This Data Protection and Privacy Policy Statement (“STATEMENT”) describes the collection and further processing of personal data by companies of Uster Technologies AG, Sonnenbergstrasse 10, CH-8610 Uster, Switzerland, and its affiliates (together “USTER”) as far as they are not covered by other data protection policies or are evident from the circumstances or are provided for by applicable law. The term “personal data” shall include all information relating to an identified or identifiable person.

If you provide USTER with personal data of other persons, please make sure that they have seen this STATEMENT, and provide their personal data to USTER only if you are allowed to do so pursuant to applicable data protection law.

1.    CONTROLLER, DATA PROTECTION OFFICER
Every website (including online shops and mini sites for special offers), every presence on social media, multimedia portals or chatbots, every mobile application and every desktop application of USTER (each a “FRONT-END SOFTWARE”) has a controller within USTER with respect to collecting personal data according to the EU General Data Protection Regulation (GDPR) (or comparable provisions according to applicable data protection laws). Unless provided otherwise on the FRONT-END SOFTWARE (according to the imprint, the terms of use, etc.), USTER is the controller.
The respective subsidiary or affiliate is the controller in case USTER communicates through other means of communication (email, letter, telephone, in person, etc.) and the communication does not fall within an activity for which USTER has appointed a specific controller within this STATEMENT or otherwise.

Should an USTER company or affiliate disclose personal data to another USTER company or affiliate for certain purposes of the receiving company or affiliate, such company or affiliate is the controller according to Article 4 (7) GDPR.

USTER has not appointed a data protection officer according to Article 37 GDPR. Any inquiry, claim or concern regarding data protection at USTER (all companies and affiliates) can be addressed to the following Contact Address: compliance@uster.com.

2.    PROCESSING OF PERSONAL DATA
USTER collects and processes personal data of the following persons:
•    Users of at least one FRONT-END SOFTWARE registered with USTER; 
•    Individuals purchasing and receiving/benefitting from products and services of USTER; 
•    Potential or actual parties interested in products and services of USTER; 
•    Recipients of newsletters of USTER; 
•    Participants in research campaigns and opinion surveys conducted by USTER; and
•    Participants in courses, seminars and other training organized by USTER;

(together “CUSTOMERS”).

The personal data of CUSTOMERS (“CUSTOMER DATA”) are generally collected directly during the course of installing or using the FRONT-END SOFTWARE, in stores or at events of USTER or USTER retailers, during direct communication via e-mail, telephone, during editing of an individual account, or in any other way. However, personal data can also be collected indirectly, in particular through further acquisition of supplementary information from third party data sources (e.g., social media or address brokers).

In particular, the following categories of personal data are processed by USTER:

• Personal data and contact information including but not limited to first and last name, address, residence, telephone number, e-mail address, date of birth, gender, pictures, etc.;
• Data pertaining to orders and purchases including but not limited to payment information, credit card details and other payment details, billing and shipping address, products and services ordered and purchased, information connected to queries, complaints and disagreements relating to products and services or respective contracts entered into such as warranty claims, rescissions and disputes, information regarding CUSTOMERS blacklisted by USTER, etc.;
• Data in connection with product and services marketing including but not limited to information such as newsletter opt-ins and opt-outs, documents received, invitations to and participations at events and special activities (as far as they are not part of a CUSTOMER PROGRAM), personal preferences and interests, etc.;
• Data concerning the use of the FRONT-END SOFTWARE including but not limited to the IP address and other identification (e.g., user name of social media, MAC address of smartphones or computers, cookies), date and time of FRONT-END SOFTWARE visits, visited sites and contents, referring websites, etc.; and
• Data in connection with communication such as preferred means of communication, correspondence and communication with USTER (including records of the communication), etc.;

(together “CUSTOMER DATA”).

In addition, USTER collects:

• Data of users of the FRONT-END SOFTWARE who do not register with USTER (“VISITOR”) but may constitute personal data (“VISITOR DATA”) for example with social media; the provisions of this policy regarding data collected from a CUSTOMER in connection with the use of the FRONT-END SOFTWARE shall apply accordingly even though the identification of a VISITOR usually is not possible for USTER; and
• Information pertaining to employees and contacts of their dealers, suppliers and further business partners (hereinafter natural persons shall be referred to as “PARTNERS”, their data as “PARTNER DATA”) such as contact details, information regarding their function, information relating to the previous contact with these individuals, data regarding marketing activities (e.g., receipt of newsletters), information regarding business transactions, requests, offers, tenders, conditions and contracts, information related to professional or other interests of the individuals.
• Within the framework of their business relationship, CUSTOMERS will be required to provide CUSTOMER DATA necessary for the establishment and execution of the contractual relationship and the fulfilment of the associated contractual obligations or required by law. Without these data, USTER will generally not be able to conclude or execute the contract with the respective CUSTOMER. This also applies analogously to the PARTNER DATA as far as business relations with the dealers, suppliers and business partners of USTER are concerned; in principle, these cannot be concluded and processed without information on their employees and other contacts. As any access to the FRONT-END SOFTWARE is logged, connection data (such as the IP address) will always be logged; this is done automatically during use and cannot be deactivated for individual VISITORS or CUSTOMERS.

