Ringele AG Privacy Policy
(September 2023 version)

In this Privacy Policy, we, Ringele AG (hereinafter referred to as ‘Ringele’, ‘we’ or ‘us’), explain how we collect and process personal data.

This is not an exhaustive description; general terms and conditions, terms of participation and similar documents may apply to specific matters. ‘Personal data’ means all information relating to an identified or identifiable person.

If you provide us with personal data pertaining to other persons (e.g. family members or work colleagues), please ensure that these persons are aware of this Privacy Policy, and that you only share their personal data with us if you are authorised to do so and if this personal data is correct.

This Privacy Policy is designed to meet the requirements of the EU General Data Protection Regulation (GDPR), as well as Switzerland’s Federal Act on Data Protection (FADP) and New Federal Act on Data Protection (nFADP). However, the question of whether and to what extent these laws are applicable depends on the individual case. The New Federal Act on Data Protection (nFADP) applies to this Privacy Policy.

Unless otherwise stated in individual cases, the controller responsible for the data processing described here is:

Ringele AG
Wasenstrasse 49
4133 Pratteln

If you have concerns relating to data protection law, you can inform us anonymously at this contact address or make contact via the ‘Integrity Line’ online reporting platform .

The information provided will be processed by our data protection officer (data protection coordinator, data protection advisor).

We primarily process personal data in connection with job applications, during administrative processing of each job application and appointment in the context of our HR applications. We also receive personal data from our customers and other business partners in the course of our business dealings with them and other persons involved, or we obtain it from their users during operation of our websites, apps and other applications.

To the extent permitted, we also use publicly accessible sources (e.g. debt enforcement registers, land registers, commercial registers, press and internet) to gather certain data from authorities and other third parties (e.g. Creditreform).

Alongside the data that you give us directly, the categories of personal data pertaining to you that we receive from third parties include, in particular:

• Information from public registers
• Information that we acquire in connection with official and legal proceedings
• Information in connection with your professional functions and activities (e.g. so that, with your assistance, we can secure and conduct business with your employer)
• Information about you that is included in correspondence and discussions with third parties, as well as information on creditworthiness (insofar as we conduct business with you personally)
• Information about you that persons with whom your are closely associated (family, advisers, legal representatives etc.) give us, so that we can secure or conduct contracts with you, or with your involvement (e.g. references, or your address for deliveries)
• Powers of attorney
• Information on compliance with legal requirements, such as those pertaining to the prevention of money laundering or to export restrictions
• Information from banks, insurance companies, sales partners and other contractual partners of ours regarding your use or provision of services (e.g. payments or purchases made)
• Information about you from the media or internet (insofar as appropriate in the specific case, e.g. in the context of a job application, press review, marketing/sales etc.)
• Your addresses and, if applicable, interests and other socio-demographic data (for marketing)
• Data connected with website use (e.g. IP address, MAC address of smartphone or computer, information about your device and settings, cookies, date and time of visit, pages and content accessed, functions used, referring website, and location data)

We primarily use the personal data we collect for the administrative processing of job applications and appointments in the context of our HR applications. In addition, all documents submitted by you in connection with a job application are recorded. This data is stored, analysed, processed or forwarded within our organisation solely in the context of your application.

The data may be processed for statistical purposes (e.g. reporting). This is done in such a way that it will not be possible to identify or trace you. If you are hired by Ringele AG, HR will store further personal data relevant to the employment contract within Ringele’s internal systems.

Data may also be processed in order to enter into and process our contracts with our customers and business partners, particularly in connection with the provision of services for our customers and the purchase of products and services from our suppliers and subcontractors, as well as to fulfil our legal obligations in Switzerland and abroad. If you work for such a customer or business partner, this can naturally also apply to you in that role, along with your personal data.

Moreover, to the extent permitted and insofar as we deem it appropriate, we also process personal data pertaining to you and other persons for the following purposes, wherever we (and sometimes third parties) have a legitimate interest corresponding to the respective purpose:

