Privacy Policy.

In this Privacy Policy, we, Chipiron AG (hereinafter Chipiron AG, we or us), explain how we collect and otherwise process personal data. This is not an exhaustive description; the information brochure and other similar documents may govern specific circumstances. Personal data means all information relating to an identified or identifiable individual.

If you provide us with personal data concerning other individuals (for example, family members), please ensure that they are familiar with this Privacy Policy. Only share their personal data with us if you are permitted to do so and the data is correct.

This Privacy Policy is aligned with the requirements of the EU General Data Protection Regulation (“GDPR”), the Swiss Federal Act on Data Protection (“FADP”) and the data protection law applicable in the United Kingdom, in particular the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018. Whether and to what extent these provisions apply in an individual case depends on the particular circumstances, especially the location of the individual concerned, the place of processing and the specific facts.

1. Data controller The controller responsible for the data processing described here is Chipiron AG, J.-C. Heerstrasse 21A, 8635 Dürnten, Switzerland.

If you have concerns relating to data protection, you can contact us by email at: dataprotection@chipiron.ch

2. Collection and processing of personal data We primarily process personal data that we receive in the course of our business relationships with our customers and other business partners, from them and other individuals involved, or that we collect from users when operating our website and other applications.

Where permitted, we also obtain certain data from publicly accessible sources (for example, debt enforcement registers, land registers, commercial registers, the press and the internet) or receive it from other companies, authorities and other third parties.

In addition to the data you provide directly, the categories of personal data we receive about you from third parties may include, in particular, information from public registers, information relating to your professional functions and activities, and information provided by people around you.

3. Purposes of processing and legal bases We primarily use the personal data we collect to enter into and perform contracts with our customers and business partners, provide our services, use IT solutions and services from outsourcing partners and other service providers, and fulfil our legal obligations in Switzerland and abroad.

If you work for such a customer or business partner, your personal data may also be affected in that capacity.

In addition, where permitted and where we consider it appropriate, we process personal data concerning you and other individuals for purposes in which we — and, where applicable, third parties — have a legitimate interest corresponding to the purpose.

Where you have consented to the processing of your personal data for specific purposes, we process it within the scope of and based on that consent, insofar as we have no other legal basis and require one.

Consent may be withdrawn at any time. Withdrawal does not, however, affect processing already carried out.

4. Technologies associated with use of our website Our website uses local browser storage to remember your Cookie Settings. This is strictly necessary. With your consent, we also use the web analytics service Matomo (see section 4.4). We do not use advertising trackers. On your first visit you can accept or reject measurement, and you can change or withdraw your choice at any time through Cookie Settings in the website footer. Language selection is part of the page address. Fonts and images are served from our own website.

4.1 Contact form and contacting us When you send the enquiry form, we receive the information you enter: your name, email address, organisation (if provided), the topic you chose and your message. We also record the language of the page, the time of sending and a one-way coded value derived from your IP address. We use these to recognise spam and to limit repeated submissions; the IP address itself is not stored with your enquiry.

Your enquiry is stored in our internal administration system, which is hosted by the same provider as our website (see section 4.3). Only authorised members of our team can read it there. They are notified by email that a new enquiry has arrived; these notifications do not contain the content of your message. We send you an email confirming that we have received your enquiry, and we answer you by email. These emails are sent through the email delivery service Resend (Resend, Inc., San Francisco, USA), which acts on our behalf.

If the form cannot be sent, the website offers to open a draft in your own email application instead. You decide whether to send that email through your email provider.

If you email us, we process the personal data you provide, including your name, email address and message, to handle your enquiry and communicate with you.

We use this data only to handle your enquiry and the business relationship that may follow from it. Enquiries are deleted once they are no longer needed for that purpose, unless statutory retention obligations apply (see section 6).

4.2 SSL encryption Our website uses SSL/TLS encryption to protect data transmission. This protects data transmitted between your browser and our website against unauthorised access during transmission.

4.3 Hosting Our website is hosted by Hetzner. When you access our website, log files may record, in particular, your IP address, the date and time of access, the browser request and information about the operating system or browser used.

