Privacy Policy of Siglis AG

Statement on protecting individuals from the misuse of personal data on zigfred.ch, zigfred.io & siglis.com

This privacy policy informs you about the nature, scope, and purpose of the processing of personal data (hereinafter “data”) within our online offerings and the websites, functions, apps, and content associated with them, as well as our external online presences, such as our social media profiles (hereinafter collectively referred to as “online offering”). With regard to the terminology used, such as “personal data” or their “processing,” we refer to the definitions in Art. 4 of the General Data Protection Regulation (GDPR).

Controller

Siglis AG
Hardturmstrasse 161
8005 Zurich | Switzerland
Commercial register number: CHE-316.857.918
Above-mentioned managing director: Markus Wegmann
+41 43 543 34 20
E-Mail: info@zigfred.ch

Data Protection Officer

Dan Mugioiu
Hardturmstrasse 161
8005 Zurich | Switzerland
E-Mail: datenschutzbeauftragter@zigfred.ch

Types of data processed

Basic data (e.g., names, addresses)
Contact data (e.g., email, phone numbers)
Content data (e.g., text entries, photographs, development documents, smart home programs)
Contract data (e.g., subject of contract, duration, customer category)
Payment data (e.g., bank details, payment history)
Usage data (e.g., visited websites, content interests, access times)
Meta/communication data (e.g., device information, IP addresses, website access, app access)

Processing of special categories of data (Art. 9(1) GDPR)

As a rule, no special categories of data are processed, except when provided by users, for example through online forms.

Categories of data subjects affected by processing

Customers / prospects / suppliers
Visitors and users of the online offer

Hereinafter, we collectively refer to the data subjects as “users”.

Purpose of processing

Provision of the online offer, its content, and functions
Provision of contractual services, support, and customer care
Responding to contact requests and communication with users
Marketing, advertising, and market research
Security measures