3.    PURPOSE OF THE PROCESSING AND LEGAL BASIS
In accordance with applicable law, USTER may process CUSTOMER DATA in particular for, but not limited to, the following purposes:

• In connection with goods and services offered, conclusions of contracts (in particular purchases), executions of contracts (in particular purchase contracts and contracts regarding the participation at customer programs and events), maintenance and development of customer relations, communication, promotions, advertisement and marketing (including newsletters and mailing of promotional materials), customer service, technical consultancy, support, sales, installation and maintenance;
• Management of the users of the FRONT-END SOFTWARE and other activities in which CUSTOMERS participate, operation and enhancement of the FRONT-END SOFTWARE (including the provision of functions which require identifiers or other personal data) and further IT systems, identity verifications;
• Protection of CUSTOMERS, employees and other individuals and protection of data, secrets and assets of and entrusted to USTER, safety of systems and premises of USTER;
• Compliance with legal and regulatory requirements and internal rules of USTER, enforcement and exploitation of legal rights and claims, defense against legal claims, litigation, complaints, combating abusive conduct, engaging in legal investigations and proceedings and responding to inquiries of public authorities;
• Sale or acquisitions of business divisions, companies or parts of companies and other corporate transactions and the transfer of CUSTOMER DATA associated therewith; and
• Other purposes as far as a legal obligation requires processing and such processing was evident from the circumstances or indicated at the time of the collection;

(together the “PURPOSE OF CUSTOMER DATA PROCESSING”).

USTER uses the CUSTOMER DATA for the PURPOSE OF CUSTOMER DATA PROCESSING based on the following legal grounds:
•    Performance of contracts;
•    Compliance with legal obligations of USTER;
•    Consent of the customer;
•    Legitimate interests of USTER, including but not limited to:

• Purchase and shipment of products and services, also in connection with individuals who are not direct contractual partners (such as e.g., individuals receiving a gift);
• Carrying out advertisement and marketing activities;
• Efficient and effective customer support, maintenance of contact and other communication with CUSTOMERS outside of the processing of contracts;
• Understanding customer behavior, activities, concerns and needs, market studies;
• Efficient and effective improvement of existing products and services and development of new products and services;
• Efficient and effective protection of customers, employees and other individuals as well as protection of data, secrets and assets of or entrusted to USTER, safety of systems and premises of USTER;
• Maintenance and secure, efficient and effective organization of business operations including a secure, efficient and effective operation and successful further development of the FRONT-END SOFTWARE and other IT systems;
• Reasonable corporate governance and development;
• Successful sale and acquisition of business units, companies or parts of companies and other corporate transactions;
• Compliance with legal and regulatory requirements and internal rules of USTER; and
• Concerns regarding the prevention of fraud, offences and crimes as well as investigation in connection with such offences and other improper conduct, handling of claims and actions against USTER, cooperation in legal proceedings and with public authorities as well as the prosecution, exercise of and defense against legal actions.

In accordance with applicable data protection laws, USTER may process VISITOR DATA in particular for the purpose of maintaining and developing the FRONT-END SOFTWARE (including the provision of functions which require identifiers or other personal data), for statistical analysis regarding the use of the FRONT-END SOFTWARE as well as for combating abusive conduct, for purposes of legal investigations or proceedings and for the response to inquiries of public authorities. The VISITOR DATA shall be processed in accordance with the principles set out for CUSTOMER DATA above.

In accordance with applicable data protection laws, USTER may process PARTNER DATA in particular for the purpose of entering into and performance of contracts and other business relationships with PARTNERS, promotions, advertisement and marketing, communication, invitation to events and participation in promotions for PARTNERS, organization of joint activities, compliance with legal and regulatory requirements and internal rules of USTER, enforcement and exploitation of legal rights and claims, defense against legal claims, litigation, complaints, combating abusive conduct, engaging in legal investigations and proceedings and responding to inquiries of public authorities, for the sale or acquisition of business units, companies or parts of companies and other corporate transaction and related transfers of PARTNER DATA. The PARTNER DATA shall be processed in accordance with the principles set out for CUSTOMER DATA above.

All the purposes of processing shall be applicable for the whole USTER Group, i.e., not only for the company which initially collected the personal data. Personal data of CUSTOMERS, VISITORS and PARTNERS are collected for the purpose of all USTER companies.

