Skip to Content

Privacy policy

1. What is this privacy policy about?

Federtechnik Kaltbrunn AG (hereinafter also "we", "us") obtains and processes personal data concerning you or other persons (so-called "third parties"). We use the term "data" here as synonymous with "personal data".

In this privacy policy, we describe what we do with your data when you use our website at federtechnik.ch (hereinafter the "website"), obtain our services or products, are otherwise connected with us under a contract, communicate with us or otherwise deal with us. Where applicable, we will inform you in good time by written notice of additional processing activities not mentioned in this privacy policy.

If you transmit or disclose data about other persons to us, we assume that you are authorised to do so and that this data is correct. By transmitting data about third parties, you confirm this.Please also make sure that these third parties have been informed of this privacy policy.

This privacy policy is designed to meet the requirements of the EU General Data Protection Regulation ("GDPR"), the Swiss Data Protection Act ("DPA") and the revised Swiss Data Protection Act ("revDPA"). Whether and to what extent these laws apply, however, depends on the individual case.

2. Who is responsible for processing your data?

For the data processing of Federtechnik Kaltbrunn AG described in this privacy policy, the controller under data protection law is Federtechnik Kaltbrunn AG in 8722 Kaltbrunn, unless otherwise communicated in an individual case.

You can reach us for your data protection concerns and the exercise of your rights under section 11 as follows:

Federtechnik Kaltbrunn AG

Datenschutz
Benknerstrasse 54
CH-8722 Kaltbrunn
datenschutz@federtechnik.ch

3. What data do we process?

We process various categories of data about you. The main categories are the following:

  • Technical data: When you use our website or other electronic services (e.g. free Wi-Fi), we collect the IP address of your device and other technical data in order to ensure the functionality and security of these services. This data also includes logs in which the use of our systems is recorded. We generally retain technical data for 12 months. To ensure the functionality of these services, we may also assign an individual code to you or your device (e.g. in the form of a cookie, see section 12). Technical data in itself does not in principle allow conclusions about your identity. However, in the context of user accounts, registrations, access controls or the performance of contracts, it may be linked with other categories of data (and thus possibly with you as a person).
  • Registration data: Certain offers and services (e.g. login areas of our online shop) can only be used with a user account or registration, which can be made directly with us or via our external login providers. You must provide us with certain data, and we collect data on the use of the offer or service. Registration data may arise in access controls to certain facilities. We generally retain registration data for 12 months after the end of use of the service or the closure of the user account.
  • Communication data: When you are in contact with us via the contact form, by email, telephone or chat, by letter or through other means of communication, we record the data exchanged between you and us, including your contact details and the peripheral data of the communication. If we record or listen in on telephone calls or video conferences, e.g. for training and quality assurance purposes, we will specifically point this out to you. Such recordings may only be made and used in accordance with our internal rules. You will be informed whether and when such recordings take place, e.g. by an indication during the video conference concerned. If you do not wish to be recorded, please let us know or end your participation. If you merely do not want your image to be recorded, please switch off your camera. If we wish or need to establish your identity, we collect data to identify you (e.g. a copy of an ID). We generally retain this data for 12 months from the last exchange with you. This period may be longer where necessary for evidentiary reasons or to comply with statutory or contractual requirements, or for technical reasons. Emails and written correspondence are generally retained for at least 15 years. Recordings of (video) conferences are generally retained for 24 months.
  • Master data: We refer to master data as the basic data that we need, in addition to contract data (see below), for the performance of our contractual and other business relationships or for marketing and advertising purposes, such as name, contact details and information e.g. about your role and function, your bank details, your date of birth, customer history, powers of attorney, signing authorities and declarations of consent. We process your master data if you are a customer or other business contact or work for one (e.g. as a contact person of the business partner), or because we wish to approach you for our own purposes or those of a contractual partner (e.g. in the context of marketing and advertising). We receive master data from you yourself (e.g. when making a purchase or as part of a registration), from entities for which you work, or from third parties such as our contractual partners, associations and address dealers, and from publicly accessible sources such as public registers or the internet (websites, social media, etc.). We generally retain this data for 15 years from the last exchange with you, but at least from the end of the contract. This period may be longer where necessary for evidentiary reasons or to comply with statutory or contractual requirements, or for technical reasons. For pure marketing and advertising contacts, the period is normally considerably shorter, usually not more than 5 years since the last contact.
  • Contract data: This isdata arising in connection with the conclusion or performance of a contract, e.g. information about contracts and the services to be provided or provided, as well as data from the run-up to a contract, the information required or used for performance and information about reactions. We generally collect this data from you, from contractual partners and from third parties involved in the performance of the contract, but also from third-party sources and publicly accessible sources. We generally retain this data for 10 years from the last contractual activity, but at least from the end of the contract. This period may be longer where necessary for evidentiary reasons or to comply with statutory or contractual requirements, or for technical reasons.
  • Behaviour and preference data: Depending on the relationship we have with you, we try to get to know you and to tailor our products, services and offers better to you. To this end, we collect and use data about your behaviour and preferences. We do this by analysing information about your behaviour in our domain, and we may also supplement this information with information from third parties – including from publicly accessible sources. Based on this, we can, for example, calculate the likelihood that you will use certain services or behave in a certain way. The data processed for this purpose is in part already known to us (e.g. when you use our services), or we obtain this data by recording your behaviour (e.g. how you navigate on our website). We anonymise or delete this data when it is no longer meaningful for the purposes pursued, which, depending on the type of data, may be the case after 12 to 24 months. This period may be longer where necessary for evidentiary reasons or to comply with statutory or contractual requirements, or for technical reasons. We describe how tracking on our website works in section 12.
  • Other data: We also collect data about you in other situations. We may receive or produce photos, videos and sound recordings in which you may be identifiable (e.g. at events, through security cameras, etc.). We may also collect data on who enters certain buildings and when or has corresponding access rights (including in access controls, based on registration data or visitor lists, etc.), who participates in events or campaigns and when, or who uses our infrastructure and systems and when. Finally, we collect and process data about our shareholders and other investors; in addition to master data, this includes information for the relevant registers, regarding the exercise of their rights and the holding of events (e.g. general meetings). The retention period for this data depends on the purpose and is limited to what is necessary. It ranges from a few weeks for security cameras to reports on events with images, which may be retained for several years or longer. Data about you as a shareholder or other investor is retained in accordance with company law requirements, but in any case for as long as you are invested.

