Data Privacy Policy

PADMA AG appreciates your visit to this website. The website “padma.ch” is a service of PADMA AG, CH-8620 Wetzikon. It provides information about our products and the world of PADMA. The protection of your privacy is important to us, which is why we refer you to this Privacy Policy and adhere to the applicable data protection regulations.
The purpose of this Privacy Policy is to inform you about how we handle personal data (hereinafter referred to as “data”) which is collected about you and processed when using our online offer and the associated websites, functions and contents as well as external online presences, e.g. our social media profiles (hereinafter collectively referred to as “online offer”). Swiss law applies, in particular the regulations of the Federal Act on Data Protection.

The European Union has enacted strict data protection regulations; this Privacy Policy therefore refers to the European General Data Protection Regulation (GDPR). With regard to the terms used, such as “processing” or “person responsible”, we refer to the definitions in Art. 4 of the GDPR.

This Privacy Policy applies to the website of PADMA AG “www.padma.ch”. For external websites to which PADMA has established hyperlinks, no guarantee can be given that these data protection provisions will also be observed there.

Please note that the following provisions may be amended from time to time. We therefore recommend that you consult this Privacy Policy regularly.

Contact for requests regarding the data privacy

PADMA AG
Haldenstrasse 30
8620 Wetzikon
Switzerland
Email address: mail@padma.ch
Imprint

Nature and processing of data

Nature of the processed data:

  • Personal data (e.g. names, addresses)
  • Contact data (e.g. email, telephone numbers)
  • Content data (e.g. text input, images, videos)
  • Usage data (e.g. visited websites, interest in content, access times)
  • Meta/communication data (e.g. device information, IP addresses)

Categories of persons concerned

Visitors and users of the online offer (hereinafter we collectively refer to all data subjects as “users”).

Purpose of processing

  • Provision of the online offer, its functions and contents
  • Security measures
  • Reach measurement/marketing

Terms used

“Personal data” is any information relating to an identified or identifiable natural person (hereinafter referred to as “data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by assignment to an identifier such as a name, an identification number, location data, an online identifier (e.g. cookie) or to one or more special features that express the physical, physiological, genetic, psychological, economic, cultural or social identity of that natural person.

“Processing” is any operation or set of operations performed upon personal data, with or without the aid of automated processes. The term goes a long way and covers practically every handling of data.

“Pseudonymization” is the processing of personal data in such a way that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that this additional information is kept separately and is subject to technical and organizational measures to ensure that the personal data are not attributed to an identified or identifiable natural person.

“Profiling” is any automated processing of personal data, insofar such personal data is used to evaluate certain personal aspects relating to a natural person, in particular to analyze or predict aspects relating to the performance, economic situation, health, personal preferences, interests, reliability, behavior, location or relocation of that natural person.

“Person responsible” is any natural or legal person, authority, institution or other body that alone or together with others decides on the purposes and means of processing personal data.

“Processor” is any natural or legal person, authority, institution or other body processing personal data on behalf of the person responsible.

Legal bases and security measures

Relevant legal bases

In accordance with Art. 13 GDPR, we inform you of the legal basis of our data processing. If the legal basis is not mentioned in our Privacy Policy, the following applies: The legal basis for obtaining the necessary consents is Art. 6 para. 1 let. a and Art. 7 of the GDPR; the legal basis of our processing necessary for the fulfillment of our services and the implementation of contractual measures as well as for answering inquiries is Art. 6 para. 1 let. b GDPR; the legal basis of our processing necessary for the fulfillment of our legal obligations is Art. 6 para. 1 let. c GDPR; the legal basis of our processing necessary for the protection our legitimate interests is Art. 6 para. 1 let. f GDPR. In the event that the vital interests of the data subject or another natural person require the processing of personal data, Art. 6 para. 1 let. d GDPR serves as the legal basis.

Security measures

In accordance with Art. 32 GDPR, we take appropriate technical and organizational measures to ensure an adequate level of protection in line with the risks incurred, while also taking into account the state of the art, the costs of implementation, and the type, scope, circumstances and purposes of processing as well as the probability of occurrence and the severity of the risk to the rights and freedoms of natural persons.

