Datenschutzerklärung – CONZEPTA'S Swiss GmbH

Privacy Policy of CONZEPTA’S Swiss GmbH

1 General

CONZEPTA’S Swiss GmbH (hereinafter “CONZEPTA’S”, “we” or “us”) processes personal data relating to you or other individuals in various ways and for various purposes.

The protection of your personal data and its confidential and lawful processing are of great importance to us. We process personal data responsibly and in accordance with the applicable data protection regulations, in particular the Swiss Data Protection Act (“DSG”) and – where applicable – the European Union’s General Data Protection Regulation (“GDPR”).

‘Personal data’ means any information relating to an identified or identifiable natural person. ‘Processing’ means any operation or set of operations performed on personal data, regardless of the means and methods used, in particular the collection, storage, retention, use, alteration, disclosure, archiving, erasure or destruction of data.

This privacy policy informs you about how we process personal data, in particular:

when you visit our website www.conzeptas.ch, www.conzeptas.ch,
in connection with our services,
in the context of existing or proposed contractual relationships,
when communicating with us by email, telephone, post or by other means,
and in connection with all other data processing activities relating to our offers and business activities.

This privacy policy is governed by the Swiss Data Protection Act (‘DSG’). Where the relevant conditions are met, in particular in the case of business relationships with individuals within the European Union (‘EU’), the General Data Protection Regulation (‘GDPR’) may also apply. Where this privacy policy refers to ‘personal data’, this also includes ‘personal data’ within the meaning of the GDPR.

2 Data controller

The data controller is:

CONZEPTA’S Swiss GmbH
Teichgässlein 9
CH-4058 Basel
Switzerland

Phone: +41 61 685 90 00
Email: [email protected]

3 Name and address of the data protection officer

The protection of your personal data is of great importance to us. To reflect this, we have commissioned a consultancy firm specialising in data protection and data security to take charge of these key issues.

actago GmbH
Weidenstrasse 66
94405 Landau an der Isar
Germany

Phone: +49 9951 99990-20
Email: [email protected]
Website: http://www.actago.de

4 Scope of personal data processing

We process different categories of personal data depending on the circumstances and purpose. The specific personal data processed depends in particular on the relevant business relationship, the service used and the nature of the communication. The main categories of personal data are described below, although this list is not exhaustive.

We process personal data to the extent necessary for the provision of our services, the implementation of pre-contractual measures, the fulfilment of contractual obligations, the safeguarding of legitimate interests, or in accordance with legal obligations. Where consent is required for certain processing activities, such processing takes place exclusively on the basis of your corresponding consent, for example in connection with marketing or tracking measures via our cookie banner.

Depending on the service used or the chosen channel of communication – such as via our website, by email, by telephone, in writing or in person – we process personal data in particular from customers, prospective customers, business partners, suppliers, job applicants and contact persons at the relevant companies and organisations.

When concluding contracts or using certain services, the provision of certain personal data is required, in particular master data and contractual data.

In particular, the following categories of personal data may be processed:

Master data (e.g. title, surname, first name, address, date of birth, gender, nationality, language, position, role or relationships with companies)
Contact and communication data (e.g. email address, telephone number, correspondence, content of communications, and details of the type, time and, where applicable, location of the communication)
Contract, service and project data (e.g. contract content, details of contract type, contract duration and termination, application processes, brokerage mandates, policies, analyses, service quotations or details regarding the use of our services)
Financial and payment data (e.g. invoicing and payment information, payment terms, receivables or creditworthiness details)
Usage, log and technical data (e.g. IP address, device ID, details of the device used, operating system, browser, language settings, internet service provider, log files, access data, content accessed, date and time of access, or digital location data)
Activity, behavioural and preference data (e.g. meetings, face-to-face meetings, attendance at events, use of our website, interactions with our services, interests or other interactions with our company)
Application and qualification data (e.g. details of education and qualifications, application documents or professional information)
Health data, where necessary in individual cases (e.g. details of allergies or intolerances)
Other personal data required in specific cases for the provision of our services, the initiation or performance of contractual relationships, the enforcement of legal rights or to comply with legal obligations

Where personal data is not collected directly from the data subject, it is obtained in particular from publicly accessible registers, insurance companies, banks, public authorities, business partners or other third parties.

