Privacy Policy
This privacy policy explains how we process personal data in connection with our activities and operations, including our website at the domain name www.bestag.ch. In particular, we explain what personal data we process, for what purpose, in what way, and where. We also provide information regarding the rights of individuals whose data we process.
Table of contents
1. Contact details
The party responsible under data protection law is:
Patrice Choffat
Renggerstrasse 43
8038 Zurich
info@bestag.ch
In individual cases, third parties may be responsible for the processing of personal data, or there may be joint responsibility with third parties. We are happy to provide affected individuals with information regarding the respective responsibilities upon request.
2. Definitions and legal bases
2.1 Definitions
Affected individual: A natural person about whom we process personal data.
Personal data: All information relating to an identified or identifiable natural person.
Sensitive personal data: Data on trade union, political, religious, or ideological views and activities, data on health, the private sphere, or ethnic or racial origin, genetic data, biometric data that uniquely identifies a natural person, data on criminal or administrative sanctions or prosecutions, and data on social assistance measures.
Processing: Any handling of personal data, regardless of the means and procedures used, such as querying, matching, adapting, archiving, storing, reading, disclosing, procuring, recording, collecting, deleting, revealing, sorting, organizing, saving, altering, disseminating, linking, destroying, and using personal data.
2.2 Legal bases
We process personal data in accordance with Swiss law, in particular the Federal Act on Data Protection (Data Protection Act, DPA) and the Data Protection Ordinance (DPO).
3. Nature, scope, and purpose of personal data processing
We process the personal data that is necessary to carry out our activities and operations in a sustainable, user-friendly, secure, and reliable manner. The personal data processed may fall into categories such as browser and device data, content data, communication data, metadata, usage data, master data including inventory and contact data, location data, transaction data, contract data, and payment data. Personal data may also include sensitive personal data.
We also process personal data that we receive from third parties, obtain from publicly accessible sources, or collect during the course of our activities and operations, provided such processing is permitted.
We process personal data with the consent of the affected individuals, where necessary. In many cases, we can process personal data without consent, for example, to fulfill legal obligations or to protect overriding interests. We may also request consent from affected individuals even when it is not required.
We process personal data for the duration required for the respective purpose. We anonymize or delete personal data, particularly in accordance with statutory retention and limitation periods.
4. Automation and Artificial Intelligence (AI)
We may process personal data automatically or use artificial intelligence to process personal data.
We may use profiling to automatically evaluate certain personal aspects relating to affected individuals. Profiling is used, for example, to analyze or predict interests, behaviors, or personal preferences.
In individual cases, we provide information about decisions based exclusively on automated processing of personal data that have legal consequences for the affected individuals or significantly affect them (automated individual decisions).
5. Disclosure of personal data
We may disclose personal data to third parties, have it processed by third parties, or process it jointly with third parties. Such third parties may include, for example, specialized providers whose services we utilize. These third parties may, in turn, disclose personal data to other third parties.
In the course of our activities and operations, we may disclose personal data to banks and other financial service providers, authorities, educational and research institutions, consultants and attorneys, accounting and fiduciary service providers, collection agencies, interest groups, IT service providers, cooperation partners, credit and business information agencies, logistics and shipping companies, marketing and advertising agencies, media, parent, sister, and subsidiary companies, organizations and associations, social institutions, telecommunications companies, insurance companies, and payment service providers.
6. Communication
We process personal data to communicate with individuals as well as with authorities, organizations, and companies. In doing so, we primarily process data that an individual provides to us when contacting us, for example via postal mail or email. We may store such data in an address book or similar tools.
Third parties who provide us with data about other individuals are legally obligated to ensure the data protection of those individuals independently. In particular, they must ensure that they are authorized to transmit such data and must also guarantee the accuracy of the data provided.
We use selected services from appropriate providers to facilitate and improve communication with individuals and other communication partners. These services allow us to manage and otherwise process the data of the individuals concerned beyond direct communication, for example in connection with orders, services, projects, and resource planning.
We primarily use:
7. Data security
We implement appropriate technical and organizational measures to ensure data security commensurate with the respective risk. Our measures are designed to ensure the confidentiality, availability, traceability, and integrity of the personal data we process, although we cannot guarantee absolute data security.
