1. What is this Privacy Policy about?

The culturee GmbH (also «we», «us») collects and processes personal data that concern you but also other individuals («third parties»). We use the word «data» here interchangeably with «personal data».

In this Privacy Policy, we describe what we do with your data when you use https://www.culturee.ch («website»), obtain services or products form us, interact with us in relation to a contract, communicate with us or otherwise deal with us. When appropriate we will provide a just-in-time notice to cover any additional processing activities not mentioned in this Privacy Policy.

If you transmit or disclose data about other persons to us, we assume that you are authorized to do so and that this data is correct. By submitting data about third parties, you confirm this. Please also ensure that these third parties have been informed about this Privacy Policy.

This Privacy Policy is aligned with the EU General Data Protection Regulation («GDPR»), the Swiss Data Protection Act («DPA») and the revised Swiss Data Protection («revDPA»). However, the application of these laws depends on each individual case.

2. Who is the controller for processing your data?

The culturee GmbH, 8125 Zollikerberg, Switzerland, is responsible under data protection law for the processing of data by culturee GmbH described in this data protection declaration, unless otherwise communicated in individual cases.

You may contact us for data protection concerns and to exercise your rights under Section 11 as follows:

culturee GmbH
In der Unterhueb 5
8125 Zollikerberg

florian@culturee.ch

3. What data do we process?

We process various categories of data about you. The main categories of data are the following:

Technical data: When you use our website or other electronic offerings, we collect the IP address of your terminal device and other technical data to ensure the functionality and security of these offerings. This data also includes logs in which the use of our systems is recorded. We generally retain technical data for 6 months. In order to ensure the functionality of these offers, we may also assign an individual code to you or your end device (e.g., in the form of a cookie, see Section 12). The technical data in itself does not allow any conclusions to be drawn about your identity. However, in the context of user accounts, registrations, access controls or the processing of contracts, they can be linked to other data categories (and thus possibly to your person).
Communication data: When you are in contact with us by email, phone, chat, letter, or other means of communication, we collect the data exchanged between you and us, including your contact details and the boundary data of the communication. We generally retain this data for 12 months from the last exchange with you. This period may be longer if this is necessary for reasons of proof or to comply with legal or contractual requirements or if it is technically required. E-mails in personal mailboxes and written correspondence are generally retained for at least 10 years.

Communication data are your name and contact details, the manner and place and time of communication and usually also its content (i.e., the content of e-mails, letters, chats, etc.). These data may also include information about third parties.

Master data: We use the term «master data» to refer to the basic data that we require, in addition to the contractual data (see below), for the processing of our contractual and other business relationships or for marketing and advertising purposes, such as name, contact data and information about, for example, your role and function, your bank account(s), your date of birth, customer history, powers of attorney, signature authorizations and declarations of consent. We process your master data if you are a customer or other business contact or are working for one (e.g., as a contact person of the business partner), or because we want to address you for our own purposes or the purposes of a contractual partner (e.g., in the context of marketing and advertising). We receive master data from you yourself (e.g., when you make a purchase), from bodies for which you work, or from third parties such as our contractual partners, associations, and address dealers, and from publicly accessible sources such as public registers or the Internet (websites, social media, etc.). We generally retain this data for 10 years from the last exchange with you, but at least from the end of the contract. This period may be longer, insofar as this is necessary for reasons of proof or to comply with legal or contractual requirements or is technically required. For pure marketing and advertising contacts, the period is usually much shorter, usually no more than 2 years since the last contact.
Contract data: This is data that arises in connection with the conclusion or processing of a contract, e.g., information about contracts and the services to be provided or provided, as well as data from the run-up to the conclusion of a contract, the information required or used for processing and information about reactions. We generally collect this data from you, from contractual partners and from third parties involved in the processing of the contract, but also from third-party sources (e.g., providers of creditworthiness data) and from publicly accessible sources. We generally retain this data for 10 years from the last contractual activity, but at least from the end of the contract. This period may be longer if this is necessary for reasons of evidence or to comply with legal or contractual requirements or for technical reasons.
Behavioral and preference data: Depending on our relationship with you, we try to get to know you and better tailor our products, services and offers to you. To do this, we collect and use data about your behavior and preferences. We do this by evaluating information about your behavior in our area, and we may also supplement this information with information from third parties - including publicly available sources. Based on this information, we can calculate the probability that you will use certain services or behave in a certain way. The data processed for this purpose is partly already known to us (e.g., when you use our services), or we obtain this data by recording your behavior (e.g., how you navigate on our website). We anonymize or delete this data when it is no longer meaningful for the purposes for which it was collected, which may be between a few weeks and 24 months (for product and service preferences) depending on the nature of the data. This period may be longer if required for evidentiary reasons or to comply with legal or contractual requirements, or if technically necessary. We describe how tracking works on our website in Section 12.