Many of the data mentioned in this section 3 are disclosed to us by you yourself (e.g. via forms, in the course of communication with us, in connection with contracts, when using the website, etc.). You are not obliged to do so. If you wish to conclude contracts with us or make use of services, you must also provide us with data as part of your contractual obligation under the relevant contract, in particular master, contract and registration data. When using our website, the processing of technical data is unavoidable. If you wish to gain access to certain systems or buildings, you must provide us with registration data. For behaviour and preference data, however, you have in principle the option to object or not to give consent.

Insofar as this is not impermissible, we also obtain data from publicly accessible sources (e.g. debt enforcement register, commercial register, media or the internet including social media) or receive data from other companies within our group, from authorities and from other third parties (such as address dealers, contractual partners, internet analytics services, etc.).

4. For what purposes do we process your data?

We process your data for the purposes explained below. Further information for the online area can be found in sections 12 and 13. These purposes, or the objectives underlying them, constitute legitimate interests of ours and, where applicable, of third parties. You will find further information on the legal bases of our processing in section 5.

We process your data for purposes connected with communication with you, in particular to respond to enquiries and to assert your rights (section 11) and to contact you in case of queries. For this we use in particular communication data and master data and, in connection with offers and services you use, also registration data. We retain this data to document our communication with you, for training purposes, for quality assurance and for follow-up enquiries.

We process data for the initiation, administration and performance of contractual relationships.

We process data for marketing purposes and for relationship management, e.g. to send our customers and other contractual partners personalised advertising for our products and services. This may take the form of newsletters and other regular contacts (electronic, postal, telephone), but also as part of individual marketing campaigns. You can decline such contacts at any time (see the end of this section 4) or refuse or revoke consent to being contacted for advertising purposes. With your consent, we can target our online advertising on the internet more specifically to you (see section 12).

We also process your data for market research, for the improvement of our services and our operations and for product development.

We may also process your data for security purposes and for access control.

We continuously review and improve the appropriate security of our IT and our other infrastructure (e.g. buildings). Like all companies, we cannot rule out data security breaches with absolute certainty, but we do our part to reduce the risks. We therefore process data e.g. for monitoring, controls, analyses and tests of our networks and IT infrastructures, for system and error checks, for documentation purposes and in the context of backups. Access controls include on the one hand the control of access to electronic systems (e.g. logging in to user accounts) and on the other hand also physical access control (e.g. building access). For security purposes (preventively and to clarify incidents) we also keep access logs or visitor lists and use surveillance systems (e.g. security cameras). We point out surveillance systems at the relevant locations by means of corresponding signs.

