1. Introduction
1.1 Purpose of this Privacy Policy
This Privacy Policy provides an overview of how Kirchhofer AG collects, processes, and protects your personal data. We place great importance on safeguarding your privacy and ensuring the security of your personal information.
1.2 Scope
This Privacy Policy applies to all personal data that we collect and process in the course of our business relationships with customers, suppliers, business partners, and visitors to our website. It covers both online and offline data collection and processing activities.
1.3 Principles of Data Processing
When processing your personal data, we adhere to the following principles:
- Lawfulness, Fairness, and Transparency: We process your personal data lawfully, fairly, and in a transparent manner.
- Purpose Limitation: We collect and process your personal data only for specified, explicit, and legitimate purposes.
- Data Minimization: We collect only the personal data that is relevant and limited to what is necessary for the purposes for which it is processed.
- Accuracy: We take reasonable steps to ensure that your personal data is accurate and kept up to date.
- Storage Limitation: We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected and processed.
- Integrity and Confidentiality: We process your personal data in a manner that ensures appropriate security, including protection against unauthorized or unlawful processing and against accidental loss, destruction, or damage.
1.4 Changes to this Privacy Policy
We reserve the right to amend this Privacy Policy at any time in order to reflect changes in legal requirements or technical developments. The current version of this Privacy Policy is always available on our website. We recommend that you review it regularly.
2. Data Controller and Data Protection Coordinator
2.1 Definition of the Data Controller
The Data Controller is the natural or legal person, public authority, agency, or other body that, alone or jointly with others, determines the purposes and means of the processing of personal data. For Kirchhofer AG, the Data Controller is the company itself.
2.2 Contact Details of the Data Controller
Kirchhofer AG is responsible for the processing of your personal data. You can contact us using the following details:
- Company Name: Kirchhofer AG
- Address: Head Office, Höheweg 36, 3800 Interlaken, Switzerland
- Telephone +41 33 553 50 00
- eMail: data-privacy@kirchhofer.com
2.3 Data Protection Coordinator
Kirchhofer AG has appointed a Data Protection Coordinator who is responsible for overseeing compliance with applicable data protection laws and regulations. The Data Protection Coordinator is available to answer any questions regarding the processing of your personal data and the exercise of your data protection rights.
- Name: Henrik Engel
- Address: Head Office, Höheweg 36, 3800 Interlaken, Switzerland
- Telephone +41 33 553 50 00
- eMail: data-privacy@kirchhofer.com
2.4 Responsibilities of the Data Protection Coordinator
The Data Protection Coordinator is responsible for:
- Monitoring compliance with applicable data protection laws and regulations within Kirchhofer AG.
- Providing training and raising employee awareness regarding data protection.
- Cooperating with the competent supervisory authorities.
- Serving as the primary contact for data subjects regarding questions, requests, or complaints relating to data protection.
3. Collection and Processing of Personal Data
3.1 Categories of Personal Data Collected
We collect various categories of personal data depending on the nature of your interaction with us. This may include:
- Contact Information: Name, postal address, telephone number, and email address.
- Payment Information: Bank account details and credit card information.
- Usage Data: Information about how you use our website and services, such as your IP address, browser type, access times, and pages visited.
- Communication Data: The content of emails, enquiries, and other communications you send to us.
3.2 Methods of Data Collection
We collect personal data in the following ways:
- Directly from You: When you voluntarily provide your personal data, for example by completing forms on our website, subscribing to newsletters, or contacting our customer service.
- Automatically: Certain information is collected automatically when you use our website and services, for example through cookies and similar tracking technologies.
- From Third Parties: In certain cases, we receive personal data from third parties, such as payment service providers or marketing partners.
3.3 Purposes of Data Processing
The personal data we collect is processed for various purposes, including:
- Performance of a Contract: To fulfill our contractual obligations towards you, such as processing orders and payments.
- Customer Service: To respond to your enquiries and provide customer support.
- Marketing and Advertising: To provide you with information about our products and services where you have given your consent or where otherwise permitted by applicable law.
- Analysis and Improvement: To analyze and improve our services and enhance the user experience on our website.
3.4 Legal Bases for Data Processing
We process your personal data based on one or more of the following legal grounds:
- Consent: Where you have given your consent to the processing of your personal data.
- Performance of a Contract: Where processing is necessary for the performance of a contract to which you are a party.
- Legal Obligation: Where processing is necessary to comply with a legal obligation to which we are subject.
- Legitimate Interests: Where processing is necessary for the purposes of our legitimate interests, such as improving our services, provided that these interests are not overridden by your fundamental rights and freedoms.
4. Purposes of Data Processing
4.1 Performance of a Contract
We process your personal data to fulfill our contractual obligations towards you. This includes:
- Order Processing: Processing and delivering your orders.