You disclose much of the data mentioned in this Section 2 yourself (e.g., via forms, in the context of communication with us, in connection with contracts, when using the website, etc.). You are not obliged to do so, with the exception of individual cases, e.g., in the context of binding protection concepts (legal obligations). If you wish to conclude contracts with us or make use of services, you must also provide us with data, in particular master data, contract data and registration data, as part of your contractual obligation in accordance with the relevant contract. When using our website, the processing of technical data is unavoidable.

As far as it is not unlawful we also collect data from public sources or receive data from public authorities and from other third parties.

4. For what purposes do we process your data?

We process your data for the purposes explained below. Further information is set out in Sections 12 and 13 for online services. These purposes and their objectives represent interests of us and potentially of third parties. You can find further information on the legal basis of our processing in Section 5.

We process your data for purposes related to communication with you, in particular in relation to responding to inquiries and the exercise of your rights (Section 11). For this purpose, we use in particular communication data and master data. We keep this data to document our communication with you, for training purposes, for quality assurance and for follow-up inquiries.

We process data for the conclusion, administration, and performance of contractual relationships.

We process data for marketing purposes and to relationship management, e.g., to send our customers and other contractual partners personalized advertising on products and services from us and from third parties. This may take the form of newsletters and other regular contacts, via other channels for which we have contact information from you, but also as part of individual marketing campaigns. You can refuse such contacts at any time (see at the end of this Section 4) or refuse or withdraw your consent to be contacted for advertising purposes. With your consent, we can target our online advertising on the Internet more specifically to you (see Section 12).

We further process your data for market research, to improve our services and operations, and for product development.

We may also process your data for security and access control purposes.

We process personal data to comply with laws, directives and recommendations from authorities and internal regulations («Compliance»).

We also process data for the purposes of our risk management and as part of our corporate governance, including business organization and development.

We may process your data for further purposes, for example as part of our internal processes and administration.

5. On what basis do we process your data?

If we ask you for your consent for certain processing, we will inform you separately about the corresponding purposes of the processing. You can revoke your consent at any time by notifying us in writing (by post) or, unless otherwise specified or agreed, by e-mail with effect for the future; you will find our contact details in Section 2. For revocation of your consent for online tracking, see Section 12. As soon as we have received notification of the revocation of your consent, we will no longer process your data for the purposes to which you originally consented, unless we have another legal basis for doing so. The revocation of your consent does not affect the lawfulness of the processing carried out on the basis of the consent until the revocation.

Where we do not ask for consent for processing, the processing of your personal data relies on the requirement of the processing for initiating or performing a contract with you (or the entity you represent) or on our or a third-party legitimate interest in the particular processing, in particular in pursuing the purposes and objectives set out in Section 4 and in implementing related measures. Our legitimate interests also include compliance with legal regulations, insofar as this is not already recognized as a legal basis by applicable data protection law (for example in the case of the GDPR, the laws in the EEA and in the case of the DPA, Swiss law).

6. What applies in case of profiling and automated individual decisions?

We may automatically evaluate («profile») certain of your personal characteristics for the purposes mentioned in Section 4 using your data (Section 3), if we want to determine preference data, but also to determine abuse and security risks, to perform statistical evaluations or for operational planning purposes. For the same purposes, we can also create profiles, i.e., we can combine behavioral and preference data, but also master and contract data and technical data assigned to you, in order to better understand you as a person with your different interests and other characteristics.

