Data protection

2. Personal data and terms

Personal data is information relating to an identified or identifiable natural person, such as name, address, telephone number, e-mail address, date of birth, etc. ("personal data"). ("personal data").

Any handling of personal data, regardless of the means and procedures used, in particular the collection, procurement, storage, use, processing, disclosure, archiving or deletion of data, is considered processing ("processing" or "processed"). A data subject is any natural person about whom personal data is processed ("data subject").

The controller is any private person or federal body that, alone or together with others, decides on the purpose and means of processing ("controller"). Processor is a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller ("processor").

4. What personal data do we process?

In principle, we process the data and information about you that is required to conduct the business relationship with you. To the extent permitted by law and necessary for the business relationship, this may also include particularly sensitive personal data. We generally process the following personal data about you:

1. Technical data: When you use our website or other electronic services (e.g. as a visitor to our shops using our free Wi-Fi), we collect the IP address of your end device and other technical data to ensure the functionality and security of these services. This data also includes logs in which the use of our systems is recorded. To ensure the functionality of these services, we may also assign you or your device a personalised code (e.g. in the form of a cookie, see section 14 of this privacy policy).
   
   The technical data includes the IP address, the referrer URL (website from which the access was made) and information about the operating system of your end device, the date, region and time of use as well as the type of browser you use to access our electronic offers. This can help us to transmit the correct formatting of the website or, for example, to show you a website customised for your region. Although we know from the IP address which provider you are using to access our offers (and therefore also the region), we cannot usually deduce who you are from this. This changes if you create a user account, for example, because personal data can then be linked to technical data (e.g. we can see which browser you are using to access an account via our website). Examples of technical data include logs that accumulate in our systems (e.g. the log of user logins on our website).
2. Registration data: Various offers and services (e.g. login areas of our website for newsletters, search subscriptions, etc.) can only be used with a user account or registration, which can be done directly with us or via our external login service providers (e.g. for newsletters). In doing so, you must provide us with certain data and we collect data on the use of the offer or service. Registration data may be collected for access controls to certain systems; depending on the control system, biometric data may also be collected.
   
   Registration data includes the information you provide when you create an account on our website (e.g. user name, password, name, e-mail address). However, registration data also includes the data that we may require from you before you can make use of certain free services, such as sending newsletters, in this case: name, e-mail; or redeeming vouchers, in this case: name, address, contact details, time of redemption. As part of access controls, we may need to register you with your data (access codes in badges, biometric data for identification).
3. Communication data: If you contact us via the contact form, by e-mail, telephone, letter or other means of communication, we collect the data exchanged between you and us (e.g. first name/last name, telephone number, e-mail address) including your contact details and the marginal data of the communication (type/place and time of contact, content of the contact, any information about third parties).
4. Master data: We define master data as the basic data that we require in addition to the contract data (see also lit. e)) for the processing of our contractual and other business relationships or for marketing and advertising purposes, such as name, contact details and information, e.g. about your role and function, your bank account(s), your date of birth, customer history, powers of attorney, signature authorisations and declarations of consent. We process your master data if you are a customer or other business contact or work for one (e.g. as a contact person of the business partner), or because we want to contact you for our own purposes or the purposes of a contractual partner (e.g. as part of marketing and advertising, with vouchers, with newsletters, etc.). We receive master data from you yourself (e.g. when making a purchase/sale or as part of a registration), from bodies for which you work or from third parties such as our contractual partners (e.g. property platforms), associations and address dealers and from publicly accessible sources such as public registers or the internet (websites, social media, etc.).
   
   Zu den Stammdaten gehören z.B. Daten wie Vorname/Nachname, Adresse, E-Mail-Adresse, Telefonnummer und andere Kontaktdaten, Geschlecht, Geburtsdatum, Nationalität, Angaben zu verbundenen Personen, Websites, Profile in sozialen Medien, Fotos und Videos; ferner Angaben über Ihre geschäftliche Beziehung mit uns (Interessent, Kunde, Käufer/Verkäufer, Lieferant, Besucher, Leistungsempfänger etc.We also collect information about your business relationship with us (prospective customer, buyer/seller, supplier, visitor, service recipient, etc.), information about your status with us, allocations, classifications and distribution lists, information about our interactions with you (possibly a history of these with corresponding entries), reports (e.g. from the media) or official documents (e.g. extracts from the commercial register, authorisations, etc.) that relate to you. We collect payment details such as your bank details, account number and credit card details. Consent or blocking notices are also part of the master data, as is information about third parties, e.g. contact persons, recipients of services, advertising recipients or representatives.
   