- Payment Processing: Processing payments and refunds.
- Customer Service: Responding to your enquiries and providing customer support.
4.2 Customer Service
Your personal data is used to provide you with efficient and personalized customer service. This includes:
- Communication: Contacting you by email, telephone, or mail to respond to your enquiries or resolve issues.
- Support: Providing technical support and assistance with the use of our products and services.
4.3 Marketing and Advertising
With your consent, we use your personal data for marketing and promotional purposes to keep you informed about our products, services, and special offers. This may include:
- Newsletters: Sending newsletters and promotional emails (with the option to unsubscribe at any time).
- Personalized Offers: Providing offers and recommendations tailored to your interests.
- Market Research: Conducting surveys and analyses to improve our products and services.
4.4 Improvement of Our Services
We analyze the use of our website and services in order to continuously improve them. This includes:
- Usage Analysis: Collecting and evaluating data regarding the use of our website and services.
- Google Analytics: Using Google Analytics to understand website traffic and user behavior.
- Social Media Plugins: Using social media plugins to enhance user interaction and engagement where applicable.
4.5 Legal Obligations
We also process your personal data where necessary to comply with our legal obligations, including:
- Accounting and Tax Compliance: Fulfilling statutory accounting, financial reporting, and tax obligations.
- Legal Proceedings: Processing personal data in connection with legal claims, disputes, investigations, or judicial and administrative proceedings.
5. Disclosure of Personal Data
5.1 Disclosure to Service Providers
We share your personal data with carefully selected service providers who support us in delivering our products and services. These service providers are contractually obligated to process your personal data confidentially and solely for the purposes agreed upon with us.
These service providers may include:
- Payment Service Providers: To process payments and refunds.
- Shipping and Logistics Providers: To deliver your orders.
- Marketing Service Providers: To carry out marketing campaigns, analytics, and customer communications.
5.2 Disclosure to Third Parties
In certain circumstances, we may disclose your personal data to third parties where this is necessary to fulfill our contractual obligations or to comply with applicable legal requirements. Such disclosures may include:
- Public Authorities: To comply with legal obligations, for example in connection with tax, regulatory, or law enforcement proceedings.
- Legal Advisors: For the establishment, exercise, or defense of legal claims.
5.3 International Data Transfers
In certain cases, it may be necessary to transfer your personal data to recipients located outside Switzerland or the European Economic Area (EEA). Where such transfers occur, we ensure that appropriate safeguards are implemented to protect your personal data, for example by entering into the European Commission’s Standard Contractual Clauses (SCCs), relying on an adequacy decision where applicable, or obtaining your explicit consent where required.
Google Inc.
1600 Amphitheatre Parkway – Mountain View, CA 94043 USA
Google services are used for Google Analytics as described above. In addition, Google Workspace services are used to support and organize our order processing. The personal data provided during the ordering process is processed for this purpose and is kept separate from analytics and marketing data.
MICROSOFT Corporation
One Microsoft Way – Redmond, WA 98052-6399 USA
Microsoft processes certain data in connection with our use of Bing Webmaster Tools within the scope described in this Privacy Policy.
The Rocket Science Group, LLC
675 Ponce de Leon Ave NE – Suite 5000 – Atlanta, GA 30308 USA
The Rocket Science Group LLC is the provider of the Mailchimp platform. We use Mailchimp to send automated notifications regarding the status of your orders. For this purpose, your name, email address, order number, and order details are transmitted to Mailchimp. In addition, Mailchimp provides the technical infrastructure for our newsletter service and therefore processes information about your newsletter subscription.
5.4 No Disclosure for Commercial Purposes
We do not sell, rent, or otherwise disclose your personal data to third parties for their own commercial or marketing purposes.
5.5 Safeguards for Data Transfers
Whenever we disclose personal data, we implement appropriate technical and organizational measures to ensure its protection. These measures include:
- Encryption: Using encryption technologies for the secure transmission of personal data.
- Contractual Safeguards: Entering into data processing agreements and contractual clauses with service providers to ensure an adequate level of data protection.
- Access Controls: Restricting access to personal data to authorized personnel who require access for legitimate business purposes.
6. Data Security
6.1 Technical Measures
We implement a range of technical measures to protect your personal data against unauthorized access, loss, alteration, or misuse. These measures include:
- Encryption: We use encryption technologies to protect your personal data during transmission and storage.
- Firewalls: Our IT systems are protected by firewalls designed to prevent unauthorized access.
- Anti-Malware Protection: We perform regular system scans and maintain up-to-date anti-malware software to detect and remove malicious software.
- Security Updates: We regularly install security updates and patches to address known vulnerabilities and maintain the security of our systems.
6.2 Organizational Measures
In addition to technical safeguards, we implement appropriate organizational measures to ensure the protection of your personal data. These include:
- Access Controls: Access to personal data is restricted to authorized employees who require such access to perform their job responsibilities.