These measures include: ensuring the confidentiality, integrity and availability of data by controlling physical access to said data; ensuring the access, entry, transmission of data; and securing the availability and separation of data. Furthermore, we have established procedures to ensure the exercise of rights of data subjects, the deletion of data and an adequate response to compromised data. In addition, we take steps to ensure the safety of personal data during the development process, respectively the selection of hardware, software and procedures, in accordance with the principle of data protection through technology design and privacy-friendly settings (Art. 25 GDPR).

Cooperation with third parties

Cooperation with external processors and third parties

If we disclose data to other persons and companies (external processors or third parties) within the scope of our processing, transmit data to them or otherwise grant them access to the data, it shall only be done within the framework of a legal permission (e.g. if a transmission of data to third parties, such as payment service providers, is necessary for contract fulfilment in accordance with Art. 6 para. 1 let. b GDPR), a consent, if a legal obligation exists or based on our legitimate interests (e.g. when using authorized persons, web hosts, etc.).

If we commission third parties with the processing of data on the basis of a so-called “processing contract”, this shall be done in accordance with the provisions laid out in Art. 28 GDPR.

Transfers to third countries

If we process data in a third country (i.e. outside the European Union (EU), Switzerland or the European Economic Area (EEA)) or if this occurs in the context of the use of services of third parties or the disclosure, respectively the transfer, of data to third parties, this is done solely for the fulfilment of our (pre)contractual obligations, on the basis of your consent, a legal obligation or our legitimate interests. Subject to legal or contractual permissions, we process or leave the data in a third country only if the special requirements of Art. 44 ff. GDPR have been fulfilled. This means, for example, that processing is carried out in accordance with special security measures, such as the officially recognized determination of a certain level of data protection corresponding to EU standards (e.g. the “Privacy Shield” in the USA), or the compliance with officially recognized special contractual obligations (so-called “standard contractual clauses”).

Rights of data subjects

In accordance with Art. 15 GDPR, you have the right to request confirmation as to whether or not data related to you is being processed, and to request information about such data, but also to receive further information and a copy of said data.

In accordance with Art. 16 GDPR, you have the right to make a request to supplement your data or to correct any inaccurate data related to you.

In accordance with Art. 17 GDPR, you have the right to demand that data related to you be deleted immediately or, alternatively, to demand a restriction on the processing of the data in accordance with Art. 18 GDPR.

In accordance with Art. 20 GDPR, you have the right to ask us to send you your personal data that you have provided to us and to demand that it be forwarded to other persons responsible.

In accordance with Art. 77 GDPR, you also have the right to file a complaint with the competent supervisory authority.

Right of revocation

You have the right to rescind any consent you have given us pursuant to Art. 7 para. 3 GDPR with effect for the future.

Right of objection

In accordance with Art. 21 GDPR, you have the right to object to the future processing of data related to you at any time. The objection may be submitted particularly in the case of processing for direct marketing purposes.

Cookies and right of objection to direct advertising

“Cookies” are small files that are stored on a user’s computer. Different data can be stored in cookies. A cookie is primarily used to store information about a user (or the device on which the cookie is stored) during or after visiting an online offering. Temporary cookies, respectively “session cookies” or “transient cookies”, are cookies that are deleted after a user leaves an online offering and closes his browser. Such a cookie can store, for example, the content of a shopping basket in an online shop or a login status. “Permanent” or “persistent” cookies remain stored even after the browser is closed. For example, a user’s login can be saved when he or her visits the website after several days. Furthermore, such a cookie can also store the interests of users, which can be used to for audience measurement or marketing purposes. “Third-party cookies” are cookies that are offered by providers other than the person responsible for operating the online offering (the cookies of the person responsible for the online offering are referred to as “first-party cookies”).

To help you find the country-specific information relevant to you more quickly on our website or to enable us to provide you with country-specific information, we determine the country from which you are visiting us. To do this, we use the ipinfo.io service and run it directly from your browser using JavaScript. This provides us with a set of data based on your IP address, including the country in which you are located. However, we do not know your IP address and only store the two-digit country code locally in a cookie (e.g. CH for Switzerland, AT for Austria or DE for Germany).

If you as a user do not want cookies to be stored on your computer, you may deactivate the corresponding option in the system settings of your browser. Stored cookies can be deleted in the system settings of the browser. Opting out of cookies can lead to functional restrictions of this online offering.

