Privacy Policy

Data protection declaration and consent to data use on www.cloudconnection.ch from Cloud Connection GmbH

1. What is this privacy policy about?

The Cloud Connection GmbH (hereinafter also “we”, “us”) obtains and processes personal data that concerns you or other people (so-called “third parties”). We use the term “data” here to mean “personal data”.

In this privacy policy we describe what we do with your data when you www.cloudconnection.ch, use other websites of ours or our apps (hereinafter collectively “website”), obtain our services or products, otherwise be in contact with us within the framework of a contract, communicate with us or otherwise have anything to do with us. If necessary, we will inform you by means of a timely written notification about additional processing activities not mentioned in this data protection declaration. In addition, we can inform you separately about the processing of your data, for example in declarations of consent, contractual conditions, additional data protection declarations, forms and notices.

If you provide us with data about other people, such as family members, work colleagues, etc., we will assume that you are authorized to do so and that this data is correct. By transmitting data via third parties, you confirm this. Please also ensure that these third parties have been informed of this privacy policy.

This data protection declaration is designed to meet the requirements of the EU General Data Protection Regulation (“GDPR”), the Swiss Data Protection Act (“DSG”) and the revised Swiss Data Protection Act (“revDSG”). However, whether and to what extent these laws are applicable depends on the individual case.

2. Who is responsible for processing your data?

For the data processing described in this data protection declaration www.cloudconnection.ch is the data protection law Cloud Connection GmbH in St. Moritz, responsible, unless otherwise communicated in individual cases, e.g. in further data protection declarations, on forms or in contracts.

You can contact our data protection officer for your data protection concerns and to exercise your rights in accordance with Section 11 as follows:

Data protection officer according to Art. 37 ff. GDPR, Art. 10 revDSG, EU according to Art. 27 GDPR, Switzerland according to Art. 14 revDSG, United Kingdom (UK) according to Art. 27 UK GDPR:

Cloud Connection GmbH
Data Protection Officer
Via Serlas 23
7500 St. Moritz

contact@cloudconnection.ch

3. What data do we process?

We process different categories of data about you. The most important categories are as follows:

Technical data 

If you use our website or other electronic offers, we collect technical data from your end device to ensure the functionality and security of these offers. This data also includes logs that record the use of our systems. We generally retain technical data for [1-14] months. In order to ensure the functionality of these offers, we can also assign you or your device an individual code (e.g. in the form of a cookie, see section 12). The technical data themselves do not allow any conclusions to be drawn about your identity. However, as part of user accounts, registrations, access controls or the processing of contracts, they can be linked to other categories of data (and thus possibly to you personally). 

Registration Data

Certain offers, such as competitions and services (e.g. login areas of our website, newsletter delivery, free WiFi access, etc.) can usually only be used with a user account or registration that is done directly with us or via our external login information. Service provider can be done. You will need to provide us with certain information and we will collect information about your use of the offer or service. We typically retain registration information during [1-14] months after the end of the use of the service or the termination of the user account. This period may be longer if this is necessary for evidentiary reasons or to comply with legal or contractual requirements or for technical reasons. This data is generally retained for at least [10] years. 

Communication data

If you are in contact with us via the contact form, by email, telephone or chat, by letter or other means of communication, we collect the data exchanged between you and us, including your contact details and the peripheral data of the communication. If we record or listen to telephone conversations or video conferences, for example for training and quality assurance purposes, we will specifically inform you of this. Such recordings may only be made and used in accordance with our internal guidelines. You will be informed whether and when such recordings take place, for example through a display during the relevant video conference. If you do not wish to be recorded, please let us know or stop participating. If you simply do not want your image to be recorded, please turn off your camera. If we want or need to establish your identity, for example in the case of a request for information from you, an application for media access, etc., we collect data in order to identify you (for example a copy of an ID card). We generally keep this data during [1-14] months from the last exchange with you. This period may be longer if this is necessary for evidentiary reasons or to comply with legal or contractual requirements or for technical reasons. Emails in personal mailboxes and written correspondence are generally retained for at least [10] years. 

