Privacy Policy BONECO AG

DATA PRIVACY POLICY
BONECO AG is part of the Plaston Group. The Plaston Group places a high value on honoring your privacy and protecting your personal data against misuse. All personal data that we receive from you will be processed in accordance with the applicable data protection regulations as well as the following conditions based on those regulations. These terms and conditions may be changed or erased at the discretion of the Plaston Group at any time and without notice.

I. General information on data processing
1. Scope of the processing of personal data
In principle, we process your personal data only for those purposes for which this data has been given to us. These usually relate to the conclusion and the transaction of contracts. Furthermore, we process your data for purposes in which we have a legitimate interest, such as for the further development of our offers, services, websites, apps and other platforms where you are active, for advertising and marketing and for the testing and optimization of needs analysis procedures. As a rule, the processing of your data takes place after receiving your consent. An exception applies in such cases where prior obtainment of consent is not possible due to valid reasons and the processing of the data is permitted by legal regulations, such as for the fulfillment of a contractual or legal obligation. If necessary for the fulfillment of the contract concluded with you, we are entitled to pass on your data to third parties (fulfillment partners, etc.).

2. Legal basis for processing personal data
Your personal data is processed on the following foundations:
• Based on your consent for one or more purposes (Art. 6)
• For the fulfillment of a contract of which you are a signatory party, or for the implementation of pre-contractual measures;
• For the fulfillment of a legal obligation that our company is subject to;
• If processing is required for either your vital interests or those of another natural person;
• For the protection of a legitimate interest of our company or a third party, provided that your interests, fundamental rights and fundamental freedoms do not outweigh our interests.

3. Data security
We take appropriate technical and organizational security precautions to protect your personal data against unauthorized access and misuse, such as IT and network security solutions, pseudonymization, access controls, issuing instructions, training employees as well as using state-of-the-art standard encryption technology for the transmission of data.

4. Data erasure and duration of storage
Wherever possible, your personal data is erased or anonymized once the purpose of its processing has been fulfilled or it is no longer required. However, the storage of your data beyond this period may be required if stipulated by legal retention and documentation obligations, or for the purposes of evidence or documentation in the event that claims are made against our company, or if required due to legitimate business interests.

II. Provision of the website and creation of log files
5. Description and scope of the data processing
Our system collects the anonymized data and information of the accessing computer system each time the website is accessed.
The following data is gathered in this process:
• Information about the browser type and the version used
• The operating system that you use
• Your IP address
• Data and time of access
• Websites from which your system reached our Internet site
• Websites that are accessed by your system by means of our website
• Name of the page accessed by the user's system
The data is also stored in the log files of our system. This data is not stored together with other personal data.

6. Legal basis for data processing
The temporary storage of data and log files is used for the protection of legitimate interests of our company.

7. Purpose of data processing
The temporary storage of the IP address by the system is necessary to be able to deliver the website to your computer. For this purpose, your IP address must remain stored for the duration of the session.
Storage in log files takes place in order to ensure the proper function of the website. Furthermore, the data is used by us to optimize the website and ensure the security of our
information technology systems. An evaluation of the data for marketing purposes does not take place in connection with this.
Our legitimate interests in data processing also lie within this context.

8. Duration of storage
The data is erased as soon as its collection is no longer required to accomplish these purposes. In cases of data collection for the provision of the website, this is the case when the respective session is ended.
In cases of data storage in log files, this is the case after 4 weeks at the latest. Storage extending beyond this is possible. In this case, your IP addresses are erased or defamiliarized so that it is no longer possible to associate them to you personally.

9. Objection and removal option
The collection of data for the provision of the website and the storage of data in log files is absolutely required for the operation of the Internet site. Consequently, you do not have an option to object.

III. Use of cookies
10. Description and scope of the data processing
Our website uses cookies. Cookies are text files that are stored in the Internet browser itself or by the Internet browser to your computer system. When you access a website, a cookie may be stored to your operating system. This cookie contains a characteristic string which enables unmistakable identification of the browser when accessing the website again.
Furthermore, we use cookies on our website to enable the analysis of your surfing behavior.
• Search terms entered
• Frequency of site access
• Use of website functions
This allows the following data to be transmitted:
The following cookies are used in tandem with Google Universal Analytics:
• _ga (duration of 2 years)
• _gat (duration of 24 hours)
• _gid (duration of 24 hours)
The following cookies are used in conjunction with Facebook:
• fr (duration of 3 months)
The following cookies are used in conjunction with the Overlay app:
• appOverlayViewed (duration of 10 years)
The following cookies are used in conjunction with the Google Tag Manager:
• _dc_gtm_UA-39291455-4 (duration of 24 hours)
The following cookies are used in tandem with the cookie message:
• cookiesAccepted (duration of 1 year)
When you access our website, you are notified of the use of cookies for analysis purposes and your consent to the processing of personal data used in this context is obtained. This data privacy policy is also referenced in this context.
 

