natelo
Legal

Privacy Policy

Version: 9 July 2024 · This is a translation for convenience; the German version is legally binding.

This privacy policy informs you about the nature, scope and purpose of the processing of personal data (hereinafter referred to as “data”) within our online offering and the websites, functions and content connected with it, as well as external online presences, such as our social media profile on. (hereinafter jointly referred to as “online offering”). With regard to the terms used, such as “personal data” or their “processing”, we refer to the definitions in Art. 4 of the General Data Protection Regulation (GDPR).

1. General information

In this privacy policy, we, natelo AG, describe what we do in our name (“natelo”, “Company”, “we” or “us”) with your data when you visit our websites www.natelo.ch or www.deinabo.ch (“Website/s”) and obtain the services offered there, interact with us, communicate with us, are in an employment or other contractual relationship with us, or otherwise deal with us. This is not an exhaustive description; where applicable, consents, general terms and conditions or similar documents govern specific matters.

In this privacy policy, “personal data” or “data” means all information relating to an identified or identifiable natural person. “Processing” comprises any handling of personal data, irrespective of the means and procedures used, in particular the retention, disclosure, procurement, erasure, storage, modification, destruction and use of personal data.

If you provide us with personal data of other persons (e.g. family members, employees, etc.), we assume that you are authorised to do so and that the data concerned are correct. If you pass on data about other persons to us, you confirm this. Please also ensure that these persons have been informed about this privacy policy.

2. Controller / representative

The “controller” for the data processing operations that we describe in this privacy policy is the Company, unless otherwise stated in the individual case. If you have any data protection concerns, you can communicate them to us at the following contact address:

  • Postal address: natelo AG, Emmenweidstrasse 58, 6020, Emmenbrücke
  • E-mail: hello@natelo.ch

3. Collection and processing of personal data

We primarily process the personal data that we receive directly from you in the context of our business or other legal relationship in your capacity as a customer, employee, reference or other person or business partner, or that we collect when you use our website and other applications or when you apply to us for a position.

We process various categories of data about you. The most important categories are the following:

  • Contract data: These are data that arise in connection with the conclusion of a contract and the performance of the contract, e.g. personal details such as name, date of birth and gender, photos, passport copies, IP address or information about contracts and the services to be provided or already provided, as well as data from the run-up to the conclusion of a contract, the information required or used for its performance.
  • Master data: These are the basic data that we require, in addition to the contract data, for the performance of our contractual and other business relationships or for marketing and advertising purposes. We process your master data if you are a customer or other business contact or because we wish to address you for our own purposes or for the purposes of a contractual partner. We receive master data from you yourself, from bodies for which you work, or from third parties, such as our contractual partners, distribution partners, associations, and from publicly accessible sources such as public registers or the internet (websites, social media, etc.).
  • Communication data: If you are in contact with us via the contact form, by e-mail, telephone or chat, by letter, public forums or any other means of communication, we record the data exchanged between you and us, including your contact details and the metadata of the communication. If we wish or need to establish your identity, e.g. in the case of a request for information made by you, we collect data in order to identify you. We generally retain these data for 36 months from the last exchange with you. This period may be longer where this is necessary for reasons of evidence or to comply with statutory or contractual requirements, or where it is technically required. E-mails in personal mailboxes, chats and written correspondence are generally retained for at least 10 years.
  • Technical data: When you visit our website or use our service, we collect the IP address of your terminal device and other technical data, such as the time of the respective user action, in order to ensure the functionality and security of these offerings. These data also include logs in which the use of our systems is recorded. We generally retain technical data for up to 2 months. In order to ensure the functionality of these offerings, we may also assign an individual code to you or your terminal device (e.g. in the form of a cookie, see section 8 in this regard). The technical data in themselves generally do not allow any conclusions to be drawn about your identity. In the context of registrations or the performance of contracts, however, they may be linked to other categories of data (and thus, where applicable, to your person).
  • Registration data for our newsletter and for advertising offers: If you wish to register on our website in order to receive our newsletters and/or advertising offers from us, we require your e-mail address as well as information that allows us to verify that you are the owner of the e-mail address provided and that you agree to receive the newsletter or the advertising offers. No further data are collected. We use these data exclusively for sending the requested information and do not pass them on to third parties.

