Data protection

Name and contact details for the controller in accordance with article 4, paragraph 7 GDPR

Schweizerische Schälmühle
E. Zwicky AG
CH-8554 Müllheim-Wigoltingen 

Tel.: +41 (0) 52 - 762 64 40
Fax: +41 (0) 52 - 763 32 14

Mail: info@zwicky.ch

Data security and protection for your personal data

We consider it our primary task to keep the personal data you supply to us confidential and to protect it against unauthorised access. For this reason, we apply the greatest care and employ state-of-the-art security standards to ensure maximum protection for your personal data.

As a private-law company, we are subject to the rulings of the European General Data Protection Regulation (GDPR) and the regulations of the Federal Data Protection Act (BDSG). We have put in place technical and organisational measures to ensure that the data protection legislation requirements are met by us and by our external service providers.

Definitions 

The law requires personal data to be processed lawfully, fairly and in a transparent manner for the data subject (“legality, fairness during processing, transparency”). To ensure that this is done, we wish to inform you about the individual legal definitions that are also used in this data protection declaration:

1. Personal data
   The term “personal data” means any information relating to an identified or identifiable natural person (referred to in the following as the “data subject”); a natural person is deemed to be identifiable if said person can be identified directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or one or more distinctive features specific to the physical, physiological, genetic, mental, economic, cultural or social identity of this natural person.
2. Processing
   “Processing” is any operation or set of operations that is performed on personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, usage, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
3. Restriction of processing
   The term “restriction of processing” means the marking of stored personal data with the aim of limiting its processing in the future.
4. Profiling
   “Profiling” is any form of automated processing of personal data consisting of the use of personal data in order to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects relating to that person’s work performance, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.
5. Pseudonymisation
   "Pseudonymisation” means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided such additional information is retained separately and is subject to technical and organisational measures to ensure that the personal data cannot be attributed to an identified or identifiable natural person.
6. File system
   A “file system” is any structured collection of personal data that can be accessed based on certain criteria, irrespective of whether this collection is held centrally, decentrally or dispersed on the basis of functional or geographical criteria.
7. Controller
   The “controller” is a natural or legal person, authority, institution or other body that, alone or together with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are defined by EU or Member State law, the controller or the specific criteria for its nomination can be provided for by EU or Member State law.
8. Processor
   The “processor” is a natural or legal person, authority, institution or other body that processes personal data on behalf of the controller.
9. Recipient
   The “recipient” is a natural or legal person, authority, institution or other body to whom or to which personal data is disclosed, whether a third party or not. However, public authorities that may receive personal data in the framework of a particular enquiry in accordance with EU or Member State law shall not be regarded as recipients; the processing of this data by these stated authorities shall be compliant with the applicable data protection regulations for the purposes of the processing.
10. Third party
    A “third party” is a natural or legal person, public authority, institution or body other than the data subject, controller, processor or persons who, under the direct responsibility of the controller or processor, are authorised to process the personal data.
11. Consent
    “Consent” from the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by means of which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data concerning him or her.

Lawfulness of processing

The processing of personal data is only lawful if there is a legal basis for the processing. A legal basis for processing can be given pursuant to points (a) to (f) of article 6, paragraph 1 GDPR in particular in the following cases:

• a. The data subject has given consent to the processing of his or her personal data for one or more specific purposes;
• b. Processing is required for the performance of a contract to which the data subject is party, or for the purpose of taking steps at the request of the data subject prior to entering into a contract;
• c. Processing is required for compliance with a legal obligation on the part of the controller;
• d. Processing is required in order to protect vital interests of the data subject or of another natural person;
• e. Processing is required in order to perform a task carried out in the public interest or in the exercise of official authority vested in the controller;
• f. Processing is required for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by interests or fundamental rights and freedoms of the data subject that require protection of personal data, in particular where the data subject is a child.

Information about the collection of personal data

(1) The following section contains information about the collection of personal data during usage of our website. Personal data includes e.g.: name, address, e-mail addresses, user behaviour.
 
(2) If contact is made to us via e-mail or via a contact form, the data you share (your e-mail address, possibly your name and your telephone number) will be saved by us so that we can answer your questions. We delete the data collected in this context once it is no longer required to be stored, or the processing is restricted if legal retention requirements apply.

