, visitor, service recipient, or employee of such a party, etc.), bank account information, date of birth, photos, copies of identification documents, customer history, any powers of attorney, signature authorizations, and declarations of consent, as well as information about third parties (e.g., contact persons, representatives).
‍
• Registration data: This refers to data collected as part of a registration process (online or via an app) with us, or data you provide to us (e.g., username, email, password), as well as data collected in connection with contests or when redeeming gift cards, and, where applicable, access data collected as part of access controls (which may also include biometric data).
• Contract data: This includes data generated in connection with a contract we have entered into or in the course of providing our services, such as details regarding the type of contract, the date the contract was concluded, the contract term, contractual services, data from the period prior to the conclusion of the contract, and information required or used for processing (e.g., information regarding invoicing or customer service, information about feedback (e.g., complaints or satisfaction ratings, etc.), financial data (e.g., information regarding solvency/creditworthiness, reminders, and debt collection).
• Communication data: This refers to data generated in connection with communication between us and with third parties (e.g., via contact form, email, telephone, or letter), such as the content of emails or letters, your contact information, and ancillary communication data, including, where applicable, a copy of an identification document. This also includes video and audio recordings of (video) phone calls.
• Technical data: This refers to data generated in connection with the use of our electronic services (e.g., website, apps, free Wi-Fi), such as your IP address, information about your device’s operating system, the region, and the time of use. Technical data alone generally does not allow us to identify you. However, it can be combined with other categories of data (e.g., registration data) and thus, in some cases, linked to you personally.
• Behavioral and preference data: This refers to data about your behavior and preferences, such as responses to electronic communications, navigation on the website, interactions with our social media profiles, participation in contests or events, etc., which may be supplemented with information from third parties (including from publicly available sources). Regarding tracking, see Section 13.
• Job Application Data: This refers to data that we process in connection with a job application submitted to us and that is included, among other things, in your application materials (e.g., professional history, education and training, references). We may also obtain data from public sources, such as professional social networks, the Internet, or the media.
• Other data: This may include, among other things, the following information and data: data arising in connection with administrative or judicial proceedings (e.g., case files, evidence, etc.), data collected for health protection purposes (e.g., as part of safety protocols), photos, videos, or audio recordings that we produce or receive from third parties and in which you are recognizable (e.g., at events, via security cameras, etc.), access data or rights (e.g., according to visitor logs, when you enter certain buildings or what access rights you have), participation in events or activities (e.g., contests and events), and when you use our infrastructure and systems. Data related to your status as a shareholder or investor with us (e.g., information for various registries, the exercise of your rights, and the organization of events such as general meetings).

• From you: You provide us with much of the data mentioned in Section 3 yourself (e.g., when communicating with us, in connection with contracts or our services, through the use of our website and other services, etc.). You are not obligated to provide your data, with exceptions in individual cases (e.g., legal obligations such as legally required identity verification or security measures). However, if you wish to enter into contracts with us or use our services (for yourself or your employer or client), you must provide us with certain data (in particular, master data, contract data, and registration data). When using our website and apps, the processing of technical data is unavoidable. If you wish to gain access to certain systems or buildings, you may need to provide us with registration data. However, with regard to behavioral and preference data, you generally have the option to object or withhold consent.
• From third parties: To the extent permitted, we may also obtain data from publicly available sources (e.g., debt collection registers, land registries, commercial registries, media, or the Internet, including social media) or receive such data from government agencies and other third parties (e.g., credit bureaus, address brokers, associations, contractual partners, web analytics services, etc.). This includes, in particular, the following categories: master data, contract data, and other data, as well as all other data categories listed in Section 3 and data from correspondence and meetings with third parties. If you work for an employer, client, or any other party that has a business relationship with us or otherwise deals with us, that party may also provide us with data about you.