As of: 14.01.2021

Relevant legal bases
1. Pursuant to Art. 13 GDPR, we inform you of the legal bases for our data processing. If the legal basis is not specified in the privacy policy, the following applies: the legal basis for obtaining consent is Art. 6(1)(a) and Art. 7 GDPR, the legal basis for processing necessary for the performance of our services and implementation of contractual measures as well as responding to inquiries is Art. 6(1)(b) GDPR, the legal basis for processing necessary to comply with our legal obligations is Art. 6(1)(c) GDPR, and the legal basis for processing necessary to safeguard our legitimate interests is Art. 6(1)(f) GDPR. In cases where vital interests of the data subject or another natural person require the processing of personal data, Art. 6(1)(d) GDPR serves as the legal basis.
Changes and updates to the privacy policy
1. We encourage you to regularly review the content of our privacy policy. We update the privacy policy as soon as changes in our data processing make it necessary.
Security measures
1. In accordance with Art. 32 GDPR, we implement, taking into account the state of the art, implementation costs, and the nature, scope, circumstances, and purposes of processing, as well as the varying likelihood and severity of risk to the rights and freedoms of natural persons, appropriate technical and organizational measures to ensure a level of protection appropriate to the risk. These measures particularly include safeguarding the confidentiality, integrity, and availability of data through control of physical access to the data as well as access, input, transmission, availability, and separation concerning them. We have also established procedures to ensure the exercise of data subject rights, data deletion, and response to data threats. Furthermore, we consider the protection of personal data during the development or selection of hardware, software, and processes, in accordance with the principles of data protection by design and by default (Art. 25 GDPR).
2. The security measures particularly include the encrypted transmission of data between your browser and our server.
Collaboration with processors and third parties
1. If, in the context of our processing, we disclose data to other persons or companies (processors or third parties), transmit it to them, or otherwise grant them access to the data, this is done only on the basis of a legal permission (e.g., where transmission of data to third parties, such as payment service providers, is necessary under Art. 6(1)(b) GDPR for contract fulfillment), you have given consent, a legal obligation requires it, or based on our legitimate interests (e.g., when using contractors, web hosts, etc.).
2. If we engage third parties to process data based on a so-called “processor agreement,” this is done in accordance with Art. 28 GDPR.
Transfers to third countries
1. If we process data in a third country (i.e., outside the European Union (EU) or the European Economic Area (EEA)) or if this occurs in the context of using third-party services or disclosing/transferring data to third parties, it only takes place if necessary for the fulfillment of our (pre)contractual obligations, based on your consent, due to a legal obligation, or based on our legitimate interests. Subject to legal or contractual permissions, we process or have data processed in a third country only if the special conditions of Arts. 44 et seq. GDPR are met. That is, processing takes place, for example, on the basis of specific safeguards, such as the officially recognized determination of an EU-equivalent level of data protection (e.g., for the USA via the “Privacy Shield”) or compliance with officially recognized special contractual obligations (so-called “standard contractual clauses”).
Transfers to third countries
1. You have the right to request confirmation as to whether your personal data is being processed and, if so, to obtain information about these data as well as additional information and a copy of the data pursuant to Art. 15 GDPR.
2. Pursuant to Art. 16 GDPR, you have the right to request the completion of your personal data or the rectification of inaccurate data concerning you.
3. Under Art. 17 GDPR, you have the right to request the immediate deletion of data concerning you, or alternatively, under Art. 18 GDPR, to request a restriction of the processing of the data.
4. You have the right to receive the data concerning you that you have provided to us pursuant to Art. 20 GDPR and to request their transfer to another controller.
5. Furthermore, pursuant to Art. 77 GDPR, you have the right to lodge a complaint with the competent supervisory authority.
Right of withdrawal
1. You have the right to withdraw consent given pursuant to Art. 7(3) GDPR with effect for the future.
Right to object
1. You may object at any time to the future processing of your data concerning you pursuant to Art. 21 GDPR. The objection can particularly relate to processing for direct marketing purposes.
Cookies and the right to object to direct marketing – general introduction on the topic of cookies
1. We use temporary and permanent functional cookies, i.e., small files stored on users’ devices (explanation of the term and function, see the last section of this privacy policy, see 19 et seq.). Some cookies serve security purposes or are necessary for the operation of our online offer (e.g., for website display) or to store the user’s decision when confirming the cookie banner.
2. In addition, we or our technology partners use cookies for audience measurement and marketing purposes, which users are informed about throughout the privacy policy.
3. A general objection to the use of cookies employed for online marketing purposes can be made for many services, especially in the case of tracking, via the U.S. site http://www.aboutads.info/choices/ or the EU site http://www.youronlinechoices.com/ . Furthermore, the storage of cookies can be prevented by disabling them in the browser settings. See also 19 et seq. of this privacy policy. Please note that some functions of this online offer may not be available in this case.
Deletion of data
1. The data we process is deleted or its processing restricted in accordance with Arts. 17 and 18 GDPR. Unless expressly stated otherwise in this privacy policy, the data we store is deleted as soon as it is no longer necessary for its purpose and no legal retention obligations prevent deletion. If the data is not deleted because it is required for other legally permissible purposes, its processing is restricted. That is, the data is blocked and not processed for other purposes. This applies, for example, to data that must be retained for commercial or tax reasons.