A general objection to the use of cookies for online marketing purposes, especially in the case of tracking, is explained for many of the services on this link for the US http://www.aboutads.info/choices/ or the following link for the EU http://www.youronlinechoices.com/. Furthermore, you can prevent the storage of cookies by deactivating them in the browser settings. Please note that, in this case, not all functions of this online offering can be used.

Deletion of data

The data processed by us will be deleted or its processing restricted in accordance with Art. 17 and 18 GDPR. Unless expressly stated in this Privacy Policy, the data stored by us will be deleted as soon as it is no longer required for its intended purpose and the deletion does not conflict with any statutory storage obligations. If the data is not deleted because it is necessary for other and legally permissible purposes, its processing is restricted. This means that the data is blocked and not processed for other purposes. This applies, for example, to data that must be retained for commercial or tax reasons.

Establishment of contact

When contacting us (e.g. via contact form, email, telephone or social media), the user’s details are processed pursuant to Art. 6 para. 1 let. b (in the context of contractual/pre-contractual relationships) and Art. 6 para. 1 let. f (other requests) of the GDPR for the purpose of processing and handling contact requests. User information can be stored in a customer relationship management system (“CRM system”) or similar organizational tool.

We delete the requests if they are no longer necessary. We review this requirement every two years; the statutory archiving obligations also apply.

Newsletter

You will receive the PADMA newsletter only with your express consent and subscription. For this purpose, we save your email address. You can unsubscribe from the newsletter at any time.
Your personal data that you provide to PADMA will not be rented, traded or sold to third parties by us or our service providers.
Furthermore, we have the right to commission third parties with the technical handling of advertising measures and to pass on your personal data for this purpose within the PADMA Group and to commissioned service providers. These domestic and international service providers are obliged to comply with privacy laws to the same extent as we are. Your user data cannot be associated with your anonymized IP address.

Distribution service providers

The newsletter is sent by the email marketing service provider “MailChimp”, a newsletter delivery platform of the US company Rocket Science Group, LLC, 675 Ponce De Leon Ave NE #5000, Atlanta, GA 30308, USA. The data protection regulations of the delivery service provider. The Rocket Science Group LLC d/b/a MailChimp is certified under the Privacy Shield Agreement and thus guarantees compliance with the European data protection standards. The delivery service provider is commissioned on the basis of our legitimate interests in accordance with Art. 6 para. 1 let. f GDPR and a processing contract pursuant to Art. 28 para. 3 s. 1 GDPR.

The delivery service provider can use the recipient’s data in pseudonymous form, i.e. without assignment to a user, to optimize or improve its own services, e.g. to technically optimize the dispatch and presentation of the newsletter, or for statistical purposes. However, the delivery service provider does not use the data of our newsletter recipients to contact them on his own account or to pass it on to third parties.

Newsletter – Performance Measurement

The newsletters contain a so-called “web beacon”, i.e. a pixel-sized file that is fetched from our server when the newsletter is opened or, if we use a delivery service provider, from his third-party server. Within the scope of this retrieval, technical information is collected, such as information about the browser and your system, your IP address and time of retrieval.

This information is used to technically improve the services with the help of technical data or target groups and their reading behavior based on their retrieval locations (which can be determined using the IP address) or access times. The statistical analysis also makes it possible to determine whether the newsletters are opened, when they are opened, and which links are clicked. Technically speaking, this information can be assigned to the individual newsletter recipients. However, it is neither our endeavor, nor that of the delivery service provider, to observe individual users. The analysis is rather used to recognize the reading habits of our users and to adapt our contents accordingly, or to send out various contents based on the interests of our users.

Separately opting-out of the performance measurement is unfortunately not possible, in this case the entire newsletter subscription must be cancelled.

Hosting and log files

Hosting and email dispatch

The hosting services we use provide the following services: infrastructure and platform services, computing capacity, storage capacity and database services, email distributions, security services and technical maintenance services that we use for the purpose of operating this online offering.

We, respectively our hosting provider, process inventory data, contact data, content data, contract data, usage data, meta and communication data of customers, interested parties and visitors of this online offering on the basis of our legitimate interests in an efficient and secure provision of this online offering according to Art. 6 Para. 1 let. f GDPR in conjunction with. Art. 28 GDPR (conclusion of processing contracts).