• Further development of our offerings, services, websites, apps and other platforms on which we are present
• Communication with third parties and processing of their queries (e.g. job applications or media enquiries)
• Assessment and optimisation of requirements-analysis procedures for the purpose of contacting customers directly, as well as collection of personal data from publicly accessible sources for business development purposes
• Advertising and marketing (including the holding of events), provided you have not objected to this use of your data (if we send you advertising as an existing customer, you can unsubscribe at any time, and we will then place you on a list of people who do not wish to receive advertising)
• Market research, opinion research and media monitoring
• Assertion of legal claims and defence in the context of legal disputes or official proceedings
• Prevention and investigation of criminal offences or other misconduct (e.g. conducting internal investigations, or data analysis to combat fraud)
• Safeguarding of our operations, particularly IT, our websites, apps and other platforms
• Video surveillance to safeguard domiciliary rights and other measures for IT security, building security and facility security, as well as protection of our employees, of other persons and of assets belonging to or entrusted to us (e.g. access controls, visitor lists, network scanners, mail scanners or telephone recordings)
• Purchase and sale of business units, companies or parts of companies and other transactions under company law, and the associated transfer of personal data, as well as business-management measures, also to the extent necessary for compliance with legal and regulatory obligations and Ringele’s internal regulations

If you have given us your consent to process your personal data for specific purposes (e.g. when you subscribe to newsletters or when a background check is carried out), we will process your personal data within the scope of this consent and on that basis, insofar as we have no other legal basis and require one. Consent can be revoked at any time, but this has no effect on data processing that has already taken place.

The data you disclose to us will be treated confidentially. For instance, in the context of a specific job application and employment relationship, only persons within our company who are involved in filling the position(s) will have access to the data you provide. Unless you inform us otherwise, we reserve the right to assess your job application with regard to other suitable positions within our company. In exceptional cases, employees of the IT partner we employ for support purposes will also have access to the data you provide.

Our websites typically use ‘cookies’ and similar technologies capable of identifying your browser or device. A cookie is a small file that is sent to your computer or automatically stored on your computer or mobile device by your web browser when you visit our website. This enables us to recognise you when you return to this website, even if we do not know who you are. In addition to cookies that are only used during a session and are deleted after your visit to the website (‘session cookies’), cookies can also be used to store user settings and other information for a certain period of time, e.g. two years (‘permanent cookies’). However, you can configure your browser so that it rejects cookies, only saves them for one session, or else deletes them earlier. Most browsers are preconfigured to accept cookies. We use permanent cookies so that you can save user settings (e.g. language and auto-login) and to improve our understanding of how you use our offerings and content. If you block cookies, certain functions (e.g. language selection etc.) may no longer work.

In some of our newsletters and other marketing emails, and to the extent permitted, we include visible and invisible pixels, which, when accessed on our servers, allow us to determine if and when you have opened the email. This provides another means of measuring and better understanding how you use our offerings so that we can tailor them to your needs. You can block this in your email program; most are preconfigured to let you do so.

By using our websites or agreeing to receive newsletters and other marketing emails, you consent to the use of these technologies. If you do not want this, you must configure your browser or email program accordingly, unless this can be adjusted in the settings.

We sometimes use Google Analytics or similar services on our websites. These services are provided by third parties, who may be located in any country in the world (in the case of Google Analytics, the third party is Google Ireland (based in Ireland); Google Ireland relies on Google LLC (based in the USA) for task processing (hereinafter both referred to as ‘Google’), www.google.com). Such services enable us to measure and analyse use of the website (but not in a person-specific manner). Permanent cookies set by the service provider are also used for this purpose. Although we can assume that Google does not consider the information we share with it to be personal data by, it is possible that Google could, for its own purposes, use this data to identify visitors, create person-specific profiles and link this data to those persons’ Google accounts. If you have registered with the service provider yourself, the service provider also knows you. The processing of your personal data by the service provider is then the responsibility of the service provider and occurs in accordance with their data protection regulations. The service provider only provides us with information about how the website in question is being used (and no information about you personally).

We also use so-called ‘plug-ins’ from social networks such as Facebook, Twitter, YouTube, Pinterest or Instagram on our websites. This will always be visible to you (typically in the form of icons). We have configured these elements so that they are deactivated by default. If you activate them (by clicking on them), the operators of the respective social networks can register your presence on our website, including the specific part of the website, and use this information for their purposes. The processing of your personal data is then the responsibility of the respective operator and occurs in accordance with their data protection regulations. We do not receive any information from them about you.

In the context of our business activities and for the purposes set out in section 3, we also disclose data to third parties, insofar as permitted and to the extent we deem it appropriate, either because they process it for us or because they wish to use it for their own purposes. This applies in particular to the following parties:

• Our service providers (either within the Obermark Group or external providers such as banks or insurance companies), including task processors (e.g. IT providers)
• Dealers, suppliers, subcontractors and other business partners
• Customers
• Swiss and foreign authorities, official bodies or courts
• Media
• The public, including website and social media users
• Industry organisations, associations, other organisations and committees
• Purchasers or parties interested in purchasing business units, companies or other parts of Ringele
• Other parties in potential or actual legal proceedings
• Other companies in the Obermark Group

Hereinafter, these are collectively referred to as ‘recipients’.

