Déclaration de protection des données
1. What is this Data Protection Notice about?
ACLARIS (hereinafter also “we“, “us“) obtains and processes personal data concerning you or other persons (so-called “third parties“). We use the term “data” here synonymously with “personal data” or “personal information“.
In this Data Protection Notice, we describe what we do with your data when you use our website, other local websites of ours or our apps (hereinafter collectively “Website“), purchase our services or products, are otherwise in contact with us under a contract, communicate with us or otherwise deal with us. Where appropriate, we will provide you with timely written notice of any additional processing activities not mentioned in this Data Protection No-tice. In addition, we may inform you separately about the processing of your data, e.g. in declarations of consent, contractual terms, additional data pro-tection notices, forms and notices. The rights mentioned in this Data Protection Notice may vary depending on the applicable data protection law. For any questions in your specific situation please feel free to contact us.
2. Who is responsible for processing your data?
ACLARIS GmbH, Lindau, Rebstein branch, CH-9445 Rebstein (hereinafter “ACLARIS“), is responsible under data protection law for the data pro-cessing by ACLARIS described in this Data Protection Notice, unless otherwise communicated in individual cases, e.g. in further Data Protection Notic-es, on forms or in contracts. However, unless otherwise communicated, this Data Protection Notice also applies to cases in which the controller is not ACLARIS GmbH, Lindau, Rebstein branch, but a group company of the ACLARIS Group. This is particularly the case where your data is processed by such a group company in connection with its own legal obligations or contracts or where you share data with such a group company. In these cases, this group company is the controller and only if you share your data with other group companies for their own purposes (see section7 ) will these other group companies also become controllers.
You can contact us as follows for your data protection concerns and to exercise your rights in accordance with section11:
ACLARIS GmbH, Lindau, Rebstein branch office, CH-9445 Rebstein
Phone: +41 71 7759 274
E-Mail:
We have created the following additional position:
Priverion GmbH
Data Protection Officer
Zugerstrasse 32
CH-6340 Baar
Phone: +41 43 883 3552
You can also contact this office for data protection concerns.
3. What data do we process?
We process various categories of data about you. The main categories are as follows:
• Communication data: If you are in contact with us via the contact form, by e-mail, telephone or chat, by letter or by other means of communica-tion, we collect the data exchanged between you and us, including your contact details and the marginal data of the communication. If we record or listen in on telephone conversations or video conferences, e.g. for training and quality assurance purposes, we will make you aware of this. Such recordings may only be made and used in accordance with our internal guidelines. You will be informed when such recordings take place, e.g. by a display during the relevant video conference. If you do not wish to be recorded, please let us know or end your participation. If you simp-ly do not wish your image to be recorded, please switch off your camera. If we want or need to establish your identity, e.g. if you request infor-mation, apply for media access, etc., we will collect data to identify you (e.g. a copy of an ID card). We store this data for the legally prescribed retention period, but at least if a contractual relationship with you exists or is in the process of being established.
• Master data: We define master data as the basic data that we require in addition to the contract data (see below) for the processing of our con-tractual and other business relationships or for marketing and advertising purposes, such as name, contact details and information, e.g. about your role and function, your bank account(s), your date of birth, customer history, powers of attorney, signature authorizations and declarations of consent. We process your master data if you are a customer or other business contact or work for one (e.g. as a contact person of the busi-ness partner), or because we want to contact you for our own purposes or the purposes of a contractual partner (e.g. as part of marketing and advertising, with invitations to events, with vouchers, with newsletters, etc.). We receive master data from directly from you (e.g. when you make a purchase or register), from bodies for which you work or from third parties such as our contractual partners, associations and address dealers and from publicly accessible sources such as public registers or the internet (websites, social media, etc.). We may also process health data and information about third parties as part of master data. We may also collect master data from our shareholders and investors. We retain this data for the legally prescribed retention period, but at least as long as a contractual relationship with you exists or is in the process of being es-tablished. This period may be longer if this is necessary for reasons of proof or to comply with legal or contractual requirements or for technical reasons. In the case of pure marketing and advertising contacts, the period is normally much shorter, usually no more than 2 years since the last contact.
The master data includes, for example, data such as name, address, e-mail address, telephone number and other contact details, gender, date of birth, nationali-ty, details of associated persons, websites, social media profiles, photos and videos, copies of ID cards; furthermore, details of your relationship with us (cus-tomer, supplier, visitor, service recipient, etc.), details of your status with us, classifications and distribution lists, details of our interactions with you (if applicable, a history of these with corresponding entries), reports (e.g. from the media), or official documents (e.g. extracts from the commercial register, authorizations, etc.) that relate to you. We collect payment details such as your bank details, account number and credit card details. Consent or blocking notices are also part of the master data, as is information about third parties, e.g. contact persons, recipients of services, advertising recipients or representatives.
For contact persons and representatives of our customers, suppliers and partners, we process master data such as name and address, information on role, function in the company, qualifications and, if applicable, information on superiors, employees and subordinates and information on interactions with these persons.