Collection of personal data during visits to our website

If you visit our website purely to look at the information provided, i.e. if you do not register with us or send us information through other means, we will collect only the personal data sent by your browser to our server. If you wish to look at our website we will collect the following data, which is technically required by us to display our website to you and to ensure its stability and security (the legal basis for this is point (f) of article 6, paragraph 1, page 1 GDPR):

• IP address
• Date and time of the request
• Time zone difference to Greenwich Mean Time (GMT)
• Content of the request (specific page)
• Access status/HTTP status code
• Data volume transmitted in each case
• Website from which the request originates
• Browser
• Operating system and its user interface
• Language and version of the browser software

Use of cookies

(1) In addition to the data mentioned above, cookies are saved on your computer when you use our website. Cookies are small text files that are saved on the hard drive of the browser you are using and are used to share information with the site that has saved the cookie on your hard drive. Cookies cannot execute any programs or transmit viruses to your computer. They serve to make Internet offerings more user friendly and more effective overall.

(2) This website uses the following types of cookies, and their scope and operating principle are explained below:

Transient cookies (see a.)
Persistent cookies (see b.)

• a. Transient cookies are automatically deleted when you close your browser. They include session cookies in particular. These save a so-called session ID, with which various requests from your browser can be assigned to the shared session. This allows your computer to be recognised if you return to our website. Session cookies are deleted when you log out or close the browser.
• b. Persistent cookies are automatically deleted after a predefined length of time, which can vary from one cookie to another. You can delete these cookies via the security settings of your browser at any time.
• c. You can configure the browser settings to suit your own preferences and e.g. reject the acceptance of third-party cookies or all cookies. So-called “third-party cookies” are cookies that are placed on a user’s hard drive from a third-party website, i.e. not from the actual website you are visiting. Please note that you may not be able to take advantage of all the functions of this website if you deactivate cookies.

Further functions and services offered on our website

(1) In addition to the option of using our website purely for information purposes, the website also offers a range of other services you can take advantage of if you are interested. In order to do this you will generally need to provide personal information, which we will then use to provide the relevant service and which will be covered by the data processing principles stated above.

(2) In some cases we employ external service providers to process your data. These service providers have been carefully selected by us. They are bound to follow our instructions and are regularly checked.

(3) In addition, we can also share your personal data with third parties in cases where participation in special events, competitions, contract conclusions or similar services are offered by us together with partners. Further information about this will be provided to you when you submit your personal data or below in the description of the service offering.

(4) Insofar as our service providers or partners have their headquarters in a country outside the European Economic Area (EEA), we will inform you what this means for you in the description of the service offering.

Children

Our offering is generally intended for adults. Persons under the age of 18 years should never submit personal data to us without the approval of their parents or other persons with parental authority.

Rights of the data subject

(1) Withdrawal of consent

If the processing of personal data is based on consent that you have granted, you have the right to withdraw that consent at any time. If you withdraw your consent, this does not affect the lawfulness of data processing that has taken place based on the consent before its withdrawal.

You can contact us at any time to withdraw your consent.

(2) Right of confirmation

You have the right to demand confirmation from the controller about whether or not we process personal data concerning you. You can request this confirmation at any time using the contact data provided above.

(3) Right to be informed.

If personal data is processed, you can demand at any time to be given information about this personal data and about the following information: 

• a. the purposes of processing;
• b. the categories of personal data that are processed;
• c. the recipients or categories of recipients to whom the personal data have been or still will be disclosed, in particular in relation to recipients in third countries or in relation to international organisations;
• d. if possible, the planned length of time for which the personal data will be stored, or if this is not possible, the criteria for defining this length of time;
• e. the existence of a right to correct or erase the personal data concerning you, or to restrict processing by the controller, or of a right to object against this processing;
• f. the existence of a right to lodge a complaint with a supervisory authority;
• g. if the personal data is not collected from the data subject, all the available information about the origin of the data;
• h. the existence of automated decision making including profiling pursuant to article 22, paragraphs 1 and 4 GDPR and, at least in these cases, meaningful information about the logic involved and the significance and envisaged consequences of such processing for the data subject.

