In this Pri­va­cy Poli­cy, we pro­vi­de infor­ma­ti­on about the pro­ces­sing of per­so­nal data in con­nec­tion with our acti­vi­ties and ope­ra­ti­ons, inclu­ding our web­site at the domain name return2activity.ch. In par­ti­cu­lar, we explain why, how, and whe­re we pro­cess per­so­nal data. We also pro­vi­de infor­ma­ti­on about the rights of indi­vi­du­als who­se data we pro­cess.

For spe­ci­fic or addi­tio­nal acti­vi­ties and ope­ra­ti­ons, we may publish fur­ther pri­va­cy state­ments or other infor­ma­ti­on regar­ding data pro­tec­tion.

1. Contact Information

The data con­trol­ler, as defi­ned by data pro­tec­tion law, is:

Nadi­ne Dewes
8000 Zürich

+41 79 371 38 55
nadine.dewes@hin.ch

 

In cer­tain cases, third par­ties may be respon­si­ble for pro­ces­sing per­so­nal data, or the­re may be shared respon­si­bi­li­ty with third par­ties. Upon request, we are hap­py to pro­vi­de data sub­jects with infor­ma­ti­on regar­ding the respec­ti­ve respon­si­bi­li­ty.

2. Definitions and Legal Basis

2.1 Definitions

Data sub­ject: A natu­ral per­son who­se per­so­nal data we pro­cess.

Per­so­nal data: Any infor­ma­ti­on rela­ting to an iden­ti­fi­ed or iden­ti­fia­ble natu­ral per­son.

Per­so­nal data requi­ring spe­cial pro­tec­tion: data regar­ding trade uni­on, poli­ti­cal, reli­gious, or ideo­lo­gi­cal views and acti­vi­ties; data regar­ding health, pri­va­cy, or mem­ber­ship in an eth­nic or racial group; gene­tic data; bio­me­tric data that uni­que­ly iden­ti­fi­es a natu­ral per­son; data regar­ding cri­mi­nal or admi­ni­stra­ti­ve sanc­tions or pro­ce­e­dings, and data regar­ding social assi­stance mea­su­res.

Pro­ces­sing: Any hand­ling of per­so­nal data, regard­less of the means and methods used, such as retrie­ving, com­pa­ring, modi­fy­ing, archi­ving, retai­ning, rea­ding, dis­clo­sing, obtai­ning, recor­ding, coll­ec­ting, dele­ting, reve­al­ing, sort­ing, orga­ni­zing, sto­ring, alte­ring, dis­se­mi­na­ting, lin­king, destroy­ing, and using per­so­nal data.

2.2 Legal Basis

We pro­cess per­so­nal data in accordance with Swiss law, in par­ti­cu­lar the Fede­ral Act on Data Pro­tec­tion (Data Pro­tec­tion Act, DSG) and the Ordi­nan­ce on Data Pro­tec­tion (Data Pro­tec­tion Ordi­nan­ce, DSV).
https://www.fedlex.admin.ch/eli/oc/2022/491/de
https://www.fedlex.admin.ch/eli/oc/2022/568/de

3. Nature, Scope, and Purpose of the Processing of Personal Data

We pro­cess the per­so­nal data neces­sa­ry to car­ry out our acti­vi­ties and ope­ra­ti­ons in a sus­tainable, user-fri­end­ly, secu­re, and relia­ble man­ner. The per­so­nal data pro­ces­sed may include, in par­ti­cu­lar, the fol­lo­wing cate­go­ries: brow­ser and device data, con­tent data, com­mu­ni­ca­ti­on data, meta­da­ta, usa­ge data, master data (inclu­ding inven­to­ry and cont­act data), loca­ti­on data, tran­sac­tion data, con­tract data, and payment data. The per­so­nal data may also con­sti­tu­te spe­cial-cate­go­ry per­so­nal data.

