Privacy policy

1. What is this privacy statement about?

RBT AG (hereinafter also "we", "us") procures and processes personal data relating to you or other persons (so-called "third parties"). We use the term "data" here synonymous with "personal data".

In this data protection declaration we describe what we do with your data when you use www.rbtag.ch, other websites of ours or our apps (collectively "Website"), obtain our services or products, are otherwise associated with us under a contract, communicate with us or otherwise deal with us. If necessary, we will inform you by means of a timely written notification about additional processing activities not mentioned in this data protection declaration. In addition, we can inform you separately about the processing of your data, z.B. in declarations of consent, contractual conditions, additional data protection declarations, Forms and Notes.

If you provide us with data about other people such as z.B. family members, work colleagues etc. or make it known., we will assume that you are authorized to do so and that this data is correct. By submitting data about third parties you confirm this. Please also make sure that that these third parties have been informed of this privacy policy.

This data protection declaration is based on the requirements of the EU-Data Protection-Basic Regulation (“GDPR”), the Swiss Data Protection Act (“DSG”) and the revised Swiss Data Protection Act (“revDSG”). Whether and to what extent these laws are applicable depends on the individual case.

2. Who is responsible for processing your data?

RBT AG in St. Moritz is responsible for the data processing of www.rbtag.ch described in this data protection declaration

You can contact our data protection officer for your data protection concerns and the exercise of your rights in accordance with section 11 as follows:

Data protection officer according to Art. 37 ff. GDPR, Art. 10 revDSG, EU according to Art. 27 GDPR, Switzerland according to Art. 14 revDSG, United Kingdom (UK) according to Art. 27 UK GDPR:

RBT AG
Data Protection Officer
Plazza dal Mulin 6
7500 St. Moritz

datenschutz@rbtag.ch

3. Which data do we process?

We process different categories of data about you. The main categories are as follows:

Technical specifications

When you use our website or other electronic offerings, we collect technical data from your terminal device to ensure the functionality and security of these offerings. This data also includes logs in which the use of our systems is recorded. We generally retain technical data for [1-14] months. In order to ensure the functionality of these offers, we may also assign an individual code to you or your end device (e.g. in the form of a cookie, see section 12). The technical data in itself does not allow any conclusions to be drawn about your identity. However, in the context of user accounts, registrations, access controls or the processing of contracts, they can be linked to other data categories (and thus possibly to your person).

Registration data

Certain offers, e.g. of competitions and services (e.g. login areas of our website, newsletter dispatch, free WLAN access, etc.) can generally only be used with a user account or registration, which can take place directly with us or via our external login service providers. In doing so, you must provide us with certain data and we collect data on the use of the offer or service. We generally retain registration data for [1-14] months after the end of the use of the service or the termination of the user account. This period may be longer if this is necessary for reasons of evidence or to comply with legal or contractual requirements or for technical reasons. This data is usually kept for at least [10] years.

Communication data

If you are in contact with us via the contact form, by E-Mail, telephone or chat, by letter or via other means of communication, we collect the data exchanged between you and us, including your contact details and the marginal data of the communication. If we have telephone calls or video conferences z.B. for training- and quality assurance purposes, we draw your particular attention to the fact. Such recordings may only be made and used in accordance with our internal specifications. You will be informed whether and when such recordings take place, z.B. by a notice during the relevant video conference. If you do not wish to be recorded, please inform us of this or end your participation. If you simply do not want your picture to be recorded, please switch your camera off. If we want or need to establish your identity, z.B. if you request information, apply for media access etc., we will collect Data to identify you (z.B. a copy of an ID card). We generally keep this data for [1-14] months from the last exchange with you. This period may be longer if this is necessary for reasons of proof or to comply with legal or contractual requirements is necessary or for technical reasons. E-Mails in personal mailboxes and written correspondence are generally kept for at least [10] years.