For applicants:

  • Personal details: e.g. first name(s), surname, photo, professional career, education and training, degrees, other qualifications or skills, and other typical information from the curriculum vitae.
  • Communication data: If you are in contact with us via the contact form, by e-mail, telephone or chat, by letter, public forums or any other means of communication, we record the data exchanged between you and us, including your contact details and the metadata of the communication.
  • Obtaining references: This is done only with the consent of the applicant. If the applicant provides references in the application, we assume tacit consent.
  • Behavioural and preference data: Depending on the relationship we have with you, we try to better tailor our products and offerings to you. For this purpose, we collect and use data about your behaviour and your preferences. We do this by evaluating information about your behaviour in our domain, which can help us to personalise our future interaction with you. We may also supplement this information with information from third parties – including from publicly accessible sources. On this basis, we can, for example, calculate the likelihood that you will make use of certain services or behave in a certain way. Some of the data processed for this purpose are already known to us (e.g. when you make use of our services), or we obtain these data by recording your behaviour (e.g. how you navigate on our website or the documents you download). We anonymise or delete these data when they are no longer meaningful for the purposes pursued, which, depending on the nature of the data, may be the case after between 60 seconds and a few weeks (for movement profiles) or between 30 minutes and 14 months (for product and service preferences). This period may be longer where this is necessary for reasons of evidence or to comply with statutory or contractual requirements, or where it is technically required. We describe how tracking on our website works in section 8.
  • Other data: We also collect data from you in other situations. In connection with official or judicial proceedings, for example, data arise (files, evidence, etc.) that may also relate to you. We may also collect data for reasons of health protection (e.g. in the context of protection concepts). We may produce videos in which you may be recognisable (in particular through security cameras). We may also collect data about who enters certain buildings and when, or who has corresponding access rights.

4. Purposes of data processing and legal bases

We use the personal data we collect primarily in order to conclude and perform contracts with our customers and business partners, to fulfil our obligations as an employee and to comply with our legal obligations domestically and abroad.

In addition, where permitted and where it appears appropriate to us, we also process personal data of you and other persons for the following purposes, in which we (and at times also third parties) have a corresponding legitimate interest:

  • Provision, development and improvement of our services as well as of the website and any other platforms on which we are present;
  • Communication with you, in particular to respond to enquiries and the assertion of your rights, and to contact you in the event of queries;
  • Communication with third parties and processing of our or their enquiries;
  • Fulfilment of our compliance obligations;
  • Advertising and marketing (including the holding of events), provided that you have not objected to the use of your data for this purpose, market and opinion research, media monitoring;
  • Exercise of rights, assertion of legal claims and defence in connection with legal disputes and official proceedings;
  • Prevention and investigation of criminal offences and other misconduct (e.g. conducting internal investigations, data analyses to combat fraud);
  • Safeguarding of our operations, including the administration of our communication systems, our IT, our websites and any other platforms;
  • Video surveillance to safeguard domiciliary rights and other measures for IT, building and facility security and for the protection of our employees and other persons as well as of assets belonging to or entrusted to us (such as access controls, visitor lists, network and e-mail scanners);
  • Purchase and sale of business units, companies or parts of companies and other corporate transactions and the associated transfers of personal data, as well as measures for business management and for compliance with statutory and regulatory obligations and internal regulations of the Company.
  • Review of the application documents and of the suitability of an applicant;
  • Drafting of employment contracts and employment references and – at the request of the employee – providing references;
  • Payment of wages and social benefits;
  • the keeping of a personnel file;
  • Internal business communication, including reports on internal meetings and events.

Where you have given us consent to process your personal data for specific purposes, we process your personal data within the scope of and on the basis of this consent, insofar as we have no other legal basis and require one. Consent given may be withdrawn at any time, in particular at the address listed under section 2; however, this has no effect on data processing that has already taken place.

5. Profiling

“Profiling” refers to the automated processing of personal data of our customers that is carried out in order to analyse personal aspects or to make predictions, e.g. the analysis of personal interests, preferences and habits or the prediction of likely behaviour. Profiling can be used in particular to derive preference data

Through profiling, we evaluate certain of your personal characteristics in an automated manner for the purposes set out in section 4 on the basis of your data (section 3), in order to draw conclusions about your characteristics, preferences and likely behaviour, e.g. your affinity for certain products and services. For this purpose, we may also create profiles, i.e. we may combine behavioural and preference data, but also master and contract data and technical data assigned to you, in order to better understand you as a person with your various interests and other characteristics.

