Privacy Policy

STARTUPS.CH AG (hereinafter also referred to as “we” or “us”) collects and processes personal data relating to you or to other persons (so-called “third parties”).

We use the term “data” here synonymously with “personal data”.

In this Data Privacy Policy, we describe what we do with your data when you use www.startups.ch, www.transparenzregister-eintrag.ch, other websites operated by us or our apps (hereinafter collectively referred to as the “Website”), purchase our services or products, otherwise have dealings with us in connection with a contract, communicate with us or otherwise interact with us.

The STARTUPS.CH Ltd. Neuwiesenstrasse 15, 8400 Winterthur (the "[company]") is responsible for the data processing described in this Data Privacy Policy, unless otherwise communicated in individual cases.

You can contact us for your data privacy concerns and to exercise your rights in accordance with para. 11 you can reach us as follows:

By postSTARTUPS.CH AG

Postfach8401 Winterthur

Schweiz

or

via e-mail to : info@startups.ch

We process various categories of data about you. The most important categories are as follows:

Technical data: When you use our Website or other electronic services, we collect the IP address of your device and other technical data in order to ensure the functionality and security of these services.

This data also includes logs recording the use of our systems. We generally retain technical data for 6 months. To ensure the functionality of these services, we may also assign an individual code to you or your device.

Technical data alone generally does not allow conclusions to be drawn about your identity. However, in connection with user accounts, registrations, access controls or the performance of contracts, it may be linked to other categories of data and thus, where applicable, to you personally.

Registration data: Certain offers and services may only be used with a user account or registration, which may take place directly with us or via our external login service providers.

In this context, you must provide us with certain data, and we collect data about your use of the relevant offer or service.

We generally retain registration data for 12 months after the end of the use of the service or the closure of the user account.

Communication data: If you contact us via a contact form, by email, telephone, letter or other means of communication, we record the data exchanged between you and us, including your contact details and communication metadata.

If we wish or are required to verify your identity, we collect data for identification purposes (e.g. a copy of an identity document). We generally retain this data for 12 months from our last interaction with you.

This period may be longer where this is required for evidentiary purposes, to comply with legal or contractual requirements, or for technical reasons. Emails in personal mailboxes and written correspondence are generally retained for at least 10 years.

Master data: Master data refers to the basic information that we require, in addition to contractual data (see below), for the management of our contractual and other business relationships or for marketing and advertising purposes, such as your name, contact details and information about, for example, your role and function, bank account details, date of birth or customer history.

We process your master data if you are a customer or another business contact, if you work for such a person or organisation (e.g. as a contact person for a business partner), or because we wish to contact you for our own purposes or those of a contractual partner (e.g. for marketing and advertising purposes).

We obtain master data from you directly (e.g. when you make a purchase or register), from organisations for which you work, from third parties such as our contractual partners, associations and address brokers, and from publicly accessible sources such as public registers or the internet (websites, etc.).

We generally retain this data for 10 years from our last interaction with you, but at least for 10 years from the end of the contract. This period may be longer where required for evidentiary purposes, to comply with legal or contractual requirements, or for technical reasons. For contacts used solely for marketing and advertising purposes, the retention period is normally considerably shorter, usually no more than 2 years from the last contact.

Contractual data: This is data generated in connection with the conclusion or performance of a contract, e.g. information about contracts and services to be provided or already provided, as well as data from the period preceding the conclusion of a contract, information required or used for its performance, and information about responses.

We generally collect this data from you, from contractual partners and from third parties involved in the performance of the contract, but also from third-party sources (e.g. providers of creditworthiness data) and publicly accessible sources.

We generally retain this data for 10 years from the last contractual activity, but at least for 10 years from the end of the contract. This period may be longer where required for evidentiary purposes, to comply with legal or contractual requirements, or for technical reasons.

You provide many of the types of data referred to in this Section 3 yourself (e.g. through forms, when communicating with us, in connection with contracts or when using the Website). Subject to individual cases, you are not obliged to do so.

If you wish to enter into contracts with us or use our services, you must also provide us, as part of your contractual obligations under the relevant contract, with certain data, in particular master data, contractual data and registration data. When using our Website, the processing of technical data is unavoidable.

To the extent permitted, we also obtain data from publicly accessible sources or receive data from authorities and other third parties.