Access to our website and other digital platforms is protected by transport encryption (SSL / TLS, specifically using Hypertext Transfer Protocol Secure, or HTTPS). Most browsers will warn you before visiting a website that lacks transport encryption.
Our digital communication is subject to mass surveillance without cause or suspicion by security authorities in Switzerland, the rest of Europe, the United States of America (USA), and other countries, as is generally the case with all digital communication. We have no direct control over the processing of personal data by intelligence services, police agencies, and other security authorities. We also cannot rule out the possibility that a specific individual may be targeted for surveillance.
8. Personal data abroad
We generally process personal data in Switzerland. However, we may also disclose or export personal data to other countries, particularly for the purpose of processing it there or having it processed.
We may disclose personal data to any country on Earth and elsewhere in the universe, provided that the law there ensures an adequate level of data protection in accordance with a decision by the Swiss Federal Council.
We may disclose personal data to countries whose laws do not guarantee adequate data protection, provided that adequate data protection is ensured for other reasons, in particular on the basis of standard data protection clauses or other appropriate safeguards. In exceptional cases, we may export personal data to countries without adequate or appropriate data protection if the specific data protection requirements are met, for example, the explicit consent of the data subjects or a direct connection with the conclusion or performance of a contract. We are happy to provide data subjects with information about any safeguards or provide a copy of such safeguards upon request.
9. Rights of data subjects
9.1 Data protection claims
We grant data subjects all claims in accordance with applicable law. In particular, data subjects have the following rights:
- Information: Data subjects may request information as to whether we are processing personal data about them and, if so, which personal data is involved. Furthermore, data subjects will receive the information necessary to assert their data protection claims and ensure transparency. This includes the personal data processed as such, but also, among other things, details regarding the purpose of processing, the duration of retention, any disclosure or export of data to other countries, and the source of the personal data.
- Correction and restriction: Data subjects may have incorrect personal data corrected, incomplete data completed, and the processing of their data restricted.
- Opportunity for own point of view and human review: Data subjects may express their own point of view and request a review by a human regarding decisions that are based exclusively on automated processing of personal data and which have legal consequences for them or significantly affect them (automated individual decisions).
- Deletion and objection: Data subjects may have personal data deleted ("right to be forgotten") and object to the processing of their data with effect for the future.
- Data release and data transfer: Data subjects may request the release of personal data or the transfer of their data to another controller.
We may postpone, restrict, or deny the exercise of data subjects' rights within the legally permitted framework. We may inform data subjects of any requirements that must be met to exercise their data protection claims. For example, we may refuse access in whole or in part by citing confidentiality obligations, overriding interests, or the protection of other individuals. We may also, for example, refuse the deletion of personal data in whole or in part, particularly by citing statutory retention obligations.
We may exceptionally charge fees for the exercise of these rights. We will inform data subjects in advance of any potential costs.
We are required to identify data subjects who request information or assert other rights using appropriate measures. Data subjects are required to cooperate.
9.2 Legal protection
Data subjects have the right to enforce their data protection claims through legal proceedings or to file a report or complaint with a data protection supervisory authority.
The data protection authority for private individuals and federal bodies in Switzerland is the Federal Data Protection and Information Commissioner (FDPIC).
10. Use of the website
10.1 Cookies
We may use cookies. Cookies—both our own (first-party cookies) and those from third parties whose services we use (third-party cookies)—are data stored in your browser. Such stored data is not necessarily limited to traditional text-based cookies.
Cookies can be stored in your browser temporarily as "session cookies" or for a specific period as "permanent cookies." Session cookies are automatically deleted when the browser is closed. Permanent cookies have a specific storage duration. Cookies enable us, in particular, to recognize your browser on your next visit to our website and thereby measure the reach of our website, for example. However, permanent cookies can also be used for online marketing purposes.
Cookies can be deactivated, restricted, or deleted in your browser settings at any time, either in whole or in part. Browser settings often also allow for automated deletion and other management of cookies. If cookies are disabled, our website may no longer be fully functional. We actively request explicit consent for the use of cookies, at least to the extent required by applicable law.
For cookies used for performance and reach measurement or for advertising, a general opt-out is available for many services via AdChoices (Digital Advertising Alliance of Canada), the Network Advertising Initiative (NAI), YourAdChoices (Digital Advertising Alliance), or Your Online Choices (European Interactive Digital Advertising Alliance, EDAA).