Profiling helps us, for example, to

  • arrange contracts for you more quickly and more precisely tailored to your needs;
  • present our content and offerings to you in line with your needs;
  • present you, as far as possible, only with advertising and offers that are likely to be relevant to you;
  • support you better in customer service.

6. Disclosure of data to third parties

In the course of our business activities and in accordance with the purposes of data processing pursuant to section 4, we may or must also transfer data to third parties (insofar as such a transfer is permitted and we consider it appropriate), either because third parties process these data for us or because they wish to use them for their own purposes. This concerns in particular the following categories of recipients (collectively the “Recipients”):

  • Telecommunications providers to whom we broker contracts;
  • Service providers domestically and abroad, such as IT providers (e.g. infrastructure providers) or support providers (e.g. call centres);
  • Accountants, auditors, lawyers and other external advisers of ours;
  • Legal and supervisory authorities, upon request or for the purpose of reporting an actual or suspected breach of applicable laws or regulations
  • domestic and foreign authorities, courts or other parties in potential or pending legal proceedings;
  • any relevant party for the purpose of preventing, investigating, detecting or prosecuting criminal offences or enforcing criminal sanctions, including the prevention of threats to public security;
  • Acquirers or parties interested in acquiring all or part of our business or our assets;
  • Other persons: This refers to other cases where the involvement of third parties results from the purposes pursuant to section 4.

When we disclose data to a Recipient, the Recipient is subject to binding contractual obligations (i) to process the data only in accordance with our prior instructions and (ii) to take measures to protect the confidentiality and security of the data, together with all other requirements under the applicable law.

7. Transfer of data abroad

Your data are located primarily on servers within the EU, but may also be processed abroad or accessed from abroad, in particular when we engage service providers for the performance of our services and for distribution and marketing. When third-party cookies are used (see section 8), data may likewise reach countries outside the EU. If a recipient is located in a country without adequate statutory data protection, we contractually oblige the recipient to comply with the applicable data protection (for this purpose, we use the current standard contractual clauses of the European Commission, which we adapt to Swiss law), insofar as the recipient is not already subject to a legally recognised set of rules to ensure data protection and we cannot rely on an exemption provision.

8. Cookies, tracking and other technologies in connection with the use of our website

On our websites www.natelo.ch and www.deinabo.ch, we use various techniques with which we and third parties engaged by us can recognise you during your use and, under certain circumstances, also track you across several visits.

In particular, we use cookies (“Cookies”). These are small text files that make it possible to store specific information relating to the user on the user’s terminal device while he or she uses the website. Cookies make it possible, in particular, to determine the frequency of use and the number of users of the pages, to analyse patterns of page use, but also to make our offering more customer-friendly.

Most of the cookies we use are so-called “session cookies”, which are automatically deleted at the end of your visit. Certain cookies remain stored beyond the end of a browser session and can be retrieved again on a subsequent visit to the site

  • Necessary cookies are necessary for the functioning of the website, the chat function and our services as a whole or for certain functions. If you block them, the website may not work. Other cookies are necessary so that the server can store decisions or entries you have made beyond a session (i.e. a visit to the website), if you use this function (e.g. selected language, consent given, the function for automatic login, etc.) These cookies remain stored even beyond your visit (so-called “permanent cookies”) and have an expiry date of up to 6 months.
  • Performance cookies serve to optimise our website and the related offerings and to better tailor them to the needs of users. These cookies analyse the use of our website. This is also done through the use of analytics services of third-party providers. Performance cookies likewise have an expiry date of up to 14 months

The provider of our website automatically collects and stores information in so-called server log files, which your browser automatically transmits to us. These are:

  • Browser type and browser version;
  • operating system used;
  • Referrer URL;
  • host name of the accessing computer;
  • time of the server request.

These data cannot be attributed to specific persons. These data are not merged with other data sources. However, we reserve the right to check these data retrospectively if we become aware of specific indications of unlawful use.