In connection with the use of our website and IT systems, technical identifiers or individual identifiers may also be assigned to end devices, for example in the form of cookies or similar technologies.

5 Purposes of data processing

We process personal data primarily to fulfil our contractual obligations towards our clients, business partners and prospective clients, in particular in connection with our services in the areas of risk, insurance and pension advice, as well as related activities.

If you are acting on behalf of a client, business partner or another organisation, your personal data may also be processed in this context.

Furthermore, we process personal data – where permitted and appropriate – in particular for the following purposes, in which we have a legitimate interest commensurate with the respective purpose:

Offering, providing, managing and further developing our services and related activities
Initiating, concluding, implementing and settling contractual relationships
Durchführung vorvertraglicher Massnahmen

Carrying out pre-contractual measures Processing enquiries and communicating with customers, prospective customers, business partners, public authorities, job applicants and other third parties

Carrying out analyses, projects, quotations and consultancy services
Reviewing and optimising procedures for needs analysis and customer-focused engagement
Marketing and information activities, as well as the organisation of events and other occasions (see section 6)
Analysing user behaviour and improving our services, our website and other online offerings
Processing payment and invoicing procedures
Provision of warranty, guarantee and support services
Ensuring the security of our IT systems, networks, buildings and facilities, and protecting our employees, customers and other individuals
Prevention, detection and investigation of criminal offences, misuse or other misconduct
Asserting, enforcing or defending legal claims, and defending our legal position in connection with legal disputes or regulatory proceedings
Compliance with statutory, regulatory and internal requirements
Carrying out transactions under company law or relating to the business

Personal data is, as a general rule, only processed and stored for as long as is necessary for the respective purposes, where statutory retention or archiving obligations apply, or where there are legitimate interests in further retention, for example for documentation, law enforcement or to ensure IT and data security.

Where the processing of personal data is based on your consent, this may be withdrawn at any time with effect for the future.

6 Direct marketing and customer information

We process personal data within the scope permitted by applicable law in order to inform customers, prospective customers and business partners about our services, offers, events and other information that may be relevant to them.

If you request information about our services or are in an existing or former business relationship with us, we may use your personal data to provide you with information about our services and offers.

Your personal data is processed for the purposes of direct marketing, informing you about our services and offers, and maintaining existing customer and business relationships. Your personal data will only be processed for as long as necessary to fulfil these purposes or until you object to such processing or withdraw any consent you may have given.

Where the processing of your personal data is based on your consent, you may withdraw that consent at any time with effect for the future. The lawfulness of any processing carried out on the basis of your consent before its withdrawal remains unaffected.

You may also object to the processing of your personal data for marketing purposes at any time with effect for the future. To do so, you may contact us using the contact details provided in this Privacy Notice. In the event of a withdrawal of consent or an objection, your personal data will no longer be processed for the respective marketing purposes.

7 Legal bases and principles of processing

Switzerland

We process personal data in accordance with the principles of the Swiss Data Protection Act (“DSG”). In doing so, we take particular care to ensure that personal data is processed lawfully, in good faith and proportionately.

Personal data is collected only for specific purposes that are recognisable to the data subjects and is processed only in a manner compatible with those purposes. As a private data controller, we ensure that the processing of personal data does not constitute an unlawful infringement of personal rights.

Where necessary, we base the processing of personal data in particular on:

the consent of the data subject,
the conclusion or performance of a contract,
legal obligations,
and overriding private or public interests.

Where we process special categories of personal data or carry out processing operations involving a higher risk, we obtain – where required by law – the explicit consent of the data subject.

When transferring personal data abroad, we comply with the legal requirements of the DSG. Where an adequate level of data protection does not exist, we implement appropriate contractual, technical or organisational safeguards.

Supplementary legal bases under the GDPR

Where we process personal data within the scope of the GDPR – for example, in the context of business relationships with individuals or companies within the EU – we also base the processing on the legal grounds set out in Art. 6 (1) of the GDPR.