10.2 Logging
For every access to our website and other digital presence, we may log at least the following information, provided it is determined or transmitted by default to our digital infrastructure during such access: date and time including time zone, IP address, access status (HTTP status code), operating system including user interface and version, browser including language and version, the specific subpage of our website accessed including the volume of data transferred, and the webpage last accessed in the same browser window (referer).
We log such information, which may constitute personal data, in log files. This information is necessary to provide our digital presence in a permanent, user-friendly, and reliable manner. Furthermore, this information is required to ensure data security, including by or with the assistance of third parties.
10.3 Tracking pixels
We may integrate tracking pixels into our digital presence. Tracking pixels are also known as web beacons. Tracking pixels—including those from third parties whose services we use—are typically small, invisible images or scripts written in JavaScript that are automatically retrieved when you access our digital presence. Tracking pixels can collect at least the same information as that recorded in log files.
11. Notifications and communications
11.1 Performance and reach measurement
Notifications and communications may contain web links or tracking pixels that record whether an individual message was opened and which links were clicked. Such links and pixels may also track the usage of notifications and communications on an individual basis. We require this statistical usage data for performance and reach measurement to ensure that notifications and communications are sent effectively, user-friendly, securely, and reliably, based on the needs and reading habits of our recipients.
11.2 Consent and objection
You must generally consent to the use of your email address and other contact details, unless their use is permitted for other legal reasons. We may use the "double opt-in" procedure to obtain consent where required. In such cases, you will receive a message with instructions for double confirmation. We may log the consent obtained, including the IP address and timestamp, for evidentiary and security purposes.
You may generally opt out of receiving notifications and communications, such as newsletters, at any time. By opting out, you may simultaneously object to the statistical tracking of usage for performance and reach measurement. This does not apply to necessary notifications and communications related to our activities and operations.
11.3 Service providers for notifications and communications
We send notifications and communications with the assistance of specialized service providers.
We primarily use:
12. Social Media
We are present on social media and other online platforms to communicate with interested individuals and provide information about our activities. In connection with such platforms, personal data may also be processed outside of Switzerland.
The general terms and conditions (GTC), terms of use, privacy policies, and other provisions of the individual operators of such platforms also apply. These provisions provide information, in particular, regarding the rights of data subjects directly against the respective platform, which includes, for example, the right to information.
Users of social media platforms have the option to log in or register for our online services using their respective user account ("Social Login"). The respective terms of the relevant social media platforms apply.
13. Third-party services
We use services from specialized third parties to ensure our activities and operations are sustainable, user-friendly, secure, and reliable. Such services allow us to embed features and content into our website, among other things. When such content is embedded, the services used will, for technically compelling reasons, at least temporarily collect the IP addresses of the users.
For necessary security-related, statistical, and technical purposes, third parties whose services we use may process data in connection with our activities and operations in an aggregated, anonymized, or pseudonymized form. This includes, for example, performance or usage data required to provide the respective service.
We specifically use:
- Google services: Providers: Google LLC (USA) / Google Ireland Limited (Ireland) in some cases for users in the European Economic Area (EEA) and Switzerland; General information on data protection: "Data protection practices", Privacy Policy, "How Google uses personal data", "Google is committed to complying with applicable data protection laws", "Privacy guide for Google products", "How we use data from websites or apps where our services are used", Cookie Policy, "Ads you control" (settings for personalized advertising).
- Microsoft services: Providers: Microsoft Ireland Operations Limited (Ireland) for users in the European Economic Area (EEA), Switzerland, and the United Kingdom / Microsoft Corporation (USA) for users in the rest of the world; General information on data protection: "Privacy at Microsoft", "Data protection and privacy", Privacy Policy, "Data and privacy settings".
13.1 Digital Infrastructure
We use services from specialized third parties to access the digital infrastructure required for our activities and operations. This includes, for example, hosting and storage services from selected providers.
We specifically use:
13.2 Automation and integration of apps and services
We use specialized platforms to integrate and connect existing third-party apps and services. We can also use these "no-code" platforms to automate workflows and tasks involving third-party apps and services.
We specifically use:
13.3 Scheduling
We use services from specialized third parties to enable online appointment scheduling, for example for meetings. In addition to this privacy policy, any terms and conditions of the services used that are directly visible, such as terms of use or privacy policies, also apply.