Base data

We refer to as master data the basic data that we need, in addition to the contractual data (see below), to process our contractual and other business relationships or for marketing and advertising purposes, such as name, contact details and information e.g. about your role and function, your bank account(s), date of birth, customer history, powers of attorney, signature authorisations and consent forms. We process your master data if you are a customer or other business contact or work for one (e.g. as a contact person of the business partner), or because we want to address you for our own purposes or the purposes of a contractual partner (e.g. as part of marketing and advertising, with invitations to events, with vouchers, with newsletters etc.). We receive master data from you yourself (e.g. when making a purchase or as part of a registration), from bodies for which you work or from third parties such as our contractual partners, associations and address dealers and from publicly accessible sources such as public registers or the Internet (websites, social media, etc.). We may also process health data and information about third parties as part of master data. We may also collect master data from our shareholders and investors. We generally keep this data for [10] years from the last exchange with you, but at least from the end of the contract. This period may be longer insofar as this is necessary for reasons of evidence or to comply with legal or contractual requirements, or for technical reasons. For pure marketing and advertising contacts, the period is usually much shorter, usually no more than [2] years since the last contact.

Contract data

This is data that arises in connection with the conclusion or processing of a contract, e.g. information about contracts and the services to be provided or provided, as well as data from the run-up to the conclusion of a contract, the information required or used for processing and information about reactions (e.g. complaints or information about satisfaction, etc.). We generally collect this data from you, from contractual partners and from third parties involved in the processing of the contract, but also from third-party sources (e.g. providers of creditworthiness data) and from publicly accessible sources. We generally keep this data for [10] years from the last contractual activity, but at least from the end of the contract. This period may be longer insofar as this is necessary for reasons of evidence or to comply with legal or contractual requirements or for technical reasons.

Behavioral - and preference data

Depending on our relationship with you, we try to get to know you and better tailor our products, services and offers to you. To do this, we collect and use data about your behaviour and preferences. We do this by evaluating information about your behaviour in our area, and we may also supplement this information with information from third parties, including publicly available sources. Based on this, we can calculate, for example, the probability that you will use certain services or behave in a certain way. Some of the data processed for this purpose is already known to us (e.g. when you use our services), or we obtain this data by recording your behaviour (e.g. how you navigate on our website or on our social media portals). We anonymise or delete this data when it is no longer meaningful for the purposes pursued, which may be between [2-3] weeks and [24] months (for product and service preferences) depending on the nature of the data. This period may be longer where necessary for evidential purposes or to comply with legal or contractual requirements, or for technical reasons. We describe how tracking works on our website in section 12.

Other data

We also collect data from you in other situations. In connection with official or judicial proceedings, for example, data is collected (such as files, evidence, etc.) which may also relate to you. We may also collect data for health protection reasons (e.g. in the context of protection concepts). We may obtain or make photographs, videos and sound recordings in which you may be identifiable (e.g. at events, through security cameras etc.). We may also collect data on who enters certain buildings when or has corresponding access rights (incl. in the case of access controls, based on registration data or visitor lists etc.), who participates in events or campaigns (e.g. competitions) and when, or who uses our infrastructure and systems. Finally, we collect and process data about our shareholders and other investors; in addition to master data, this includes information for the relevant registers, regarding the exercise of their rights and the holding of events (e.g. general meetings). The retention period for this data depends on the purpose and is limited to what is necessary. This ranges from a few days for many of the security cameras and usually a few weeks for contact tracing data, to visitor data that is usually kept for [3] months, to reports on events with pictures that can be kept for a few years or longer.

You disclose much of the data mentioned in this point 3 to us yourself (e.g. via forms, as part of communication with us, in connection with contracts, when using the website, etc.). You are not obliged to do so, subject to individual cases, e.g. within the framework of binding protection concepts (legal obligations). If you wish to conclude contracts with us or claim services, you must also provide us with data, in particular master data, contract data and registration data, as part of your contractual obligation under the relevant contract. When using our website, the processing of technical data is unavoidable. If you wish to gain access to certain systems or buildings, you must provide us with registration data.

Unless this is inadmissible, we also take data from publicly accessible sources (e.g. debt collection registers, land registers, commercial registers, the media or the internet incl. social media) or receive data from other companies within our group, from public authorities and from other third parties (such as credit agencies, address dealers, associations, contractual partners, internet analysis services etc.).