Master data is not collected comprehensively for all contacts. Which data we collect in detail depends in particular on the purpose of the processing.
• Contract data: This is data that arises in connection with the conclusion or processing of a contract, e.g. information about contracts and the services to be provided or provided, as well as data from the run-up to the conclusion of a contract, the information required or used for pro-cessing and information about reactions (e.g. complaints or information about satisfaction, etc.). This also includes health data and information about third parties, e.g. about hereditary diseases in the family. We generally collect this data from you, from contractual partners and from third parties involved in the execution of the contract, but also from third-party sources (e.g. providers of credit rating data) and from publicly acces-sible sources. As a rule, we store this data for 10 years from the last contractual activity, but at least from the end of the contract. This period may be longer if this is necessary for reasons of proof or to comply with legal or contractual requirements or for technical reasons.
Contract data includes information about the conclusion of the contract, about your contracts, e.g. type and date of conclusion of the contract, information from the application process (such as an application for our products or services) and information about the contract in question (e.g. its duration) and the pro-cessing and administration of the contracts (e.g. information in connection with invoicing, customer service, support with technical matters and the enforcement of contractual claims). Contract data also includes information on defects, complaints and adjustments to a contract, as well as information on customer satisfaction, which we can collect e.g. by means of surveys. Contract data also includes financial data such as information on creditworthiness (i.e. information that allows conclusions to be drawn about the likelihood of claims being settled), reminders and debt collection. We receive some of this data from you (e.g. when you make payments), but also from credit agencies and debt collection agencies and from publicly accessible sources (e.g. a commercial register).
Insofar as this is not inadmissible, we also obtain data from publicly accessible sources (e.g. debt collection registers, land registers, commercial reg-isters, media or the Internet including social media) or receive data from other companies within our group, from authorities and from other third parties (such as credit agencies, address dealers, associations, contractual partners, Internet analysis services, etc.).
4. For what purposes do we process your data?
We process your data for the purposes explained below. Further information for the online area can be found in sections 12 and13. These purposes and the underlying objectives represent legitimate interests on our part and, where applicable, on the part of third parties. You will find further information on the legal basis of our processing in section 5. 5.
We process your data for purposes related to communication with you, in particular to respond to inquiries and assert your rights (section 11) and to contact you in the event of queries. We use communication data and master data for this purpose and, in connection with offers and services used by you, also registration data. We retain this data to document our communication with you, for training purposes, for quality assurance and for follow-up questions.
More
This concerns all purposes in connection with which you and we communicate, whether in customer service or consulting, authentication in the event of use of the website or for training and quality assurance (e.g. in the area of customer service). We further process communication data so that we can contact you by e-mail and telephone, as well as messenger services, chat, social media, letter and fax. Communication with you usually takes place in connection with other processing purposes, e.g. so that we can provide services or respond to a request for information. Our data processing also serves as proof of communication and its content.
We process data for the establishment, administration and processing of contractual relationships
More
We conclude contracts of various kinds with our business and private customers, with suppliers, subcontractors or other contractual partners, such as partners in projects or with parties in legal disputes. In particular, we process master data, contract data and communication data and, depending on the circumstances, registration data of the customer or the persons to whom the customer provides a service. This includes, for example, the recipients of our products or services who receive vouchers and invita-tions from our customers and may become our customers when they redeem them. In this case, we process data for the purpose of processing the contract with these re-cipients, but also with the contractual partners who have invited them.
As part of the business initiation process, personal data – in particular master data, contract data and communication data – is collected from potential customers or other contractual partners (e.g. in an order form or contract) or results from communication. We also process data in connection with the conclusion of the contract to check cre-ditworthiness and to open the customer relationship. In some cases, this information is checked for compliance with legal requirements.
As part of the processing of contractual relationships, we process data for the administration of the customer relationship, for the provision and collection of contractual ser-vices (which also includes the involvement of third parties, such as logistics companies, security services, advertising service providers, banks, insurance companies or credit agencies, which may in turn provide us with data), for consulting and for customer support. The enforcement of legal claims arising from contracts (debt collection, le-gal proceedings, etc.) is also part of processing, as are accounting, termination of contracts and public communication.
We process data for marketing purposes and to maintain relationships, e.g. to send our customers and other contractual partners personalized advertising about our products and services and those of third parties (e.g. advertising contractual partners). This may take place, for example, in the form of newsletters and other regular contacts (electronically, by post, by telephone), via other channels for which we have contact information from you, but also as part of individual marketing campaigns (e.g. events, competitions, etc.) and may also include free services (e.g. invitations, vouchers, etc.). We use the so-called double opt-in procedure for newsletter registration. With the service provider Hubspot, which we use as our central CRM system, we regularly send information about our company to existing customers and new prospects who have already registered. You can find Hub-spot’s Data Protection Notice here: HubSpot Privacy Notice.
You can refuse such contacts at any time (see at the end of this section 4) or refuse or revoke your consent to be contacted for advertising purposes. With your consent, we can target our online advertising on the Internet more specifically to you (see section 12). Finally, we also want to enable our con-tractual partners to contact our customers and other contractual partners for advertising purposes (see section 7).