2. In accordance with legal requirements, retention is carried out in particular for 6 years pursuant to Art. 958f CO (commercial books, inventories, opening balances, annual financial statements, commercial correspondence, accounting records, books, records, management reports, accounting documents, commercial and business letters, documents relevant for taxation, etc.).
Provision of contractual services (including in the case of paid orders for products and services and/or subscription to our newsletter)
1. We process inventory data (e.g., names and addresses as well as user contact details), contractual data (e.g., services used, names of contact persons, payment information) to fulfill our contractual obligations and service provisions pursuant to Art. 6(1)(b) GDPR. Entries marked as mandatory in online forms are required for contract conclusion. Using an access code, users can view their order after placement. User data is not public and cannot be indexed by search engines. It is the responsibility of users to secure their data in the event of termination before the end of the contract. We and the user are entitled to irreversibly delete all user data stored during the contract period after its expiration, provided no commercial or tax reasons pursuant to Art. 5(1)(c) GDPR prevent this.
2. In the context of the ordering process, registration and re-registrations, as well as use of our online services, we store the IP address and the time of each user action. The storage is based on our legitimate interests, as well as the users’ interest in protection against misuse and other unauthorized use. The transfer of this data to third parties generally does not occur, except if necessary to enforce our claims or if there is a legal obligation pursuant to Art. 6(1)(c) GDPR.
3. In the course of your order with us, we collect, process, and use the personal data necessary to handle your order. This includes in particular your delivery and billing address as well as your payment data, such as bank or credit card information. Additionally, in individual cases, we may check your creditworthiness. Your data is stored with us and used exclusively for processing your order. For order fulfillment, we may also transfer your data to companies responsible for payment processing and delivery of goods. These companies may only use your data for the purpose of fulfilling the contract concluded between you and us. No further use, especially for advertising purposes, takes place. If third-party payment services are used, the terms and conditions and privacy notices of the respective third-party providers (e.g., Stripe, Inc.) apply and are available on their respective websites.
4. A user can optionally create a free account. This gives them access to additional features such as posting comments and forum contributions, sharing Smarthome programs, etc. This user account is not public, although the profile page is. The latter can also be indexed by search engines. The user has the option to delete this account. In doing so, all content created by this user account is deleted. We also have the option to delete the user account along with its content.
5. We process usage data (e.g., pages of our online offer visited, interest in our products) and content data (e.g., entries in the contact form or user profile) for advertising purposes in a user profile, in order to display product suggestions based on the services previously used by the user.
6. We process aggregated and pseudonymized usage data (e.g., of visited content) to provide top lists, view counters, comment counts, etc.
7. Deletion occurs after the expiration of legal warranty and similar obligations, with the necessity of data retention being reviewed every three years; in the case of statutory archiving obligations, deletion occurs after their expiration and the tax retention period (10 years); information in the order view remains until it is deleted.
Contact and contact management
1. When contacting us (via contact form, phone, or email), the user’s information is processed to handle the contact request in accordance with Art. 6(1)(b) GDPR. We reserve the right to contact the user through their preferred method.
2. Personal data, in particular for the processing of contracts for individual sales and subscriptions, is stored in our Customer Relationship Management system (“CRM System”) and comparable accompanying support systems.
3. We delete requests when they are no longer needed. We review their necessity every two years; requests from customers with a customer account are stored permanently, and deletion is subject to the instructions regarding the customer account. In the case of statutory archiving obligations, deletion occurs after their expiration (end of commercial and tax retention period (10 years)).
Comments and posts
1. When users leave comments or other posts in the forum, log in, or re-register, their IP addresses are stored based on our legitimate interests under Art. 6(1)(f) GDPR for 365 days.
2. This is done for our security, in case someone posts unlawful content in comments and contributions (insults, prohibited political propaganda, etc.). In such a case, we could be held liable for the comment or post and are therefore interested in the identity of the author.
Collection of access data and log files
1. We collect, based on our legitimate interests under Art. 6(1)(f) GDPR, data on each access to the server hosting this service (so-called server log files). Access data includes the name of the retrieved webpage or file, date and time of access, amount of data transferred, message about successful retrieval, browser type and version, user’s operating system, referrer URL (previously visited page), IP address, and the requesting provider.
2. Log file information is stored for security reasons (e.g., to investigate abuse or fraud) for a maximum of 90 days and then deleted. Data whose further retention is necessary for evidentiary purposes is exempt from deletion until the respective incident is fully resolved.
Online presence on social media
1. We maintain online presences within social networks and platforms to communicate with customers, prospects, and users active there and to inform them about our services.