4. For what purposes do we process your data?

We process your data for the purposes we explain below. Further information for the online area can be found in sections 12 and 13. These purposes or the underlying objectives represent legitimate interests of us and, where applicable, of third parties. You will find further information on the legal basis for our processing in section 5.

We process your data for purposes related to communication with you, in particular to answer enquiries and assert your rights (section 11) and to contact you in the event of queries. For this purpose, we use in particular communication data and master data and, in connection with offers and services used by you, also registration data. We keep this data to document our communication with you, for training purposes, for quality assurance and for enquiries. We process data for the purpose of establishing, managing and processing contractual relationships.

We process data for marketing purposes and to maintain relationships, e.g. to send our customers and other contractual partners personalised advertising on products and services from us and from third parties (e.g. from advertising contractual partners). This may take the form of e.g. newsletters and other regular contacts (electronically, by post, by telephone), via other channels for which we have contact information from you, but also as part of individual marketing campaigns (e.g. events, competitions etc.) and may also include free benefits (e.g. invitations, vouchers etc.). You can refuse such contacts at any time (see at the end of this section 4) or refuse or revoke your consent to be contacted for advertising purposes. With your consent, we can target our online advertising on the Internet more specifically to you (see section 12). We continue to process your data for market research, to improve our services and operations and for product development. We may also process your data for security and access control purposes. We process personal data to comply with laws, directives and recommendations from authorities and internal regulations ("Compliance"). We also process data for the purposes of our risk management and prudent corporate governance, including business organisation and development.

5. On what basis do we process your data?

Insofar as we ask you for your consent for certain processing, we will inform you separately about the corresponding purposes of the processing. You can revoke your consent at any time with future effect by notifying us in writing (by post) or, unless otherwise stated or agreed, by email; you will find our contact details in section 2. For revocation of your consent for online tracking, see section 12. Where you have a user account, revocation or contacting us may also be possible via the relevant website or other service. Once we have received notification that you have withdrawn your consent, we will no longer process your data for the purposes to which you originally consented, unless we have another legal basis for doing so. The revocation of your consent does not affect the lawfulness of the processing carried out on the basis of the consent until the revocation.

Where we do not ask you for your consent for processing, we base the processing of your personal data on the fact that the processing is necessary for the initiation or execution of a contract with you (or the entity you represent) or that we or third parties have a legitimate interest in doing so, so in particular in order to pursue the purposes and related objectives described above under section 4 and to be able to implement appropriate measures. Our legitimate interests also include compliance with legal requirements, insofar as this is not already recognised as a legal basis by the applicable data protection law in each case (e.g. in the case of the GDPR, the law in the EEA and Switzerland).

If we receive sensitive data, we may also process your data on the basis of other legal grounds, e.g. in the event of disputes due to the need for processing for any legal proceedings or the enforcement or defence of legal claims. In individual cases, other legal grounds may come into play, which we will communicate to you separately where necessary.

6. What applies to profiling and automated individual decisions?

We may automatically assess ("profile") certain of your personal characteristics for the purposes set out in section 4 using your data (section 3), if we want to determine preference data, but also to determine abuse and security risks, to carry out statistical evaluations or for operational planning purposes. For the same purposes, we can also create profiles, i.e. we can combine behavioural and preference data, but also master and contract data and technical data assigned to you, in order to better understand you as a person with your different interests and other characteristics.

If you are a customer of ours, we can, for example, use "profiling" to determine which other products are likely to interest you based on your purchases. However, we can also use this to check your creditworthiness before offering you a purchase on account. Automated analysis of data can also check, for your protection, the likelihood of a particular transaction being fraudulent. This allows us to stop the transaction for clarification. To be distinguished from this are "profiles". This refers to the linking of various data in order to gain clues about essential aspects of your personality from the totality of this data (e.g. what you like or how you behave in certain situations). Profiles can also be used for marketing, for example, but also for security purposes.