11. Legal basis for data processing
Processing personal data while using technically necessary cookies serves to protect the legitimate interests of our company.
Personal data is processed with the use of cookies for analysis purposes based on your previously granted consent.

12. Purpose of data processing
The purpose of using technically necessary cookies is to simplify the use of our website for you. Some functions of our Internet site may not be offered without the use of cookies. These functions require that the browser is recognized after a page change.
We require cookies for the following applications:
• Taking over language settings
• Bookmarking search terms
The data collected by technically necessary cookies is not used for the creation of user profiles.
Analysis cookies are uses for the purposes of improving the quality of our website and its contents. We learn how the website is used through analysis cookies and as a result are able to continually optimize our offers.
Our legitimate interests in the processing of personal data also lie within this context.

13. Duration of storage, objection and removal options
Cookies are stored to your computer and transmitted from it to our website. Therefore, as the user, you have full control over the use of cookies. You can deactivate or limit the transmission of cookies by making changes to the settings in your Internet browser. Cookies that are already stored may be erased at any time. This can be done automatically. If cookies are deactivated for our website, it is possible that all functions of the website will no longer be able to be used in their full scope.
IV. Registration
14. Description and scope of the data processing
On our Internet site, we offer you the option to register in a non-public area (extranet) when indicating your personal data. In this process, the data is entered in an input screen, transmitted to us and stored. The data is not forwarded to third parties. The following data is compiled as a part of the registration process:
• First name
• Last name
• Username
• Company
• User status (active/inactive)
• Status change: Notify user (checkbox)
• User group: Security group / extranet user
The following data is stored at the time of registration:
• Your IP address
• Date and time of registration
Registration happens through direct contact with Boneco. In doing so, you are giving your consent for the processing of this data.

15. Legal basis for data processing
The data is processed based on your previously granted consent.

16. Purpose of data processing
Your registration is required to keep certain content and services available on our website.

17. Duration of storage
The data is erased as soon as its collection is no longer required to accomplish these purposes.
This is the case for the data collected during the registration process if you have unregistered from our website or modified your registration.

18. Objection and removal option
You have the option to cancel registration at any time. You may amend the data you have stored at any time.
You may opt out of storage at any time by sending us an e-mail at the following e-mail address: Notify support@boneco.com.
V. Contact form and e-mail contact

19. Description and scope of the data processing
There is a contact form available on our website that may be used to contact us over the Internet. If you exercise this option, the data that you enter in the input screen will be transmitted to us and stored. This data is:
• Title
• First name
• Last name
• Comment field/message
• E-mail address
• Country
• Confirmation for the processing of the data (checkbox)
The following data is stored at the point in time that the message is submitted:
• Your IP address
• Date and time of submission
For processing the data as part of the submission process, your consent is obtained and you are referred to this data privacy policy.
As an alternative, we may be contacted using the provided e-mail address. In this case, the personal data that is transmitted with the e-mail is stored.
No data is forwarded to third parties in connection to this. The data is used exclusively for processing this conversation.

20. Legal basis for data processing
The data is processed based on your previously granted consent. The processing of data that is transmitted in the course of sending an e-mail may serve our legitimate interests or may serve the conclusion of a contract, which then forms the legal basis for the processing.

21. Purpose of data processing
We process personal data from the entry form solely for processing this conversation. When contacting us via e-mail, the required legitimate interests in processing the data also exist here.
Other personal data that is processed during the submission process is used for the purposes of preventing the misuse of the contact form and to ensure the security of our information technology systems.

22. Duration of storage
The data is erased as soon as its collection is no longer required to accomplish these purposes. For personal data from the input screen of the contact form and data which has been transmitted via e-mail, this is the case when the respective conversation with you is concluded. The conversation is considered to be concluded when, based on the circumstances, it can be ascertained that the issue concerned has finally been resolved.
The personal data that has been additionally collected during the submission process is erased after a period of seven days at the very latest.

23. Objection and removal option
You have the option to revoke your consent for the processing of the personal data at any time. You may opt out of the storage of your personal data at any time by contacting us via e-mail. In this case, the conversation cannot be continued.
You may opt out of storage at any time by sending us an e-mail at the following e-mail address: Notify support@boneco.com.
In this case, all personal data that has been stored in the course of the conversation is erased.