The website functions or is dependent on third parties. These third parties have the possibility of also collecting personal data from you. Again, in most cases the browser settings can be changed in order to protect yourself, should such collection be undesired. Furthermore, for performance cookies that are used for measuring success and reach or for advertising, a general objection (“opt-out”) is possible for numerous services via the AdChoices (Digital Advertising Alliance of Canada), the Network Advertising Initiative (NAI), YourAdChoices (Digital Advertising Alliance) or Your Online Choices (European Interactive Digital Advertising Alliance, EDAA).

9. Retention period of personal data

We process your data for as long as our processing purposes, the statutory retention periods and our legitimate interests in processing for documentation and evidence purposes require, or storage is technically necessary. Further information on the respective storage and processing periods can be found in each case under the individual data categories in section 3 or under the cookie categories in section 8. Unless legal or contractual obligations preclude this, we delete or anonymise your data after the storage or processing period has expired as part of our usual procedures.

10. Data security

We take appropriate security measures to maintain the confidentiality, integrity and availability of your personal data, to protect them against unauthorised or unlawful processing and to counter the risks of loss, unintentional alteration, unwanted disclosure or unauthorised access.

However, we are not responsible or liable for the security of your data during transmission via e-mail. Any such transmission is at your own risk, and you are yourself responsible for ensuring that all personal data that you send to us via e-mail are transmitted securely. We also oblige our processors to take appropriate security measures. However, security risks can generally not be completely ruled out; residual risks are unavoidable.

Cloudflare CDN

We use the Content Delivery Network of Cloudflare. The provider is Cloudflare, Inc. (“Cloudflare”), 101 Townsend St, San Francisco, CA 94107 USA.

Cloudflare offers a globally distributed Content Delivery Network. Technically, the transfer of information between your browser and our website is routed via the Cloudflare network. This enables us to increase the global accessibility and the performance of our website.

The use of Cloudflare CDN is based on our legitimate interest in providing our web offering as error-free and securely as possible (Art. 6(1)(f) GDPR).

The transfer of data to the USA is based on the standard contractual clauses of the EU Commission. Details can be found here: https://www.cloudflare.com/gdpr/introduction/.

Further information on Cloudflare CDN can be found here: https://support.cloudflare.com/hc/de.

Conclusion of a data processing agreement

In order to ensure processing in compliance with data protection law, we have concluded a data processing agreement with Cloudflare regarding the use of Cloudflare CDN.

Amazon Web Services (AWS)

For our website, we use Amazon Web Services (AWS), among other things a web hosting provider. The service provider is the American company Amazon Web Services, Inc., 410 Terry Avenue North, Seattle WA 98109, USA.

Amazon processes your data, among other places, in the USA as well. Amazon is an active participant in the EU-US Data Privacy Framework, which governs the correct and secure transfer of personal data of EU citizens to the USA. You can find more information on this at https://commission.europa.eu/document/fa09cbad-dd7d-4684-ae60-be03fcb0fddf_en

In addition, Amazon uses so-called standard contractual clauses (= Art. 46(2) and (3) GDPR). Standard contractual clauses (Standard Contractual Clauses - SCC) are templates provided by the EU Commission and are intended to ensure that your data comply with European data protection standards even when they are transferred to and stored in third countries (such as the USA). Through the EU-US Data Privacy Framework and the standard contractual clauses, Amazon undertakes to comply with the European level of data protection when processing your relevant data, even if the data are stored, processed and managed in the USA. These clauses are based on an implementing decision of the EU Commission.

You can find the Amazon data processing terms (AWS GDPR DATA PROCESSING), which correspond to the standard contractual clauses, at https://d1.awsstatic.com/legal/aws-gdpr/AWS_GDPR_DPA.pdf.

You can find out more about the data that are processed through the use of Amazon Web Services (AWS) in the privacy policy at https://aws.amazon.com/de/privacy/

11. E-commerce and payment providers

Processing of data (customer and contract data)

We collect, process and use personal data only insofar as they are necessary for the establishment, the definition of the content or the amendment of the legal relationship (inventory data). This is done on the basis of Art. 6(1)(b) GDPR, which permits the processing of data for the performance of a contract or of pre-contractual measures. We collect, process and use personal data about the use of this website (usage data) only insofar as this is necessary to enable the user to use the service or to bill for it.

The customer data collected are deleted after completion of the order or termination of the business relationship. Statutory retention periods remain unaffected.