In these cases, the processing of personal data is carried out in particular:

Consent (Art. 6 (1) (a) of the GDPR)
for the performance of a contract or the implementation of pre-contractual measures (Art. 6 (1) (b) of the GDPR)
to comply with legal obligations (Art. 6 (1) (c) of the GDPR)
to protect the vital interests of the data subject or another natural person (Art. 6 (1) (d) of the GDPR)
to safeguard the legitimate interests of our company or third parties (Article 6 (1) (f) of the GDPR)

The application of these legal bases is context-dependent and only applies to the extent that the GDPR is actually applicable in the specific case.

8 Data erasure and duration of storage

We process and store personal data only for as long as is necessary for the respective processing purposes and, in addition, in accordance with statutory retention and documentation obligations.

Personal data relating to contractual relationships, services, business relationships and associated commercial and administrative processes is generally stored for the duration of the relevant business relationship and beyond, in accordance with statutory retention periods. Unless more specific legal requirements apply, data is generally retained for ten years from the conclusion of the relevant business transaction or contractual relationship.

Personal data relating to general enquiries, initial contacts, quotations or pre-contractual measures is generally stored for three years from the conclusion of the relevant communication, provided that no further business relationship arises or that statutory or legitimate reasons necessitate longer retention.

We store personal data processed on the basis of consent for marketing, newsletter or similar communication purposes until such consent is withdrawn or until we receive an objection to the relevant processing.

Technical data, log data and log files are generally stored only for as long as is necessary to ensure the security, stability and functionality of our website and our IT systems.

In addition, personal data may be retained for longer where this is:

to fulfil legal or regulatory obligations,
to assert, exercise or defend legal claims,
to ensure IT and data security,
or is necessary on the basis of overriding legitimate interests.

Once the relevant purpose of processing has ceased to apply and statutory retention periods have expired, personal data will be deleted, anonymised or subject to restrictions on processing, provided there are no legal or legitimate grounds for further retention.

9 Disclosure of personal data

In connection with our processing of personal data, we also disclose such data to other recipients.

We pass on the personal data required for their respective services to the service providers we have commissioned for this purpose. This applies in particular to IT service providers, but also to analytics service providers, debt collection agencies, credit reference agencies, etc.

Where service providers process personal data as data processors, they are obliged to process personal data exclusively in accordance with our instructions and to implement data security measures.

Data may also be disclosed to other recipients, e.g. courts, solicitors and public authorities in the context of legal proceedings and statutory obligations to provide information and cooperate, to purchasers of companies and assets, to finance companies in the context of securitisation, and to debt collection agencies.

In individual cases, we may also disclose personal data to other third parties for their own purposes, e.g. if you have given us your consent to do so or if we are legally obliged or entitled to disclose such data.

10 Transfer of personal data abroad

As part of our business activities and for the purposes set out, to the extent permitted and where we deem it appropriate, we also disclose personal data to third parties, whether because they process it on our behalf or because they wish to use it for their own purposes.

This particularly concerns the following positions:

Our service providers, both within CONZEPTA and externally (such as insurance companies, pension schemes, banks, consultancy firms and law firms), including data processors (such as IT providers);
Network partners such as united CONZEPT GmbH, suppliers, subcontractors, and other business partners in connection with the fulfillment of our contractual obligations to you;
Customers and their legal representatives or contact persons;
Domestic and foreign authorities, agencies, or courts;
The general public, including visitors to websites and social media;
Competitors in mandate transfers, industry organizations, associations, organizations, and other committees;
Purchasers or prospective purchasers of business divisions, companies or other parts of CONZEPTA’S;
other parties in potential or actual legal proceedings;

(hereinafter referred to as “recipient”).