If personal data is transmitted to a third country or to an international organisation, you have the right to be informed about the appropriate guarantees pursuant to article 46 GDPR in connection with the transmission. We will provide a copy of the personal data that is the subject of processing. For all further copies you request personally we can demand appropriate payment based on our administrative costs. If you make the request electronically, the information will be made available in a standard electronic format provide nothing else is specified. The right to receive a copy in accordance with paragraph 3 must not impair the rights and freedoms of other persons.

(4) Right to rectification

You have the right to demand that we immediately correct any incorrect personal data we hold in relation to you. Taking into account the purposes of processing, you have the right to demand the completion of incomplete personal data – including by means of a supplementary declaration.

(5) Right to erasure (“right to be forgotten”)

You have the right to demand from the controller that personal data concerning you is deleted immediately, and we are obliged to delete personal data immediately if one of the following cases applies:

• a. The personal data is no longer required for the purposes for which it was collected or processed by other means.
• b. The data subject withdraws their consent upon which the processing was based pursuant to point (a) of article 6, paragraph 1 or point (a) of article 9, paragraph 2 GDPR and there is no other legal basis for processing.
• c. The data subject raises an objection pursuant to article 21, paragraph 1 GDPR against the processing and there are no overriding legitimate reasons for processing, or the data subject raises an objection against processing pursuant to article 21, paragraph 2 GDPR.
• d. The personal data has been processed unlawfully.
• e. The erasure of the personal data is required in order to comply with a legal obligation based on EU or Member State law to which the controller is subjected.
• f. The personal data was collected in relation to offered information society services pursuant to article 8, paragraph 1 GPDR.

If the controller has made the personal data public and is obliged to erase said data pursuant to paragraph 1, the controller – taking into account the available technology and cost of implementation – shall take reasonable steps, including technical measures, to inform the controllers processing the personal data that the data subject has requested the erasure by such controllers of any links to, or copies or replications of, this personal data.

The right to erasure (“right to be forgotten”) does not apply if the processing is necessary for the following reasons: 

• to exercise the right to freedom of expression and information;
• to satisfy a legal obligation that requires the processing based on EU or Member State law to which the controller is subjected, or that takes place as part of the exercise of official authority vested in the controller;
• for reasons of public interest in the field of public health pursuant to points (h) to (i) of article 9, paragraph 2 as well as article 9, paragraph 3 GDPR;
• for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with article 89, paragraph 1 GDPR, in so far as the right referred to in paragraph 1 is likely to render impossible or seriously impair the achievement of the objectives of that processing; or
• in order to enforce, exercise or defend legal claims.

(6) Right to restriction of processing

• a. The correctness of the personal data of the data subject is contested, specifically for a duration that enables the controller to verify the correctness of the personal data;
• b. The process is unlawful and the data subject rejects the deletion of the personal data and instead demands restriction of the usage of the personal data;
• c. The controller no longer requires the personal data for the purpose of processing, but the data subject still requires the data in order to enforce, exercise or defend legal claims; or
• d. The data subject has raised an objection against the processing pursuant to article 21, paragraph 1 GDPR, while it is not yet clear whether the legitimate reasons of the controller outweigh those of the data subject.

If processing has been restricted in accordance with the above preconditions then such personal data shall – with the exception of storage – only be processed with the consent of the data subject or for the enforcement, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State. 

In order to be able to assert the right to restriction of processing, the data subject can contact us at any time under the contact details provided above. 

(7) Right to data portability

You have the right to receive personal data you have provided in a structured, commonly used and machine readable format, and you have the right to request that this data be transferred to a different controller without hindrance from the controller to whom the personal data was originally made available, provided:

• a. the processing is based on consent pursuant to point (a) of article 6, paragraph 1 or point (a) of article 9, paragraph 2 or on a contract pursuant to point (b) of article 6, paragraph 1 GDPR, and
• b. the processing is carried out by automated methods.

When exercising your right to data portability in accordance with paragraph 1, you have the right to have the personal data transmitted directly from one controller to another, where technically feasible. The exercise of the right to data portability does not affect the right to erasure (“right to be forgotten”). This right shall not apply to processing that is required for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

(8) Right to object

You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you based on point (e) or (f) of article 6, paragraph 1 GDPR; this also applies to profiling based on these provisions. The controller shall no longer process the personal data unless the controller can demonstrate compelling legitimate grounds for the processing that override the interests, rights and freedoms of the data subject, or in order to assert, exercise or defend legal claims.