• Communication: In order to communicate with you (e.g., to respond to inquiries, in the context of consulting, and for contract fulfillment), we must process data (in particular, communication and master data, as well as registration data in connection with the services you use) from you. If we need to or wish to verify your identity, we will collect additional data (e.g., a copy of an ID). For this purpose, we use, in particular, communication data and master data, as well as registration data in connection with the services you use.
• Contract Formation, Management, and Execution: In connection with the conclusion and execution of contracts with our customers, suppliers, subcontractors, or other contractual partners (e.g., project partners), we process related personal data. For this purpose, we also process data to assess creditworthiness, to establish and manage the customer relationship, to provide advice and customer support, and to perform and enforce contractual obligations (which also includes engaging third parties, such as logistics companies, advertising service providers, or credit bureaus, which may in turn provide us with data). This also includes the enforcement of legal claims arising from contracts (debt collection, legal proceedings, etc.), accounting, the termination of contracts, and public communications. For these purposes, we use, in particular, master data, contract data, and communication data, as well as, where applicable, registration data of the customer or of the persons for whom the customer arranges a service, and technical data (e.g., for digital offerings).
• Marketing purposes and relationship management: For marketing purposes and to foster customer relationships, we process data, for example, to send our customers, other contractual partners, and other interested parties personalized advertising (e.g., in print, via email, through an app, via other electronic channels, or by phone) regarding products, services, and other news from us and from third parties (e.g., product partners), in connection with free services (e.g., invitations, coupons, etc.) or as part of individual marketing campaigns (e.g., events, contests, etc.). You may opt out of such communications at any time or refuse or withdraw your consent to be contacted for advertising purposes by notifying us (Section 2). With your consent, we can tailor our online advertising on the Internet more specifically to you (see Section 13). This also includes interacting with existing customers and their contacts, which can be personalized based on behavioral and preference data. As part of our relationship management, we may also operate a customer relationship management (CRM) system in which we store the data of customers and other business partners. Finally, we also allow our contractual partners to contact our customers and other contractual partners for advertising purposes (see Section 8). For marketing purposes and to maintain customer relationships, we process, in particular, communication, registration, behavioral, and preference data.
• Market research, improvement of our services and operations, and product development: To continuously improve our products and services (including our website and other electronic offerings) and to be able to respond quickly to changing needs, we analyze, for example, how you navigate our website, which products are used by which groups of people and in what ways, and how new products and services can be designed (for further details, see Section 13). This provides us with insights into the market acceptance of existing products and services and the market potential of new ones. To this end, we process, in particular, master data, behavioral data, and preference data, as well as communication data and information from customer surveys, polls, and studies, and other information, e.g., from the media, social media, the Internet, and other public sources. To the extent reasonably feasible, we use pseudonymized or anonymized data for these purposes.
• Registration and security purposes, as well as technical and physical access controls: To use certain offerings and services (e.g., login areas, free Wi-Fi), you must register (either directly with us or through our external login service providers); we process data for this purpose. Furthermore, we also collect additional personal data about you while you are using the offering or service. We continuously review and improve the appropriate security of our IT systems and other infrastructure (e.g., buildings). We therefore process data, for example, for monitoring, checks, analyses, and tests of our networks and IT infrastructure; for system and error checks; for documentation purposes; and as part of backup procedures. Access controls include, on the one hand, controlling access to electronic systems (e.g., logging into user accounts) and, on the other hand, physical access control (e.g., building access). For security purposes (both preventative and to investigate incidents), we also maintain access logs and visitor lists and use surveillance systems (e.g., security cameras). We notify you of the presence of surveillance systems at the relevant locations through appropriate signage. For this purpose, we process, in particular, registration data (including biometric data) and technical data, as well as other data mentioned in Section 3.
• Compliance with laws, directives, and recommendations from authorities and internal regulations (“Compliance”): In order to comply with laws, we may process personal data (e.g., anti-money laundering, tax obligations, implementation of health and safety measures). In addition, data processing may occur in connection with internal investigations as well as external investigations (e.g., by a law enforcement or supervisory authority or a commissioned private entity). For this purpose, we process, in particular, master data, contract data, and communication data; under certain circumstances, however, we may also process behavioral data, technical data, and data from the “other data” categories. Legal obligations may include Swiss law, as well as foreign regulations to which we are subject, self-regulatory measures, industry standards, our own “corporate governance,” and official instructions and requests.
• Risk Management and Corporate Governance: We may process personal data in the context of risk management (e.g., to protect against criminal activities) and corporate governance, including our operational organization (e.g., resource planning) and corporate development (e.g., the acquisition and sale of business units or companies). For this purpose, we process, in particular, master data, contract data, registration data, and technical data, as well as behavioral and communication data.
• Job Applications: If you apply for a position with us, we collect and process the relevant data for the purpose of reviewing your application, conducting the application process, and—in the event of a successful application—preparing and concluding the corresponding contract. Data processing in connection with the employment relationship is covered by a separate privacy policy
• Other Purposes: These other purposes include, for example, training and educational purposes, administrative purposes (e.g., managing master data or accounting), safeguarding our rights, and evaluating and improving internal processes. We may record telephone or video conferences for training, evidence-gathering, and quality assurance purposes. In such cases, we will notify you separately (e.g., via a notification during the relevant video conference), and you are free to inform us if you do not wish to be recorded or to end the communication (if you simply do not wish your image to be recorded, please turn off your camera). In general, such recordings may only be made and used in accordance with our internal guidelines. The protection of other legitimate interests is also among the additional purposes, which cannot be listed exhaustively. We also process data related to your status as a shareholder or investor in our company (e.g., information for various registries, the exercise of your rights, and the organization of events such as general meetings).