We process personal data to comply with laws, directives and recommendations of authorities and internal regulations ("compliance").

We also process data for the purposes of our risk management and as part of prudent corporate management, including operational organisation and corporate development.

We may process your data for further purposes , e.g. as part of our internal processes and administration or for training and quality assurance purposes.

5. On what basis do we process your data?

Where we ask for your consent for certain processing (e.g. for marketing mailings and for advertising control and behaviour analysis on the website), we will inform you separately about the corresponding purposes of the processing. You may revoke consents at any time with effect for the future by written notice (by post) or, unless otherwise stated or agreed, by email; you will find our contact details in section 2. For revoking your consent to online tracking, see section 12. Where you have a user account, a revocation or contact with us may also be made via the relevant website or other service. As soon as we have received notice of the revocation of your consent, we will no longer process your data for the purposes to which you originally consented, unless we have another legal basis for doing so. The revocation of your consent does not affect the lawfulness of processing carried out on the basis of the consent until the revocation.

Where we do not ask for your consent for processing, we base the processing of your personal data on the fact that the processing is necessary for the initiation or performance of a contract with you (or the entity you represent) or that we or third parties have a legitimate interest in doing so, in particular to pursue the purposes described above in section 4 and the related objectives and to be able to implement corresponding measures. Our legitimate interests also include compliance with legal requirements, insofar as this is not already recognised as a legal basis by the applicable data protection law (e.g. under the GDPR, the law in the EEA and in Switzerland).

If we receive sensitive data (e.g. health data, information on political, religious or philosophical views or biometric data for identification), we may also process your data on the basis of other legal grounds, e.g. in the event of disputes due to the necessity of the processing for possible proceedings or for the enforcement or defence of legal claims. In individual cases, other legal grounds may apply, which we will communicate to you separately where necessary.

6. What applies to profiling and automated individual decisions?

We may assess certain of your personal characteristics in an automated manner for the purposes mentioned in section 4 on the basis of your data (section 3) ("profiling"), when we wish to determine preference data, but also to identify misuse and security risks, carry out statistical analyses or for operational planning purposes. For the same purposes, we may also create profiles, i.e. we may combine behaviour and preference data, but also master and contract data and technical data assigned to you, in order to better understand you as a person with your various interests and other characteristics.

In both cases, we pay attention to the proportionality and reliability of the results and take measures against misuse of these profiles or of profiling. If this may have legal effects or significant disadvantages for you, we generally provide for a manual review.

7. To whom do we disclose your data?

In connection with our contracts, the website, our services and products, our legal obligations or otherwise to safeguard our legitimate interests and the other purposes listed in section 4, we also transmit your personal data to third parties, in particular to the following categories of recipients:

  • Service providers: We work with service providers in Switzerland and abroad who process data about you on our behalf or under joint responsibility with us, or who receive data about you from us under their own responsibility (e.g. IT providers, banks, insurance companies, debt collection companies, credit agencies or address verifiers). This may also include health data. For the service providers engaged for the website, see section 12. Key service providers in the IT area for us are Microsoft and Hostpoint. You can find more information on how Microsoft processes data here: privacy.microsoft.com/de-de/privacystatement; for the use of Microsoft Teams in particular here docs.microsoft.com/de-de/microsoftteams/teams-privacy.
  • Contractual partners including customers: This means first of all our customers and other contractual partners, because this data transmission results from these contracts. If you yourself work for such a contractual partner, we may also transmit data about you to it in this context. The recipients also include contractual partners with whom we cooperate.
  • Authorities: We may disclose personal data to offices, courts and other authorities in Switzerland and abroad if we are legally obliged or entitled to do so or if this appears necessary to safeguard our interests. The authorities process data about you that they receive from us under their own responsibility.

 

All these categories of recipients may in turn involve third parties, so that your data may also become accessible to them. We can restrict processing by certain third parties (e.g. IT providers), but not by others (e.g. authorities, banks, etc.).

We reserve the right to make these disclosures of data even if they concern secret data (unless we have expressly agreed with you that we will not disclose this data to certain third parties, unless we are legally obliged to do so). Notwithstanding this, your data remains subject to appropriate data protection even after disclosure in Switzerland and the rest of Europe. For disclosure to other countries, the provisions of section 8 apply. If you do not want certain data to be disclosed, please let us know so that we can check whether and to what extent we can accommodate you (section 2).

8. Is your personal data also transferred abroad?

As explained in section 7, we also disclose data to other bodies. These are not only located in Switzerland. Your data may therefore be processed both in Europe and in the USA; in exceptional cases, however, in any country in the world.