More
For example, with your consent, we will send you information, advertising and product offers from us and from third parties within and outside the Group (e.g. advertising contract partners), as printed matter, electronically or by telephone. For this purpose, we mainly process communication and registration data. Like most companies, we personalize communications so that we can provide you with individual information and offers that meet your needs and interests. To do this, we combine data that we pro-cess about you and determine preference data and use this data as the basis for personalization (see section 3). We also process data in connection with competitions, prize draws and similar events.
Relationship management also includes addressing existing customers and their contacts in a personalized manner – if necessary on the basis of behavioral and preference data. As part of relationship management, we may also operate a customer relationship management system (“CRM”), in which we store the data on customers, suppliers and other business partners necessary for the relationship management, e.g. about contact persons, relationship history (e.g. about products and services purchased or supplied, interactions, etc.), interests, wishes, marketing measures (newsletters, invitations to events, etc.) and other information.
All this processing is important for us not only to promote our offers as effectively as possible, but also to make our relationships with customers and other third parties more personal and positive, to focus on the most important relationships and to use our resources as efficiently as possible.
We continue to process your data for market research, to improve our services and operations and for product development.
More
We strive to continuously improve our products and services (including our website) and to be able to react quickly to changing needs. We therefore analyze, for example, how you navigate through our website or which products are used by which groups of people and in what way, and how new products and services can be designed (for fur-ther details, see section12 ). This gives us an indication of the market acceptance of existing products and services and the market potential of new products and services. In particular, we process master data, behavioral data and preference data, but also communication data and information from customer surveys, polls and studies and other information, e.g. from the media, social media, the Internet and other public sources. Where possible, we use pseudonymized or anonymized data for these purposes. We may also use media monitoring services or carry out media monitoring ourselves and process personal data in order to carry out media work or to understand and react to current developments and trends.
We use anonymized location data, for example, to make recommendations to our contractual partners on how to avoid peak times. With your consent, we use non-anonymized location data to inform you of interesting offers and products in the vicinity based on your position, to infer your interests from the location data (dwell time) and to inform you which products and services other contractual partners with similar interests have used.
We may also process your data for security purposes and for access control.
More
We continuously review and improve the appropriate security of our IT and other infrastructure (e.g. buildings). Like all companies, we cannot rule out data security breaches with absolute certainty, but we do what we can to reduce the risks. We therefore process data, for example, for monitoring, checking, analyzing and testing our networks and IT infrastructures, for system and error checks, for documentation purposes and as part of backup copies. Access controls include controlling access to electronic systems (e.g. logging in to user accounts) as well as physical access control (e.g. access to buildings). For security purposes (preventive and to investigate incidents), we also keep access logs and visitor lists and use surveillance systems (e.g. security cameras). We will inform you of surveillance systems at the relevant locations by means of appropri-ate signs.
We process personal data to comply with laws, instructions and recommendations from authorities and internal regulations (“compliance”).
More
More
This includes, for example, the implementation of health and safety concepts or the legally regulated fight against money laundering and the financing of terrorism. In certain cases, we may be obliged to make certain inquiries about customers (“Know Your Customer”) or to submit reports to authorities. The fulfillment of disclosure, information or reporting obligations, e.g. in connection with supervisory and tax obligations, also requires or entails data processing, e.g. the fulfillment of archiving obligations and the pre-vention, detection and clarification of criminal offenses and other violations. This also includes the receipt and processing of complaints and other reports, the monitoring of communications, internal investigations or the disclosure of documents to an authority if we have sufficient reason to do so or are legally obliged to do so. Your personal data may also be processed in the event of external investigations, e.g. by a law enforcement or supervisory authority or a commissioned private body. We also process data to support our shareholders and other investors and to fulfill our obligations in this regard. For all these purposes, we process your master data, your contract data and com-munication data, but possibly also behavioral data and data from the category of other data. The legal obligations may relate to Swiss law, but also to foreign regulations to which we are subject, as well as self-regulation, industry standards, our own corporate governance and official instructions and requests.
We also process data for the purposes of our risk management and as part of prudent corporate governance, including business organization and corporate development.
More
For these purposes, we process master data, contract data, registration data and technical data, but also behavioral and communication data. For example, we need to monitor our debtors and creditors as part of our financial management, and we need to avoid becoming a victim of crime and abuse, which may require the evaluation of data for corresponding patterns. We may also carry out profiling and create and process profiles for these purposes and to protect you and us from criminal or abusive activities (see also section 6). As part of the planning of our resources and organization of our operations, we must evaluate and process data on the use of our services and other of-fers or exchange information with others (e.g. outsourcing partners), which may also include your data. The same applies to services provided to us by third parties. As part of our corporate development, we may sell or acquire businesses, parts of businesses or companies to or from others or enter partnerships, which may also lead to the ex-change and processing of data (including from you, e.g. as a customer or supplier or as a supplier representative).
We may process your data for other purposes, e.g. as part of our internal processes and administration or for training and quality assurance purposes.