In both cases, we pay attention to the proportionality and reliability of the results and take measures against misuse of these profiles or profiling. If these can have legal effects or significant disadvantages for you, we generally provide for a manual review.

7. With whom do we share your data?

In connection with our contracts, the website, our services and products, our legal obligations or otherwise in order to protect our legitimate interests and the other purposes listed in Section 4, we also transfer your personal data to third parties, in particular to the following categories of recipients:

Service Provider: We cooperate with producers/service providers in Germany and abroad who process data about you on our behalf or in joint responsibility with us or who receive data about you from us in their own responsibility.
Contractual partners including customers: First, this refers to our customers and other contractual partners, because this data transfer results from these contracts. If you work for such a contractual partner yourself, we may also transfer data about you to them in this context. The recipients further include contractual partners with whom we cooperate.

All these categories of recipients may in turn involve third parties, so that your data may also become accessible to them. We can restrict processing by certain third parties (e.g., IT providers), but not by other third parties (e.g., authorities, banks, etc.).

8. Is your personal data disclosed abroad?

As explained in Section 7, we also disclose data to other entities. These are not only located in Switzerland. Your data may therefore be processed in Europe, but in exceptional cases in any country in the world.

If a recipient is located in a country without adequate legal data protection, we contractually obligate the recipient to comply with the applicable data protection (for this purpose, we use the revised standard contractual clauses of the European Commission, which can be accessed here: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?), insofar as the recipient is not already subject to a legally recognized set of rules for ensuring data protection and we cannot rely on an exception. An exception may apply in particular in the case of legal proceedings abroad, but also in cases of overriding public interests or if the performance of a contract requires such disclosure, if you have given your consent or if it is a matter of data made generally available by you, the processing of which you have not objected to.

Please also note that data exchanged via the Internet is often routed via third countries. Your data can therefore end up abroad even if the sender and recipient are in the same country.

9. How long do we process your data?

We process your data for as long as our processing purposes, the statutory retention periods, and our legitimate interests in processing for documentation and evidence purposes require or storage is technically necessary. You will find further information on the respective storage and processing periods for the individual data categories in Section 3 and for the cookie categories in Section 12. If there are no legal or contractual obligations to the contrary, we will delete or anonymize your data after the storage or processing period has expired as part of our normal processes.

10. How do we protect your data?

We take appropriate security measures to protect the confidentiality, integrity, and availability of your personal information, to protect it against unauthorized or unlawful processing, and to protect it against the risks of loss, accidental alteration, unauthorized disclosure or access.

11. What are your rights?

Applicable data protection law grants you the right, under certain circumstances, to object to the processing of your data, in particular for direct marketing, direct marketing profiling and other legitimate interests in processing.

To facilitate your control over the processing of your personal data, you also have the following rights in connection with our data processing, depending on the applicable data protection law:

The right to request information from us as to whether and which of your data we are processing;
the right to have us correct data if it is incorrect;
the right to request that we delete data;
the right to request that we provide certain personal data in a commonly used electronic format or transfer it to another controller;
the right to withdraw consent, insofar as our processing is based on your consent;
the right to obtain, on request, further information necessary for the exercise of these rights.

If you wish to exercise the above rights against us, please contact us in writing, by e-mail; you will find our contact details in Section 2. For us to be able to exclude misuse, we must identify you (e.g., with a copy of your ID card, if this is not otherwise possible).

Please note that these rights are subject to conditions, exceptions, or restrictions under applicable data protection law (e.g., to protect third parties or trade secrets). We will inform you accordingly if necessary.

If you do not agree with our handling of your rights or data protection, please let us know (Section 2). If you are located in the EEA, the United Kingdom or Switzerland, you also have the right to complain to the data protection supervisory authority in your country.

12. Do we use online tracking and online advertising techniques?

On our website, we use various techniques with which we and third parties engaged by us can recognize you during your use and possibly also track you over several visits. In this Section, we inform you about them.

In essence, this is so that we can distinguish access by you (via your system) from access by other users, so that we can ensure the functionality of the website and carry out evaluations and personalizations. We do not want to infer your identity, even if we can, as far as we or third parties engaged by us can identify you by combination with registration data. Even without registration data, however, the technologies used are designed in such a way that you are recognized as an individual visitor each time you access the site, for example by our server (or the servers of third parties) assigning you or your browser a specific identification number (so-called «cookie»).

