Data protection and processing (privacy)

This data protection and processing policy of the Immoware.swiss website, the Immoware software, and the databases of clients, suppliers, and users archived and managed by Studiosoft Sagl (hereinafter also "we/us" or "IMMOWARE") informs clients, suppliers, and users (hereinafter "you" or "users") of our services, our offers, and our products (hereinafter "services") regarding the collection and processing of their data (personal data as well as non-personal data; hereinafter "data").

1. Introduction

Below, we inform you, among other things, about who the controller of your data is, what data we collect in connection with your use of our services, for what purposes we process such data, and to whom we may disclose it. Furthermore, we inform you about the duration of the processing of your data, the legal basis of the processing (where one is required), as well as what rights you have vis-à-vis us regarding the processing of your data. This data protection policy applies to all your data already in our possession or that will be in the future. Please note that this data protection policy may be amended from time to time. The current updated version published on www.Immoware.swiss applies.

Personal data means all information relating to an identified or identifiable person (hereinafter "personal data"). This includes, in particular, information such as name, address, telephone number, email address, and potentially also IP addresses and device identifiers. In this data protection policy, the generic term "data" encompasses personal data as well as non-personal data and anonymized data. Processing means any handling of data, regardless of the means and procedures applied, in particular the collection, storage, use, modification, disclosure, archiving, or deletion of data (hereinafter "processing"). If you provide us with personal data of other individuals, please ensure that these individuals are aware of this data protection policy and only provide us with their data if you are authorized to do so under applicable data protection law (including the Swiss Federal Act on Data Protection, FADP).

2. Data Controller

The data controller within the meaning of this data protection policy is immoware.swiss - STUDIOSOFT Sagl of Chiasso, Corso San Gottardo 73, Switzerland. For any questions and inquiries regarding data protection, please contact our data protection department (reachable at info@studiosoft.ch).

3. Categories of Processed Data

We collect certain data during the use of our services, our software, and in contact with Immoware.swiss (e.g. when visiting our websites, during the use of one of our mobile apps or another of our digital services, upon concluding a contract, during registration, or upon logging into the user account, or in contact with our employees). As a rule, we collect this data directly from you. In certain cases, we may receive data from other persons (e.g. if a third party submits a rating or comment referring to you, if your employer provides us with your contact details, or if a company with which you maintain a contractual relationship forwards your data to us).

The personal data we process may include the following:

• Data provided to us upon registration for one of our services (e.g. name, contact details, gender, marital status, date of birth, professional title, photos, relatives, employees, language, payment information, login credentials, etc.).
• Data relating to offers and concluded contracts (e.g. date, type, content, product, parties, duration, value, contract amendments, payment information, contact details, contact persons, billing and correspondence addresses, customer feedback, terminations, disputes, etc.).
• Data identified or communicated during the use of our services by registered and unregistered users. This includes, among other things, IP and MAC address or device ID, cookies, pages accessed by users and search terms entered by them, text field entries, bookings, ratings, time and duration of visits, clicks, responses to offers from Immoware.swiss and third parties, referring/exit URLs, information on the time of use, browser and device type, operating system and Internet service provider used, as well as the volume of transmitted data. This also includes data published or communicated via our services (including any integrated third-party services) (e.g. images, texts, comments, ratings, bookings, videos, etc.). We may link personal data relating to one of our services with data originating from another service.
• Data exchanged during or in connection with contact with us (e.g. communication by letter, telephone, fax, email, text and multimedia messages (SMS/MMS), video messages or instant messaging, reactions to communications and offers from Immoware.swiss, preferred communication channels, etc.).
• Data that you or third parties communicate when participating in contests, surveys, and the like.
• Certain Immoware.swiss services may collect and store location data if the geolocation function of the device used is active.
• Data provided to us by third parties with whom we maintain business relationships (e.g. directory entries, address databases, modifications to database entries, creditworthiness data, information regarding internal company contact persons, etc.).
• Data from public sources (e.g. commercial register entries, other directories, etc.).