More
These other purposes include, for example, training and educational purposes, administrative purposes (such as the management of master data, accounting and data ar-chiving and the testing, management and ongoing improvement of IT infrastructure), the protection of our rights (e.g. to enforce claims in court, in or out of court and before authorities in Switzerland and abroad or to defend ourselves against claims, for example by preserving evidence, legal clarifications and participation in court or official pro-ceedings) and the evaluation and improvement of internal processes. We may use recordings of (video) conferences for training and quality assurance purposes. The protec-tion of other legitimate interests is also one of the other purposes, which cannot be listed exhaustively.
5. On what basis do we process your data?
If we ask for your consent for certain processing (e.g. for the processing of particularly sensitive personal data, for marketing mailings, for the creation of personalized movement profiles and for advertising control and behavior analysis on the website), we will inform you separately about the corre-sponding purposes of the processing. You can withdraw your consent any time with effect for the future by sending us written notification (by post) or, unless otherwise stated or agreed, by email; you can find our contact details in section 2. To withdraw your consent to online tracking, see section 12. If you have a user account, you may also be able to withdraw your consent or contact us via the website or other service in question. Once we have re-ceived notification of the withdrawal of your consent, we will no longer process your data for the purposes to which you originally consented, unless we have another legal basis for doing so. The withdrawal of your consent does not affect the lawfulness of processing based on consent before its with-drawal.
Where we do not ask for your consent for processing, we base the processing of your personal data on the fact that the processing is necessary for the initiation or execution of a contract with you (or the entity you represent) or that we or third parties have a legitimate interest in doing so, in par-ticular to pursue the purposes and associated objectives described above under section 4 and to be able to take appropriate measures. Our legitimate interests also include compliance with statutory provisions, insofar as this is not already recognized as a legal basis by the applicable data protection law (e.g. in the case of the GDPR, the law in the EEA and Switzerland). However, this also includes the marketing of our products and services, the in-terest in better understanding our markets and managing and further developing our company, including operations, securely and efficiently.
If we receive sensitive data (e.g. health data, information on political, religious or ideological views or biometric data for identification purposes), we may also process your data based on other legal grounds, e.g. in the event of disputes due to the necessity of processing for any legal proceedings or the enforcement of or defense against legal claims. In individual cases, other legal grounds may apply, which we will communicate to you separately if necessary.
6. Profiling and automated individual decision-making dung
We do not evaluate personal characteristics based on your data (section 3) in an automated form (“profiling”), nor do we use automated individual deci-sion-making processes in connection with personal data and, for example, using artificial intelligence.
More
An example of an automated individual decision is the automatic acceptance of an order by an online store. Pure if-then decisions are not meant (e.g. when the computer al-lows you to access your user account after checking your password), but discretionary decisions (e.g. the decision to conclude a contract). We will inform you on a case-by-case basis if an automated decision leads to negative legal consequences or a comparable significant impairment for you. If you do not agree with the result of such a deci-sion, you will be able to communicate with a human being who will review the decision.
7. To whom do we disclose your data?
In connection with our contracts, the website, our services and products, our legal obligations or otherwise to protect our legitimate interests and the other purposes listed in section 4, we also transfer your personal data to third parties, in particular to the following categories of recipients:
• Service providers: We work with service providers in Germany and abroad who process data about you on our behalf or under joint re-sponsibility with us or who receive data about you from us under their own responsibility (e.g. IT providers, mail order companies, adver-tising service providers, login service providers, cleaning companies, security companies, banks, insurance companies, debt collection agencies, credit agencies or address verifiers).
More
To enable us to provide our products and services efficiently and focus on our core competencies, we procure services from third parties in numerous areas. These services include IT services, the dispatch of information, marketing, sales, communication and printing services, building management, security and clean-ing, the organization and execution of events and receptions, debt collection, credit agencies, address verifiers (e.g. to update address databases when moving house), anti-fraud measures and services from consulting firms, lawyers, banks, insurers and telecommunications companies. We provide these service provid-ers with the data required for their services, which may also concern you. These service providers may also use such data for their own purposes, e.g. infor-mation on outstanding debts and your payment history in the case of credit agencies or anonymized information to improve services. In addition, we conclude con-tracts with these service providers that contain provisions for the protection of data, insofar as this does not arise from the law. Our service providers may also pro-cess data on how their services are used and other data generated in the course of using their services as independent controllers for their own legitimate interests (e.g. for statistical analysis or billing). Service providers provide information about their independent data processing in their own Data Protection Notices. You can find more information on how Microsoft processes data here: https://privacy.microsoft.com/de-de/privacystatement; for the use of Microsoft Teams in particular here https://docs.microsoft.com/de-de/microsoftteams/teams-privacy.
• Contractual partners including customers: This initially refers to customers (e.g. service recipients) and other contractual partners of ours, because this data transfer arises from these contracts. For example, you receive registration data for vouchers issued and redeemed, invita-tions, etc. If you work for such a contractual partner yourself, we may also transmit data about you to them in this context. This may also include health data. The recipients also include contractual partners with whom we cooperate or who advertise for us and to whom we therefore transmit data about you for analysis and marketing purposes (these may in turn be service recipients, but also sponsors and providers of online advertis-ing, for example). We require these partners to only send you advertising or display it based on your data if you have consented to this (for the online area, see section12 ). Our central cooperation partners are listed here ABOUT US – ACLARIS; our online advertising contract partners are listed in section12 .
