Data privacy statement

 

With this privacy policy, VZPM informs about the personal data it processes in connection with its certifications, including its website www.vzpm.ch. In particular, we provide information on what personal data we process for what purpose, how and where. We also inform about the rights of individuals whose data we process.

For individual or additional activities and operations, additional privacy policies, as well as other legal documents such as Terms and Conditions (T&Cs), Usage Terms, or Participation Requirements, may apply.

 

1. Terms and Legal Bases

1.1 Terms

Personal data refers to all information relating to a specific or identifiable natural person. A data subject is a person about whom we process personal data.

Processing includes any handling of personal data, regardless of the means and methods used, such as querying, comparing, adapting, archiving, retaining, reading out, disclosing, procuring, recording, collecting, deleting, arranging, organising, storing, modifying, distributing, linking, destroying, and using personal data.

 

1.2 Legal Bases

We process personal data in accordance with Swiss data protection law such as, in particular, the Federal Data Protection Act (DPA), and the Data Protection Ordinance (DPO).

 

2. Nature, Scope and Purpose

We process those personal data that are necessary to permanently, user-friendly, safely, and reliably carry out our activities and operations. Such personal data may particularly fall into the categories of inventory and contact data, browser and device data, content data, meta or marginal data, and usage data, location data, sales data, as well as contract and payment data.

We process personal data for the duration necessary for the respective purpose or as required by law. Personal data that is no longer required for processing will be anonymised or deleted.

We may have third parties process personal data on our behalf. We may also process personal data in collaboration with third parties or transmit it to third parties. These third parties include specialised service providers whose services we utilise. We ensure data protection with these third parties as well.

We process personal data only with the consent of the data subject, unless processing is permissible for other legal reasons. Processing without consent may be permissible, for example, to fulfil a contract with the data subject and for relevant pre-contractual measures, to protect our overriding legitimate interests, when processing is evident from the circumstances, or after prior notification.

In this context, we primarily process information that a data subject voluntarily provides to us when contacting us, for instance, through postal mail, email, instant messaging, contact form, social media, or by phone, or when registering for a user account. We may store such information, for example, in an address book, a Customer Relationship Management system (CRM system), or similar tools. When we receive data about other individuals from senders, those senders are obliged to ensure data protection for these individuals and ensure the accuracy of this personal data.

We also process personal data that we receive from third parties, obtain from publicly accessible sources, or collect in the course of our activities and operations, to the extent that such processing is permissible for legal reasons..

 

3. Personal Data Abroad 

We primarily process personal data in Switzerland. However, we may also disclose or export personal data to other countries, particularly to process them there or have them processed.

We may disclose personal data to all countries and territories on Earth and elsewhere in the universe, provided that the local laws, as determined by a decision of the Swiss Federal Council, ensure adequate data protection.

We may disclose personal data to countries where the law does not ensure adequate data protection, provided that suitable data protection is ensured for other reasons. Suitable data protection can be ensured, for example, through appropriate contractual agreements, based on standard data protection clauses, or with other suitable guarantees. In exceptional cases, we may export personal data to countries without adequate or suitable data protection if specific data protection requirements are met, such as the explicit consent of the data subjects or a direct connection to the conclusion or execution of a contract. Upon request, we will gladly provide data subjects with information about any guarantees or supply a copy of such guarantees.

 

4. Rights of Data Subjects

4.1 Data Protection Claims

We grant data subjects all rights in accordance with applicable data protection law. In particular, data subjects have the following rights:

  • Information: Data subjects can request information about whether we process personal data about them and, if so, what personal data is involved. Data subjects also receive the information necessary to assert their data protection rights and ensure transparency. This includes the processed personal data as such, but also information about the purpose of processing, the duration of retention, any disclosure or export of data to other countries, and the source of the personal data.
  • Rectification and Restriction: Data subjects can correct inaccurate personal data, complete incomplete data, and request restrictions on the processing of their data.
  • Deletion and Objection: Data subjects can have their personal data deleted (“right to be forgotten”) and object to the processing of their data for the future.
  • Data Disclosure and Data Transfer: Data subjects can request the disclosure of their personal data or the transfer of their data to another data controller.

We may, within the legally permissible framework, postpone, limit, or refuse the exercise of data subject rights. We may inform data subjects of any prerequisites they may need to fulfil to exercise their data protection claims. For example, we may refuse full or partial information based on business secrets or the protection of other individuals. Similarly, we may refuse full or partial deletion of personal data by citing legal retention obligations.

We may exceptionally impose charges for the exercise of rights. We will inform data subjects in advance of any potential costs.

We are obligated to reasonably verify the identity of data subjects who request information or assert other rights. Data subjects are required to cooperate in this process.