This data is used, in particular, to ensure technical operation and security and to analyse errors.

4.4 Web analytics with Matomo If you consent, we use Matomo, an open-source web analytics software, to understand how our website is used and to improve it. Matomo runs on our own server at our hosting provider Hetzner in Falkenstein, Germany (see section 4.3). The data is not passed to the maker of Matomo or to any other third party.

When you open a page, Matomo processes the page visited, the page you came from, the date and time, your browser, operating system, device type, screen resolution and language settings, and your IP address. Your IP address is shortened before it is stored (the last two bytes are removed), and only this shortened address is used to derive your approximate location (country). Matomo sets no cookies and stores nothing on your device. To tell visits apart, it uses a coded value formed from technical characteristics of your browser, which cannot be traced back to you.

We process this data on the basis of your consent. You can withdraw your consent at any time through Cookie Settings in the website footer. The withdrawal applies from the next page you open and does not affect processing already carried out. Visit data is deleted automatically after 13 months; anonymous summary reports are kept.

5. Disclosure and transfer of data in Switzerland and abroad In the course of our business activities and for the purposes described in this Privacy Policy, where permitted and where we consider it appropriate, we may disclose data to third parties, either because they process data for us or because they use it for their own purposes.

These may include, in particular, service providers such as banks, IT providers or hosting providers, or authorities, public bodies or courts in Switzerland or abroad.

These recipients may be located in Switzerland or abroad.

In particular, data is transferred to Germany (hosting and web analytics, see sections 4.3 and 4.4) and to the USA (email delivery, see section 4.1). The email delivery provider is certified under the EU-U.S. Data Privacy Framework; for transfers from Switzerland, we rely on the standard contractual clauses recognised by the FDPIC, which form part of our agreement with the provider.

If a recipient is in a country without adequate statutory data protection, we contractually require the recipient to comply with applicable data protection, unless it is already subject to a legally recognised framework ensuring data protection and unless we can rely on an exception. Such an exception may apply, in particular, to legal proceedings abroad, but also where overriding public interests exist, where performance of a contract requires disclosure, where you have consented, or where the data has been made generally accessible by you and you have not objected to its processing.

6. Retention period for personal data We process and store your personal data for as long as necessary to fulfil our contractual and legal obligations or the purposes pursued through processing.

This includes, for example, the entire business relationship — from its initiation through performance to termination of a contract — and beyond, in accordance with statutory or regulatory retention and documentation obligations.

Personal data may also be retained for the period during which claims may be brought against our company, insofar as we are legally required to do so or legitimate business interests require it, for example for evidence and documentation purposes.

Once your personal data is no longer required for these purposes, it is generally deleted or anonymised to the extent possible.

Shorter retention periods may apply to operational data, for example system records and logs.

7. Data security We take appropriate technical and organisational security precautions to protect your personal data against unauthorised access, loss and misuse.

8. Obligation to provide personal data In the course of our business relationships, you must provide the personal data required to establish and conduct a business relationship and to fulfil the associated contractual obligations.

As a rule, there is no legal obligation to provide data to us.

Without this data, however, we may be unable to enter into or perform a contract with you or the entity or individual you represent.

It may also be impossible to use the website fully if certain information needed to ensure data traffic, such as the IP address, is not disclosed.

9. Rights of the individual concerned Within the framework of the data protection law applicable to you and insofar as provided therein, you have, in particular, the right to access, correct and delete your personal data and, where applicable, the right to restrict processing, object to certain processing and receive certain personal data for transfer to another entity.

Please note that these rights may be subject to legal conditions and restrictions. For example, we may be obliged to continue retaining or processing certain data.

Exercising such rights generally requires that you clearly establish your identity.

To exercise your rights, you can contact us at the address specified in section 1.

Every individual concerned also has the right to enforce their claims in court or lodge a complaint with the competent data protection authority. The competent Swiss data protection authority is the Federal Data Protection and Information Commissioner (FDPIC).

10. Changes We may amend this Privacy Policy at any time without prior notice. The current version published on our website applies.

If the Privacy Policy forms part of an agreement with you, we may notify you of an update by email or in another appropriate manner.