We also pro­cess per­so­nal data that we recei­ve from third par­ties, obtain from publicly available sources, or coll­ect in the cour­se of our acti­vi­ties and ope­ra­ti­ons, to the ext­ent that such pro­ces­sing is per­mit­ted.

We pro­cess per­so­nal data, whe­re neces­sa­ry, with the con­sent of the data sub­jects. In many cases, we may pro­cess per­so­nal data wit­hout con­sent, for exam­p­le, to com­ply with legal obli­ga­ti­ons or to pro­tect legi­ti­ma­te inte­rests. We may also ask data sub­jects for their con­sent even when their con­sent is not requi­red.

We pro­cess per­so­nal data for as long as is neces­sa­ry for the respec­ti­ve pur­po­se. We anony­mi­ze or dele­te per­so­nal data, in par­ti­cu­lar, in accordance with sta­tu­to­ry reten­ti­on and sta­tu­te of limi­ta­ti­ons peri­ods.

4. Disclosure of Personal Data

We may dis­c­lo­se per­so­nal data to third par­ties, have it pro­ces­sed by third par­ties, or pro­cess it joint­ly with third par­ties. Such third par­ties may include, for exam­p­le, spe­cia­li­zed ser­vice pro­vi­ders who­se ser­vices we use.

In the cour­se of our acti­vi­ties and ope­ra­ti­ons, we may dis­c­lo­se per­so­nal data, in par­ti­cu­lar to banks and other finan­cial ser­vice pro­vi­ders, govern­ment agen­ci­es, edu­ca­tio­nal and rese­arch insti­tu­ti­ons, con­sul­tants and att­or­neys, inte­rest groups, IT ser­vice pro­vi­ders, coope­ra­ti­on part­ners, cre­dit and busi­ness cre­dit bure­aus, logi­stics and ship­ping com­pa­nies, mar­ke­ting and adver­ti­sing agen­ci­es, media out­lets, parent com­pa­nies, sister com­pa­nies, and sub­si­dia­ries, orga­nizati­ons and asso­cia­ti­ons, social insti­tu­ti­ons, tele­com­mu­ni­ca­ti­ons com­pa­nies, insu­rance com­pa­nies, and payment ser­vice pro­vi­ders.

5. Communication

We pro­cess per­so­nal data in order to com­mu­ni­ca­te with indi­vi­du­als, as well as with govern­ment agen­ci­es, orga­nizati­ons, and com­pa­nies. In par­ti­cu­lar, we pro­cess data that a data sub­ject pro­vi­des to us when cont­ac­ting us, for exam­p­le, by mail or email. We may store such data in an address book or using simi­lar tools.

Third par­ties who pro­vi­de us with data about other indi­vi­du­als are requi­red to ensu­re the data pro­tec­tion of tho­se indi­vi­du­als on their own. In par­ti­cu­lar, they must ensu­re that such data is accu­ra­te and may be dis­c­lo­sed.

6. Data Security

We take appro­pria­te tech­ni­cal and orga­nizatio­nal mea­su­res to ensu­re data secu­ri­ty com­men­su­ra­te with the respec­ti­ve risk. Through the­se mea­su­res, we ensu­re, in par­ti­cu­lar, the con­fi­den­tia­li­ty, avai­la­bi­li­ty, tracea­bi­li­ty, and inte­gri­ty of the per­so­nal data we pro­cess; howe­ver, we can­not gua­ran­tee abso­lu­te data secu­ri­ty.

Access to our web­site and our other digi­tal plat­forms is secu­red using trans­port encryp­ti­on (SSL/TLS, spe­ci­fi­cal­ly the Hyper­text Trans­fer Pro­to­col Secu­re, abbre­via­ted as HTTPS). Most brow­sers issue a war­ning befo­re visi­ting a web­site that lacks trans­port encryp­ti­on.