base data

By master data we refer to the basic data that we need in addition to the contract data (see below) for the processing of our contractual and other business relationships or for marketing and advertising purposes, such as name, contact details and information, for example about your role and function, your bank details ), your date of birth, customer history, powers of attorney, signature authorizations and declarations of consent. We process your master data if you are a customer or other business contact or work for one (e.g. as a contact person for a business partner), or because we want to address you for our own purposes or the purposes of a contractual partner (e.g. in the context of marketing and Advertising, with invitations to events, with vouchers, with newsletters, etc.). We receive master data from you (e.g. when making a purchase or as part of a registration), from entities you work for or from third parties such as our contractual partners, associations and address dealers and from publicly accessible sources such as public registers or the Internet (Websites, social media, etc.). We can also process health data and information about third parties as part of master data. We can also collect master data from our shareholders and investors. We generally retain this data for [10] years from the last exchange with you, but at least from the end of the contract. This period may be longer if this is necessary for evidentiary reasons or to comply with legal or contractual requirements or for technical reasons. For purely marketing and advertising contacts, the period is usually much shorter, usually no more than [2] years since the last contact.

Contract data

This is data that arises in connection with the conclusion of a contract or the execution of a contract, e.g. information about contracts and the services to be provided or provided, as well as data from the run-up to the conclusion of a contract, the information required or used for processing and information about reactions (e.g. complaints or information about satisfaction etc.). We usually collect this data from you, from contractual partners and from third parties involved in the execution of the contract, but also from third-party sources (e.g. providers of creditworthiness data) and from publicly accessible sources. We generally retain this data for [10] years from the last contractual activity, but at least from the end of the contract. This period may be longer if this is necessary for evidentiary reasons or to comply with legal or contractual requirements or for technical reasons.

Behavioral and preference data

Depending on the relationship we have with you, we try to get to know you and better tailor our products, services and offers to you. To do this, we collect and use data about your behavior and preferences. We do this by evaluating information about your behavior in our area, and we may also supplement this information with information from third parties, including from publicly available sources. Based on this, we can, for example, calculate the probability that you will use certain services or behave in a certain way. Some of the data processed for this purpose is already known to us (e.g. when you use our services), or we obtain this data by recording your behavior (e.g. how you navigate on our website or on our social media portals). We anonymize or delete this data when it is no longer useful for the purposes pursued, which can be between [2-3] weeks and [24] months (for product and service preferences), depending on the type of data. This period may be longer if this is necessary for evidentiary reasons or to comply with legal or contractual requirements or for technical reasons. We describe how tracking works on our website in Section 12. 

other data

We also collect data from you in other situations. In connection with official or judicial proceedings, for example, data is generated (such as files, evidence, etc.) which can also relate to you. We may also collect data for health protection reasons (e.g. as part of protection concepts). We may receive or produce photographs, videos and audio recordings in which you may be identifiable (e.g. on occasions, through security cameras, etc.). We can also collect data about who enters certain buildings and when or has corresponding access rights (including access controls, based on registration data or visitor lists, etc.), who takes part in events or campaigns (e.g. competitions) and when, or who uses our infrastructure and systems and when . Finally, we collect and process data about our shareholders and other investors; In addition to master data, this includes information for the relevant registers regarding the exercise of your rights and the implementation of events (e.g. general meetings). The retention period of this data depends on the purpose and is limited to what is necessary. This ranges from a few days for many of the security cameras and typically a few weeks for contact tracing data, to visitor data that is typically retained for [3] months, to reports of events with images that are a few years or longer can be stored. 

You provide us with much of the data specified in this Section 3 (e.g. via forms, as part of communication with us, in connection with contracts, when using the website, etc.). You are not obliged to do so, subject to individual cases, e.g. within the framework of binding protection concepts (legal obligations). If you want to conclude contracts with us or claim services, you must also provide us with data as part of your contractual obligation in accordance with the relevant contract, in particular master, contract and registration data. When using our website, the processing of technical data is unavoidable. If you wish to gain access to certain systems or buildings, you will be required to provide us with registration information. 

Insofar as this is not inadmissible, we also take data from publicly accessible sources (e.g. debt collection registers, land registers, commercial registers, media or the Internet including social media) or receive data from other companies within our group, from authorities and from other third parties (e.g. credit reporting agencies , address dealers, associations, contractual partners, Internet analysis services, etc.). 