Where personal data is processed for direct marketing purposes, you have the right to object at any time against the processing of personal data concerning you for the purpose of such marketing; this also includes profiling to the extent that it is connected to such direct marketing. If you object to processing for direct marketing purposes, the personal data shall no longer be processed for these purposes.

In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, you  may exercise your right to object by automated means using technical specifications.

Where personal data is processed for scientific or historical research purposes or for statistical purposes pursuant to article 89 paragraph 1, you have the right, on grounds relating to your particular situation, to object to processing of personal data concerning you, unless the processing is necessary for the performance of a task carried out for reasons of public interest.

You can exercise this right to object at any time by contacting the relevant controller.

(9) Automated individual decision-making, including profiling

You have the right not to be subjected to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or significantly adversely affects you in other, similar ways. This shall not apply if the decision:

• a. is necessary for entering into, or performance of, a contract between the data subject and the controller,
• b. is permissible by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard the rights, freedoms and legitimate interests of the data subject; or
• c. is based on the express consent of the data subject.

The controller shall put in place suitable measures to safeguard the rights, freedoms and legitimate interests of the data subject, including at least the right to obtain human intervention on the part of the controller, to express his or her point of view and to contest the decision.

The data subject can exercise this right at any time by contacting the relevant controller.

(10) Right to lodge a complaint with a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, your place of work or the place of the alleged infringement, if the data subject considers that the processing of personal data relating to him or her infringes this regulation. 

(11) Right to an effective judicial remedy

Without prejudice to any other administrative or non-judicial remedy, including the right to lodge a complaint with a supervisory authority in accordance with article 77 GDPR, you have the right to an effective judicial remedy if you believe that the rights you are due on the basis of this regulation have been violated because your personal data has been processed in a way that goes against this regulation.

Use of Google Analytics

(1) This website uses Google Analytics, a web analytics service provided by Google Inc. (“Google”). Google Analytics uses so-called cookies, text files that are saved on your computer and enable your usage of the website to be analysed. The information generated by the cookie about your usage of this website is normally transmitted to one of Google’s servers in the USA and stored there. If you choose to activate IP anonymisation on this website, your IP address will, however, be shortened within member states of the European Union or in other states who are party to the Agreement on the European Economic Area. Only in exceptional cases is the full IP address transmitted to one of Google’s servers in the USA and shortened there. On behalf of the operator of this website, Google will use this information to analyse your usage of the website in order to compile reports about website activities and to provide further services to the website operator that are linked to the usage of the website and of the Internet.

(2) The IP address transmitted by your browser in the context of Google Analytics is not combined with other data held by Google.

(3) You can prevent cookies from being saved by changing the corresponding settings in your browser software; however, please be aware that if you do this you may not be able to use all the functions available on our website in full. In addition, you can prevent the data generated by the cookie relating to your usage of the website (including your IP address) from being captured and processed by Google by downloading and installing the browser plugin that is available via the following link: http://tools.google.com/dlpage/gaoptout?hl=de.

(4) This website uses Google Analytics with the extension “_anonymizeIp()”. As a result, IP addresses are shortened before they are processed any further, which rules out the possibility of establishing a link to persons. If a personal link is associated with the data collected about you, this connection will therefore immediately be removed and the personal data will therefore immediately be deleted.

(5) We use Google Analytics to analyse usage of our website and to regularly improve it. With the aid of the statistics collected, we can improve our offering and make it more interesting for you as a user. For exceptional cases in which personal data is transmitted to the USA, Google has signed up to the EU-US Privacy Shield, www.privacyshield.gov/EU-US-Framework. The legal basis for the usage of Google Analytics is point (f) of article 6, paragraph 1, page 1 GDPR. 

(6) Information about the third-party provider: Google Dublin, Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland, Fax: +353 (1) 436?1001. Terms and conditions of use: 

http://www.google.com/analytics/terms/de.html, data protection overview: http://www.google.com/intl/de/analytics/learn/privacy.html, plus the data protection declaration: http://www.google.de/intl/de/policies/privacy.

(7) This website also uses Google Analytics for cross device analysis of visitor streams, which is carried out via a user ID. You can disable cross device analysis of your usage in your user account under “My data”, “Personal data”.