Our digi­tal communications—like all digi­tal com­mu­ni­ca­ti­ons, in principle—are sub­ject to mass sur­veil­lan­ce wit­hout cau­se or sus­pi­ci­on by secu­ri­ty agen­ci­es in Switz­er­land, the rest of Euro­pe, the United Sta­tes of Ame­ri­ca (USA), and other count­ries. We have no direct influence over how per­so­nal data is pro­ces­sed by intel­li­gence agen­ci­es, poli­ce depart­ments, and other secu­ri­ty agen­ci­es. Nor can we rule out the pos­si­bi­li­ty that a data sub­ject may be spe­ci­fi­cal­ly moni­to­red.

7. Personal Data Abroad

As a gene­ral rule, we pro­cess per­so­nal data in Switz­er­land. Howe­ver, we may also dis­c­lo­se or export per­so­nal data to other count­ries, in par­ti­cu­lar to pro­cess it the­re or have it pro­ces­sed the­re.

We may dis­c­lo­se per­so­nal data to any coun­try on Earth or else­whe­re in the uni­ver­se, pro­vi­ded that the laws of that juris­dic­tion ensu­re an ade­qua­te level of data pro­tec­tion in accordance with a decis­i­on by the Swiss Fede­ral Coun­cil.

We may dis­c­lo­se per­so­nal data to count­ries who­se laws do not gua­ran­tee ade­qua­te data pro­tec­tion, pro­vi­ded that ade­qua­te data pro­tec­tion is ensu­red for other rea­sons, in par­ti­cu­lar on the basis of stan­dard data pro­tec­tion clau­ses or other appro­pria­te safe­guards. In excep­tio­nal cases, we may trans­fer per­so­nal data to count­ries wit­hout ade­qua­te or appro­pria­te data pro­tec­tion if the spe­ci­fic legal requi­re­ments under data pro­tec­tion law are met, such as the expli­cit con­sent of the data sub­jects or a direct con­nec­tion to the con­clu­si­on or per­for­mance of a con­tract. Upon request, we are hap­py to pro­vi­de data sub­jects with infor­ma­ti­on about any safe­guards in place or to pro­vi­de a copy of such safe­guards.

8. Rights of Data Subjects

8.1 Claims Under Data Protection Law

We grant data sub­jects all rights pro­vi­ded for under appli­ca­ble law. In par­ti­cu­lar, data sub­jects have the fol­lo­wing rights:

• Right of Access: Data sub­jects may request infor­ma­ti­on regar­ding whe­ther we pro­cess per­so­nal data about them and, if so, what per­so­nal data is invol­ved. Data sub­jects will also recei­ve the infor­ma­ti­on neces­sa­ry to assert their rights under data pro­tec­tion law and to ensu­re trans­pa­ren­cy. This inclu­des the per­so­nal data being pro­ces­sed as such, as well as, among other things, details regar­ding the pur­po­se of pro­ces­sing, the reten­ti­on peri­od, any dis­clo­sure or export of data to other count­ries, and the ori­gin of the per­so­nal data.
• Cor­rec­tion and Rest­ric­tion: Data sub­jects may cor­rect inac­cu­ra­te per­so­nal data, com­ple­te incom­ple­te data, and have the pro­ces­sing of their data rest­ric­ted.
• Oppor­tu­ni­ty to express one’s own view­point and for human review: Indi­vi­du­als affec­ted by decis­i­ons that are based sole­ly on the auto­ma­ted pro­ces­sing of per­so­nal data and that have legal con­se­quen­ces for them or signi­fi­cant­ly affect them (auto­ma­ted indi­vi­du­al decis­i­ons) may pre­sent their own point of view and request a review by a human being.
• Dele­ti­on and Objec­tion: Data sub­jects may request the dele­ti­on of their per­so­nal data (“right to be for­got­ten”) and object to the pro­ces­sing of their data with future effect.
• Data Dis­clo­sure and Data Trans­fer: Data sub­jects may request the dis­clo­sure of their per­so­nal data or the trans­fer of their data to ano­ther data con­trol­ler.