Some of these recipients are in Switzerland, but they can be anywhere in the world. In particular, you must expect your data to be transferred to all countries in which the Obermark Group is represented by group companies, branches or other offices, as well as to other European countries and the USA, where the service providers we use are situated (e.g. Microsoft, proAlpha, Sage, Refline etc.).

If a recipient is situated in a country without adequate statutory data protection, we contractually oblige the recipient to observe the applicable data protection requirements (for this purpose, we use the European Commission’s revised standard contractual clauses, which are available here: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?) unless the recipient is already subject to a legally recognised set of rules to ensure data protection and we cannot rely on an exemption clause.

In particular, an exception may be made in the event of legal proceedings abroad, but also in cases of overriding public interest, or if fulfilment of a contract requires such disclosure, if you have given your consent, or if you have made the data in question generally accessible and have not objected to it being processing.

We process and store your personal data for as long as is necessary either for fulfilment of our contractual and legal obligations or for the purposes pursued with such processing, e.g. for the duration of the entire business relationship (from the initiation to the processing, through to the termination of a contract) and beyond that, as per the statutory retention and documentation obligations.

It is also possible that personal data may be retained for the period in which claims can be asserted against our company, for as long as we are otherwise legally obliged to do so, or to the extent necessitated by legitimate business interests (e.g. for evidence and documentation purposes).

As soon as your personal data is no longer required for the aforementioned purposes, it will always, and to the fullest possible extent, be deleted or anonymised. Shorter retention periods of twelve months or less generally apply to operational data (e.g. system protocols and logs).

We take appropriate technical and organisational security precautions to protect your personal data from unauthorised access and misuse. Such precautions include, for instance, instructions on the use of IT infrastructure, staff regulations, a code of ethics and conduct, and corresponding employee training. These are supplemented by IT and network security solutions, access controls and restrictions, and the encryption of data media and transmissions.

In the context of our business relationship, you must provide the personal data required to establish and maintain a business relationship, and to fulfil the associated contractual obligations (although you do not generally have a legal obligation to provide data to us). Without this data, we will generally be unable to enter into or fulfil a contract with you (or with the entity or person you represent). Use of the website will also be impossible if certain information required for data traffic (e.g. an IP address) is not disclosed.

Within the framework of the data protection law applicable to you, and insofar as provided for therein, you have the right of access to personal data, the right of rectification and erasure of personal data, the right of restriction of data processing, and the right to otherwise object to data processing by us, particularly for the purposes of direct marketing, direct advertising or other legitimate interests pertaining to processing, as well as the right to the disclosure of certain personal data for the purpose of transfer to another organisation (data portability).

Please note, however, that we reserve the right to apply the restrictions provided for by law, e.g. if we are obliged to store or process certain data, have an overriding interest in doing so (insofar as we are entitled to invoke this) or require it for the assertion of claims. If this entails costs for you, we will notify you in advance.

We have already informed you, in section 3, about the possibility of revoking your consent. Please note that exercising these rights may conflict with contractual agreements and have consequences such as premature contract cancellation or resulting costs. We will inform you in advance if cases that are not already covered by contract arise.

Exercising such rights generally requires that you provide clear proof of your identity (e.g. via a copy of an identity document if your identity is otherwise unclear or unverifiable). By defining the necessary responsibilities and workflows, Ringele AG ensures that such requests from data subjects are taken care of within a reasonable period of time. Assertion of a data subject’s rights must be reported immediately so that the necessary steps can be initiated.

Breaches of data security must be reported without delay. (This is binding for persons in a relationship governed by labour law, mandate law or other contractual law). This is the only way to ensure that immediate measures can be taken to avert further risks, and that obligations to notify authorities and data subjects can be met in good time. Such reports can be made anonymously.

To assert your rights, make a request, or report a breach, contact us at the address given in section 1.

Furthermore, every data subject has the right to enforce their claims in court or to lodge a complaint with the relevant data protection authority. In Switzerland, the relevant data protection authority is the Federal Data Protection and Information Commissioner (http://www.edoeb.admin.ch).

We also draw your attention to the options for objecting to the collection of data for advertising purposes published on the website www.aboutads.info/choices/ (applies to European territories).