 

4.2 Right to Complain

Data subjects have the right to enforce their data protection claims through legal means or lodge a complaint with a competent data protection supervisory authority. The data protection supervisory authority for private controllers and federal agencies in Switzerland is the Federal Data Protection and Information Commissioner (FDPIC).

 

5. Data Security

We implement appropriate technical and organisational measures to ensure data security commensurate with the respective risks. However, we cannot guarantee absolute data security.

Access to our website is provided through transport encryption (SSL/TLS, specifically using the Hypertext Transfer Protocol Secure, abbreviated as HTTPS). Most browsers indicate transport encryption with a padlock icon in the address bar.

Our digital communication, like all digital communication in general, is subject to mass surveillance without cause or suspicion, as well as other surveillance by law enforcement agencies in Switzerland, the rest of Europe, the United States of America (USA), and other countries. We cannot directly control the processing of personal data by intelligence agencies, police authorities, and other security agencies.

 

6. Use of the Website

6.1 Cookies

We may use cookies. Cookies, both first-party cookies and third-party cookies from services we use, are data stored in the browser. Such stored data may not be limited to traditional text-based cookies.

Cookies can be temporarily stored in the browser as 'session cookies' or for a specific period as so-called permanent cookies. 'Session cookies' are automatically deleted when the browser is closed. Permanent cookies have a designated storage duration. Cookies allow, in particular, the recognition of a browser on the next visit to our website, facilitating tasks such as measuring the reach of our website. Permanent cookies can also be used for online marketing, for instance.

Cookies can be disabled or deleted entirely in the browser settings at any time. Without cookies, our website may not be fully functional. We request, at least when and where necessary, explicit consent for the use of cookies.

For cookies used for performance and audience measurement or for advertising, many services offer a general opt-out option through AdChoices (Digital Advertising Alliance of Canada), the Network Advertising Initiative (NAI), YourAdChoices (Digital Advertising Alliance) or Your Online Choices (European Interactive Digital Advertising Alliance, EDAA).

 

6.2 Server Log Files

We may record the following information for each access to our website, to the extent that it is transmitted from your browser to our server infrastructure or can be determined by our web server: date and time, including time zone, IP address (Internet Protocol), access status (HTTP status code), operating system including user interface and version, browser including language and version, individual subpage of our website accessed, including the amount of data transferred, and the last webpage accessed in the same browser window (referer or referrer).

We store such information, which may also constitute personal data, in server log files. This information is necessary to provide our website permanently, user-friendly, and reliably and to ensure data security, including the protection of personal data, both by ourselves and with the assistance of third parties.

 

6.3 Tracking Pixel

We may use tracking pixels on our website, also known as web beacons. Tracking pixels, including those from third parties whose services we use, are small, usually invisible images that are automatically retrieved when visiting our website. Tracking pixels can capture the same information as server log files.

 

7. Notifications and Communications

We send notifications and communications via email and through other communication channels such as instant messaging or SMS.

 

7.1 Success and Reach Measurement

Notifications and communications may contain web links or tracking pixels that capture whether an individual message was opened and which web links were clicked. Such web links and tracking pixels can also capture the personal use of notifications and communications. We require this statistical data collection for success and reach measurement to effectively and user-friendly send notifications and communications based on the needs and reading habits of the recipients, ensuring permanent, safe, and reliable delivery.

 

7.2 Consent and Objection

You must generally provide explicit consent for the use of your email address and other contact information unless the use is permissible for other legal reasons.

You can generally object to receiving notifications and communications, such as newsletters, at any time. With such an objection, you can also object to the statistical tracking of usage for success and reach measurement. Mandatory notifications and communications related to our activities and operations remain unaffected.

 

7.3 Service Providers for Notifications and Communications

We send notifications and communications with the help of specialised service providers. In particular, we use:

 

8. Social Media

We maintain a presence on social media platforms and other online channels in order to engage with interested parties and to provide information regarding our activities and operations. In connection with the use of such platforms, personal data may be processed outside the jurisdiction of Switzerland.

The general terms and conditions (GTC), terms of use, privacy policies, and other provisions established by the respective platform operators shall also apply. These provisions inform, in particular, about the rights of data subjects vis-à-vis the respective platform, including, for example, the right of information.

 

9. Third-Party Services

We utilise services provided by specialised third parties in order to carry out our activities in a sustainable, user-friendly, secure, and reliable manner. These services may enable us, among other things, to embed functions and content into our website. For technical reasons, such embedded services may temporarily collect users’ Internet Protocol (IP) addresses.