• Contract: To the extent that we process data for the conclusion and performance of contracts that we enter into or have entered into for you, with you, or with your employer, client, or other persons on whose behalf you act, this also constitutes the legal basis on which we process your data.
• Legal Obligations: We may also process your data based on the applicable legal, regulatory, and professional ethical requirements that we are required to comply with.
• Legitimate Interest: We may process your data based on our legitimate interest or the legitimate interest of a third party. This applies in particular to achieving the purposes and objectives set forth in Section 5 and to carrying out related measures. Among other things, we have a legitimate (and overriding) interest in marketing our products and services, as well as in gaining a better understanding of the markets relevant to us and our business (in particular, in the efficient and secure execution of our processes and the further development of our activities), in the efficient and effective management of our company, and in safeguarding the security of our systems and our interests vis-à-vis third parties.
• Consent: When we ask for your consent to process your data, this serves as the legal basis on which we process your data. We will inform you of the purpose of the processing. You may revoke your consent at any time by sending us written notice (by mail or, unless otherwise specified or agreed, by email), effective for the future (see Section 2 for our contact information and Section 13 regarding the withdrawal of your consent in the area of online tracking). As soon as we have received and processed your notice of withdrawal of consent, we will no longer process your data for the purposes to which you originally consented (unless further processing is permitted on another legal basis).
• Other Legal Bases: In specific cases, we may also process data based on other legal bases. If this is the case, we will inform you on a case-by-case basis.

• Group companies: The group companies (Werap-Wicklerei AG, Werap-Elektronik AG, Werap Holding AG, CAC Fabrimex GmbH) may use your data, as described in this Privacy Policy, for the same purposes as we do (see Section 5). We may also disclose your health data to our group companies. The recipients generally process the data under their own responsibility, but may also process it on our behalf or under joint responsibility with us.
• Service Providers: We work with service providers in Switzerland and abroad (third parties) who process data about you (i) on our behalf, (ii) under joint responsibility with us, or (iii) on their own responsibility using data they have received from us (e.g., IT providers, shipping companies, advertising service providers, cleaning companies, security firms, banks, insurance companies, debt collection agencies, credit bureaus, address verification services, consulting firms, or attorneys). This may also include health data. For information on the service providers used for the website, see Section 13.· Contractual partners, including customers: This primarily refers to our customers and other contractual partners where the transfer of your data results from the contract (e.g., because you work for a contractual partner or because they provide services to or for you). Recipients also include contractual partners with whom we cooperate or who conduct advertising on our behalf. Contractual partners may, for example, receive registration data regarding issued and redeemed vouchers, invitations, etc. The recipients generally process the data under their own responsibility.
• Government Authorities: We may disclose personal data to government agencies, courts, and other authorities both domestically and abroad if we are legally obligated or authorized to do so, or if it appears necessary to protect our interests. This may also include health data. The recipients process the data under their own responsibility.
• Other Persons: This refers to other cases where the involvement of third parties arises from the purposes set forth in Section 5. Other recipients include, for example, delivery addresses you have provided or third-party payees, third parties acting as your representatives (e.g., your attorney or your bank), or persons involved in administrative or court proceedings. If we collaborate with media outlets and provide them with material (e.g., photos), you may also be affected under certain circumstances. As part of our business development, we may sell or acquire businesses, business units, assets, or companies, or enter into partnerships, which may also result in the disclosure of data (including yours, e.g., as a customer, supplier, or their representative) to the parties involved in these transactions. In the course of communicating with our competitors, industry organizations, associations, and other bodies, data may also be exchanged that may pertain to you.

We also allow certain third parties to collect personal data from you on our website and at events we organize (e.g., media photographers, providers of tools we have integrated into our website, etc.). To the extent that we are not significantly involved in this data collection, these third parties are solely responsible for it. If you have any concerns or wish to exercise your data protection rights, please contact these third parties directly. See Section 13 for the website.

‍We process and store personal data primarily in Switzerland and within the European Economic Area (EEA). In isolated cases, however, we may also transfer personal data to service providers and other recipients (see Section 8) who are located outside this area or who process personal data outside this area—in principle, in any country in the world.