We use anonymous movement profiles in a non-personalised way, for example to provide our contractual partners with recommendations for avoiding rush hour. For personalised movement profiles, we use personal data, for example, to point out interesting offers and products in your vicinity, to infer your interests from the position data (dwell time) and to tell you which products and services other contractual partners with similar interests have used.

In both cases, we pay attention to the proportionality and reliability of the results and take measures against misuse of these profiles or profiling. If these can have legal effects or significant disadvantages for you, we generally provide for a manual review.

7. Who do we disclose your data to?

In connection with our contracts, the website, our services and products, our legal obligations or otherwise to protect our legitimate interests and the other purposes listed in section 4, we also transfer your personal data to third parties, in particular to the following categories of recipients:

Service provider

We work with service providers in Germany and abroad who process data about you on our behalf or in joint responsibility with us or who receive data about you from us in their own responsibility.

In order to provide our products and services efficiently and to enable us to focus on our core competencies, we procure services from third parties in numerous areas. These services relate, for example, to IT services, the dispatch of information, marketing, sales, communication or printing services, building management, security and cleaning, the organisation and holding of events and receptions, debt collection, credit agencies, address checkers (e.g. for updating address lists in the event of relocations), anti-fraud measures and services from consultancy firms, lawyers, banks, insurers and telecoms companies. We disclose to these service providers in each case the data required for their services, which may also concern you. These service providers may also use such data for their own purposes, e.g. information about outstanding debts and your payment history in the case of credit agencies or anonymised information to improve services. In addition, we enter into contracts with these service providers that include provisions for the protection of data where such protection does not arise from the law. Our service providers may also process data on how their services are used and other data that arise in the course of using their services as independent data controllers for their own legitimate interests (e.g. for statistical evaluations or billing). Service providers inform about their independent data processing in their own data protection statements.

Contractual partners including customers

First of all, this refers to our customers (e.g. service recipients) and other contractual partners, because this data transfer results from these contracts. For example, they receive registration data on issued and redeemed vouchers, invitations etc. If you work for such a contractual partner yourself, we may also transmit data about you to them in this context.

Authorities

We may pass on personal data to offices, courts and other authorities in Switzerland and abroad if we are legally obliged or entitled to do so or if this appears necessary to protect our interests. The authorities process data about you that they receive from us on their own responsibility.

Other persons

This refers to other cases where the involvement of third parties arises from the purposes set out in section 4.

All these categories of recipients may in turn involve third parties, so that your data may also become accessible to them. We can restrict processing by certain third parties (e.g. IT providers), but not by other third parties (e.g. authorities, banks, etc.).

8. Does your personal data also go abroad?

As explained in section 7, we also disclose data to other bodies. These are not only located in Switzerland. Your data may therefore be processed in Europe, but in exceptional cases in any country in the world.

If a recipient is located in a country without adequate legal data protection, we contractually oblige the recipient to comply with the applicable data protection (for this purpose, we use the revised standard contractual clauses of the European Commission, which can be accessed here: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?), unless the recipient is already subject to a legally recognised set of rules to ensure data protection and we cannot rely on an exemption provision. An exception may apply in particular in the case of legal proceedings abroad, but also in cases of overriding public interests or if the performance of a contract requires such disclosure, if you have consented or if it is a matter of data made generally accessible by you, the processing of which you have not objected to.

Please also note that data exchanged via the internet is often routed via third countries. Your data can therefore end up abroad even if the sender and recipient are in the same country.

9. How long do we process your data?

We process your data for as long as our processing purposes, the statutory retention periods and our legitimate interests in processing for documentation and evidence purposes require or storage is technically necessary. Further information on the respective storage and processing periods can be found for the individual data categories in section 3 and for the cookie categories in section 12. If there are no legal or contractual obligations to the contrary, we delete or anonymise your data after the storage or processing period has expired as part of our normal processes.