Data relating to the Transparency Register: If you instruct us to submit a notification to the Swiss Transparency Register, we process the data required for the relevant notification concerning the legal entity subject to the reporting obligation, its ownership and control structures, and its beneficial owners.

This includes, in particular, information identifying the beneficial owners, such as surname and first name, date of birth, nationality or nationalities, residence or place of residence and country of residence, as well as information on the nature and extent of any direct or indirect participation or other form of control. Depending on the specific ownership and control structures, we may also process information on direct and indirect participations, intermediary legal entities, fiduciary holdings, nominee arrangements, voting agreements, joint control and other circumstances relevant to determining the beneficial owners.

We also process information concerning the legal entity subject to the reporting obligation, its governing body members and representatives that is required to carry out and document the notification, as well as information about the processing and notification status, the required authorisations and the handling of the procedure via EasyGov.

We obtain this data in particular from the customer, the legal entity subject to the reporting obligation, its governing body members or authorised representatives and, where necessary and permissible, from publicly accessible registers and other publicly accessible sources.

The personal data we process may also relate to persons who are neither our customers nor our contractual partners, in particular shareholders, partners, members of governing bodies and beneficial owners.

We retain this data for as long as necessary to perform and document the commissioned service, to comply with statutory retention and documentation obligations, and to establish, exercise or defend legal claims. Thereafter, the data is deleted or anonymised as part of our usual processes, unless statutory or other permissible grounds require further retention.

Audio, bot and interaction data: If you interact with us via telephone bots, voice assistants, chatbots, digital advisory assistants, video communication or comparable systems, we process in particular your spoken or written inputs, conversation and chat content, audio recordings, transcripts, conversation logs, interaction metadata (e.g. date, time, duration, channel, language and technical identifiers), any transfers to employees, and resulting processing and support information.

Such data may include personal data that you actively provide to us, including information about yourself, your company, your business formation project or other concerns.

We retain this data only for as long as necessary for the stated purposes, in particular to process your request, for documentation, quality assurance, training, error analysis, abuse and security prevention, preservation of evidence and compliance with legal obligations.

We process your data for the purposes explained below. These purposes and the underlying objectives constitute legitimate interests of ours and, where applicable, of third parties.

We process your data for purposes related to communication with you, in particular to respond to enquiries, to enable you to exercise your rights and to contact you if we have follow-up questions.

For this purpose, we use in particular communication data and master data and, in connection with offers and services used by you, also registration data. We retain this data to document our communication with you, for training purposes, for quality assurance and for follow-up enquiries.

We also process data, among other things, for the initiation, administration and performance of contractual relationships, for marketing purposes and relationship management, market research, improvement of our services and operations, product development, compliance with laws, instructions and recommendations from authorities and internal regulations (compliance), and for other purposes, e.g. in connection with our internal processes and administration.

We also process your data to provide and improve our digital communication and advisory services, including telephone bots, chatbots and other AI-assisted systems.

This includes in particular:

• receiving and processing enquiries;
• identifying your request and routing it appropriately;
• documenting advisory and support processes;
• creating, storing and analysing conversation logs and transcripts;
• quality assurance and training;
• error analysis and improvement of our services, processes and systems;
• ensuring security, preventing misuse and preserving evidence;
• complying with legal obligations and establishing, exercising or defending legal claims.

In connection with services relating to the Swiss Transparency Register, we process personal data in particular for the following purposes:

• receiving and processing the instruction;
• collecting and processing the information required for the notification concerning the legal entity subject to the reporting obligation and its beneficial owners;
• preparing and submitting the notification to the Transparency Register;
• applying for, setting up and managing the authorisations and links required for the notification via EasyGov;
• communicating with the customer, the legal entity subject to the reporting obligation, its governing body members and the competent authorities and bodies;
• clarifying follow-up questions and requesting additional information and documents;
• documenting the performance and completion of the commissioned notification;
• complying with legal obligations and official orders; and
• establishing, exercising or defending legal claims.

The processing may also concern personal data of persons who are not themselves our customers or contractual partners, in particular shareholders, partners, members of governing bodies and beneficial owners.

Where we ask for your consent for certain processing activities, we inform you separately about the relevant purposes of the processing. You may withdraw your consent at any time with effect for the future by written notification by post or, unless otherwise stated or agreed, by email; our contact details can be found in Section 2.

For the withdrawal of your consent in relation to online tracking, please refer to Section 12. Where you have a user account, withdrawal of consent or contact with us may, where applicable, also be carried out via the relevant Website or other service.