In particular, we use:
13.4 Audio and video conferencing
We use specialized services for audio and video conferencing to communicate online. This allows us to hold virtual meetings, for example, or conduct online classes and webinars. When participating in audio and video conferences, the legal texts of the individual services, such as privacy policies and terms of use, also apply.
Depending on your situation, we recommend muting your microphone by default when participating in audio or video conferences, as well as blurring your background or using a virtual background.
We specifically use:
13.5 Online collaboration
We use third-party services to facilitate online collaboration. In addition to this privacy policy, any terms and conditions of the services used that are directly visible, such as terms of use or privacy policies, also apply.
We specifically use:
13.6 Social media features and social media content
We use third-party services and plugins to embed features and content from social media platforms and to enable content to be shared on social media platforms and through other channels.
We specifically use:
13.7 Maps
We use third-party services to embed maps into our website.
We specifically use:
13.8 Digital content
We use services from specialized third parties to embed digital content into our website. Digital content includes, in particular, images, video material, music, and podcasts.
We specifically use:
13.9 Documents
We use third-party services to embed documents into our website. Such documents can include PDF files, presentations, spreadsheets, and text documents. This allows us to enable not only the viewing but also the editing or commenting of such documents.
We primarily use:
13.10 Advertising
We use the option to display targeted advertising on third-party platforms, such as social media platforms and search engines, for our activities and operations.
We aim to use such advertising to reach people who are already interested in our activities and operations, or who might be interested in them (remarketing and targeting). For this purpose, we may transmit relevant – and potentially personal – data to third parties that facilitate such advertising. We can also determine whether our advertising is successful, which means, in particular, whether it leads to visits to our website (conversion tracking).
Third parties where we advertise and where you are registered as a user may potentially associate your use of our website with your profile there.
We primarily use:
14. Website extensions
We use extensions for our website to enable additional functionality. We may use selected services from appropriate providers or host such extensions on our own digital infrastructure.
In particular, we use:
- Google reCAPTCHA: Bot protection (distinguishing between desired human activity and unwanted bot activity); Provider: Google; Google reCAPTCHA-specific information: "What is reCAPTCHA?".
15. Performance and reach measurement
We attempt to measure the success and reach of our activities and operations. In this context, we can also measure the impact of third-party references or check how different parts or versions of our digital presence are used ("A/B testing" method). Based on the results of the performance and reach measurement, we can, in particular, fix errors, enhance popular content, or make improvements.
For performance and reach measurement, the IP addresses of individual users are recorded in most cases. In this case, IP addresses are generally truncated ("IP masking") in order to comply with the principle of data minimization through the corresponding pseudonymization.
Cookies may be used and user profiles created for performance and reach measurement. Any user profiles created include, for example, the individual pages visited or content viewed on our digital presence, information on the size of the screen or browser window, and the – at least approximate – location. In principle, any user profiles are created exclusively in pseudonymized form and are not used to identify individual users. Individual third-party services where users are logged in may be able to associate the use of our online services with the respective user account or profile.
We use in particular:
- Google Marketing Platform: performance and reach measurement, in particular with Google Analytics; Provider: Google; Google Marketing Platform-specific information: measurement also across different browsers and devices (cross-device tracking) with pseudonymized IP addresses, which are only in exceptional cases are transferred in full to Google in the USA, Privacy policy for Google Analytics, "Browser add-on to disable Google Analytics".
- Google Tag Manager: Integration and management of services from Google and third parties, particularly for performance and reach measurement; Provider: Google; Google Tag Manager-specific information: Privacy Policy for Google Tag Manager; further privacy information can be found with the individual integrated and managed services.
- Hotjar: Recording of user behavior; Provider: Hotjar Ltd. (Malta); Privacy information: Recording without reference to individual website visitors, for example regarding movements and clicks with a mouse or other input method, Privacy and Hotjar, Privacy, Privacy Policy, Cookie Policy, Security.
- Mouseflow: Analysis of movements, inputs, and other behavior of website visitors without personal identification; Providers: Mouseflow ApS (Denmark) / Mouseflow Inc. (USA); Privacy information: Privacy Policy, Privacy & Security Overview, Right to object (opt-out).
16. Final notes on the privacy policy
We created this privacy policy using the Privacy Policy Generator from Datenschutzpartner.
We may update this privacy policy at any time. We will inform you of updates by publishing the current privacy policy on our website.