The recipients of personal data are partly based in Switzerland, but may also be located abroad. In particular, you should expect your data to be transferred to our parent company, CONZEPTA’S Assekuranzmakler AG, in Germany, as well as to our network partner, united CONZEPT GmbH, in Germany, or to other brokers abroad. Where we transfer data to a country without adequate statutory data protection, we ensure an appropriate level of protection as required by law through the use of appropriate contracts (namely on the basis of the European Commission’s so-called Standard Contractual Clauses) or rely on the statutory exceptions, including consent, the performance of a contract, the establishment, exercise or defence of legal claims, overriding public interests, publicly available personal data, where it is necessary to protect the physical integrity of the data subjects, or where the data subject has made the data generally accessible and has not expressly prohibited its processing. You may at any time obtain a copy of the aforementioned contractual safeguards from the contact person named in section 2. However, we reserve the right to redact copies or provide only extracts for data protection or confidentiality reasons.

For the sake of completeness, we would like to point out that, as a broker licensed in Switzerland, we primarily serve Swiss clients.

11 Use of online tracking and online advertising techniques

Our website uses various technologies that enable us and third parties engaged by us to recognise you when you use the site and, in some cases, to track your activity across multiple visits.

11.1 Use of cookies and similar technologies

For our website, we use third-party services to measure and improve the website’s user-friendliness and online advertising campaigns. To this end, third-party components are integrated into the website, which may in turn set cookies.

When we track you or use similar technologies, the fundamental purpose is to distinguish your visits from those of other users, so that we can ensure the website functions properly and carry out statistical analyses. This does not allow us to identify you personally.

The techniques used are designed so that you are recognised as an individual visitor each time you view a page, for example by our server assigning you or your browser a specific identification number, known as a ‘cookie’.

Cookies are small text files that are stored on the device you are using.
These can be divided into the following categories:

Essential cookies: These are necessary for the functionality and operation of the website

Performance cookies: These cookies collect information about how a website is used and enable analysis

Functional cookies: Functional cookies can enable advanced features and display personalised content

Marketing cookies: Marketing cookies help us and our advertising partners to target you with adverts for products or services that may be of interest to you on our websites and on third-party websites, or to display our adverts whilst you are browsing the internet following a visit to our website

We use cookies in particular for the following purposes:

Personalising content
Displaying personalised adverts and offers
Displaying adverts on third-party websites and measuring their effectiveness, i.e. whether you interact with these adverts (remarketing)
Saving your settings between visits
Determining whether and how we can improve our website
Collecting statistical data on the number of users and their usage habits, as well as improving the website’s performance and speed
We may process your contact details to target you with advertising on third-party platforms

In addition, similar technologies, such as pixel tags or fingerprints, may be used to store data in the browser. Pixel tags refer to small, usually invisible images or pieces of code that are loaded from a server and thereby transmit certain information to the server operator, e.g. whether and when the website was visited. Fingerprints are pieces of information collected during your visit to our website regarding the configuration of your device or browser, which enable your device to be distinguished from other devices.

11.2 Disabling cookies and similar technologies

When you visit our website, you have the option to disable certain categories of cookies. You can configure your browser settings to block certain cookies and similar technologies, or to erase existing cookies and other data stored in the browser. You can also install add-ons for your browser that block tracking by certain third parties. You can find more information on this in your browser’s help pages. Please note that our website may no longer be fully accessible if you block cookies and similar technologies.

11.3 Logging

When you visit this or other websites, you transmit data to our web server via your web browser. The following data is recorded during an active connection for communication between your web browser and our web server:

Date and time of request
Name of requested file
Site from which the request was sent
Status of access (data transferred, data not found, etc.)
web browser and operating system used
Complete IP-address of requesting computer
amount of data transferred.

We store this data for technical security reasons, in particular to defend against attempts to attack our web server. After seven days at the latest, the data is anonymised by truncating the IP address to the domain level, so that it is no longer possible to establish a link to individual users.

11.4 Secure data transmission

When you access this information service, we provide a connection encrypted using HTTPS and Perfect Forward Secrecy, secured using at least the TLS 1.2 encryption protocol, so that your data is protected from being accessed by third parties during transmission. We recommend that you keep your web browser up to date to make use of this feature.

12 Contacting us by email

Alternatively, you may contact us via the email address provided. In this case, the personal data you provide in your email will be stored. In this context, your data will not be passed on to third parties unless this is necessary to process your enquiry or we are legally obliged to do so.

The data will be used exclusively for the purpose of handling the correspondence and, where applicable, for the initiation or performance of a contractual relationship.