4. For what purposes do we process your data?

We process your data for the purposes that we explain below. You will find further information for the online area in sections 12 and 13. These purposes and the underlying objectives represent legitimate interests of us and, if applicable, of third parties. You will find further information on the legal basis of our processing in section 5.

We process your data for purposes related to communication with you, in particular to answer inquiries and assert your rights (section 11) and to contact you if you have any questions. For this purpose, we use communication data and master data in particular and, in connection with the offers and services you use, also registration data. We keep this data to document our communications with you, for training purposes, for quality assurance and for inquiries. We process data for the recording, administration and processing of contractual relationships. 

We process data for marketing purposes and to maintain relationships, for example to send our customers and other contractual partners personalized advertising about products and services from us and from third parties (e.g. from advertising contractual partners). This can take place, for example, in the form of newsletters and other regular contacts (electronically, by post, by telephone), via other channels for which we have contact information from you, but also as part of individual marketing campaigns (e.g. events, competitions, etc.). Free services included (e.g. invitations, vouchers, etc.). You can reject such contacts at any time (see at the end of this section 4) or refuse or revoke your consent to be contacted for advertising purposes. With your consent, we can target our online advertising on the Internet more specifically to you (see section 12). We continue to process your data for market research, to improve our services and operations and for product development. We may also process your data for security purposes and access control. We process personal data to comply with laws, instructions and recommendations from authorities and internal regulations (“compliance”). We also process data for our risk management purposes and as part of prudent corporate governance, including operational organization and corporate development. 

5. On what basis do we process your data?

If we ask you for your consent for certain processing, we will inform you separately about the corresponding purposes of the processing. You can revoke your consent at any time with future effect by sending us a written notice (by post) or, unless otherwise stated or agreed, by email; Our contact details can be found in Section 2. To revoke your consent to online tracking, see Section 12. Where you have a user account, you may also be able to revoke your consent or contact us via the relevant website or other service become. Once we have received the notice of withdrawal of your consent, we will no longer process your data for the purposes to which you initially consented, unless we have another legal basis for doing so. Revoking your consent will not affect the lawfulness of the processing carried out based on your consent before its revocation.

Where we do not ask for your consent to processing, we base the processing of your personal data on the fact that the processing is necessary for the initiation or execution of a contract with you (or the entity you represent) or that we or a third party have a legitimate interest in particular in order to be able to pursue the purposes described above under Section 4 and the associated goals and to be able to implement appropriate measures. Our legitimate interests also include compliance with legal regulations, insofar as this is not already recognized as a legal basis by the applicable data protection law (e.g. the law in the EEA and Switzerland in the case of the GDPR). 

If we receive sensitive data, we may also process your data based on other legal bases, for example in the event of a dispute due to the need for processing for possible litigation or the enforcement or defense of legal claims. In individual cases, other legal reasons may apply, which we will communicate to you separately if necessary.

6. What applies to profiling and automated individual decisions?

We can automatically evaluate certain of your personal characteristics for the purposes stated in Section 4 using your data (Section 3) ("profiling") if we want to determine preference data, but also to determine misuse and security risks, to carry out statistical evaluations or for operational planning purposes. We can also create profiles for the same purposes, ie we can combine behavioral and preference data, but also master and contract data and technical data assigned to you in order to better understand you as a person with your different interests and other characteristics. 

If you are one of our customers, we can, for example, use profiling based on your purchases to determine which other products are likely to interest you. We can also use it to check your creditworthiness before offering you a purchase on account. For your protection, an automated evaluation of data can also check the probability of a specific transaction being fraudulent. This allows us to stop the transaction for clarification. A distinction must be made between “profiles”. This means the linking of various data in order to gain information about essential aspects of your personality from the totality of this data (e.g. what you like or how you behave in certain situations). Profiles can also be used for marketing, but also security purposes. 

We use anonymous movement profiles in a non-personal way, for example to give our contractual partners recommendations for avoiding peak times. For personalized movement profiles, we use personal data, for example to point out interesting offers and products in your area, to draw conclusions about your interests from the position data (dwell time) and to tell you which products and services other contractual partners with similar interests have used. 

In both cases, we pay attention to the proportionality and reliability of the results and take measures against misuse of these profiles or profiling. If these can have legal effects or significant disadvantages for you, we generally carry out a manual check. 