VI. Rights of the data subjects
If your personal data is processed, you are the data subject within the meaning of the valid data protection regulations. You have the following rights when dealing with our company:
Right of access
You may request information about whether personal data concerning you is processed by us.
If such processing is taking place, you may request information from us on the following:
• The purposes for which the personal data is processed;
• The categories of personal data that is processed;
• The recipients or the categories of recipients to whom the personal data concerning you has been disclosed or is still being disclosed;
• The planned period of storage of the personal data concerning you or, if actual information on this is not possible, the criteria for the definition of the storage period;
• The existence of a right for rectification or erasure of the personal data concerning you, a right of restriction of processing by us or a right to object to this processing;
• The existence of a right of appeal to a supervisory authority;
• All available information on the origin of the data, if the personal data has not been collected from you as the data subject;
• The existence of automated decision-making, including profiling, and meaningful information on the logic involved and on the scope and the intended effects of such processing for you as the data subject.
You have the right to request information on whether the personal data concerning you is transmitted to a non-EU country or to an international organization. In this context, you may request to be informed on appropriate guarantees in connection with the transmission.
Right to rectification
You have the right to rectification and/or completion of your data, insofar as the processed personal data concerning you is incorrect or incomplete. Rectification shall be carried out promptly.
Right to restriction of processing
You may request that the processing of personal data concerning you is restricted under the following conditions:
• If you dispute the correctness of the personal data concerning you;
• If the processing is unlawful and you oppose the erasure of personal data and request the restriction of the use of your personal data instead;
• If we no longer need the personal data for the purpose of the processing, but you require the data for asserting, enforcing or defending legal claims, or
• If you have opted out of processing and have not yet determined whether our company's legitimate grounds override yours.
If the processing of personal data concerning you has been restricted, this data—apart from the storage thereof—may be processed only with your consent or for asserting, enforcing or defending legal claims or for the protection of the rights of another natural or legal entity or for causes of an important public interest.
If the restriction of the processing in accordance with the above-mentioned conditions, you will be notified by us before the restriction is lifted.
Right to erasure
a) Erasure obligations
You may request that we erase the personal data concerning you immediately, and we are obliged to erase this data immediately if one of the following grounds for erasure applies:
• The personal data concerning you is no longer needed for the purposes for which it has been collected or otherwise processed;
• You revoke your consent on which the processing rests, and where there is no other legal ground for the processing;
• You lodge an objection to the processing and there are no overriding legitimate grounds for the processing;
• The personal data concerning you has been processed unlawfully;
• The erasure of the personal data that concerns you is required for the fulfillment of a legal obligation;
b) Information to third parties
If we have published the personal data in question and are obligated to the erasure of this data, we shall take measures, including those of a technical nature, appropriate under consideration of the available technology and costs of implementation, to notify third parties who process your personal data of the fact that you, as the involved person, have requested the erasure of all links to this personal data or of copies or replications of this data.
c) Exceptions
The right to erasure does not exist provided that the processing of this data is required
• For the exercise of the right to the freedom of expression and the freedom of information;
• For complying with a legal obligation requiring the processing of this data, or for exercising a duty that is in the public interest or occurs in execution of public authority;
• For reasons of public interest in the area of public health;
• For archival purposes in the public interest, for the purposes of scientific or historical research or statistical purposes, or
• For asserting, enforcing or defending legal claims.
Right of information
If you have asserted your right of correction, erasure or restriction of processing to us, we are obliged to communicate this correction or erasure of data or restriction of processing to all recipients to whom the personal data concerning you has been disclosed, unless this is shown to be impossible or to involve a disproportionate effort.
You also have the right to be notified of these recipients.
Right to data portability
You have the right to receive the personal data concerning you that you have provided to us in a structured, common and machine-readable format. Additionally, you may request from us that this data be transmitted to a third party, provided that
• The processing is based on consent or on a contract, and
• Processing is done using automated procedures.
The right of data portability shall not apply to the processing of personal data that is required for exercising a duty in the public interest or occurs in execution of public authority.
Right to object
You have the right to lodge an objection to the processing of the personal data concerning you.
We will then no longer continue to process personal data concerning you, unless the existence of compelling grounds for the processing that are worthy of protection and supersede your interests, rights and freedoms can be proved, or the processing is for asserting, enforcing or defending legal claims.
Right of withdrawal of your declaration of consent under data protection legislation
You have the right to withdraw your declaration of consent under data protection legislation at any time. The withdrawal does not affect the legality of processing that was based on consent and completed before the withdrawal.
Right of complaint to a supervisory authority
Irrespective of any other remedies of administrative law or judicial remedies, you are entitled to the right of complaint to a supervisory authority if you are of the opinion that the processing of the personal data concerning you violates valid data protection regulations.

VII. Name and address of the controller (party responsible for processing) and of the Data Protection Officer

The controller for the processing of your personal data is:
 

Boneco AG
Espenstrasse 85
9443 Widnau, Switzerland
Phone: 071 727 81 11
E-mail: support@boneco.com
Website: www.boneco.com

The Data Protection Officer of the controller is:
Mr. Hansruedi Lanker
Plaston Holding
Espenstrasse 85
9443 Widnau, Switzerland
Phone: 071 727 81 11
E-mail: Hansruedi.Lanker@plaston.com
Website: www.plastongroup.com
Effective as of July 2018