   Master data is not collected comprehensively in every case. Which data is collected in each case depends on the purpose of the relationship and the necessary processing.
5. Contract data: This is data that arises in connection with the conclusion or processing of a contract, e.g. information on contracts and the services to be provided or provided, as well as data from the run-up to the conclusion of a contract, the information required or used for processing and information on reactions (e.g. complaints or information on satisfaction, etc.). We generally collect this data from you, from contractual partners and from third parties involved in the processing of the contract, but also from third-party sources (e.g. providers of creditworthiness data) and from publicly accessible sources.
   
   Contract data includes information about the conclusion of the contract, about your contracts, e.g. type and date of conclusion of the contract, information from the application process (such as an application for our products or services) and information about the contract in question (e.g. its duration) and the processing and administration of the contracts (e.g. information in connection with invoicing, customer service, support with technical matters and the enforcement of contractual claims). Contract data also includes information on defects, complaints and adjustments to a contract, as well as information on customer satisfaction, which we can collect e.g. by means of surveys. Contract data also includes financial data such as information on creditworthiness (i.e. information that allows conclusions to be drawn about the likelihood of claims being settled), reminders and debt collection. We receive some of this data from you (e.g. when you make payments), but also from credit agencies and debt collection agencies and from publicly accessible sources (e.g. a commercial register).
6. Behavioural and preference data: Depending on the relationship we have with you, we try to get to know you and better tailor our products, services and offers to you. To do this, we collect and use data about your behaviour and preferences. We do this by evaluating information about your behaviour in our area, and we can also supplement this information with data from third parties, including from publicly accessible sources. Based on this, we can, for example, calculate the probability that you will use certain services or behave in a certain way. Some of the data processed for this purpose is already known to us (e.g. when you use our services), or we obtain this data by recording your behaviour (e.g. how you navigate our website).
   
   Behavioural data is information about certain actions, e.g. about your response to electronic communications (e.g. whether and when you opened an email) or about your location and your interaction with our social media profiles. For example, we may collect your location data wirelessly through unique codes sent by your mobile phone or when you use our website. We will inform you of the collection of anonymous movement profiles at the relevant locations by means of appropriate signs; we will only create a personalised movement profile with your consent. Preference data provides us with information about your needs, which products or services might be of interest to you or when and how you are likely to react to messages from us. We obtain this information from the analysis of existing data, such as behavioural data, so that we can get to know you better, tailor our advice and offers more precisely to you and generally improve our offers. In order to improve the quality of our analyses, we can link this data with other data that we also obtain from third parties such as address dealers, public authorities and publicly accessible sources such as the Internet. Behavioural and preference data can be evaluated on a personal basis (e.g. to show you personalised advertising), but also on a non-personal basis (e.g. for market research or product development). Behavioural and preference data can also be combined with other data (e.g. movement data can be used for contact tracing as part of a health protection concept).
7. Other data: We also collect data from you in other situations. In connection with official or legal proceedings, for example, data is collected (such as files, evidence, etc.) that may also relate to you. We may receive or produce photos, videos and audio recordings in which you may be recognisable (e.g. at events, through security cameras, etc.). We may also collect data about who enters certain buildings or has access rights to them and when (including in the case of access controls, based on registration data or visitor lists, etc.), who takes part in events or campaigns and when, or who uses our infrastructure and systems and when. The retention period of this data depends on the purpose and is limited to what is necessary.

6. On what legal basis do we process your personal data?

We process your personal data for the above-mentioned purposes on the basis of the following legal bases:

If we ask you for your consent for certain processing (e.g. for the processing of particularly sensitive personal data, for newsletters, for marketing mailings, for search requests, for the creation of personalised movement profiles and for advertising control and behaviour analysis on the website), we will inform you separately about the corresponding purposes of the processing. You can revoke your consent at any time with effect for the future by sending us written notification (by post) or, unless otherwise stated or agreed, by email; our contact details can be found in section 1 of this privacy policy. Where you have a user account, a cancellation or contact with us may also be carried out via the relevant website or other service. Once we have received notification of the withdrawal of your consent, we will no longer process your data for the purposes to which you originally consented, unless we have another legal basis for doing so. The withdrawal of your consent does not affect the lawfulness of processing based on consent before its withdrawal.