If a recipient is located in a country without adequate statutory data protection, we contractually oblige the recipient to comply with the applicable data protection (for this we use the revised standard contractual clauses of the European Commission, which are available here: eur-lex.europa.eu/eli/dec_impl/2021/914/oj? ), insofar as the recipient is not already subject to a legally recognised set of rules to ensure data protection and we cannot rely on an exemption provision. An exemption may apply in particular in legal proceedings abroad, but also in cases of overriding public interests or where performance of a contract requires such disclosure, where you have consented or where the data concerned has been made generally accessible by you and you have not objected to its processing.

Please also note that data exchanged via the internet is often routed through third countries. Your data may therefore also end up abroad even if sender and recipient are in the same country.

9. How long do we process your data?

We process your data for as long as our processing purposes, the statutory retention periods and our legitimate interests in processing for documentation and evidentiary purposes require, or storage is technically necessary. Further information on the respective storage and processing period can be found under the individual categories of data in section 3 or the cookie categories in section 12. Where no legal or contractual obligations stand in the way, we delete or anonymise your data after expiry of the storage or processing period as part of our usual processes.

Documentation and evidentiary purposes include our interest in documenting transactions, interactions and other facts in the event of legal claims, discrepancies, for IT and infrastructure security purposes and to demonstrate good corporate governance and compliance. Retention may be technically necessary where certain data cannot be separated from other data and we therefore have to retain it together with them (e.g. in the case of backups or document management systems).

10. How do we protect your data?

We take appropriate security measures to maintain the confidentiality, integrity and availability of your personal data, to protect it against unauthorised or unlawful processing and to counteract the risks of loss, accidental alteration, unintended disclosure or unauthorised access.

Technical and organisational security measures may include, for example, measures such as encryption and pseudonymisation of data, logging, access restrictions, storage of backups, instructions to our employees, confidentiality agreements and controls. We protect the data you transmit via our website in transit by means of suitable encryption mechanisms. However, we can only secure areas that we control. We also oblige our processors to take appropriate security measures. Security risks cannot, however, generally be ruled out entirely; residual risks are unavoidable.

11. What rights do you have?

The applicable data protection law grants you, under certain circumstances, the right to object to the processing of your data, in particular that for the purposes of direct marketing, profiling carried out for direct advertising and other legitimate interests in the processing.

To make it easier for you to control the processing of your personal data, you also have the following rights in connection with our data processing, depending on the applicable data protection law:

  • the right to request information from us as to whether and which data about you we process;
  • the right to have us correct data if it is inaccurate;
  • the right to request the deletion of data;
  • the right to request that we hand over certain personal data in a common electronic format or transfer it to another controller;
  • the right to revoke consent insofar as our processing is based on your consent;
  • the right to obtain, on request, further information necessary for the exercise of these rights;

If you wish to exercise the above-mentioned rights towards us, please contact us in writing, on site at our premises or, unless otherwise stated or agreed, by email; you will find our contact details in section 2. To rule out misuse, we need to identify you (e.g. with a copy of an ID, if this is not possible otherwise).

Please note that, under the applicable data protection law, conditions, exceptions or restrictions apply to these rights (e.g. for the protection of third parties or trade secrets). We will inform you accordingly where applicable.

If you disagree with the way we handle your rights or data protection, please let us know (section 2). In particular, if you are located in the EEA, the United Kingdom or Switzerland, you also have the right to lodge a complaint with the data protection supervisory authority of your country.

12. Do we use online tracking?

On our website we use various techniques with which we and third parties we engage can recognise you when you use it and, under certain circumstances, also track you across several visits. We inform you about this in this section.

In essence, the point is that we can distinguish accesses by you (via your system) from accesses by other users so that we can ensure the functionality of the website and carry out analyses and personalisation. We do not wish to infer your identity in doing so, even though we can, insofar as we or third parties we engage can identify you by combination with registration data. Even without registration data, however, the techniques used are designed so that you are recognised as an individual visitor with every page view, for example because our server (or the servers of third parties) assigns a certain identification number to you or your browser (a so-called "cookie").

Cookies are individual codes (e.g. a serial number) that our server or a server of our service providers or advertising contractual partners transmits to your system when connecting to our website and that your system (browser, mobile) accepts and stores until the programmed expiry time. With each further access, your system transmits these codes to our server or the third party's server. In this way you are recognised, even if your identity is unknown.

Other techniques may also be used with which you are recognised with greater or lesser probability (i.e. distinguished from other users), e.g. "fingerprinting". In fingerprinting, your IP address, the browser you use, the screen resolution, the language selection and other information that your system communicates to every server are combined, resulting in a more or less unique fingerprint. In this way cookies can be dispensed with.