The aforementioned data is not always personal data. As a rule, we are not able to attribute data generated during the use of our services without registration (e.g. via a user account) to nominally identified individuals. In specific cases, however, this may occur in combination with other data.

In order to use our services, you may be required to provide certain personal data that is necessary or prescribed by law for initiating and managing the contractual relationship and for fulfilling the contractual obligations related thereto. In the absence of such personal data, we will, in principle, not be able to enter into and perform the contract or provide a specific service.

The logging of access to our digital services and the associated collection of connection data (such as the IP address) is also necessary; this function activates automatically upon use and cannot be disabled for individual users. Therefore, if you do not agree with the collection of such data, you must refrain from using our services.

4. Purposes of Processing and Legal Bases

The processing of personal data, to the extent permitted under applicable law, will be carried out in particular for the following purposes:

• initiation, conclusion, fulfillment, and execution of contracts;
• provision, further development, and improvement of our services, development of new services, operation, maintenance, optimization, and security assurance of our services and our infrastructure;
• management of users of our services, identity checks, logins, and other authentications;
• maintenance, administration, and development of our customer relationships, communication with customers and third parties, customer service and support, promotions, advertising and marketing, creation of user profiles, provision of personalized services and relevant content;
• management and publication of directories (in print, on data carriers, and/or on the Internet), management, comparison, and updating of databases, including central directories of addresses and contact details relating to our company and to companies with which we maintain a contractual relationship;
• protection of users, our employees, and third parties, as well as protection of our data, trade secrets, and assets, security of our systems, buildings, and other infrastructure;
• quality control, market research, statistical calculations, reporting, development of business-relevant management information, administration and development of the company, our offering, and our activities, acquisition and disposal of business units, companies, and parts thereof;
• compliance with legal and regulatory obligations and internal rules, law enforcement, civil, administrative, and criminal proceedings, claims, fraud prevention, investigations, and responding to inquiries from authorities and administrative bodies.

We may also process personal data for other purposes, to the extent that a legal obligation requires such processing, where we inform you thereof elsewhere, or where the processing was discernible from the circumstances at the time the data was collected.

We use personal data for the aforementioned purposes on the basis of the following legal grounds, to the extent required under applicable data protection law (such as the FADP):

• performance of a contract;
• compliance with legal obligations;
• consent granted to us or to third parties;
• legitimate interests of our own and of third parties, in particular:
• offering and providing services;
• advertising and marketing;
• maintaining contact and communicating with users and third parties;
• monitoring user behavior, preferences, and needs, market research;
• further development and improvement of our services, development of new services;
• user management, identity checks, logins, authentications;
• protection of users, our employees, and third parties, our data, secrets, infrastructure, and assets;
• maintenance, security, efficiency, and effectiveness of business management organization, including secure, efficient, and effective operation and further development of digital services and other IT systems, troubleshooting;
• appropriate corporate management and development, sale or acquisition of business units, companies, or parts of companies, and other commercial law transactions;
• compliance with legal and regulatory obligations and internal rules, law enforcement, civil, administrative, and criminal proceedings, claims, fraud prevention, investigations, and responding to inquiries from authorities.

5. Publication and Disclosure of Data

We may publish and disclose data as set out below:

Publication

Certain services of ours provide for the publication of data. As a rule, published data can be accessed from anywhere, including outside Switzerland. For example, published directory data is publicly available (e.g. on Facebook.com, Linkedin.com, etc.). Data published via the corresponding features of our services (e.g. posts, images, texts, videos, comments, ratings, etc.) may also be publicly accessible. The same applies to the username used in this context. Published data may also be republished by us or by third parties on other platforms and in other media (e.g. print media), where appropriate with the necessary adaptations. Data published on our services is likely to also be indexed by search engines (e.g. Google) or further disseminated by third parties, over which we have no influence; consequently, such data may continue to be publicly available in any country worldwide even after it has been deleted by us.