We may defer, rest­rict, or deny the exer­cise of data sub­jects’ rights to the ext­ent per­mit­ted by law. We may inform data sub­jects of any pre­re­qui­si­tes that must be met in order to exer­cise their rights under data pro­tec­tion law. For exam­p­le, we may refu­se to pro­vi­de infor­ma­ti­on, in who­le or in part, citing con­fi­den­tia­li­ty obli­ga­ti­ons, over­ri­ding inte­rests, or the pro­tec­tion of other indi­vi­du­als. We may also, for exam­p­le, refu­se to dele­te per­so­nal data, in who­le or in part, citing sta­tu­to­ry reten­ti­on requi­re­ments.

In excep­tio­nal cases, we may char­ge a fee for the exer­cise of the­se rights. We will inform the indi­vi­du­als con­cer­ned in advan­ce of any such fees.

We are requi­red to take rea­sonable mea­su­res to iden­ti­fy data sub­jects who request infor­ma­ti­on or exer­cise other rights. Data sub­jects are requi­red to coope­ra­te.

8.2 Legal Protection

Data sub­jects have the right to enforce their data pro­tec­tion rights through legal action or to file a report or com­plaint with a data pro­tec­tion super­vi­so­ry aut­ho­ri­ty.

The super­vi­so­ry aut­ho­ri­ty for data pro­tec­tion for pri­va­te data con­trol­lers and fede­ral agen­ci­es in Switz­er­land is the Fede­ral Data Pro­tec­tion and Infor­ma­ti­on Com­mis­sio­ner (FDPIC).

9. Use of the Website

9.1 Cookies

We may use coo­kies. Cookies—including our own coo­kies (first-par­ty coo­kies) and coo­kies from third par­ties who­se ser­vices we use (third-par­ty cookies)—are data stored in the brow­ser. Such stored data is not neces­s­a­ri­ly limi­t­ed to tra­di­tio­nal text-based coo­kies.

Coo­kies can be stored tem­po­r­a­ri­ly in the brow­ser as “ses­si­on coo­kies” or for a spe­ci­fic peri­od of time as so-cal­led per­ma­nent coo­kies. “Ses­si­on coo­kies” are auto­ma­ti­cal­ly dele­ted when the brow­ser is clo­sed. Per­ma­nent coo­kies have a spe­ci­fic reten­ti­on peri­od. In par­ti­cu­lar, coo­kies make it pos­si­ble to reco­gni­ze a brow­ser the next time it visits our web­site and, for exam­p­le, to mea­su­re the reach of our web­site. Howe­ver, per­ma­nent coo­kies can also be used for online mar­ke­ting, for exam­p­le.

Coo­kies can be dis­ab­led, rest­ric­ted, or deleted—either in who­le or in part—at any time through your brow­ser set­tings. Brow­ser set­tings often also allow for the auto­ma­tic dele­ti­on and other manage­ment of coo­kies. Wit­hout coo­kies, our web­site may no lon­ger be ful­ly acces­si­ble. We actively seek your express con­sent to the use of cookies—at least to the ext­ent requi­red by appli­ca­ble law.

For coo­kies used to mea­su­re per­for­mance and reach or for adver­ti­sing, many ser­vices offer a gene­ral opt-out opti­on through AdChoices (Digi­tal Adver­ti­sing Alli­ance of Cana­da), the Net­work Adver­ti­sing Initia­ti­ve (NAI), You­rAd­Choices (Digi­tal Adver­ti­sing Alli­ance), or Your Online Choices (Euro­pean Inter­ac­ti­ve Digi­tal Adver­ti­sing Alli­ance, EDAA).