Where we do not ask for your consent for processing, we base the processing of your personal data on the fact that the processing is necessary for the initiation or execution of a contract with you (or the entity you represent) or that we or third parties have a legitimate interest in it, in particular in order to pursue the purposes and associated objectives described above under Section 4 and to be able to implement corresponding measures. Our legitimate interests also include compliance with statutory provisions, insofar as this is not already recognised as a legal basis by the applicable data protection law. However, this also includes the marketing of our products and services, the interest in better understanding our markets and managing and further developing our company, including its operations, securely and efficiently.

8. To whom do we pass on your personal data?

To the extent permitted, we only disclose your personal data or make it accessible to third parties if they require your personal data to fulfil the business relationship. This may be necessary in connection with our contracts, the website, our services, legal obligations or otherwise to protect legitimate interests.

For the above-mentioned purposes (section 5 of this Privacy Policy) and based on a legal basis, we generally disclose your personal data to the following categories of third parties who process the personal data for the above-mentioned purposes on our behalf or for their own purposes in accordance with the law:

1. Service providers who process the personal data on our behalf and/or on our instructions (e.g. banks, insurance companies, financial institutions and other organisations and so-called processors, such as IT companies in the area of maintenance and support who receive access to IT systems, providers of external storage space or outsourcing partners)
2. other group companies of our group of companies
3. Customers, dealers, suppliers and other business partners
4. domestic and foreign authorities and other public bodies, such as social security institutions, social insurance funds, pension and health insurance funds, criminal and debt enforcement offices, courts, the withholding tax office or FINMA
5. Competitors, industry organisations, associations and other bodies

6. the public, including visitors to Immosky AG websites and social media

7. courts, arbitration bodies, law enforcement authorities, regulators, lawyers and other parties in potential or actual legal proceedings where necessary for compliance with the law or for the establishment, exercise or defence of legal rights or claims
8. acquirers or parties interested in acquiring business divisions, companies or other parts of Immosky AG.

(hereinafter all collectively referred to as "Recipients").

The recipients are obliged to fully comply with confidentiality and the applicable data protection law at all times and to implement the appropriate technical and organisational measures to secure the personal data and protect it against unauthorised or unlawful processing, unintentional loss, alteration, disclosure or access.

10. How long do we store personal data?

We generally only store your personal data for as long as is necessary for the purposes for which it was collected. In addition, we process and store personal data for a longer period if we are obliged to do so (e.g. due to statutory or contractual retention and documentation obligations) or if we have a legitimate interest in doing so (e.g. for reasons of proof for the assertion, exercise or defence of legal claims until the expiry of the limitation periods, which can generally be five to ten years). As soon as your personal data is no longer required for the above-mentioned purposes, it will be deleted or anonymised.

12. Security

We have implemented technical and organisational measures to maintain the security of your personal data and to protect it against unauthorised or unlawful processing, accidental loss, alteration, disclosure or access. However, we can only secure areas that we can control ourselves. However, we also oblige our contract processors to take appropriate security measures. However, security risks cannot generally be completely ruled out; residual risks are unavoidable. Unless otherwise agreed, we accept no liability for breaches of these security provisions unless they are intentional or due to gross negligence.

14. Services / Online tracking and online advertising technologies

Social Media

We may have a presence on social networks and other platforms operated by third parties. We receive data from you and the platforms when you come into contact with us via our online presence (e.g. when you communicate with us, comment on our content or visit our presence). At the same time, the platforms evaluate your use of our online presence and link this data with other data about you known to the platforms (e.g. about your behaviour and preferences). They also process this data for their own purposes under their own responsibility, in particular for marketing purposes and to control their platforms (e.g. which content they display to you).

We may redistribute content published by you (e.g. comments) ourselves (e.g. in our advertising on the platform or elsewhere). We or the operators of the platforms may also delete or restrict content from or about you in accordance with the usage guidelines (e.g. inappropriate comments).

We currently use the following platforms:

• Instagram
• Facebook
• LinkedIn
• YouTube
• TikTok