4.    DISCLOSURE OF DATA AND TRANSFER OF DATA ABROAD
In accordance with applicable data protection laws, USTER may disclose CUSTOMER DATA, VISITOR DATA and PARTNER DATA to the following categories of third parties who process PERSONAL DATA in accordance with the PURPOSE OF CUSTOMER DATA PROCESSING on behalf of USTER or for their own purposes:

• Service providers (within USTER as well as external), including processors;
• Agents, dealers, suppliers and other business partners;
• Local, national and foreign authorities;
• Acquirers or parties interested in acquiring business units, companies or other parts of USTER; and
• Other parties in potential or actual legal proceedings;

(together “THIRD PARTIES”).

USTER may disclose CUSTOMER DATA, VISITOR DATA and PARTNER DATA within USTER as well as to THIRD PARTIES and in any country worldwide, including in particular all countries in which USTER is represented by companies, affiliates, agents or other offices and representatives as well as to countries in which service providers of USTER process their data. If data are disclosed to countries that do not guarantee adequate protection, USTER will ensure adequate protection of data disclosed by CUSTOMERS, VISITORS or PARTNERS by way of putting adequate contractual guarantees, in particular on the basis of EU standard clauses, and binding corporate rules in place, or it bases the transfer on the exceptions of consent, conclusion or performance of contract, the determination, exercise or enforcement of legal claims, overriding public interests or it discloses the data in order to protect the integrity of these individuals. The CUSTOMER, VISITOR or PARTNER can obtain a copy of the contractual guarantees from USTER or will be advised where to obtain such copies under the Contact Address given in Para. 1 above. USTER reserves the right to redact such copies for reasons of data protection or secrecy.

When the CUSTOMER downloads the FRONT-END SOFTWARE from a third party’s digital distribution platform (e.g., an app store), USTER has no influence on the collection of CUSTOMER DATA by said third party.

5.    STORAGE OF DATA
As a rule, USTER retains contract related CUSTOMER DATA and PARTNER DATA as long as the contractual relationship is ongoing and for ten years after the termination of the contractual relationship, unless a longer statutory store obligation is applicable on a case-by-case basis, this is required for reasons of proof, another valid reason for an exception is pertinent based on applicable law, or the deleting of the data is required earlier (in particular because the data is no longer needed or USTER is required to delete the respective data).
As a rule, shorter retention periods are applicable for operational data containing CUSTOMER DATA, VISITOR DATA or PARTNER DATA (e.g., protocols, logs).

Business records, including communications, will be retained as long as USTER has an interest in them (in particular an interest for reasons of proof in case of claims, documentation of compliance with certain legal or other requirements, an interest in non-personalized analysis) or is obligated to do so (by way of contract, law or other provisions). Deviating legal obligations are reserved in particular with respect to anonymization or pseudonymization.

6.    COOKIES, GOOGLE ANALYTICS AND SOCIAL PLUG-INS
USTER uses cookies on its FRONT-END SOFTWARE. Cookies are a widespread technique that allocates an identification to the browser of the user of a FRONT-END SOFTWARE which the user saves and shows upon request. On the one hand, USTER uses session cookies which are automatically erased when the user closes the FRONT-END SOFTWARE and which enable the server to establish a stable connection to the user (so that the content of a shopping basket is not lost, for example) as long as he browses on the FRONT-END SOFTWARE. On the other hand, permanent cookies which are only erased after a period defined per FRONT-END SOFTWARE are used. Permanent cookies allow saving certain settings (e.g., language) for several sessions or allow for an automated log-in. The user consents to the application of permanent cookies by way of using the FRONT-END SOFTWARE and the respective functions (e.g., language settings and automated log-in). The user may block the application of cookies on his browser or delete cookies there which may, however, impair the use of the FRONT-END SOFTWARE.

In accordance with applicable law, USTER may install coding in newsletters and other marketing e-mails which allow it to determine if the recipient has opened an e-mail or downloaded pictures contained in the e-mail. However, the recipient may block this application in his e-mail application. In any case he consents to the application of this technology by way of receiving newsletters on other marketing related e-mails.

Should USTER place advertisement of third parties on the FRONT-END SOFTWARE (e.g., banners) or intend to place an own advertisement on the FRONT-END SOFTWARE of a third party, cookies from companies specializing in the use of such advertisement may be used. USTER will not disclose personal data to such companies, i.e., they shall only place a permanent cookie with users of the FRONT-END SOFTWARE in order to recognize users and do so in the sole interest of USTER. This allows USTER to place aimed advertisements for these users on external websites (e.g., in connection with products for which these users showed an interest in the online-shop). USTER will not disclose personal data to the operators of external websites either.