If a recipient is located in a country without adequate legal data protection, we contractually oblige the recipient to comply with applicable data protection laws (for this purpose, we use the European Commission’s revised Standard Contractual Clauses, which are available here: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?), unless the recipient is already subject to a legally recognized framework for ensuring data protection and we cannot rely on an exception. An exception may apply, in particular, in the case of legal proceedings abroad, but also in cases of overriding public interest, or if the performance of a contract requires such disclosure, if you have given your consent, or if the data in question has been made publicly available by you and you have not objected to its processing.

Please also note that data exchanged over the Internet is often routed through third countries. Your data may therefore be transferred abroad even if the sender and recipient are located in the same country.

‍We process your data for as long as required by our processing purposes, statutory retention periods, and our legitimate interests in processing for documentation and evidentiary purposes, or as long as storage is technically necessary (e.g., in the case of backups or document management systems). Unless prevented by legal or contractual obligations, we will delete or anonymize your data after the retention or processing period has expired as part of our standard procedures.

‍Unless there are specific legal retention requirements in individual cases, we generally process personal data for the duration of the business relationship or the term of the contract and, thereafter, depending on the applicable legal basis, for an additional five, ten, or more years. This corresponds to the period during which we or third parties may assert legal claims against one another. Ongoing or anticipated legal proceedings may result in processing beyond this period. See Section 13.2 for more information on the retention period for cookies.

Under certain circumstances, applicable data protection law grants you the right to object to the processing of your data, particularly for the purposes of direct marketing, profiling for direct marketing, and other legitimate interests in processing.To help you maintain control over the processing of your personal data, you also have the following rights in connection with our data processing, depending on the applicable data protection law:

• The right to request information from us regarding whether and what data we process about you;
• the right to have us correct data if it is inaccurate;
• the right to request the erasure of data;
• the right to request that we provide certain personal data in a commonly used electronic format or transfer it to another data controller;
• the right to withdraw consent, to the extent that our processing is based on your consent;
• the right to receive, upon request, further information necessary to exercise these rights;

If you wish to exercise the above rights with us, please contact us in writing, in person at our office, or—unless otherwise specified or agreed—by email; You can find our contact information in Section 2. To prevent misuse, we must verify your identity (e.g., with a copy of your ID, unless this can be done by less intrusive means).

You also have these rights with respect to other entities that work with us on their own behalf—please contact them directly if you wish to exercise rights related to their processing activities. Information about our key partners and service providers can be found in Section 8; further details are provided in Section 13.

Please note that these rights are subject to conditions, exceptions, or restrictions under applicable data protection law (e.g., to protect third parties or trade secrets). We will inform you accordingly if necessary.

If you disagree with how we handle your rights or data protection, please let us know. In particular, if you are located in the EEA, the United Kingdom, or Switzerland, you also have the right to file a complaint with your country’s data protection supervisory authority. A list of authorities in the EEA can be found here: https://edpb.europa.eu/about-edpb/board/members_de. You can contact the UK supervisory authority here: https://ico.org.uk/global/contact-us/. You can also contact the Federal Data Protection and Information Commissioner: https://www.edoeb.admin.ch/edoeb/de/home/deredoeb/kontakt.html.

‍On our website (including apps, newsletters, and other digital offerings), we use various technologies (e.g., cookies, fingerprinting, tracking pixels, and similar techniques) that allow us and third parties we engage to recognize you during your use of our services and, in some cases, to track you across multiple visits.

We use our own tools as well as, at times, third-party services, in particular to improve the functionality or content of our website (e.g., integration of videos or maps), to compile statistics, and to display advertisements. This enables us and authorized third-party providers to offer you a personalized web experience (e.g., personalized advertising, interactions on social media sites, etc.).

1. 12.1 What Are Cookies and Similar Technologies

   ‍A cookie is a small text file containing an identifier (a sequence of letters and numbers) that is transmitted between the server and your system. This enables us and third-party providers we engage or with whom we collaborate to recognize visitors to our website and track them across multiple visits and across different websites. Cookies enable the recognition of a specific device or browser and do not necessarily contain information that personally identifies a user. However, personal data that we or third-party providers we have commissioned or with whom we collaborate store about you (e.g., if you have a user account with us or these providers) may be linked to the information stored in cookies and derived from them, and thus potentially to you personally.

   In addition to cookies, there are other similar technologies, such as pixel tags, fingerprints, and social media plug-ins. Pixel tags are small, usually invisible images or pieces of code that are loaded from a server and provide the server operator with certain information (e.g., access to a web page). Fingerprints consist of information collected during your visit to the website regarding the configuration of your device or browser, which makes it possible to distinguish your device from other devices. Social media plug-ins are small software components that establish a connection between your visit to our website and a third-party social media platform. The social media plug-in notifies the third-party provider that you have visited our website and may transmit cookies to the third-party provider that it has previously placed on your web browser. For more information on how these third parties use the personal data they collect via their social media plug-ins, please refer to their respective privacy policies.