Once we receive notification that you have withdrawn your consent, we will no longer process your data for the purposes to which you originally consented, unless we have another legal basis for doing so.

The withdrawal of your consent does not affect the lawfulness of processing carried out on the basis of your consent prior to its withdrawal.

Where we do not ask for your consent for processing, we base the processing of your personal data on the fact that it is necessary to enter into or perform a contract with you (or the entity you represent), or that we or third parties have a legitimate interest in the processing, in particular in pursuing the purposes and associated objectives described above in Section 4 and in implementing corresponding measures.

Our legitimate interests also include compliance with statutory provisions, insofar as such compliance is not already recognised as a legal basis under the applicable data protection law.

Other legal grounds may apply in individual cases, which we will communicate to you separately where required.

Where, in the context of our services, we process personal data of persons who are not themselves our contractual partners, in particular shareholders, partners, members of governing bodies or beneficial owners, the processing is carried out in particular for the performance of the contract concluded with our customer or the legal entity represented by the customer, as well as on the basis of our legitimate interests and the legitimate interests of the relevant legal entity in the proper performance of the commissioned service and compliance with the associated legal obligations.

Where statutory obligations apply directly to us, we also process personal data in order to comply with those obligations.

We obtain the consent of the data subject where a specific processing activity requires such consent and no other legal basis for the processing exists.

We may add certain of your personal attributes to those listed in para. 4 using your data for the purposes set out in section 4. 3) ("profiling"), if we want to determine preference data , but also to determine abuse and security risks, to carry out statistical evaluations or for operational plan-ning purposes.

For the same purposes, we can also create profiles, i.e. we can combine behav-ioural and preference data, but also master and contract data and technical data assigned to you, in order to better understand you as a person with your different interests and other characteristics.

In connection with our contracts, the Website, our services and products, our legal obligations or otherwise to safeguard our legitimate interests and the other purposes set out in Section 4, we also disclose your personal data to third parties, in particular to the following categories of recipients:

Service providers: We work with service providers in Switzerland and abroad that process data about you on our behalf or jointly with us, or that receive data about you from us under their own responsibility. These may include, in particular, providers of hosting, cloud, CRM, support, analytics, telephony, speech-to-text, transcription, AI and communication services. Where we use external providers to supply AI-assisted services, speech processing, transcription or comparable technical services, such providers may access personal data on our behalf to the extent necessary to provide the relevant services.

Authorities and registers: We may disclose personal data to public authorities, courts, registers and other authorities in Switzerland and abroad where we are legally obliged or authorised to do so, where this is necessary to provide a service ordered by you, or where this appears necessary to safeguard our legitimate interests.

In connection with services relating to the Swiss Transparency Register, we disclose the personal data required to carry out the notification in particular to EasyGov or the entities responsible for its operation, the Swiss Transparency Register, the authority responsible for maintaining the register and, where applicable, other authorities and bodies responsible for the notification procedure.

The relevant authorities and bodies may process the personal data disclosed to them within the scope of their statutory duties under their own responsibility under data protection law. As a general rule, we have no influence over the further processing of data by authorities and registers.

Contractual partners, including customers: This primarily refers to our customers (e.g. recipients of services) and other contractual partners, where the disclosure of data arises from these contracts.

If you work for such a contractual partner, we may also disclose data about you to that contractual partner in this context. Recipients also include contractual partners with whom we cooperate.

Other persons: This refers to other cases in which the involvement of third parties results from the purposes set out in Section 4.

All of these categories of recipients may themselves involve third parties, meaning that your data may also become accessible to such third parties.

We can restrict processing by certain third parties (e.g. IT providers), but not by others (e.g. authorities, banks, etc.).

Personal data of third parties: If a customer provides us with personal data relating to other persons, in particular shareholders, partners, members of governing bodies or beneficial owners, we assume that the customer is authorised to disclose this data to us and that the information is accurate and up to date.

Where required, the customer is obliged to inform the persons concerned about the disclosure of their personal data to us, the purposes of the processing and this Privacy Policy. This applies in particular where the person concerned has no direct contact with us.

As described in para. 7 we also disclose data to other bodies. These are not only located in Swit-zerland. Your data may therefore be processed in Europe and in other countries.