Collection of access data and log files

We, respectively our hosting provider, collect the following data on the basis of our legitimate interests within the scope of Art. 6 para. 1 let. f GDPR pertaining to each access to the server on which this service is located (so-called server log files). Access data includes: name of the visited website, file, date and time of access, transferred data volume, notification of successful access, browser type and version, the user’s operating system, referrer URL (the previously visited page), IP address and the requesting provider.

Log file information is stored for a maximum of 7 days for security reasons (e.g. to investigate misuse or fraud), and then deleted. Data for which further storage is required for evidentiary purposes are excluded from deletion until the respective incident has been clarified.

Integration of third-party services and content

Within the scope of our legitimate interests (i.e. for purposes such as the analysis, optimization and rentability of our online offering pursuant to Art. 6 para. 1 let. f GDPR), we use contents or services of third parties and incorporate them into our online offering, for example, videos or fonts (hereinafter uniformly referred to as “contents”).

This always presupposes that the third-party providers of this content obtain the IP address of the users, since without the IP address they would not be able send the content to their browser. The IP address is therefore required for the display of this content. We make every effort to use only such contents whose respective providers use the IP address solely for delivering the contents. Third-party providers may also use so-called pixel tags (invisible graphics, also known as “web beacons”) for statistical or marketing purposes. Pixel tags can be used to evaluate information such as visitor traffic on the pages of this website. The pseudonymous information may also be stored in cookies on the user’s device and may include technical information about the browser and operating system, referring websites, visiting time and other information about the use of our online offering; they may also be associated with such information from other sources.

Google Tag Manager

Google Tag Manager is a solution which allows us to manage so-called website tags via an interface (and thus, for example, integrate Google Analytics and other Google marketing services into our online offering). The Tag Manager itself (which implements the tags) does not process any personal data of the users. We refer you to the following information on Google services with regard to the processing of users’ personal data. Usage guidelines.

Google Analytics

Within the scope of our legitimate interests (i.e. for purposes such as the analysis, optimization and rentability of our online offering pursuant to Art. 6 para. 1 let. f GDPR), we use Google Analytics, a web analysis service of Google LLC (“Google”). Google uses cookies. The information generated by the cookie about the usage of our online offering by users is generally transferred to a Google server in the USA and stored there.

Google is certified under the Privacy Shield Agreement and thus complies with the European data protection laws.

Google will use this information on our behalf to evaluate the use of our online offering by users, to compile reports on the activities within this online offering and to provide us with further services associated with the use of this online offering and the use of the Internet. Anonymized user profiles can be created from the processed data.

We use Google Analytics only with IP anonymization enabled. This means that Google will abbreviate the IP address of users within Member States of the European Union or in other states party to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and abbreviated there.

The IP address transmitted by the user’s browser is not merged with other Google data. Users can prevent the storage of cookies by setting their browser software accordingly; users can also prevent Google from collecting the data generated by the cookie and relating to their use of the online offering, and the processing of this data by Google by downloading and installing the browser plug-in.

Further information on the use of data by Google, as well as on the different settings options and possible objections can be found in Google’s Privacy Policy and in Google’s settings for the display of advertisements.

Users’ personal data will be deleted or made anonymous after 14 months.

Jetpack (WordPress Stats)

Within the scope of our legitimate interests (i.e. for purposes such as the analysis, optimization and rentability of our online offering pursuant to Art. 6 para. 1 let. f GDPR), we use the plugin Jetpack (i.e. the subfunction “WordPress Stats”), which integrates a tool for statistical analysis of visitor access, offered by Automattic Inc. 60 29th Street #343, San Francisco, CA 94110, USA. Jetpack uses “cookies”, which are text files placed on your computer, to help the website analyze how users use the site.

The information generated by the cookie about your use of this online offering is stored on a server in the USA. The processed data can be used to create user profiles, which are only used for analysis and not for advertising purposes. For further information, please consult Automattic’s Privacy Policy, or if you would like to know more about jetpack cookies.

Online presence in social media

We have an online presence on social networks and different platforms to communicate with active customers, interested parties and users, and to inform them about our services. When accessing the respective networks and platforms, the terms and conditions and the data processing policies of their respective operators apply.

Unless otherwise stated in our Privacy Policy, we process the data of users who communicate with us on social networks and platforms – for example, when leaving comments on our online presence or sending us messages.

YouTube

We embed videos from the “YouTube” platform, a service provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.
Privacy Policy, opt-out.

Status as of 28 May 2018