Data transfer upon conclusion of a contract for online shops, retailers and shipment of goods

We transfer personal data to third parties only if this is necessary in the context of the performance of the contract, for example to the companies entrusted with the delivery of the goods or to the credit institution commissioned with payment processing. No further transfer of the data takes place, or only if you have expressly consented to the transfer. Your data are not passed on to third parties without express consent, for example for advertising purposes.

The basis for the data processing is Art. 6(1)(b) GDPR, which permits the processing of data for the performance of a contract or of pre-contractual measures.

Data transfer upon conclusion of a contract for services and digital content

We transfer personal data to third parties only if this is necessary in the context of the performance of the contract, for example to the credit institution commissioned with payment processing.

No further transfer of the data takes place, or only if you have expressly consented to the transfer. Your data are not passed on to third parties without express consent, for example for advertising purposes.

The basis for the data processing is Art. 6(1)(b) GDPR, which permits the processing of data for the performance of a contract or of pre-contractual measures.

Payment services

We integrate payment services of third-party companies on our website. When you make a purchase from us, your payment data (e.g. name, payment amount, bank details, credit card number) are processed by the payment service provider for the purpose of payment processing. The respective contractual and data protection provisions of the respective providers apply to these transactions. The payment service providers are used on the basis of Art. 6(1)(b) GDPR (performance of the contract) and in the interest of a payment process that is as smooth, convenient and secure as possible (Art. 6(1)(f) GDPR). Insofar as your consent is requested for certain actions, Art. 6(1)(a) GDPR is the legal basis of the data processing; consents may be withdrawn at any time with effect for the future.

We use the following payment services / payment service providers within the scope of this website:

Apple Pay

The provider of the payment service is Apple Inc., Infinite Loop, Cupertino, CA 95014, USA. You can find the Apple privacy policy at: https://www.apple.com/legal/privacy/de-ww/.

Saferpay

For payment processing, we use the payment service provider Saferpay, a payment service of Worldline Schweiz AG, headquartered in Zurich (“Worldline”).

Saferpay complies with the common security standards, in particular the Payment Card Industry Data Security Standard (PCI DSS). Your data are passed on exclusively for the purpose of payment processing. The processing and storage of your payment and personal data takes place directly via the payment service provider. As the operator, we do not receive any information about the (bank) account or credit card, but only information on the confirmation (acceptance) or rejection of the payment. Under certain circumstances, the data may be transmitted by the payment service providers to credit agencies. In this regard, we refer to the general terms and conditions and the privacy notices of the payment service providers.

The terms and conditions and the privacy notices of the respective payment service providers apply to the payment transactions. We likewise refer to these for further information and for the assertion of withdrawal, access and other data subject rights.

The legal basis for the processing of your personal data is the performance of a contract to which you are a party, or the implementation of pre-contractual measures.

Further information on data processing by Worldline can be found at: https://worldline.com/de-ch/compliancy/privacy

12. Your rights

To make it easier for you to control the processing of your personal data, you have the following rights in connection with our data processing:

  • The right to request information from us as to whether and which data we process about you;
  • the right to have us correct data if they are inaccurate;
  • the right to request the deletion of data;
  • the right to request that we hand over certain personal data in a common electronic format or transfer them to another controller; this applies only to data that you have disclosed to us and that we process automatically with your consent or for the conclusion or performance of a contract with you;
  • the right to withdraw consent insofar as our processing is based on your consent.

If you wish to exercise the rights mentioned, you can contact us at the address given in section 2. Exercising these rights generally requires that you can clearly prove your identity (e.g. by means of a copy of an identity document, where your identity is not otherwise evident or cannot be verified in any other way). If the exercise of certain rights entails costs for you, we will inform you of this in advance.

Please note that conditions, exceptions or restrictions apply to these rights under the applicable data protection law. We reserve the right to assert or enforce such conditions, exceptions or restrictions, e.g. to protect third parties or trade secrets, or if we are obliged to retain or process certain data or require the data to assert claims.

You also have the right to lodge a complaint with the competent data protection authority. The competent data protection authority in Switzerland is the Federal Data Protection and Information Commissioner (FDPIC, http://www.edoeb.admin.ch).

13. Amendments

We may amend this privacy policy at any time without unilateral prior notice. The privacy policy does not form part of the contract. The current version published on our website applies in each case.