Data Processors

We may engage third parties to perform certain services (e.g. in the IT sector, application hosting/management, administration, printing, shipping, etc.) and to process and store data (so-called "processors"). Processors may access personal data and process it on our behalf. In this regard, we oblige processors to comply with data protection law and to process the data only as we would process it ourselves. Processors who may receive personal data can be located in any country, in particular in Switzerland, in EU and EEA countries, and in the United States.

Contractual Partners

We may disclose data to contractual partners (for example, sales partners, service providers, clients, suppliers, financial institutions, etc.). This occurs, for example, to fulfill contractual obligations, to offer certain services, for database comparison, validation, and updating (including central directories of our addresses and contact details and those of our contractual partners), for debt collection and marketing purposes, for analyzing the use and operation of our services, our systems, and our infrastructure, as well as for payment processing. Potential recipients may also include purchasers or parties interested in acquiring business units, companies, or parts thereof. Contractual partners may obtain access to personal data and process it for their own purposes (for example, to fulfill the contract or their own legal obligations). In this regard, they are required to comply with applicable data protection laws. Contractual partners who may receive personal data can be located in any country, in particular in Switzerland, in EU and EEA countries, and in the United States.

Disclosure to Authorities and Other Disclosures for Legal Reasons

In certain situations, we may disclose data to authorities, administrative bodies, and other third parties (e.g. in connection with official or regulatory requests, inquiries and investigations, administrative or criminal investigations, civil and/or criminal proceedings). We do so in cases where we are officially or authoritatively required to do so, or where, in our opinion, we are obliged to do so, or where we can prevent cases of fraud or security flaws or protect the rights and property of Immoware.swiss. If data that is not already public in itself is transferred to a country without adequate data protection, we ensure adequate data protection through the use of appropriate contractual guarantees, in particular based on standard contractual clauses approved by the competent authority or Binding Corporate Rules, or relying on exceptions such as consent, performance of the contract, the establishment, exercise, or enforcement of legal claims, overriding public interests, or because it is necessary to protect the life or physical integrity of a data subject. Where applicable data protection law provides for it, you may obtain from our data protection department a copy of the contractual guarantees regarding your personal data or find out where to request them. We reserve the right to redact such copies for data protection or confidentiality reasons.

6. Retention Period

We store personal data for as long as necessary for the purposes for which we collected it. Furthermore, certain personal data is subject to legally binding retention obligations of ten or more years, which we comply with. We may also store personal data at least for the duration of the applicable limitation periods, which in several cases are five or ten years. Personal data generated in connection with the use of our services (e.g. logs, log files, analyses, etc.) that is not subject to such retention or limitation periods is generally deleted sooner, as soon as the interest in processing it ceases. Data may also be retained longer in anonymized form. Subject to an express contractual agreement, we are under no obligation to you to retain data for a specific duration.

7. Cookies, Web Analytics and Tracking Tools, and Other Technologies

We use various standard technologies to record, store, and analyze data when you use our services.

These technologies include, in particular, cookies by means of which your browser or end device can be identified. A cookie is a small file sent to your computer or stored automatically by the browser used on your computer or mobile device when you access one of our services. If you access a service again, that service can recognize your browser or your end device thanks to the cookie. Cookies can store user settings and other information. In addition to so-called session cookies, which are automatically deleted again after a visit to our services, we also use temporary and permanent cookies that remain stored longer on your computer or mobile device. The cookies used serve primarily to offer you the features of the various services more easily and securely (such as logging into the user account).

Furthermore, the information collected via cookies enables us to improve our services in line with customer wishes and to present you with personalized offers and advertisements. We assume that by using our services and the corresponding functions (e.g. language selection, automatic login), you consent to the use of such cookies. You can block the use of cookies or delete them in your browser settings. Please note that if you do not consent to cookies, you may not be able to fully use all functions of a service, and that deleting cookies will also delete any opt-out cookies you may have set. Such opt-out cookies would then have to be reactivated upon visiting the relevant service again. Otherwise, you will be recognized as a new user, and your data will need to be collected again.