7. Who do we share your data with?

In connection with our contracts, the website, our services and products, our legal obligations or otherwise to protect our legitimate interests and the other purposes listed in Section 4, we also transmit your personal data to third parties, in particular to the following categories of recipients: 

service provider

We work together with service providers in Germany and abroad who process data about you on our behalf or in joint responsibility with us or who receive data about you from us on their own responsibility. 

So that we can provide our products and services efficiently and concentrate on our core competencies, we obtain services from third parties in numerous areas. These services relate, for example, to IT services, the sending of information, marketing, sales, communication or printing services, building management, security and cleaning, organization and implementation of events and receptions, debt collection, credit agencies, address verifiers (e.g. to update addresses when moving), anti-fraud measures and services from consulting firms, lawyers, banks, insurers and telecom companies. We provide these service providers with the data required for their services, which may also concern you. These service providers may also use such data for their own purposes, eg information about outstanding debts and your payment history in the case of credit reporting agencies or anonymous information to improve the services. In addition, we conclude contracts with these service providers that provide for provisions for the protection of data, insofar as this does not result from the law. Our service providers may also process data on how their services are used and other data that arises as part of the use of their services as independent controllers for their own legitimate interests (e.g. for statistical evaluations or billing). Service providers provide information about their independent data processing in their own data protection declarations.

Contractual partners including customers

This initially refers to our customers (e.g. service recipients) and other contractual partners of ours, because this data transfer results from these contracts. For example, you will receive registration data for issued and redeemed vouchers, invitations, etc. If you work for such a contractual partner yourself, we can also provide them with data about you in this context.

Authorities

We can pass on personal data to authorities, courts and other authorities at home and abroad if we are legally obliged or authorized to do so or if this appears necessary to protect our interests. The authorities are responsible for processing data about you that they receive from us.

Other people

This refers to other cases where the involvement of third parties arises from the purposes set out in section 4

All of these categories of recipients may in turn involve third parties so that your data can also become accessible to them. We can restrict processing by certain third parties (e.g. IT providers), but not that of other third parties (e.g. authorities, banks, etc.).

8. Does your personal data also go abroad?

As explained in Section 7, we also disclose data to other parties. These are not only in Switzerland. Your data can therefore be processed in Europe; but in exceptional cases in every country in the world. 

If a recipient is located in a country without adequate legal data protection, we contractually oblige the recipient to comply with the applicable data protection (we use the revised standard contractual clauses of the European Commission, which can be found here: https://eur-lex.europa.eu/eli/ dec_impl/2021/914/oj?) unless it is already subject to a legally recognized set of rules to ensure data protection and we cannot rely on an exception clause. An exception may apply in the case of legal proceedings abroad, but also in cases of overriding public interest or if a contract requires such disclosure, if you have given your consent or if it concerns data that you have made generally accessible and whose processing you have not objected to. 

Please also note that data exchanged over the Internet is often routed via third countries. Your data can therefore end up abroad even if the sender and recipient are in the same country.

9. How long do we process your data?

We process your data for as long as our processing purposes, the legal retention periods and our legitimate interests in processing for documentation and evidence purposes require, or storage is required for technical reasons. Further information on the respective storage and processing period can be found in the individual data categories in Section 3 or in the cookie categories in Section 12. If there are no legal or contractual obligations to the contrary, we will delete or anonymize your data after the storage period has expired. or processing time as part of our usual processes.

Documentation and evidence purposes include our interest in documenting processes, interactions and other facts in the event of legal claims, discrepancies, IT and infrastructure security purposes and evidence of good corporate governance and compliance. Storage can be due to technical reasons if certain data cannot be separated from other data and we therefore have to store them with them (e.g. in the case of backups or document management systems)

10. How do we protect your data?

We take appropriate security measures to protect the confidentiality, integrity and availability of your personal data, to protect them against unauthorized or unlawful processing and to counteract the risks of loss, unintentional modification, unintentional disclosure or unauthorized access. 

Security measures of a technical and organizational nature may include, for example, measures such as encryption (e.g. SSL, TLS) and pseudonymization of data, logging, access restrictions, storage of backup copies, instructions to our employees, confidentiality agreements and controls. We protect your data transmitted via our website during transport using suitable encryption mechanisms. But we can only secure areas that we control. We also require our processors to take appropriate security measures. However, security risks cannot generally be completely ruled out; Residual risks are unavoidable. 