9.2 Logging

For every visit to our web­site and our other digi­tal pre­sence, we may log at least the fol­lo­wing infor­ma­ti­on, pro­vi­ded that this infor­ma­ti­on is auto­ma­ti­cal­ly coll­ec­ted or trans­mit­ted to our digi­tal infras­truc­tu­re during such visits: Date and time, inclu­ding time zone; IP address; access sta­tus (HTTP sta­tus code); ope­ra­ting system, inclu­ding user inter­face and ver­si­on; brow­ser, inclu­ding lan­guage and ver­si­on; spe­ci­fic sub­pages of our web­site acces­sed, inclu­ding the amount of data trans­fer­red; and the last web­page acces­sed in the same brow­ser win­dow (refer­rer).

We record such information—which may also con­sti­tu­te per­so­nal data—in log files. This infor­ma­ti­on is neces­sa­ry to ensu­re that our digi­tal pre­sence is available on a long-term basis, in a user-fri­end­ly and relia­ble man­ner. It is also neces­sa­ry to ensu­re data security—including through third par­ties or with the assi­stance of third par­ties.

9.3 Pixel Counters

We may incor­po­ra­te track­ing pixels into our digi­tal pre­sence. Track­ing pixels are also known as web bea­cons. Track­ing pixels—including tho­se from third par­ties who­se ser­vices we use—are typi­cal­ly small, invi­si­ble images or Java­Script scripts that are auto­ma­ti­cal­ly loa­ded when you access our digi­tal pre­sence. Track­ing pixels can coll­ect at least the same infor­ma­ti­on as is recor­ded in log files.

10. Third-Party Services

We use ser­vices pro­vi­ded by spe­cia­li­zed third par­ties to ensu­re that we can car­ry out our acti­vi­ties and ope­ra­ti­ons in a sus­tainable, user-fri­end­ly, secu­re, and relia­ble man­ner. The­se ser­vices allow us, among other things, to embed fea­tures and con­tent into our web­site. When such embed­ding occurs, the ser­vices used coll­ect users’ IP addres­ses—at least temporarily—for tech­ni­cal rea­sons.

For neces­sa­ry secu­ri­ty-rela­ted, sta­tis­ti­cal, and tech­ni­cal pur­po­ses, third par­ties who­se ser­vices we use may pro­cess data rela­ted to our acti­vi­ties and ope­ra­ti­ons in an aggre­ga­ted, anony­mi­zed, or pseud­ony­mi­zed form. This inclu­des, for exam­p­le, per­for­mance or usa­ge data neces­sa­ry to pro­vi­de the respec­ti­ve ser­vice.

In par­ti­cu­lar, we use:

• Goog­le Ser­vices: Pro­vi­ders: Goog­le LLC (U.S.) / Goog­le Ire­land Limi­t­ed (Ire­land), in part for users in the Euro­pean Eco­no­mic Area (EEA) and Switz­er­land; Gene­ral Infor­ma­ti­on on Data Pro­tec­tion: “Data Pro­tec­tion Prac­ti­ces & Safe­guards,” Pri­va­cy Poli­cy, “More Infor­ma­ti­on on How Goog­le Uses Per­so­nal Data,” “Goog­le Is Com­mit­ted to Com­ply­ing with Appli­ca­ble Data Pro­tec­tion Laws,” “Gui­de to Data Pro­tec­tion in Goog­le Pro­ducts,” “How We Use Data from Web­sites or Apps Whe­re Our Ser­vices Are Used,” Coo­kie Poli­cy, “Ads You Can Con­trol” (per­so­na­li­zed ad set­tings).

10.1 Digital Infrastructure

We use ser­vices pro­vi­ded by spe­cia­li­zed third par­ties to access the digi­tal infras­truc­tu­re we need in con­nec­tion with our acti­vi­ties and ope­ra­ti­ons. The­se include, for exam­p­le, hosting and sto­rage ser­vices from sel­ec­ted pro­vi­ders.