More
If you act as an employee for a company with which we have concluded a contract, the processing of this contract may result in us informing the company, for ex-ample, how you have used our service. Cooperation and advertising contract partners receive selected master, contract, behavioral and preference data from us so that they can carry out non-personal evaluations in their area (e.g. about the number of our customers who have viewed their advertising) and also use data for advertising purposes (including targeting you). For example, advertising contract partners should be able to communicate with suitable other customers of ours and send them advertising.
• Public authorities: We may disclose personal data to offices, courts and other authorities in Switzerland and abroad if we are legally obliged or entitled to do so or if this appears necessary to protect our interests. This may also include health data. The authorities process data about you that they receive from us under their own responsibility.
More
Use cases include criminal investigations, police measures (e.g. health protection concepts, combating violence, etc.), regulatory requirements and investigations, legal proceedings, reporting obligations and pre- and extrajudicial proceedings as well as statutory information and cooperation obligations. Data may also be dis-closed if we wish to obtain information from public bodies, e.g. to justify an interest in obtaining information or because we need to say about whom we require in-formation (e.g. from a register).
• Other persons: This refers to other cases where the inclusion of third parties arises from the purposes set out in section 4, e.g. service recipi-ents, media and associations in which we participate or if you are part of one of our publications.
More
Other recipients are, for example, delivery recipients or third-party payment recipients other than those specified by you, other third parties also in the context of agency relationships (e.g. if we send your data to your lawyer or your bank) or persons involved in official or court proceedings. If we work with the media and send them material (e.g. photos), you may also be affected under certain circumstances. The same applies to the publication of content (e.g. photos, interviews, quotes, etc.) on our website or in other publications. As part of our corporate development, we may sell or acquire businesses, parts of businesses, assets or companies or enter into partnerships, which may also result in the disclosure of data (including your data, e.g. as a customer or supplier or as a supplier repre-sentative) to the persons involved in these transactions. In the course of communication with our competitors, industry organizations, associations and other bod-ies, data may also be exchanged that also concerns you.
All these categories of recipients may in turn involve third parties, so that your data may also become accessible to them. We can restrict the pro-cessing by certain third parties (e.g. IT providers), but not by other third parties (e.g. authorities, banks, etc.).
We reserve the right to disclose this data even if it concerns confidential data (unless we have expressly agreed with you that we will not disclose this data to certain third parties, unless we are legally obliged to do so). Irrespective of this, your data will continue to be subject to appropriate data protec-tion even after disclosure in Switzerland and the rest of Europe. The provisions of section 8 apply to disclosure to other countries. If you do not wish certain data to be disclosed, please let us know so that we can check whether and to what extent we can accommodate you (section 2).
More
In many cases, the disclosure of even secret data is necessary in order to execute contracts or provide other services. Confidentiality agreements do not generally exclude such data disclosures, nor do they exclude disclosure to service providers. However, depending on the sensitivity of the data and other circumstances, we ensure that these third parties handle the data appropriately. We cannot comply with your objection to the disclosure of data if the data disclosure in question is necessary for our activities.
We also enable certain third parties to collect personal data from you on our website and at our events (e.g. media photographers, providers of tools that we have integrated on our website, etc.). Insofar as we are not decisively involved in this data collection, these third parties are solely respon-sible for it. If you have any concerns and wish to assert your data protection rights, please contact these third parties directly. See section 12 for the website.
8. Is your personal data also sent abroad?
As explained in section 7, we also disclose data to other bodies. These are not only located in Switzerland. Your data may therefore be processed in Europe as well as in China, South Korea and the USA; in exceptional cases, however, in any country in the world.
In particular, our products CLARIS, CLAROSWISS and MINTEC are manufactured in the explicitly named markets and can be distributed via partners.
If a recipient is located in a country without adequate statutory data protection, we contractually oblige the recipient to comply with the applicable data protection (for this purpose we use the revised standard contractual clauses of the European Commission, which are available here: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj? ), unless the recipient is already subject to a legally recognized set of rules to ensure data protection and we cannot rely on an exception. An exception may apply in particular in the case of legal proceedings abroad, but also in cases of overriding public inter-ests or if the performance of a contract requires such disclosure, if you have given your consent or if the data in question has been made generally ac-cessible by you and you have not objected to its processing.
More
Many countries outside Switzerland, the EU and the EEA do not currently have laws that guarantee an adequate level of data protection from the perspective of the FADP or the GDPR. The contractual precautions mentioned above can partially compensate for this weaker or missing legal protection. However, contractual precautions cannot elim-inate all risks (from government access abroad). You should be aware of these residual risks, even if the risk may be low in individual cases and we take further measures (e.g. pseudonymization or anonymization) to minimize it.