Whenever you access a server (e.g. when using a website or an app or because an image is embedded visibly or invisibly in an email), your visits can thus be "tracked". If we integrate offers of an advertising contractual partner or a provider of an analytics tool on our website, it can track you in the same way, even if you cannot be identified in the individual case.

We use such techniques on our website and allow certain third parties to do so as well. Depending on the purpose of these techniques, however, we ask for your consent before they are used. You can program your browser to block or deceive certain cookies or alternative techniques, or to delete existing cookies. You can also extend your browser with software that blocks tracking by certain third parties. You will find further information on this on the help pages of your browser (usually under the keyword "privacy") or on the websites of the third parties we list below.

The following cookies are distinguished (techniques with comparable modes of operation such as fingerprinting are also included here):

  • Necessary cookies:Some cookies are necessary for the website as such or certain functions to work. They ensure, for example, that you can switch between pages without information entered in a form being lost. They also ensure that you remain logged in. These cookies exist only temporarily ("session cookies"). If you block them, the website may not work. Other cookies are necessary so that the server can store decisions or entries you have made beyond a session (i.e. a visit to the website), if you use this function (e.g. selected language, consent given, automatic login function, etc.).
  • Performance cookies:To optimise our website and corresponding offers and to better tailor them to users' needs, we use cookies to record and analyse the use of our website, under certain circumstances also beyond the session. We do this by using analytics services of third-party providers. We have listed these below. Before we use such cookies, we ask for your consent. You can find details on the websites of the third-party providers.

We may also integrate further third-party offers on our website, in particular from social media providers. These offers are deactivated by default. As soon as you activate them (e.g. by clicking a switch), the relevant providers can determine that you are on our website. If you have an account with the social media provider, it can assign this information to you and thus track your use of online offers. These social media providers process this data under their own responsibility.

We currently use the offers of the following service providers and advertising contractual partners:

Google Analytics, Google Maps and YouTube: Google Ireland (headquartered in Ireland) is the provider of the "Google Analytics" service and acts as our processor. For this purpose Google Ireland relies on Google LLC (headquartered in the USA) as its processor (both "Google"). Google thereby tracks, by means of performance cookies (see above), the behaviour of visitors on our website (duration, frequency of pages visited, geographical origin of access, etc.) and compiles reports for us on the use of our website on this basis. We have configured the service so that visitors' IP addresses are truncated by Google in Europe before being forwarded to the USA and thus cannot be traced back. We have switched off the "data sharing" and "Signals" settings. Although we can assume that the information we share with Google is not personal data for Google, it is possible that Google may draw conclusions about the identity of visitors from this data for its own purposes, create personal profiles and link this data with the Google accounts of these persons. If you consent to the use of Google Analytics, you explicitly consent to such processing, which also includes the transfer of personal data (in particular website and app usage data, device information and individual IDs) to the USA and other states. Information on data protection at Google Analytics can be found here support.google.com/analytics/answer/6004245 and if you have a Google account, you can find further information on processing by Google here policies.google.com/technologies/partner-sites.

13. What data do we process on our pages in social networks?

We may operate pages and other online presences on social networks and other platforms operated by third parties and collect the data about you described in section 3 and below there. We receive this data from you and from the platforms when you come into contact with us via our online presence (e.g. when you communicate with us, comment on our content or visit our presence). At the same time, the platforms analyse your use of our online presences and link this data with other data about you known to the platforms (e.g. about your behaviour and preferences). They also process this data for their own purposes under their own responsibility, in particular for marketing and market research purposes (e.g. to personalise advertising) and to control their platforms (e.g. which content they show you).

We process this data for the purposes described in section 4, in particular for communication, for marketing purposes (including advertising on these platforms, see section 12) and for market research. Information on the corresponding legal bases can be found in section 5. We may ourselves further disseminate content published by you yourself (e.g. comments on an announcement) (e.g. in our advertising on the platform or elsewhere). We or the platform operators may also delete or restrict content from or about you in accordance with the usage guidelines (e.g. inappropriate comments).

For further information on the processing by the platform operators, please refer to the platforms' privacy notices. There you will also find out in which countries they process their data, what rights of access, deletion and other data subject rights you have and how you can exercise them or obtain further information. We currently use the following platforms:

 

14. Can this privacy policy be changed?

This privacy policy is not part of a contract with you. We may amend this privacy policy at any time. The version published on this website is the current version in each case.