Privacy Statement

1.

Name and address of the person responsible

The person responsible within the meaning of the European Data Protection Basic Regulation and the Swiss Data Protection Act is the person who decides on the purposes and means of processing personal data:

BX Swiss AG
Talacker 50
8001 Zürich
Schweiz
Tel.: +41 (0)31 329 40 40
E-Mail.: office@bxswiss.com
Website: www.bxswiss.com

2.

Name and address of the Data Protection Officer

The data protection officer of the person responsible is:

Integritas Compliance AG
Hardeggerstrasse 20
3008 Bern
Switzerland
Tel.: +41 31 372 21 00
E-Mail: compliance@integritas-compliance.ch
Website: www.integritas-compliance.ch

3.

Access data

Each time you access our website, data and information are automatically collected by the computer system of the accessing computer.

The following data will be collected:

• IP address of the requesting computer

The above data is collected by us for the purpose of ensuring a smooth connection to the website and for the evaluation of system security and stability.

The legal basis for data processing is Art. 6 para. 1 lit. f GDPR. Our legitimate interest follows from the above-mentioned purposes of data collection.

The collected data are not used to draw conclusions about persons.

In addition, we use cookies (see point 6) and analysis services (see point 7) when you visit our website.

4.

Tools

For users who have a login for tools (Issuer Extranet / Reporting Tool) on our website, the following data is stored at the time of their login:

• IP address of the requesting computer
• Date and time of login

The collected data is stored in log files at our hosting provider (VI Company). This is done to ensure the functionality of the website after login.

If the data processing is carried out to fulfil legal obligations, the legal basis is Art. 6 Para. 1 lit. c GDPR. If the data processing is carried out to fulfil a contract, the legal basis is Art. 6 Para. 1 lit. b GDPR.

The collected data is deleted from the working memory 15 minutes after the logout or from the logfiles after 10 days.

5.

Newsletter

You can subscribe to a free newsletter on our website. When registering for the newsletter, the data from the input mask is transmitted to us. The following data is collected in the input mask:

• Name and first name
• E-Mail

In connection with the data processing for the dispatch of newsletters, the data will not be passed on to third parties. The data will be used exclusively for sending the newsletter.

The legal basis for the processing of the data after registration for the newsletter by the user is in the presence of a consent of the user Art. 6 Para. 1 lit. a GDPR.

The collection of the listed data serves to deliver the newsletter and to prevent misuse of the services or the e-mail address used.

The data will be deleted as soon as the subscription to the newsletter is cancelled.

The subscription of the newsletter can be cancelled by the affected user at any time. For this purpose you will find a corresponding link in every newsletter (email).

6.

Cookies

Our website uses cookies. Cookies are small text files that your browser automatically creates and that are stored on your device (laptop, tablet, smartphone, etc.) when you visit our website. Cookies do not cause any damage to your terminal device, do not contain viruses, Trojans or other malware.

The use of cookies serves on the one hand to make the use of our website more pleasant for you. We use so-called session cookies to recognize that you have already visited individual pages on our website and to set the language of the website. These are automatically deleted after leaving our website.

On the other hand, we use cookies to statistically record the use of our website and to evaluate it for you for the purpose of optimising our website (see point 7).

These cookies enable us to automatically recognise that you have already visited our website when you visit it again.

The data collected through cookies is necessary for the purposes mentioned to safeguard our legitimate interest pursuant to Art. 6 Para. 1 lit. f GDPR.

Most browsers automatically accept cookies. However, you can configure your browser so that no cookies are stored on your computer or a message always appears before a new cookie is created. The complete deactivation of cookies can, however, result in the functionality of our website being restricted.

7.

Google Analytics

Our website uses Google Analytics, a web analytics service provided by Google Ireland Limited, a company incorporated and operated under the laws of Ireland (registration number: 368047) with its registered office at Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter "Google Analytics").

Google Analytics uses so-called cookies. The information generated by the cookie about your use of this website will generally be transmitted to and stored by Google on servers in the United States.

However, if IP anonymization is enabled on this website, Google will previously truncate your IP address within member states of the European Union or other signatory states to the Agreement on the European Economic Area. Only in exceptional cases is the full IP address transmitted to a Google server in the USA and shortened there.