In par­ti­cu­lar, we use:

• Info­ma­ni­ak: Hosting; Pro­vi­der: INFOMANIAK NETWORK SA (Switz­er­land); Infor­ma­ti­on on data pro­tec­tion: “Info­ma­ni­ak and the Pro­tec­tion of Your Per­so­nal Data,” Pri­va­cy Poli­cy, Coo­kie Poli­cy, “Cer­ti­fi­ca­ti­ons and Labels.”

10.2 Fonts

We use third-par­ty ser­vices to embed sel­ec­ted fonts, icons, logos, and sym­bols on our web­site.

In par­ti­cu­lar, we use:

• Goog­le Fonts: Fonts; Pro­vi­der: Goog­le; Goog­le Fonts-spe­ci­fic infor­ma­ti­on: “Your Pri­va­cy and Goog­le Fonts,” “Data Pro­tec­tion and Data Coll­ec­tion” (Goog­le Fonts).

11. Website Extensions

We use exten­si­ons on our web­site to pro­vi­de addi­tio­nal func­tion­a­li­ty. We may use sel­ec­ted ser­vices from appro­pria­te pro­vi­ders or imple­ment such exten­si­ons on our own digi­tal infras­truc­tu­re.

In par­ti­cu­lar, we use:

• Anti­s­pam Bee: Pri­va­cy-fri­end­ly yet effi­ci­ent and relia­ble spam pro­tec­tion (distin­gu­is­hes bet­ween desi­red con­tent from humans and unwan­ted con­tent from bots and spam); Deve­lo­pers: Plug­in­kol­lek­tiv (in Ger­ma­ny and the rest of Euro­pe); Data pro­tec­tion infor­ma­ti­on: Ope­ra­tes on its own digi­tal infras­truc­tu­re and wit­hout coo­kies; Docu­men­ta­ti­on (Plug­in­kol­lek­tiv); Docu­men­ta­ti­on (Git­Hub).

12. Measuring Success and Reach

We stri­ve to mea­su­re the suc­cess and reach of our acti­vi­ties and ope­ra­ti­ons. As part of this effort, we can also mea­su­re the impact of third-par­ty recom­men­da­ti­ons or test how dif­fe­rent parts or ver­si­ons of our digi­tal pre­sence are used (the “A/B test­ing” method). Based on the results of the­se suc­cess and reach mea­su­re­ments, we can, in par­ti­cu­lar, cor­rect errors, enhan­ce popu­lar con­tent, or make impro­ve­ments.

In most cases, the IP addres­ses of indi­vi­du­al users are coll­ec­ted to mea­su­re suc­cess and reach. In such cases, IP addres­ses are always trun­ca­ted (“IP mas­king”) in order to com­ply with the prin­ci­ple of data mini­mizati­on through pseud­ony­mizati­on.

As a gene­ral rule, any user pro­files crea­ted are exclu­si­ve­ly pseud­ony­mi­zed and are not used to iden­ti­fy indi­vi­du­al users. Cer­tain third-par­ty ser­vices with which users are regi­stered may, in some cases, asso­cia­te the use of our online offe­ring with the user’s account or pro­fi­le on the respec­ti­ve ser­vice.

In par­ti­cu­lar, we use:

• Goog­le Tag Mana­ger: Inte­gra­ti­on and manage­ment of Goog­le and third-par­ty ser­vices, par­ti­cu­lar­ly for mea­su­ring per­for­mance and reach; Pro­vi­der: Goog­le; Goog­le Tag Mana­ger-spe­ci­fic infor­ma­ti­on: Pri­va­cy Poli­cy for Goog­le Tag Mana­ger; addi­tio­nal infor­ma­ti­on on data pro­tec­tion can be found in the pri­va­cy poli­ci­es of the indi­vi­du­al inte­gra­ted and mana­ged ser­vices.

13. Final Notes on the Privacy Policy

We may update this Pri­va­cy Poli­cy at any time. We will noti­fy you of any updates in an appro­pria­te man­ner, spe­ci­fi­cal­ly by publi­shing the most cur­rent ver­si­on of the Pri­va­cy Poli­cy on our web­site.