For necessary security-related, statistical, and technical purposes, third parties whose services we employ may process data in connection with our activities in aggregated, anonymised, or pseudonymised form. This may include performance or usage data required to provide the respective service. In particular, we use:

 

9.1 Digital Infrastructure

We utilise services provided by specialised third parties in order to obtain the necessary digital infrastructure for our activities and operations. This includes, for example, hosting and storage services from selected providers. In particular, we use:

 

9.2 Contact Options

We use services provided by selected third-party providers in order to improve communication with third parties, such as potential and existing customers.

 

9.3 Audio and Video Conferences

We use specialised services for audio and video conferencing in order to facilitate online communication. These services enable us, for example, to hold virtual meetings, conduct online exams, or host webinars. Participation in audio and video conferences is also subject to the legal terms of the respective service providers, such as their privacy policies and terms of use.

Depending on individual circumstances, we recommend muting the microphone by default and either blurring the background or using a virtual background when participating in audio or video conferences. In particular, we use:

 

9.4 Social Media Functions and Content

We use services and plugins provided by third parties to embed functions and content from social media platforms, as well as to enable the sharing of content on social media platforms and through other channels. In particular, we use:

 

9.5 Map Services

We use services provided by third parties to embed maps into our website. In particular, we use:

 

9.6 Digital Audio and Video Contents

We use services provided by specialised third parties to enable the direct playback of digital audio and video content, such as music or podcasts. In particular, we use:

  • Vimeo: Video platform; Provider: Vimeo Inc. (USA); Information on data protection: Privacy Policy.

 

9.7 Fonts

We use services provided by third parties to embed selected fonts, as well as icons, logos, and symbols, into our website. In particular, we use:

 

9.8 Advertising

We make use of opportunities to display targeted advertising for our activities and operations via third parties, such as social media platforms and search engines.

Through such advertising, we aim in particular to reach individuals who are already interested in our activities or who may have a potential interest in them (remarketing and targeting). For this purpose, we may transmit relevant – potentially also personal – data to third parties that enable such advertising. We may also assess the effectiveness of our advertising, in particular whether it leads to visits to our website (conversion tracking).

Third parties with whom we advertise and on whose platforms you are registered as a user may, under certain circumstances, associate the use of our online offering with your respective user profile on those platforms. In particular, we use:

 

10. Website Extensions

We use extensions on our website to enable additional functionality. In particular, we use:

 

11. Performance and Reach Measurement

We use services and software tools to analyse how our online offering is used. This enables us, for example, to measure the success and reach of our activities and operations, as well as the impact of third-party links to our website. We may also test and compare how different versions or components of our online offering are used (A/B testing). Based on the results of performance and reach measurement, we can identify and correct errors, strengthen popular content, or make improvements to our online offering.

When using services and tools for performance and reach measurement, the Internet Protocol (IP) addresses of individual users must be stored. As a rule, IP addresses are truncated (“IP masking”) to comply with the principle of data minimisation and to enhance user privacy through pseudonymisation.

Cookies may be used and user profiles created when using such services and tools. These profiles may include, for example, pages visited or content viewed on our website, screen or browser window size, and the approximate location. As a rule, user profiles are created exclusively in pseudonymised form. We do not use these profiles to identify individual users. However, third-party providers with whom users have an account may be able to associate the use of our online offering with the respective user account or profile.

In particular, we use:

  • Google Analytics: Performance and reach measurement; Provider: Google; Google Analytics-specific information: Measurement across different browsers and devices (cross-device tracking) and use of pseudonymised IP addresses, which are only exceptionally transmitted in full to Google in the USA, «Privacy», «Browser add-on to deactivate Google Analytics».
  • Google Tag Manager: Integration and management of other services for performance und reach measurement, as well as other services from Google and third parties; Provider: Google; Google Tag Manager-specific information: «Data collected via Google Tag Manager»; Additional information on data protection can be found in the respective policies of the integrated und managed services.

 

12. Video Surveillance

We use video surveillance to prevent criminal activity, to preserve evidence in the event of criminal offences, and to exercise our property rights.

Recordings from our video surveillance systems are stored for as long as necessary to preserve evidence.

We may retain recordings due to legal obligations, to enforce our own legal claims, or in cases of suspected criminal activity. Such recordings may be disclosed to competent authorities, in particular courts or law enforcement agencies.

 

13. Contact

If you have any questions regarding data protection, please contact us at datenschutz@vzpm.ch

 

14. Final Provisions

This privacy policy was created using the Datenschutz-Generator provided by Datenschutzpartner and has been adapted accordingly.

We reserve the right to amend or supplement this privacy policy at any time. We will inform users of such changes in an appropriate manner, in particular by publishing the current version of the privacy policy on our website.