Integration of Google Maps

(1) We use services from Google Maps on this website. This enables us to display interactive maps directly in the website and enables you to use the maps functions in a convenient way.

(2) When you visit our website, Google receives the information that you have called up the corresponding subpage of our website. In addition, the data stated in  § 3 of this declaration is transmitted. This happens regardless of whether Google makes available a user account, via which you are logged in, or if no user account exists. If you are logged into Google, your data will be directly linked to your account. If you do not wish to be associated with your profile at Google then you will need to log out of your Google account before clicking the button. Google saves your data in the form of usage profiles and uses the data for the purpose of advertising, market research and/or demand-driven design of its website. This type of analysis is performed in particular (even for users who are not logged in) to deliver demand-based advertising and in order to inform other users of social networks about your activities on our website. You have the right to object against the creation of this type of user profile, but you need to address your objections to Google.

(3) Further information about the purpose and scope of the data collection and its processing the by plugin provider can be found in the data protection declarations of the provider. Here you will also find more information about your rights in this matter and about your options for changing settings to protect your privacy: www.google.de/intl/de/policies/privacy. Google also processes your personal data in the USA and has signed up to the EU-US Privacy Shield, https://www.privacyshield.gov/EU-US-Framework.

Facebook Remarketing / Retargeting

Remarketing tags from the social network “Facebook”, 1601 South California Avenue, Palo Alto, CA 94304, USA, are integrated in our web pages. When you visit our site, the remarketing tags establish a direct link between your browser and the Facebook server. As a result, Facebook will receive the information that you have visited our site from your IP address. In turn, Facebook can assign your visit to our site to your user account. We can use the information obtained in this way to display Facebook Ads. As the provider of the web pages, we wish to inform that we receive no knowledge of the content of any transmitted data or its usage by Facebook. Further information about this can be found in the data protection declaration of Facebook under www.facebook.com/about/privacy/. If you do not wish your data to be collected via Custom Audience, you can deactivate Custom Audiences here.

Use of our online shop

(1) If you wish to place an order via our online shop, you will need to provide the personal data required by us to process your order. This is necessary in order to conclude a contract. Mandatory information required to process contracts is specially marked, all other information is voluntary. We will use the data you provide to process your order. For this purpose we can forward your payment data to our house bank. The legal basis for this is given in section 1, page 1, letter b) of article 6 of the General Data Protection Regulation. You can voluntarily choose to create a customer account, which we can use to save your data for other purchases in the future. If you create an account under “My Account”, the data you provide will be saved but can be deleted again. The customer account will be deleted at the request of the customer by the operator of the shop.

(2) We are required by trade and tax laws to save your address, payment and ordering data for a period of ten years. However, after two years we will restrict processing of the data, i.e. your data will be used only for the purpose of compliance with the legal requirements. 
 
(3) In order to prevent unauthorised third party access to your personal data, in particular your financial data, the ordering process is encrypted using TLS technology.

Data protection regulations when using external payment service providers
(1) We offer multiple methods of payment when using the online shop and use different payment service providers in the process. Depending on the payment method you opt for, different data is transmitted to the relevant payment service provider. The legal basis for this transmission of data is given in section 1, page 1, letter a) of article 6 of the General Data Protection Regulation. We have listed our payment service providers for you below.

• PayPal
  If you decide to pay via PayPal, your personal data will be transmitted to PayPal. Before you can use PayPal you will first need to open a PayPal account. If you use or open a PayPal account, among other things your name, address, telephone number and e-mail address will need to be transmitted to PayPal. The legal basis for the transmission of this data is given in section 1, letter a) of article 6 of the General Data Protection Regulation (Consent) and section 1, letter b) of article 6 of the the General Data Protection Regulation (Processing of data for the fulfilment of a contract).

The payment service “PayPal” is operated by:

PayPal (Europe) S.à r.l. et Cie, S.C.A.
22-24 Boulevard Royal
L-2449 Luxembourg
E-mail: impressum@paypal.com

By choosing the payment option PayPal, you consent to the transmission of personal data to PayPal, such as your name, address, telephone number and e-mail address. Details of any further data that is collected by PayPal can be found in the relevant data protection declaration of PayPal. This can be found here: https://www.paypal.com/de/webapps/mpp/ua/privacy-full