11. What rights do you have?

Applicable data protection law grants you the right, under certain circumstances, to object to the processing of your data, in particular those for direct marketing purposes, profiling for direct marketing purposes and other legitimate interests in processing.

In order to make it easier for you to control the processing of your personal data, you also have the following rights in connection with our data processing, depending on the applicable data protection law: 

• The right to request information from us as to whether and what data we process about you;
• the right for us to correct data if it is inaccurate;
• the right to request deletion of data;
• the right to request that we provide certain personal data in a commonly used electronic format or transmit it to another person in charge;
• the right to withdraw consent to the extent that our processing is based on your consent;
• the right to request further information necessary to exercise these rights;
• the right to express your point of view in the case of automated individual decisions (section 6) and to request that the decision be reviewed by a natural person.

If you wish to exercise the above rights against us, please contact us in writing, at our location or, unless otherwise stated or agreed, by email; Our contact details can be found in Section 2. In order for us to rule out misuse, we must identify you (e.g. with a copy of your ID, unless this is possible otherwise). 

Please note that these rights are subject to requirements, exceptions or restrictions under applicable data protection law (e.g. to protect third parties or trade secrets). We will inform you accordingly if necessary.

If you do not agree with our handling of your rights or data protection, please let us know or our data protection officer (Section 2). In particular, if you are located in the EEA, the UK or Switzerland, you also have the right to complain to your country's data protection supervisory authority.

12. Do we use online tracking and online advertising techniques?

We use various technologies on our website that allow us and third parties we engage to recognize you when you use it and, under certain circumstances, to track you across multiple visits. In this section we will inform you about it.

Essentially, it's about us being able to distinguish your access (via your system) from access from other users so that we can ensure the functionality of the website and carry out evaluations and personalization. We do not want to draw conclusions about your identity, even if we can, if we or third parties we engage can identify you through combination with registration data. Even without registration data, the technologies used are designed in such a way that you are recognized as an individual visitor each time you access the page, for example by our server (or the servers of third parties) assigning you or your browser a specific identification number (so-called “cookie”). 

Cookies are individual codes (e.g. a serial number) that our server or a server of our service provider or advertising partner transmits to your system when connecting to our website and that your system (browser, mobile) accepts and stores until the programmed expiration time. With each further access, your system transmits these codes to our server or the third party's server. This way you will be recognized even if your identity is unknown. 

Other techniques can also be used with which you are more or less likely to be recognized (ie distinguished from other users), eg «fingerprinting». Fingerprinting combines your browser, screen resolution, language choice, and other information your system communicates to each server, resulting in a more or less unique fingerprint. In this way, cookies can be dispensed with. 

Whenever you access a server (e.g. when using a website or an app or because an e-mail contains a visible or invisible image), your visits can be tracked. If we integrate offers from an advertising partner or provider of an analysis tool on our website, they can track you in the same way, even if you cannot be identified in individual cases. 

We use such techniques on our website and allow certain third parties to do the same.

You can program your browser to block or deceive certain cookies or alternative technologies, or delete existing cookies. You can also enhance your browser with software that blocks tracking by certain third parties. You can find more information on this on the help pages of your browser (usually under the keyword “Privacy Policy”) or on the websites of third parties, which we list below.

A distinction is made between the following cookies (techniques with comparable functionalities such as fingerprinting are also meant here):

Necessary cookies

Some cookies are necessary for the functioning of the website as such or certain functions. For example, they ensure that you can switch between pages without losing information entered in a form. They also ensure that you stay logged in. These cookies are only temporary ("session cookies"). If you block them, the website may not work. Other cookies are necessary so that the server can store decisions or entries made by you beyond a session (i.e. a visit to the website) if you use this function (e.g. selected language, given consent, the function for automatic login, etc.) . These cookies have an expiration date of up to [24] months. 

Performance cookies

In order to optimize our website and corresponding offers and to better tailor them to the needs of users, we use cookies to record and analyze the use of our website, possibly beyond the session. We do this by using third-party analysis services. We have listed these below. Performance cookies also have an expiry date of up to [24] months. Details can be found on the third party websites.