If a recipient is located in a country without adequate legal data protection, we contractually oblige the recipient to comply with the applicable data protection (for this purpose, we use the revised standard contractual clauses of the European Commission, which can be accessed here: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj? ), insofar as it is not already subject to a legally recognised set of rules to ensure data protection and we cannot rely on an exemption provision. An exception may apply in particular in the case of legal proceedings abroad, but also in cases of overriding public interests or if the performance of a contract requires such disclosure, if you have consented or if it is a matter of data that you have made generally accessible and you have not objected to its processing.

Please also note that data exchanged via the internet is often routed via third countries. Your data can therefore end up abroad even if the sender and recipient are in the same country.

Facebook may use this information for the purpose of advertising, market research and demand-oriented design of the Facebook pages. For this purpose, Facebook creates usage, interest and relationship profiles, e.g. to evaluate your use of our website with regard to the advertisements displayed on Facebook, to inform other Facebook users about your activities on our website and to provide other services associated with the use of Facebook.

You can find further information on this in the Facebook privacy policy at https://www.facebook.com/about/privacy/.

If you do not want Facebook to be able to assign visits to our pages to your Facebook user account, please log out of your Facebook user account before using our website.

We process your data for as long as our processing purposes, the legal saving periods and our legitimate interests in processing for documentation and evidence purposes require or saving is technically necessary.

Further information on the respective retention and processing duration can be found under the individual data categories in section 3. 3 or for the cookie categories in para. 12.

If there are no legal or contractual obligations to the contrary, we will delete or anonymise your data after the saving or processing period has expired as part of our normal processes.

Chat logs, audio recordings, transcripts and other bot and interaction data are generally retained only as long as this is necessary for processing your request, documentation, quality assurance, training, error analysis, prevention of misuse, preservation of evidence and compliance with legal obligations.

We take reasonable security measures to maintain the confidentiality, integrity and availability of your personal data, to protect it against unauthorised or unlawful processing and to protect against the risks of loss, accidental alteration, unauthorised disclosure or access. You can find this information at: http://www.linkedin.com/legal/privacy-policy.

To make it easier for you to control the processing of your personal data, depending on the applicable data protection law you may also have the following rights in connection with our data processing:

• the right to request information from us as to whether and what data we process about you;
• the right to have us correct data if it is inaccurate;
• the right to request the deletion of data;
• the right to request that we provide certain personal data in a commonly used electronic format or transfer it to another controller;
• the right to withdraw consent where our processing is based on your consent;
• the right to obtain, upon request, further information necessary to exercise these rights;
• the right, in the case of automated individual decisions (Section 6), to express your point of view and request that the decision be reviewed by a natural person.

If you wish to exercise the above rights against us, please contact us in writing, at our premises or, unless otherwise stated or agreed, by email; our contact details can be found in Section 2. To prevent misuse, we must verify your identity (e.g. by means of a copy of an identity document where this cannot be done otherwise).

Please note that these rights may be subject to requirements, exceptions or restrictions under applicable data protection law (e.g. to protect third parties or trade secrets). Where applicable, we will inform you accordingly.

If you disagree with how we handle your rights or data protection, please let us know (Section 2). In particular, if you are located in the EEA, the United Kingdom or Switzerland, you also have the right to lodge a complaint with the data protection supervisory authority in your country. A list of authorities in the EEA can be found here: https://edpb.europa.eu/about-edpb/board/members_de.

The supervisory authority in the United Kingdom can be contacted here: https://ico.org.uk/global/contact-us/. The Swiss supervisory authority can be contacted here: https://www.edoeb.admin.ch/edoeb/de/home/der-edoeb/kontakt/adresse.html.

Subject to the relevant statutory requirements, these rights also apply to persons whose personal data we process in connection with services for our customers even though those persons are not themselves our customers or contractual partners. This may include, in particular, shareholders, partners, members of governing bodies and beneficial owners.

We use various technologies on our website that enable us and third parties we have engaged to recognise you when you use our website and, in some circumstances, to track you across multiple visits. We inform you about this in this section.

In essence, this is so that we can distinguish accesses by you (via your system) from accesses by other users, so that we can ensure the functionality of the website and carry out evaluations and personalisation. In doing so, we do not want to infer your identity, even if we can do so insofar as we or third parties engaged by us can identify you through a combination with registration data. Even without registration data, however, the technologies used are designed in such a way that you are recognised as an individual visitor each time you access the site, for example by our server (or the servers of the third parties) assigning you or your browser a specific identification number (so-called "cookie").