Your personal data will be erased as soon as it is no longer required to fulfil the purpose for which it was collected and there are no statutory retention periods that prevent this. For personal data sent by email, this is the case once the relevant conversation with you has been concluded. The conversation is deemed to have been concluded when it is clear from the circumstances that the matter in question has been definitively resolved.

You may object to the processing of your personal data in accordance with the statutory provisions. In such a case, the conversation between you and us may not be able to continue.

13 Handling of applicant data

We offer you the opportunity to apply for a job with us online. Below, we provide information on the scope, purpose and use of your personal data collected as part of the application process. We assure you that your data will be processed in accordance with applicable data protection law and all other legal provisions, and that your data will be treated in strict confidence.

The application process is conducted via the careers portal of CONZEPTA’S Assekuranzmakler AG. If you apply for a vacancy advertised by us, you will be redirected to the application portal of CONZEPTA’S Assekuranzmakler AG. The collection and processing of personal data submitted as part of the application process are carried out in accordance with the data protection policy of CONZEPTA’S Assekuranzmakler AG.

If you apply for a position with our company, the individuals within our group of companies responsible for filling the advertised vacancy will have access to your application documents, to the extent necessary for the conduct of the recruitment process.

If your application is successful, the personal data you have submitted will be further processed for the purpose of managing the employment relationship and stored in the systems designated for this purpose.

If we are unable to make you a job offer, if you decline a job offer or if you withdraw your application, your personal data will be deleted upon completion of the recruitment process, as soon as its retention is no longer necessary and there are no statutory retention obligations or other legitimate grounds preventing its deletion.

Data may be retained for a longer period, in particular where this is necessary to assert, exercise or defend legal claims, or where statutory retention obligations apply. In this case, the data will be deleted as soon as the relevant purpose for retention no longer applies.

Further information on the processing of your personal data in connection with the application process can be found in the privacy policy of CONZEPTA’S Assekuranzmakler AG at:

14 Data security

We take appropriate security measures to safeguard the confidentiality, integrity and availability of your personal data, to protect it against unauthorised or unlawful processing, and to counter the risks of loss, accidental alteration, unauthorised disclosure or unauthorised access. However, security risks cannot generally be entirely ruled out.

15 Rights of data subjects

Data subjects have certain rights under the applicable data protection laws regarding the processing of their personal data. These rights include, in particular, the following:

Right of access: You may request further details about our data processing. We are happy to assist you in this regard. You may also submit a so-called request for access if you wish to receive further information and a copy of your data.
Objection and erasure: You may object to our data processing and may also request at any time that we erase your personal data, provided that we are not obliged to continue processing or retaining this data and provided that it is not necessary for the purposes of the employment relationship.
Rectification: You may have inaccurate or incomplete personal data rectified or completed, or have a note of dispute added to it.
Portability: You also have the right to receive the personal data you have provided to us in a structured, commonly used and machine-readable format, or to have it transferred to a third party, provided that the relevant data processing is based on your consent or is necessary for the performance of a contract.
Withdrawal of consent: Where we process data on the basis of your consent, you may withdraw your consent at any time. The withdrawal applies only with future effect, and we reserve the right to continue processing data on another legal basis in the event of withdrawal.

Further restrictions and, where applicable, exclusions to the aforementioned rights may arise from the applicable data protection laws or national legislation. You can also obtain more detailed information on these rights from our data protection officer.

Where both the Swiss Data Protection Act (DSG) and the GDPR apply, the data protection requirements are taken into account in parallel and in a coordinated manner. The aim is to ensure a consistently appropriate and coherent level of data protection without restricting the rights of data subjects.

You are free to lodge a complaint with the relevant supervisory authority regarding our processing of your data. The relevant supervisory authority in Switzerland is the Eidgenössische Datenschutz- und Öffentlichkeitsbeauftragte (EDÖB).

Eidgenössischer Datenschutz- und Öffentlichkeitsbeauftragter
Feldeggweg 1
CH – 3003 Bern
Phone: +41 58 4624395
Website: https://www.edoeb.admin.ch/de