Please also note that data exchanged via the Internet is often routed via third countries. Your data may therefore be sent abroad even if the sender and recipient are in the same country.
9. How long do we process your data?
We process your data for as long as required by our processing purposes, the statutory retention periods and our legitimate interests in processing for documentation and evidence purposes or for as long as storage is technically necessary. Further information on the respective storage and processing duration can be found in the individual data categories in section 3 or in the cookie categories in section 12. If there are no legal or contractual obliga-tions to the contrary, we will delete or anonymize your data after the storage or processing period has expired as part of our normal processes.
More
Documentation and evidence purposes include our interest in documenting processes, interactions and other facts in the event of legal claims, discrepancies, IT and infra-structure security purposes and proof of good corporate governance and compliance. Retention may be required for technical reasons if certain data cannot be separated from other data and we therefore need to retain it with this data (e.g. in the case of backups or document management systems).
10. How do we protect your data?
We take appropriate security measures to protect the confidentiality, integrity and availability of your personal data, to protect it against unauthorized or unlawful processing and to counteract the risks of loss, unintentional alteration, unwanted disclosure or unauthorized access.
More
Security measures of a technical and organizational nature may include, for example, measures such as the encryption and pseudonymization of data, logging, access re-strictions, the storage of backup copies, instructions to our employees, confidentiality agreements and controls. We protect your data transmitted via our website in transit us-ing suitable encryption mechanisms. However, we can only secure areas that we control. We also oblige our contract processors to take appropriate security measures. However, security risks cannot be completely ruled out; residual risks are unavoidable.
11. What rights do you have?
Under certain circumstances, the applicable data protection law grants you the right to object to the processing of your data, in particular for the purposes of direct marketing, profiling for direct advertising and other legitimate interests in processing.
To make it easier for you to control the processing of your personal data, you also have the following rights in connection with our data processing, de-pending on the applicable data protection law:
– The right to request information from us as to whether and which of your data we process;
– the right to have us correct or complete data if it is incorrect, or incomplete and in certain circumstances the right to restrict data processing;
– the right to request the deletion of data;
– the right to obtain from us the personal data concerning you in a commonly used electronic format or to transmit those data to another controller;
– the right withdraw consent where our processing is based on your consent;
– the right to receive, on request, further information necessary for the exercise of these rights;
– the right to express your point of view on automated individual decisions (point 6 ) and to request that the decision be reviewed by a natural person.
If you wish to exercise the above rights against us (or against one of our group companies), please contact us in writing, at our premises or, unless otherwise stated or agreed, by e-mail; our contact details can be found in section 2. So that we can rule out misuse, we must identify you (e.g. with a copy of your ID card, if this is not otherwise possible).
You also have these rights vis-à-vis other entities that work with us on their own responsibility – please contact them directly if you wish to exercise rights in connection with their processing. You can find details of our key cooperation partners and service providers in section 7 and further information in section 12.
Please note that these rights are subject to conditions, exceptions or restrictions under the applicable data protection law (e.g. to protect third parties or business secrets). We will inform you accordingly if necessary.
More
In particular, we may need to further process and store your personal data in order to fulfill a contract with you, to protect our own legitimate interests, such as the assertion, exercise or defense of legal claims, or to comply with legal obligations. To the extent permitted by law, in particular to protect the rights and freedoms of other data subjects and to safeguard legitimate interests, we may therefore refuse a data subject’s request in whole or in part (e.g. by redacting certain content relating to third parties or our business secrets).
If you do not agree with our handling of your rights or data protection, please let us or our data protection officer (section 2) know. If you are located in the EU, the EEA, the United Kingdom or Switzerland, you also have the right to complain to the data protection supervisory authority in your country. A list of authorities in the EU, the EEA can be found here: https://edpb.europa.eu/about-edpb/board/members_de. You can contact the UK supervisory au-thority here: https://ico.org.uk/global/contact-us/. You can contact the Swiss supervisory authority here: https://www.edoeb.admin.ch/edoeb/de/home/deredoeb/kontakt.html.
12. Do we use online tracking and online advertising techniques?
We use various technologies on our website with which we and third parties engaged by us can recognize you when you use our website and, under cer-tain circumstances track you over several visits. We will inform you about this in this section.
In essence, we want to be able to distinguish between access by you (via your system) and access by other users so that we can ensure the function-ality of the website and carry out evaluations and personalization. We do not want to infer your identity, even if we can, insofar as we or third parties en-gaged by us can identify you by combining this with registration data. Even without registration data, however, the technologies used are designed in such a way that you are recognized as an individual visitor each time you visit the site, for example by our server (or the servers of third parties) assigning you or your browser a specific identification number (so-called “cookie”).
More
Cookies are individual codes (e.g. a serial number) that our server or a server of our service provider or advertising contract partner transmits to your system when you con-nect to our website and that your system (browser, mobile) receives and stores until the programmed expiry date. Each time you access our website again; your system transmits these codes to our server or the server of the third party. This allows you to be recognized, even if your identity is unknown.