In addition to cookies, we may also use other technologies (e.g. pixels, web beacons, tags, advertising IDs) to analyze the use of our services, personalize them, and display personalized offers and advertisements to you. When sending newsletters and emails, we may, for example, use technologies that allow us to analyze what content interests users and whether, when, and how they react to our offers (e.g. downloading images in an email, clicking on URLs contained in an email or on a website, filling in form data, etc.). We assume that by using such functions, you consent to the use of the relevant technologies.

Finally, we use standard web analytics and tracking tools to evaluate and analyze the use of our services. These tools, mostly provided by third parties, provide us with information and statistics on the use of our services, helping us to better understand it and adjust our services accordingly to user needs. Google servers in the United States and stored there. For Google Analytics, IP anonymization has been activated on our services. Your IP address is therefore truncated beforehand by Google within member states of the European Union or in other contracting states to the EEA. The full IP address is transferred to a Google server in the United States and truncated there only in exceptional cases. Google uses this information to analyze the use of the respective website, compile reports on website activity, and provide the website operator with other services relating to website and Internet use.

Please note that selected third parties (e.g. advertising partners) may also use cookies and other technologies on our services to analyze the use of the services, personalize the services themselves, and show you personalized offers and advertisements. You can find an overview of the third parties with whom we collaborate in this context here. The processing of data by such third parties is subject to their own data protection and privacy policies.

8. Social Media Plugins and Integration of Third-Party Offerings

We integrate social network plugins (e.g. Facebook, Linkedin, Twitter, etc.) into our services. These plugins facilitate the sharing of content on such platforms.

When visiting our services that contain such plugins, a connection to the server of the respective provider may be established automatically. In this context, certain data (such as the time of the visit to the service, browser type, IP address) is collected and stored by this server. If you have a user account with one of these providers, the provider may assign this information to your profile. If you also interact with these plugins (e.g. by clicking the "like" button or leaving a comment), this information is also transmitted to the provider, stored by them, and potentially published. When using a social login service (e.g. Facebook Connect), the provider may transmit personal data to us, such as your name, email address, and profile picture stored with the provider.

We also integrate third-party services into our services that allow you to interact with clients and other users of Immoware.swiss and with third parties (for example, to make a booking via a booking service or to post ratings and comments). In this regard, any data provided is transmitted to these third parties for processing and execution of the respective service, or is processed directly by these third parties.

Please note that the processing of data by such third parties is subject to their own terms of use and data protection policies.

9. Rights of Data Subjects

Every data subject has a right of access (right to information) regarding personal data concerning them. Furthermore, the data subject has the right to demand from us the rectification, deletion, and restriction of data concerning them, as well as to object to such processing of personal data. The exercise of such rights generally requires that the data subject can unambiguously prove their identity. Where the processing of personal data is based on consent, such consent may be revoked at any time by the data subject. In EU or EEA member states, the data subject has the right, in certain cases, to receive the data generated during the use of online services in a structured, commonly used, and machine-readable format that permits further use and transmission. Requests relating to these rights must be addressed to the data protection department (see Section 2 above). We reserve the right to restrict the rights of the data subject within the framework of applicable law (including the FADP) and, for example, not to disclose full information or not to delete data. We also draw your attention to the fact that deleting your personal data may result in some or all of the services no longer being usable or available.

If we make an automated decision regarding an individual that produces legal effects concerning the data subject or similarly significantly affects them, the data subject may speak with a competent person in our company to request that said automated decision be reconsidered, or request from the outset a human review, to the extent provided for by applicable law. In such case, the data subject may possibly no longer be able to use certain automated services. The person will be informed separately.

Every data subject has the right to lodge a complaint with the competent data protection supervisory authority. In the case of a controller in Switzerland, this is the Federal Data Protection and Information Commissioner (FDPIC) (http://www.edoeb.admin.ch).