We use such techniques on our website and allow certain third parties to do so as well. You can program your browser to block, deceive or delete existing cookies from certain cookies or alternative techniques. You can also enhance your browser with software that blocks tracking by certain third parties. You can find more information about this on the help pages of your browser (usually under the keyword "data protection") or on the websites of the third parties that we list below.

A distinction is made between the following cookies (techniques with comparable functions such as fingerprinting are included here):

Necessary cookies: Some cookies are necessary for the website to function as such or for certain functions. For example, they ensure that you can switch between pages without losing information entered in a form. They also ensure that you remain logged in. These cookies are only temporary ("session cookies"). If you block them, the website may not work. Other cookies are necessary so that the server can save decisions or entries made by you beyond one session (i.e. one visit to the website) if you use this function (e.g. language selected, consent given, the func-tion for automatic login etc.). These cookies have an expiry date of up to 24 months.

Performance cookies: In order to optimise our website and corresponding offers and to better adapt them to the needs of users, we use cookies to record and analyse the use of our website, possibly even beyond the session. We do this through the use of third-party analytics services. We have listed these below. Performance cookies also have an expiry date of up to 24 months. Details can be found on the websites of the third-party providers.

Marketing cookies: We and our advertising partners have an interest in targeting advertising, i.e. displaying it only to those we want to target. We have listed our advertising partners below. For this purpose, we and our advertising partners also use cookies - if you consent - which can be used to record the content accessed or contracts concluded. This allows us and our advertising partners to display advertisements that we think you may be interested in on our website, but also on other websites that display advertisements from us or our advertising partners. These cookies have an expiry date of between a few days and 12 months depending on the situation. If you consent to the use of these cookies, you will be shown appropriate advertising. If you do not consent to these cookies, you will not see less advertising, but simply any other advertising.

In addition to marketing cookies, we use other techniques to control online advertising on other websites and thereby reduce wastage. For example, we can transmit the email addresses of our users, customers and other persons to whom we want to display advertising to the operators of advertising platforms (e.g. social media). If these persons are registered there with the same e-mail address (which the advertising platforms determine through a comparison), the operators show the advertising placed by us to these persons in a targeted manner. The operators do not receive personal e-mail addresses of persons who are not already known. In the case of known email addresses, however, they learn that these persons are in contact with us and which content they have accessed.

We may also integrate further third-party offers on our website, in particular from social media providers. These offers are deactivated by default. As soon as you activate them (e.g. by clicking a button), the corresponding providers can determine that you are on our website. If you have an account with the social media provider, they can assign this information to you and thus track your use of online offers. These social media providers process this data on their own responsibility.

We currently use offers from the following service providers and advertising contract partners (insofar as they use data from you or cookies set on your computer for advertising purposes):

Google Analytics: Google Ireland (based in Ireland) is the provider of the "Google Analytics" service and acts as our order processor. Google Ireland relies on Google LLC (based in the USA) as its order processor (both "Google"). Google uses performance cookies (see above) to track the behaviour of visitors to our website (duration, frequency of pages viewed, geographical origin of access, etc.) and compiles reports for us on the use of our website on this basis. We have config-ured the service in such a way that the IP addresses of visitors are shortened by Google in Europe before being forwarded to the USA and thus cannot be traced. We have switched off the "Data sharing" and "Signals" settings. Although we can assume that the information we share with Google is not personal data for Google, it is possible that Google can draw conclusions about the identity of visitors from this data for its own purposes, create personal profiles and link this data to the Google accounts of these individuals. If you consent to the use of Google Analytics, you explicitly agree to such processing, which also includes the transfer of personal data (in particular usage data for the website and app, device information and individual IDs) to the USA and other countries. Information on the data protection of Google Analytics can be found here [https://support.google.com/analytics/answer/6004245] and if you have a Google account, you can find further details on processing by Google here [https://policies.google.com/technologies/partner-sites?hl=de].

Google AdSense: Our website uses Google AdSense, an advertising integration service provided by Google Inc ("Google"). For this ad integration service, Google AdSense uses "cookies", which are text files placed on your computer, to help the website analyse how users use the site. In addition, Google AdSense also uses web beacons (invisible graphics). Based on the web beacons, information such as visitor traffic on websites can be evaluated. Cookies and web beacons are used to generate information about the use of our website, including your IP address. The delivery of advertising formats is then transmitted to a Google server in the USA and stored there, as with Google Analytics. The stored information may then be passed on by Google to their contractual partners. Nevertheless, the information collected by Google about your IP address will not be merged with other data stored by you. If this collection of information based on your visit to our site is not in your interest, you can prevent the storage or installation of cookies by selecting the appropriate settings in your browser software. At the same time, we would like to inform you that in this case you will not be able to use all the functions of this website to their full extent. By using this website, you consent to the processing of data about you by Google in the manner and for the purposes set out above.