The IP address transmitted by your browser as part of Google Analytics is not combined with other data from Google. On our behalf, Google will use this information to evaluate your use of the website, compile reports on website activity and provide other services to the website operator relating to website activity and internet usage.

Our legitimate interest in data processing also lies in these purposes. The legal basis for the use of Google Analytics is Art. 6 para. 1 lit. f GDPR. The data sent by us and linked to cookies, user identifications (e.g. user ID) or advertising IDs are automatically deleted after 14 months. Data whose retention period has been reached is automatically deleted once a month.

Further information on the terms of use and data protection can be found at https://www.google.com/analytics/terms/de.html and https://policies.google.com/?hl=de.

8.

Duration of storage

Unless specifically stated, we will only store personal data for as long as is necessary to fulfill the purposes for which it was collected.

In some cases, Swiss legislation provides for the retention of personal data. In these cases, the personal data will only be stored by us for these legal purposes, but will not be processed elsewhere and deleted after the expiry of the legal retention period.

9.

Data transfer and transmission abroad

In principle, we use your personal data only within our company.

If and to the extent that we involve third parties in the performance of contracts (e.g. service providers, IT providers), such personal data will only be provided to the extent that the transmission is necessary for the corresponding service.

In the event that we outsource certain parts of the data processing (“contract processing”), we contractually oblige contract processors to use personal data only in accordance with the requirements of the GDPR and the Swiss Data Protection Act and to guarantee the protection of the rights of the data subject.

A data transfer to places or persons outside the EU or Switzerland does not take place and is not planned. The only exception to this is described in point 7.

10.

Rights of the data subject

If you process personal data, you are affected in the sense of the GDPR and the DPA. In addition to the rights under the DSG, you are also entitled to the following rights under the GDPR vis-à-vis the person responsible:

10.1. Right to information

Pursuant to Art. 15 GDPR, you have the right to request information about your personal data processed by us. In particular, you may request information about the purposes of the processing, the category of personal data, the category of recipients to whom your data has been or will be disclosed, the planned storage period, the existence of a right of rectification, deletion, limitation of processing or opposition, the existence of a right of appeal, the origin of the data if not collected from us, and the existence of an automated decision making process including profiling and, where appropriate, meaningful information on its details.

10.2. Right to rectification

Pursuant to Art. 16 GDPR, you have the right to demand immediate correction or completion of your personal data stored by us.

10.3. Right to cancellation

Pursuant to Art. 17 GDPR, you have the right to request the deletion of your personal data stored by us, unless processing is necessary for the exercise of the right to freedom of expression and information, for the fulfilment of a legal obligation, for reasons of public interest or for the assertion, exercise or defence of legal claims.

10.4. Right to limitation of processing

Pursuant to Art. 18 GDPR, you have the right to request the restriction of the processing of your personal data insofar as the accuracy of the data is disputed by you; the processing is unlawful but you refuse to delete it; we no longer need the data but you need it to assert, exercise or defend legal claims; or you have lodged an objection to the processing pursuant to Art. 21 GDPR.

10.5. Right to data transferability

Pursuant to Art. 20 GDPR, you have the right to receive the personal data that you have provided to us in a structured, common and machine-readable format or to request transmission to another responsible person.

10.6. Right of objection

Pursuant to Art. 21 GDPR, you have the right, for reasons arising from your particular situation, to object at any time to the processing of personal data relating to you on the basis of Art. 6 para. 1 lit. e or f GDPR.

10.7. Right to revoke the declaration of consent under data protection law

Pursuant to Art. 7 GDPR, you have the right to revoke your declaration of consent under data protection law at any time. The revocation of the consent does not affect the legality of the processing carried out on the basis of the consent up to the revocation.

10.8. Right to complain to a supervisory authority

Pursuant to Art. 77 GDPR, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your place of residence, your place of work or the place where the alleged infringement is suspected. This is the case if you are of the opinion that the processing of your personal data violates the GDPR.

11.

Data security

We take appropriate technical and organisational security measures in accordance with Art. 32 GDPR to protect your personal data from unauthorised access and misuse. Our security measures are continuously improved in line with technological developments.

12.

Changes

In order to ensure that our data protection declaration always complies with the current legal requirements, we reserve the right to make changes at any time.