Documentation and evidence purposes include our interest in documenting processes, interactions and other facts in case of legal claims, discrepancies, IT and infrastructure security purposes and evidence of good corporate governance and compliance. Retention may be technically necessary if certain data cannot be separated from other data and we therefore need to retain it with them (e.g. in the case of backups or document management systems)

10. How do we protect your data?

We take reasonable security measures to maintain the confidentiality, integrity and availability of your personal data, to protect it against unauthorised or unlawful processing and to protect against the risks of loss, accidental alteration, unauthorised disclosure or access.

The security measures of a technical and organizational nature may include z.B. measures such as encryption (z. B. SSL, TLS) and pseudonymization of data, logging, access restrictions, storage of backup copies, instructions to our employees, confidentiality agreements and controls. We protect your privacy via our website data transmitted on the transport route using suitable encryption mechanisms. However, we can only secure areas that we control. We also oblige our processors to take appropriate security measures. However, security risks cannot generally be completely ruled out; Residual risks are unavoidable.

11. What are your rights?

Applicable data protection law grants you the right to object to the processing of your data in certain circumstances, in particular for direct marketing, direct marketing profiling and other legitimate processing interests.

To help you control the processing of your personal data, you also have the following rights in connection with our data processing, depending on the applicable data protection law:

the right to request information from us as to whether and which of your data we are processing;
the right to have us correct data if it is inaccurate;
the right to request the deletion of data;
the right to request that we provide certain personal data in a commonly used electronic format or transfer it to another controller;
the right to withdraw consent insofar as our processing is based on your consent;
the right to obtain, on request, further information necessary for the exercise of these rights;
the right to express your point of view in the case of automated individual decisions (section 6) and to request that the decision be reviewed by a natural person.

If you wish to exercise any of the above rights against us, please contact us in writing, at our premises or, unless otherwise stated or agreed, by email; you will find our contact details in section 2. In order for us to be able to rule out any misuse, we must identify you (e.g. by means of a copy of your identity card, unless otherwise possible).

Please note that conditions, exceptions or restrictions apply to these rights under applicable data protection law (e.g. to protect third parties or trade secrets). We will inform you accordingly if necessary.

If you do not agree with our handling of your rights or data protection, please let us or our data protection officers (section 2) know. In particular, if you are in the EEA, the United Kingdom or Switzerland, you also have the right to complain to the data protection supervisory authority in your country.

12. Do we use Online-Tracking- and Online-Advertising Techniques?

We use various technologies on our website that enable us and third parties we have engaged to recognise you when you use our website and, in some circumstances, to track you across multiple visits. We inform you about this in this section.

In essence, this is so that we can distinguish accesses by you (via your system) from accesses by other users, so that we can ensure the functionality of the website and carry out evaluations and personalisations. In doing so, we do not want to infer your identity, even if we can do so insofar as we or third parties engaged by us can identify you through a combination with registration data. Even without registration data, however, the technologies used are designed in such a way that you are recognised as an individual visitor each time you access the site, for example by our server (or the servers of the third parties) assigning you or your browser a specific identification number (so-called "cookie").

Cookies are individual codes (e.g. a serial number) that our server or a server of our service providers or advertising contract partners transmits to your system when you connect to our website and that your system (browser, mobile) accepts and stores until the programmed expiry time. With each subsequent access, your system transmits these codes to our server or the server of the third party. In this way, you are recognised even if your identity is unknown.

Other techniques can also be used to make you more or less likely to be recognised (i.e. distinguished from other users), e.g. "fingerprinting". Fingerprinting combines the browser you use, the screen resolution, the language choice and other information that your system communicates to each server), resulting in a more or less unique fingerprint. In this way, cookies can be dispensed with.

Whenever you access a server (e.g. when using a website or an app or because an image is visibly or invisibly integrated in an email), your visits can therefore be "tracked" (traced). If we integrate offers from an advertising contractor or provider of an analysis tool on our website, they may track you in the same way, even if you cannot be identified in individual cases.

We use such techniques on our website and allow certain third parties to do so as well.

You can programme your browser to block, deceive or delete existing cookies or alternative techniques. You can also enhance your browser with software that blocks tracking by certain third parties. You can find more information about this on the help pages of your browser (usually under the keyword "data protection") or on the websites of the third parties that we list below.