Marketing cookies

We and our advertising contract partners have an interest in controlling advertising precisely to the target group, ie only showing it to those we want to address. We have listed our advertising contract partners below. For this purpose, we and our advertising contract partners also use cookies with which the content accessed or contracts concluded can be recorded. This enables us and our advertising partners to display advertising that we can assume will be of interest to you on our website, but also on other websites that display advertising from us or our advertising partners. Depending on the situation, these cookies have an expiry period of a few days to [12] months. 

In addition to marketing cookies, we use other techniques to control online advertising on other websites and thereby reduce wastage. For example, we can transmit the e-mail addresses of our users, customers and other people to whom we want to show advertising to operators of advertising platforms (e.g. social media). If these people are registered there with the same e-mail address (which the advertising platforms determine through a comparison), the operators show the advertising we have placed to these people in a targeted manner. The operators do not receive personal email addresses from people who are not already known. However, if you have known email addresses, you will find out that these people are in contact with us and what content they have accessed. 

We can also include other offers from third parties on our website, in particular from social media providers. If you have an account with the social media provider, they can assign this information to you and thus track your use of online offerings. These social media providers process this data on their own responsibility.

We currently use offers from the following service providers and advertising contract partners:

Google Analytics

Google Ireland (based in Ireland) is the provider of the service and acts as our data processor. For this purpose, Google Ireland relies on Google LLC (based in the USA) as its processor (both “Google”). Information on data protection can be found here [https://policies.google.com/].

Google Ads

Google Ireland (based in Ireland) is the provider of the service and acts as our data processor. For this purpose, Google Ireland relies on Google LLC (based in the USA) as its processor (both “Google”). Information on data protection can be found here [https://policies.google.com/].

Google Fonts

Google Ireland (based in Ireland) is the provider of the service and acts as our data processor. For this purpose, Google Ireland relies on Google LLC (based in the USA) as its processor (both “Google”). Information on data protection can be found here [https://policies.google.com/].

Google reCaptcha

Google Ireland (based in Ireland) is the provider of the service and acts as our data processor. For this purpose, Google Ireland relies on Google LLC (based in the USA) as its processor (both “Google”). Information on data protection can be found here [https://policies.google.com/].

Google Maps

Google Ireland (based in Ireland) is the provider of the service and acts as our data processor. For this purpose, Google Ireland relies on Google LLC (based in the USA) as its processor (both “Google”). Information on data protection can be found here [https://policies.google.com/].

Google Tag Manager

Google Ireland (based in Ireland) is the provider of the service and acts as our data processor. For this purpose, Google Ireland relies on Google LLC (based in the USA) as its processor (both “Google”). Information on data protection can be found here [https://policies.google.com/].

OneSignal Push Notification

OneSignal, Inc. (located in the USA) is the provider of the service and acts as our data processor. Information on data protection can be found here [https://onesignal.com/privacy/].

13. What data do we process on our social network pages?

We can operate pages and other online presences on social networks and other platforms operated by third parties (“fan pages”, “channels”, “profiles”, etc.) and collect the data about you described in Section 3 and below. We receive this data from you and the platforms when you come into contact with us via our online presence (e.g. when you communicate with us, comment on our content or visit our presence). At the same time, the platforms evaluate your use of our online presence and link this data to other data about you known to the platforms (e.g. about your behavior and your preferences). They also process this data for their own purposes under their own responsibility, in particular for marketing and market research purposes (e.g. to personalize advertising) and to control their platforms (e.g. what content they show you).

We process this data for the purposes described in Section 4, in particular for communication, for marketing purposes (including advertising on these platforms, cf. Section 12) and for market research. You will find information on the relevant legal bases in section 5. We can distribute content that you have published yourself (e.g. comments on an announcement) (e.g. in our advertising on the platform or elsewhere). We or the operators of the platforms can also delete or restrict content from or about you in accordance with the usage guidelines (e.g. inappropriate comments). 

For further information on the processing by the operators of the platforms, please refer to the data protection notices of the platforms. There you will also find out in which countries they process your data, which information, deletion and other data subject rights you have and how you can exercise them or receive further information. 

We currently do not use any platforms.

14. Can this privacy policy be changed?

This privacy policy does not form part of any contract with you. We can adapt this data protection declaration at any time. The version published on this website is the current version. 

 

Last updated: November 2023