We use such techniques on our website and allow certain third parties to do so as well. However, depending on the purpose of these techniques, we may ask for your consent before they are used. You can program your browser to block or deceive certain cookies or alternative techniques, or to delete existing cookies. You can also enhance your browser with software that blocks tracking by certain third parties. You can find more information about this on the help pages of your browser (usually under the keyword «Privacy») or on the websites of the third parties that we list below.

The following cookies are distinguished (techniques with comparable functionalities such as fingerprinting are included here):

Necessary Cookies: Some cookies are necessary for the functioning of the website as such or certain functions. For example, they ensure that you can switch between pages without losing information entered in a form. They also ensure that you remain logged in. These cookies are only temporary («session cookies»). If you block them, the website may not work. Other cookies are necessary so that the server can store your decisions or entries beyond one session (i.e., one visit to the website) if you request this function (e.g., selected language, given consent, the function for automatic login, etc.). These cookies have an expiration date of up to 24 months.
Performance Cookies: To optimize our website and corresponding offers and to better adapt them to the needs of the users, we use cookies to record and analyze the use of our website, possibly even beyond the session. We do this using third-party analytics services. We have listed these below. Before we use such cookies, we ask for your consent. Performance cookies also have an expiration date of up to 24 months. Details can be found on the websites of the third-party providers.

Currently, we also use offers from the following service provider:

Google Analytics: Google Ireland (based in Ireland) is the provider of the «Google Analytics» service and acts as our order processor. Google Ireland relies on Google LLC (based in the USA) as its order processor (both «Google»). Google thereby tracks the behavior of visitors to our website (duration, frequency of pages viewed, geographic origin of access, etc.) through performance cookies (see above) and creates reports for us on the use of our website on this basis. We have configured the service so that the IP addresses of visitors are shortened by Google in Europe before being forwarded to the USA and thus cannot be traced. We have turned off the «Data Forwarding» and «Signals» settings. Although we can assume that the information, we share with Google is not personal data for Google, it is possible that Google can draw conclusions about the identity of visitors from this data for its own purposes, create personal profiles and link this data to the Google accounts of these individuals. If you agree to the use of Google Analytics, you explicitly consent to such processing, which also includes the transfer of personal data (usage data for the website and app, device information and individual IDs) to the USA and other countries. Information on the data protection of Google Analytics can be found here [https://support.google.com/analytics/answer/6004245?hl=en] and if you have a Google account, you can find further information on processing by Google here [https://policies.google.com/technologies/partner-sites?hl=en].

13. What data do we process on our social network pages?

We may operate pages and other online presences («fan pages», «channels», «profiles», etc.) on social networks and other platforms operated by third parties and collect the data about you already described above and below. We receive this data from you and the platforms when you encounter us via our online presence (e.g., when you communicate with us, comment on our content or visit our presence). At the same time, the platforms evaluate your use of our online presences and link this data with other data about you known to the platforms (e.g., about your behavior and preferences). They also process this data for their own purposes under their own responsibility, in particular for marketing and market research purposes (e.g., to personalize advertising) and to control their platforms (e.g., which content they show you).

We process this data for the purposes described in Section 4, in particular for communication, marketing purposes (including advertising on these platforms, see Section 12) and market research. You will find information on the corresponding legal basis in Section 5. We may ourselves disseminate content published by you (e.g., comments on an announcement) (e.g. in our advertising on the platform or elsewhere). We or the operators of the platforms may also delete or restrict content from or about you in accordance with the usage guidelines (e.g., inappropriate comments).

For further information on the processing of the platform operators, please refer to the data protection notices of the respective platforms. There you can also find out in which countries they process your data, what rights you have to information, deletion, and other data subjects and how you can exercise these or obtain further information. We currently use the LinkedIn platform [https://ch.linkedin.com | https://de.linkedin.com/legal/privacy-policy] in particular.

14. Can we update this Privacy Policy?

This Privacy Policy is not part of a contract with you. We can change this Privacy Policy at any time. This version published on this website is the current version.

Last updated: March 12th, 2023