- Employee Training: We provide regular training on data protection and information security to raise employee awareness and ensure compliance with applicable data protection requirements.
- Policies and Procedures: We maintain and enforce data protection policies and procedures that govern the processing of personal data and ensure compliance with applicable legal and regulatory requirements.
6.3 Physical Security Measures
We also implement physical security measures to protect your personal data. These measures include:
- Access Controls: Access to our business premises is controlled through appropriate physical security measures to prevent unauthorized entry.
- Video Surveillance: We use video surveillance and other appropriate security measures to protect our property rights and to ensure the security of our premises and facilities. These measures also serve to protect our employees, visitors, and other individuals, as well as assets that belong to us or have been entrusted to our care.
6.4 Review and Continuous Improvement
We regularly review and update our security measures to ensure the ongoing protection of your personal data. This includes:
- Security Audits: Conducting regular security audits and risk assessments to identify, evaluate, and remediate potential vulnerabilities.
- Incident Response Planning: Developing, maintaining, and testing incident response and business continuity plans to enable a prompt and effective response in the event of a security incident.
7. Rights of Data Subjects
7.1 Right of Access
You have the right to request confirmation as to whether we process personal data relating to you. Where this is the case, you have the right to obtain access to your personal data and the following information:
- Purposes of Processing: Why we process your personal data.
- Categories of Personal Data: The types of personal data we process.
- Recipients: The recipients or categories of recipients to whom your personal data has been or will be disclosed.
- Retention Period: The period for which your personal data will be stored, or the criteria used to determine that period.
- Your Rights: Information about your rights regarding the processing of your personal data.
- Source of the Data: Where the personal data was obtained if it was not collected directly from you.
- Automated Decision-Making: Whether automated decision-making, including profiling, takes place and, where applicable, meaningful information about the logic involved and its potential consequences.
7.2 Right to Rectification
You have the right to request the correction of inaccurate personal data concerning you and to have incomplete personal data completed.
7.3 Right to Erasure
You have the right to request the erasure of your personal data where one of the following grounds applies:
- The personal data is no longer necessary for the purposes for which it was collected or otherwise processed.
- You withdraw your consent and there is no other legal basis for the processing.
- You object to the processing and there are no overriding legitimate grounds for continuing the processing.
- The personal data has been processed unlawfully.
- Erasure is required to comply with a legal obligation.
7.4 Right to Restriction of Processing
You have the right to request the restriction of processing where:
- You contest the accuracy of your personal data, for a period enabling us to verify its accuracy.
- The processing is unlawful, and you oppose the erasure of the personal data and request restriction instead.
- We no longer need the personal data for processing purposes, but you require it for the establishment, exercise, or defense of legal claims.
- You have objected to the processing pending verification of whether our legitimate grounds override your interests.
7.5 Right to Data Portability
You have the right to receive the personal data concerning you that you have provided to us in a structured, commonly used, and machine-readable format and to transmit that data to another controller, provided that:
- The processing is based on your consent or on a contract; and
- The processing is carried out by automated means.
7.6 Right to Object
You have the right to object, on grounds relating to your particular situation, at any time to the processing of your personal data where such processing is based on our legitimate interests. We will cease processing your personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or where the processing is necessary for the establishment, exercise, or defense of legal claims.
7.7 Right to Withdraw Consent
Where the processing of your personal data is based on your consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of any processing carried out before the withdrawal.
7.8 Right to Lodge a Complaint
If you believe that the processing of your personal data violates applicable data protection laws, you have the right to lodge a complaint with the competent supervisory authority.
8. Contact
8.1 Contact Information
If you have any questions regarding the processing of your personal data or wish to exercise your rights, you may contact our Data Protection Coordinator at any time.
- Data Protection Coordinator: Henrik Engel
- Address: Head Office, Höheweg 36, 3800 Interlaken, Switzerland
- Telephone +41 33 553 50 00
- eMail: data-privacy@kirchhofer.com
8.2 Assistance and Support
Our Data Protection Coordinator is available to answer any questions relating to data protection and to assist you in exercising your rights. Please do not hesitate to contact us if you require assistance or have any concerns regarding the processing of your personal data.
9. Changes to this Privacy Policy
9.1 Updates
We reserve the right to amend this Privacy Policy at any time to reflect changes in legal, regulatory, or technical requirements. Any updates will be published on our website, where the most current version of this Privacy Policy will always be available.
9.2 Notification of Material Changes
Where material changes to this Privacy Policy affect your rights or obligations, we will notify you in an appropriate manner. Such notification may be provided through a notice on our website or by email, where appropriate.
9.3 Regular Review
We encourage you to review this Privacy Policy periodically to ensure that you remain informed about our current data protection practices and any updates to this Policy.