Other techniques can also be used to recognize you with a greater or lesser degree of probability (i.e. to distinguish you from other users), e.g. “fingerprinting”. Fingerprint-ing combines your IP address, the browser you are using, the screen resolution, language selection and other information that your system communicates to each server, resulting in a more or less unique fingerprint. In this way, cookies can be dispensed with.
Whenever you access a server (e.g. when using a website or an app or because an image is visibly or invisibly integrated in an email), your visits can therefore be “tracked”. If we integrate offers from a contractual advertising partner or provider of an analysis tool on our website, this partner can track you in the same way, even if you cannot be identified in individual cases.
We use such techniques on our website and allow certain third parties to do the same. However, depending on the purpose of these techniques, we may ask for your consent before using them. You can access your current settings in our cookie banner. You can program your browser to block or deceive certain cookies or alternative technologies or delete existing cookies. You can also add software to your browser that blocks tracking by certain third parties. You can find more information about this on the help pages of your browser (usually under the heading “Data protection”) or on the websites of the third parties listed below.
A distinction is made between the following cookies (technologies with comparable functions such as fingerprinting are also included here):
– Necessary cookies: Some cookies are necessary for the functioning of the website as such or for certain functions. They ensure, for example, that you can switch between pages without losing information entered in a form. They also ensure that you remain logged in. These cookies are only temporary (“session cookies”). If you block them, the website may not work. Other cookies are necessary so that the server can save deci-sions or entries made by you beyond a session (i.e. a visit to the website) if you use this function (e.g. selected language, consent given, the func-tion for automatic log-in, etc.). These cookies have an expiry date of up to 24 months.
– Performance cookies: In order to optimize our website and corresponding offers and to better tailor them to the needs of users, we use cookies to record and analyze the use of our website, possibly even beyond the session. We do this by using third-party analysis services. We have listed these below. Before we such cookies, we ask for your consent. You can revoke this at any time via the cookie settings in the cookie banner. Per-formance cookies also have an expiry date of up to 24 months. Details can be found on the websites of the third-party providers.
– Marketing cookies: We and our advertising contract partners have an interest in targeting advertising precisely, i.e. only displaying it to those we want to address. We have listed our advertising contract partners below. For this purpose, we and our advertising contract partners – if you con-sent – also use cookies with which the content accessed, or contracts concluded can be recorded. This enables us and our advertising contract partners to display advertising that we can assume is of interest to you on our website, but also on other websites that display advertising from us or our advertising contract partners. Depending on the situation, these cookies have an expiry date of a few days to 2 months (Google Analytics). If you consent to the use of these cookies, you will be shown appropriate advertising. If you do not consent to these cookies, you will not see less advertising, but simply any other advertising.
We may also integrate other third-party offers on our website, from social media providers. These offers are deactivated by default. As soon as you acti-vate them (e.g. by clicking a button), the relevant providers can determine that you are on our website. If you have an account with the social media pro-vider, they can assign this information to you and thus track your use of online services. These social media providers process this data on their own responsibility.
We currently use offers from the following service providers and advertising contract partners (insofar as they use data from you, or cookies set by you for advertising purposes):
– Google Analytics: Google Ireland (based in Ireland) is the provider of the “Google Analytics” service and acts as our processor. Google Ireland relies on Google LLC (based in the USA) as its processor (both “Google“). Google uses performance cookies (see above) to track the behavior of visitors to our website (duration, frequency of pages accessed, geographical origin of access, etc.) and compiles reports for us on the use of our website on this basis. We have configured the service so that the IP addresses of visitors are truncated by Google in Europe before being for-warded to the USA and therefore cannot be traced. We have switched off the “Data sharing” and “Signals” settings. Although we can assume that the information we share with Google is not personal data for Google, it is possible that Google can use this data for its own purposes to conclu-sions about the identity of visitors, create personal profiles and link this data to the Google accounts of these persons. If you agree to the use of Google Analytics, you explicitly consent to such processing, which also includes the transfer of personal data (usage data for the website and app, device information and individual IDs) to the USA and other countries. Information on Google Analytics data protection can be found here: How we use data from websites or apps on or in which our services are used – Privacy Notice & Terms of Use – Google.
– Google Tag Manager: Google Ireland Limited (based in Ireland) is the provider of the tag management system “Google Tag Manager” and acts as our processor. Google Tag Manager is used to integrate tags that enable us to track activities on our website. Tags are small pieces of code that collect certain data about user behavior, such as the length of time spent on the site or interactions with certain content. These tags can be integrated by other tools and script codes, allowing us to control when a particular tag is triggered. The data collected primarily includes aggre-gated information about the triggering of the tags, which is collected using technologies such as cookies and pixels that are placed in the user’s browser. This data is used to analyze and understand user behavior in order to improve the user experience. The data is mainly processed in the European Union, but the data collected may also be transferred to other countries such as Singapore, Taiwan, Chile and the United States of America. These countries may offer a lower level of data protection than the European Union. Further details on security measures and data pro-tection can be found in the provider’s Data Protection Notice. The recipients of the data collected are Alphabet Inc, Google LLC and Google Ire-land Limited. Further information on Google’s data protection is available at Privacy Notice – Privacy Notice & Terms of Use – Google and on the cookie policy at How Google uses cookies – Privacy Notice & Terms of Use – Google.