A distinction is made between the following cookies (techniques with comparable functions such as fingerprinting are included here):

Necessary cookies

Some cookies are necessary for the website to function as such or for certain functions. For example, they ensure that you can switch between pages without losing information entered in a form. They also ensure that you remain logged in. These cookies are only temporary ("session cookies"). If you block them, the website may not work. Other cookies are necessary so that the server can save decisions or entries made by you beyond one session (i.e. one visit to the website) if you use this function (e.g. language selected, consent given, the function for automatic login etc.). These cookies have an expiry date of up to [24] months.

Performance cookies

In order to optimise our website and corresponding offers and to better adapt them to the needs of users, we use cookies to record and analyse the use of our website, possibly even beyond the session. We do this through the use of third-party analytics services. We have listed these below. Performance cookies also have an expiry date of up to [24] months. Details can be found on the websites of the third-party providers.

Marketing cookies

We and our advertising partners have an interest in targeting advertising, i.e., displaying it only to those we want to reach. We have listed our advertising partners below. For this purpose, we and our advertising partners also use cookies that can be used to record the content accessed or contracts concluded. This allows us and our advertising contractors to display advertisements that we think you will be interested in on our website, as well as on other websites that display advertisements from us or our advertising contractors. These cookies have an expiration period of a few days up to [12] months, depending on the situation.

In addition to marketing cookies, we use other techniques to control online advertising on other websites and thereby reduce wastage. For example, we may transmit the e-mail addresses of our users, customers and other persons to whom we want to display advertising to operators of advertising platforms (e.g. social media). If these persons are registered there with the same e-mail address (which the advertising platforms determine by matching), the operators show the advertising we have placed to these persons in a targeted manner. The operators do not receive personal e-mail addresses of persons who are not already known. In the case of known e-mail addresses, however, they learn that these persons are in contact with us and which content they have accessed.

We may also integrate other third-party offers on our website, in particular from social media providers. If you have an account with the social media provider, they can assign this information to you and thus track your use of online offers. These social media providers process this data under their own responsibility.

We currently use offers from the following service providers and advertising partners:

Google Analytics

Google Ireland (based in Ireland) is the provider of the Service and acts as our order processor. Google Ireland relies on Google LLC (based in the USA) as its order processor (both "Google") for this purpose. Information on data protection can be found here [https://policies.google.com/].

Google Fonts

Google Maps

Google Tag Manager

13. What data do we process on our social network pages?

We may operate pages and other online presences ("fan pages", "channels", "profiles", etc.) on social networks and other platforms operated by third parties and collect the data about you described in section 3 and below there.We receive this data from you and the platforms when you come into contact with us via our online presence (e.g., when you communicate with us, comment on our content or visit our presence).At the same time, the platforms evaluate your use of our online presences and link this data with other data about you known to the platforms (e.g., about your behavior and preferences). They also process this data for their own purposes under their own responsibility, in particular for marketing and market research purposes (e.g. to personalize advertising) and to control their platforms (e.g. which content they show you).

We process this data for the purposes described in section 4, in particular for communication, marketing purposes (including advertising on these platforms, see section 12) and market research. You will find information on the relevant legal basis in section 5. We may ourselves disseminate content published by you (e.g. comments on an announcement) (e.g. in our advertising on the platform or elsewhere).We or the operators of the platforms may also delete or restrict content from or about you in accordance with the usage guidelines (e.g. inappropriate comments).

For further information on the processing of the platform operators, please refer to the data protection notices of the platforms. There you can also find out in which countries they process your data, which rights of access, deletion and other data subjects you have and how you can exercise these or obtain further information.

We currently use the following platforms:

Here we operate the site https://ch.linkedin.com/company/rbt-ag. The responsible body for operating the platform for users from Europe is LinkedIn Ireland Unlimited Company, Ireland. Their data protection information is legal at https://www.linkedin.com/ /privacy-policy/ available.

14. Can this privacy policy be changed?

This privacy policy is not part of any contract with you. We may amend this privacy policy at any time. The version published on this website is the current version.

Last update: 13.07.2023