USTER may use Google Analytics or similar services on its FRONT-END SOFTWARE. These applications are third-party services which allow USTER to measure and analyze the use of its FRONT-END SOFTWARE. The provider of these services may be located in any country worldwide (in the case of Google Analytics, which is operated by Google Inc., it is the U.S., www.google.com). The service provider uses permanent cookies for these applications. USTER will not disclose any personal data to the service provider (who will also not save any IP addresses). The service provider may, however, monitor the use of the FRONT-END SOFTWARE by the user and combine these data with data from other websites monitored by the same service provider which the user has visited, and the service provider may use these findings for its own benefits (e.g., control of advertisements). The service provider knows the identity of the user who has registered with the service provider. In this case, the processing of personal data will be the service provider's responsibility and data shall be processed according to the data protection policies of the service provider. The service provider will provide data on the use of the FRONT-END SOFTWARE to USTER.

In addition, USTER may use plug-ins from social media networks such as Facebook, Twitter, Youtube, Google+, Pinterest or Instagram on its FRONT-END SOFTWARE. In the default setting of the FRONT-END SOFTWARE, plug-ins are deactivated; the user can thus choose whether and when to activate them. Should the user do so, the social-media providers are able to establish a direct connection to the user during his visit on the FRONT-END SOFTWARE, which allows the social-media provider to be aware of the user's visit and to analyze the respective information. The subsequent processing of the personal data will be conducted in the responsibility of the social-media provider and according to his data protection policies. The provider of the respective social media offering will not disclose any information to USTER.

7.    CUSTOMER SERVICE
Services to CUSTOMERS may be provided by an agent (“AGENT”) on behalf of USTER. In accordance with applicable data protection laws, USTER may disclose according to Para. 4 above CUSTOMER DATA to the AGENT for the PURPOSE OF CUSTOMER DATA PROCESSING as defined in Para. 3 above. The AGENT may collect himself and process the CUSTOMER DATA for the PURPOSE OF CUSTOMER DATA PROCESSING as defined in Para. 3 above.

8.    NEWSLETTER AND BANNER ADVERTISEMENT
USTER may send newsletters or other commercial communications in connection with its products and services to CUSTOMERS and PARTNERS. In accordance with applicable law USTER reserves the right to do so without prior consent of existing customers and business partners. However, the respective customers and business partners may object to a further mailing of newsletters or other commercial communications at any time through their account on the respective FRONT-END SOFTWARE or through the link indicated in every mailing. However, the termination of one newsletter may not entail the termination of other newsletters, as well. 

It is possible that personalized advertisement is placed during the visit on the FRONT-END SOFTWARE. Every banner advertisement displayed to the CUSTOMER contains products offered on the FRONT-END SOFTWARE which have previously been looked at by the customer. The advertisement is generated by USTER by the means of cookies (see Para. ‎6 above).

9.    RIGHTS OF THE CUSTOMER, THE VISITOR AND THE PARTNER
Any affected individual, including any CUSTOMER, VISITOR and PARTNER, may request information from USTER as to whether data concerning him is being processed. In addition, he has the right to request the correction, destruction or restriction of personal data regarding him as well as to object to the processing of personal data. Should the processing of personal data be based on consent, the affected individual may withdraw consent at any time. In countries of the EU and EEA, the affected individual may, in certain cases, have the right to obtain data generated during the use of online services in a structured, common and machine-readable format which allows for further use and transfer. A request in this respect shall be submitted to the Contact Address given in Para. 1 above. USTER reserves the right to restrict the rights of the affected individual in accordance with applicable law and, e.g., not to disclose comprehensive information or not to delete data.

Should USTER make an automated decision with respect to a certain individual which may have a legal effect for the affected individual or seriously affect him in a similar way, the affected individual shall have, in accordance with applicable law, the right to communicate with a controller of USTER and to request a reconsideration of the decision or to request the prior evaluation by the controller. In this case the affected individual might no longer be able to use certain automated services. The individual will be informed thereof subsequently or separately in advance.
Any affected individual may also raise a complaint with the competent data protection authority, which in the case of an USTER controller in Switzerland is the Federal Data Protection and Information Commissioner in Switzerland (www.edoeb.admin.ch).

10.    CHANGES TO THE STATEMENT 
USTER is entitled to amend this STATEMENT at any time and without prior notice or announcement. The latest version according to the FRONT-END SOFTWARE shall be applicable. 
Should the STATEMENT form part of an agreement with CUSTOMERS and PARTNERS, USTER may inform them of an update or amendments by e-mail or in another appropriate manner. The amendments shall be deemed to have been accepted unless an objection is raised within 30 days of notification. In case of objection, USTER shall be free to terminate the agreement exceptionally and with immediate effect.