– HupSpot: HupSpot Inc. (based in the USA) ist he provider of the HubSpot software, which we use to cover various aspects of online marketing and customer management. HupSpot uses cookies and other tracking technologies to analyze user behaviout on our website and to optimize our marketing efforts. The data collected may include IP address, geographic location, browser type, duration of session, and page viewed. The col-lected data is stored on HupSpot server. The use of HupSpot is based exclusively on user consent (Art. 6 (1)(a) GDPR), which is obtained through the corresponding cookie banner. This consent can be withdrawn at any time. The collected data may also be transferred to the USA. HupSpot is certified under the EU-U.S. Data Privacy Framework, ensuring an adequate level of data protection when transferring personal data to the USA. For more information about data protection practices of HupSpot please visit Privacy Notice – HupSpot.
– Dealfront: Liidio Oy / Dealfront Group GmbH (based in Germany) is provider of Dealfront (formerly Leadfeeder), which we use to analyze user behavior on our website. Dealfront processes visitor IP adresses in a pseudonymized form in order to identify companie that have visited our website. Only company-related data is processed – personal data is neither fully collected nor stored. The use of Dealfront is based exclusively on user consent, which is obtained through the corresponding cookie banner upon visiting our website (Art. 6(1)(a) GDPR). For more information about data protection, please visit Privacy Notice – Dealfront.
13. What data do we process on our pages in social networks?
We may operate pages and other online presences (“fan pages”, “channels”, “profiles”, etc.) on social networks and other platforms operated by third parties and collect the data about you described in section 3 and below. We receive this data from you and the platforms when you meet us via our online presence (e.g. when you communicate with us, comment on our content or visit our presence). At the same time, the platforms evaluate your use of our online presence and link this data with other data about you had known to the platforms (e.g. about your behavior and preferences). They also process this data for their own purposes under their own responsibility, for marketing and market research purposes (e.g. to personalize advertising) and to control their platforms (e.g. what content they show you).
More
We receive data about you when you communicate with us via online presences or view our content on the relevant platforms, visit our online presences or are active on them (e.g. publish content, make comments). These platforms also collect technical data, registration data, communication data, behavioral data and preference data from you or about you (for the terms, see section3 ). These platforms regularly statistically evaluate the way in which you interact with us, how you use our online presences, our content or other parts of the platform (what you view, comment on, “like”, share, etc.) and link this data with other information about you (e.g. information on age and gender and other demographic information). In this way, they also create profiles about you and statistics on the use of our online presences. They use this data and profiles to show you our or other advertising and other content on the platform in a personalized way and to control the behavior of the platform, but also for market and user research and to provide us and with information about you and the use of our online presence. We can partially control the evaluations that these platforms create regarding the use of our online presence.
We process this data for the purposes described in section 4, in particular for communication, marketing purposes (including advertising on these plat-forms, see section 12) and market research. You will find information on the relevant legal bases in section 5. We may redistribute content published by you (e.g. comments on an announcement) ourselves (e.g. in our advertising on the platform or elsewhere). We or the operators of the platforms may also delete or restrict content from or about you in accordance with the usage guidelines (e.g. inappropriate comments).
For further information on the processing carried out by the platform operators, please refer to the platforms’ Data Protection Notices. There you can also find out in which countries they your data, what rights of access, erasure and other rights of data subjects you have and how you can exercise these or obtain further information. We currently use the following platforms:
– Facebook: Here we operate the page Aclaris GmbH | Rebstein | Facebook. The responsible body for the operation of the platform for users from Europe is Facebook Ireland Ltd, Dublin, Ireland. Their Data Protection Notice is available at www.facebook.com/policy. Some of your data will be transferred to the USA. You can object to advertising here: www.facebook.com/settings?tab= ads. We are jointly responsible with Facebook Ire-land Ltd, Dublin, Ireland, for the data that is collected and processed when you visit our site for the creation of “Page Insights”. As part of Page In-sights, statistics are compiled about what visitors do on our page (comment on posts, forward content, etc.). This is described at www.facebook.com/legal/terms/information_about_page_insights_data. It helps us to understand how our site is used and how we can improve it. We only receive anonymous, aggregated data. We have regulated our responsibilities regarding data protection in accordance with the information on www.facebook.com/legal/terms/page_controller_addendum.
– You can find our LinkedIn company page here: ACLARIS GmbH | LinkedIn. With our LinkedIn posts and messages about our products and ser-vices, you can get in touch with us as a contact person and business contact, but also as a private individual and interested party. We do not use any targeted advertising services from LinkedIn. You can find LinkedIn’s Data Protection Notice, and information on how the social media platform handles your data here: LinkedIn Privacy Notice.
14. Can this Data Protection Notice be changed?
This Data Protection Notice is not part of a contract with you. We may amend this Data Protection Notice at any time. The version published on this web-site is the current version.
Last update: 23.04.2025