X: Plug-ins of the short message network X Inc., 795 Folsom St., Suite 600, San Francisco, CA 94107, USA are integrated on our website. You can recognise the X plug-ins (Tweet button) by the X logo on our site. You can find an overview of the Tweet button at https://dev.X.com/. When you call up a page of our website that contains such a plug-in, a direct connection is established between your browser and the X server. X thereby receives the information that you have visited our site with your IP address. If you click the "Tweet button" while you are logged into your X account, you can link the content of our pages on your X profile. This enables X to associate the visit to our pages with your user account. We would like to point out that we, as the provider of the pages, have no knowledge of the content of the transmitted data or its use by X. You can find more information on this in X's privacy policy. If you do not want X to be able to associate your visit to our pages, please log out of your X user account.

Linkedin: Plug-ins of the social network LinkedIn of LinkedIn Corporation, 2029 Stierlin Court, Mountain View, CA 94043, USA (hereinafter "LinkedIn") are integrated on our website. You can recognise the LinkedIn plug-ins by the LinkedIn logo or the "Recommend" button on our site. When you visit our pages, a direct connection is established between your browser and the LinkedIn server via the plug-in. LinkedIn thereby receives the information that you have visited our site with your IP address. If you click the LinkedIn "Recommend Button" while logged into your LinkedIn account, you can link the content of our pages on your LinkedIn profile. This enables LinkedIn to assign the visit to our pages to your user account. We would like to point out that we, as the provider of the pages, have no knowledge of the content of the transmitted data or its use by LinkedIn. Details on data collection (purpose, scope, further processing, use) as well as your rights and setting options can be found in LinkedIn's privacy policy. You can find this information at: http://www.linkedin.com/legal/privacy-policy..

Instagram: So-called social plug-ins from Instagram, which is operated by Instagram LLC, 1601 Willow Road, Menlo Park, CA 94025, USA ("Instagram"), are used on our website. The plug-ins are marked with an Instagram logo, for example in the form of an "Instagram camera". You can find an overview of the Instagram plug-ins and their appearance here: http://blog.instagram.com/post/36222022872/introducing-instagram-badges. When you call up a page of our website that contains such a plug-in, your browser establishes a direct connec-tion to the servers of Instagram. The content of the plug-in is transmitted by Instagram directly to your browser and integrated into the page. Through this integration, Instagram receives the in-formation that your browser has called up the corresponding page of our website, even if you do not have an Instagram profile or are not currently logged in to Instagram. This information (in-cluding your IP address) is transmitted by your browser directly to an Instagram server in the USA and stored there. If you are logged in to Instagram, Instagram can directly assign your visit to our website to your Instagram account. If you interact with the plug-ins, for example by clicking the "Instagram" button, this information is also transmitted directly to an Instagram server and stored there. The information is also published on your Instagram account and displayed there to your contacts. For the purpose and scope of the data collection and the further processing and use of the data by Instagram, as well as your rights in this regard and setting options for protecting your privacy, please refer to Instagram's privacy policy: https://help.instagram.com/155833707900388/. If you do not want Instagram to directly assign the data collected via our website to your Instagram account, you must log out of Instagram be-fore visiting our website. You can also completely prevent the loading of Instagram plug-ins with add-ons for your browser, e.g. with the script blocker "NoScript" (http://noscript.net/).

Facebook: Plugins of the social network Facebook, 1601 South California Avenue, Palo Alto, CA 94304, USA are integrated on our pages. You can recognise these by the Facebook logo or the "Like" button on our site. You can find an overview of possible Facebook plugins at the following link: http://developers.facebook.com/docs/plugins/. Due to these Facebook plugins (Like button), a direct connection is established between your browser and the Facebook server if you visit our pages. Through your visit, Facebook receives information that you have visited our pages with your IP address. If you click on the Facebook "Like" button on our pages while you are logged into your Facebook account, the content of our pages will be linked to your Facebook profile. Consequently, Facebook can associate your visit to our site with your user account. We, as the service provider, point out that we, as the website provider, have no knowledge of the content of the transmitted data or its use by Facebook. Therefore, we refer to the following link to obtain further information regarding Facebook's privacy policy: http://de-de.facebook.com/policy.php. If you do not want Facebook to associate your visit to our website with your Facebook user account, we ask you to log out of your Facebook user account when you visit our website.