2. 12.2 What types of cookies and similar technologies do we use?

   The cookies and similar technologies we use on our websites serve the following purposes (similar techniques are included in each case):

   • Essential Cookies: Some cookies are essential for using the website and its features. These cookies ensure the website’s basic functionality, such as the ability to navigate from page to page without losing the items in your shopping cart. They also ensure that you remain logged in to the website. These cookies have an expiration period of up to [12] months.
   • Performance and Analytics Cookies: Performance and analytics cookies collect information about how our website is used and allow us to analyze website usage, such as which pages are visited most frequently and how visitors navigate our website. These cookies are used to make visiting the website easier and faster and to generally improve the user experience and convenience. For this purpose, we use third-party analytics services. Before we use such cookies, we ask for your consent. You can revoke this consent at any time via the cookie settings here [Link] [RN(58] [MG59]. These cookies have an expiration period of up to [24] months.
   • Marketing Cookies: Marketing cookies help us and our advertising partners show you ads on our website for offers or services that may be of interest to you, or display our ads as you continue browsing the internet after leaving our website—that is, to show you targeted ads. Depending on the circumstances, these cookies have an expiration period ranging from [a few days] to [12] months.

   Details about our third-party providers and advertising partners can be found in the Consent Management System, which is available here: https://de.borlabs.io/borlabs-cookie/. In the Consent Management System, you also have the option to disable certain categories of cookies by adjusting the relevant settings. Some of the third-party providers we use may be located in a country other than our own. Information on the transfer of data abroad can be found in Section 9. By consenting to the use of cookies, you agree that your data may be transferred to a country that does not have an adequate level of data protection, and you accept the risk that your data in the recipient’s country may be subject to access by foreign authorities that do not adhere to adequate data protection regulations. You may withdraw your consent to cookies at any time, as explained in Section 13.3. ‍

3. 12.3 How can I control the use of cookies and similar technologies?

   ‍You can manage your preferences regarding the use of cookies and similar technologies on our website by accessing the Consent Management System available here: https://de.borlabs.io/borlabs-cookie/

   ‍Browsers can automatically accept or reject cookies, but they allow you to change these settings. You can also disable or delete cookies that you have previously accepted. Please note that all settings will be lost if you delete all cookies, including the setting to not accept cookies, as this in turn requires that an opt-out cookie has been set. You must configure these settings separately for each browser you use. To learn how to manage cookies in your browser, consult your browser’s help menu.

   If you choose to reject cookies and similar technologies, you can still use our website; however, your access to some features and areas of our website may be restricted.

‍We may operate pages and other online presences (“fan pages,” “channels,” “profiles,” etc.) on social media and other third-party platforms, where we process the data about you described in Section 3 and below. We receive this data from you and the platforms when you interact with us through our online presence (e.g., when you communicate with us, comment on our content, or visit our page). At the same time, the platform providers may analyze your use of our online presences (e.g., the way you interact with us, how you use our online presences, what you view, comment on, or “like”) and process this data together with other data they have about you (e.g., information about your age and gender, as well as other demographic information). In this way, they create profiles about you and statistics regarding the use of our online presence. They use this data and these profiles to display our or other advertisements and other personalized content on the platform and to manage user behavior on the platform, as well as for market and user research and to provide us and other parties with information about you and your use of our online presence. To the extent that we are jointly responsible with the provider for certain types of processing, we will enter into a corresponding agreement with the provider. You can obtain information about the essential content of this agreement from the provider. They also process this data for their own purposes, in particular for marketing and market research (e.g., to personalize advertisements) and to manage their platforms (e.g., to decide what content to show you), and act as separate data controllers for this purpose.We are entitled, but not obligated, to review content before or after it is published on our online platforms, to delete content without notice, and, if necessary, to report it to the provider of the relevant platform. In the event of violations of rules of decency and conduct, we may also notify the provider of the platform on which the relevant user account is located to block or delete the account.

For further information on processing by the platform operators, please refer to the privacy policies of the respective platforms. There you can also find out in which countries your data is processed, what rights you have regarding access and deletion, and how you can exercise these rights or obtain further information. We currently use the following platforms:

‍LinkedIn:
Our profile: https://www.linkedin.com/company/werap-ag-bubikon/about/ ‍

‍This Privacy Policy is not part of a contract with you. We may update this Privacy Policy at any time. The version published on this website is the most current version.

Last updated: [2024-02-20]