Pinterest: We use the pinterest.com service on our website. Pinterest.com is a service of Pinterest, Inc., 808 Brannan St, San Francisco, CA 94103, USA. Through the integrated "Pin it" button on our site, Pinterest receives the information that you have accessed the corresponding page of our website. If you are logged in to Pinterest, Pinterest can assign this visit to our site to your Pinterest account and thus link the data. The data transmitted by clicking the "Pin it" button is stored by Pinterest. For more information on the purpose and scope of data collection, its processing and use, as well as your rights in this regard and setting options for protecting your privacy, please refer to the Pinterest privacy policy, which you can access at http://pinterest.com/about/privacy/. To prevent Pinterest from associating your visit to our website with your Pinterest account, you must log out of your Pinterest account before visiting our website.

YouTube: Our Internet pages contain at least one plug-in from YouTube, which belongs to Google Inc. San Bruno, CA 94066 USA. As soon as you visit a page of our website that is equipped with a YouTube plug-in, a connection to the YouTube servers is established. In the process, the YouTube server is informed which particular page of our website you have visited. If, on top of this, you are logged into your YouTube account, you would enable YouTube to assign your surfing behaviour directly to your personal profile. You can negate this possibility of association if you log out of your account beforehand. For further information on the collection and use of your data by YouTube, please refer to the information on data protection at http://www.youtube.com/t/privacy.

On our website and via other communication channels, we use chatbots, voice bots as well as other automated and AI-supported assistance systems in order to process inquiries quickly and efficiently.

If you use such systems, the content you enter or speak as well as the technical and organisational metadata associated with the use are processed. This may in particular include chat messages, audio inputs, conversation recordings, transcripts, conversation logs, time information, channel information, technical usage data as well as information that you provide to us within the interaction.

The processing takes place in particular for the following purposes:

• processing and answering your inquiries;
• provision of information and support regarding our services;
• forwarding your request to responsible employees or departments;
• documentation of communication and advisory processes;
• quality assurance and training;
• error analysis, prevention of misuse and security incidents;
• improvement of our services, processes and systems;
• assertion, enforcement or defence of legal claims;
• compliance with legal obligations.

Conversation and chat contents, recordings, transcripts and logs may be viewed, evaluated or – in the case of telephone and voice channels – listened to subsequently by authorised employees and commissioned service providers, insofar as this is necessary for the stated purposes.

To the extent that we use external service providers for hosting, telephony, speech recognition, transcription, analytics or AI functionalities, they may process personal data on our behalf. We contractually ensure that such service providers process personal data only within the scope of our instructions and in compliance with the applicable data protection law.

To the extent that we use content to improve our systems, workflows or AI-supported functionalities, this is done only within the framework of the applicable legal provisions and this privacy policy. If further consent is required for this, we obtain it separately.
The use of our bots is voluntary. If you do not wish to interact with such systems, you may contact us – where available – via alternative contact channels.

We share your information with our partners (third parties) in order to offer you the best possible service. Where we work with banks, the data transfer allows conclusions to be drawn about a potential banking relationship. Partner banks can also send us a message to confirm the successful conclusion of a new banking relationship.

You release the relevant bank(s) from the obligation to maintain bank-client confidentiality and data protection to this extent.

If we forward data to external service providers, technical and organizational measures are taken to ensure that the forwarding is carried out in accordance with the legal provisions of data protection.

If you voluntarily provide us with personal or company-related data, we will not use, process or forward this data beyond the scope permitted by law or specified by you in a declaration of consent.

Beyond that, we only pass on your data to external service providers if this is necessary for the execution of the contract and if they have agreed to the corresponding confidentiality and due diligence provisions. Beyond that, we only pass on your data if we are legally obliged to do so by official or court orders.

This Data Privacy Policy does not form part of any contract with you. We may amend this privacy policy at any time.

The version published on this website is the current version.

This privacy policy is not part of any contract with you. We may amend this privacy policy at any time. The version published on this website is the current version.

Last update: September 7, 2026