2. We point out that, in this context, user data may be processed outside the European Union and EEA. This may pose risks for users, for example, by making it more difficult to enforce their rights. Regarding US providers certified under the Privacy Shield, we note that they commit to comply with EU data protection standards.
3. We point out that, in this context, user data may be processed outside the European Union. This may pose risks for users, for example, by making it more difficult to enforce their rights. Regarding US providers certified under the Privacy Shield, we note that they commit to comply with EU data protection standards. Furthermore, user data is generally processed for market research and advertising purposes. For example, usage profiles can be created from users’ behavior and resulting interests. These usage profiles can then be used to display ads within and outside the platforms, presumably matching users’ interests. For these purposes, cookies are generally stored on users’ computers, in which their behavior and interests are recorded. Additionally, usage profiles may also contain data independently of the devices used by the users (particularly if users are members of the respective platforms and logged in).
4. The processing of users’ personal data is based on our legitimate interests in effectively informing and communicating with users under Art. 6(1)(f) GDPR. If users are asked by the respective providers to consent to data processing (i.e., indicate their agreement, for example, by checking a box or confirming a button), the legal basis for processing is Art. 6(1)(a) and Art. 7 GDPR. For a detailed description of the respective processing activities and the options to object (opt-out), we refer to the linked information provided by the providers below.
5. Even in the case of information requests and exercising users’ rights, we point out that these can be most effectively asserted with the providers. Only the providers have access to users’ data and can directly take appropriate measures and provide information. If you still need assistance, you may contact us.
  - Facebook (Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland) – Privacy Policy: https://www.facebook.com/about/privacy/ , Opt-Out: https://www.facebook.com/settings?tab=ads and http://www.youronlinechoices.com , Privacy Shield: https://www.privacyshield.gov/participant?id=a2zt0000000GnywAAC&status=Active .
  - Google/YouTube (Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA) – Privacy Policy: https://policies.google.com/privacy , Opt-Out: https://adssettings.google.com/authenticated , Privacy Shield: https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active .
  - Instagram (Instagram Inc., 1601 Willow Road, Menlo Park, CA, 94025, USA) – Privacy Policy / Opt-Out: http://instagram.com/about/legal/privacy/ .
  - Twitter (Twitter Inc., 1355 Market Street, Suite 900, San Francisco, CA 94103, USA) – Privacy Policy: https://twitter.com/de/privacy , Opt-Out: https://twitter.com/personalization , Privacy Shield: https://www.privacyshield.gov/participant?id=a2zt0000000TORzAAO&status=Active .
  - LinkedIn (LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland) – Privacy Policy: https://www.linkedin.com/legal/privacy-policy , Opt-Out: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out , Privacy Shield: https://www.privacyshield.gov/participant?id=a2zt0000000L0UZAA0&status=Active .
Cookies & audience measurement
1. Cookies are information transferred from our web server or third-party web servers to users’ web browsers and stored there for later retrieval. Cookies can be small files or other types of information storage.
2. We use “session cookies,” which are stored only for the duration of the current visit to our online presence (e.g., to save your login status and thereby allow the use of our website). Additionally, a cookie contains information about its origin and storage duration. These cookies cannot store other data. Session cookies are deleted when you end your use of our website, for example by logging out or closing the browser.
3. Users are informed, within this privacy policy, about the use of cookies for pseudonymous audience measurement.
4. If users do not want cookies to be stored on their computer, they are asked to disable the corresponding option in their browser settings. Stored cookies can be deleted in the browser settings. Disabling cookies may lead to functional limitations of this online offering.
5. You can object to the use of cookies for audience measurement and advertising purposes via the Network Advertising Initiative opt-out page (http://optout.networkadvertising.org/ ) and additionally via the US website (http://www.aboutads.info/choices ) or the European website (http://www.youronlinechoices.com/uk/your-ad-choices/ ).
Hetzner Online GmbH
1. Based on our legitimate interests (i.e., interest in analyzing, optimizing, and economically operating our website in accordance with Art. 6(1)(f) GDPR), we use the services of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany (“Hetzner”) to provide our website via servers. Data used for the functioning of our website, provision of contractual services, service, customer management, marketing, advertising, and market research, as well as access data and log files, are hosted on servers managed by us at Hetzner.
2. For the security of our legitimate interests, a functional, encrypted backup of the data sets is created daily and deleted after 90 days. Access to the backups is only granted in the event of an IT failure by the IT officer of Siglis AG.
Stripe, Inc.
1. Based on our legitimate interests (i.e., interest in analyzing, optimizing, and economically operating our website in accordance with Art. 6(1)(f) GDPR), we use the external credit card service provider Stripe, operated by Stripe, Inc., 510 Townsend Street, San Francisco, CA 94103, USA (“Stripe”). During the ordering process, users transmit their contract-related, address, contact, and credit card data to Stripe.
2. According to its own statements, Stripe, Inc. complies with European data protection law.
Mailchimp
1. Based on our legitimate interests (i.e., interest in analyzing, optimizing, and economically operating our website in accordance with Art. 6(1)(f) GDPR), we use the external newsletter service provider Mailchimp, operated by The Rocket Science Group, LLC, 675 Ponce de Leon Ave NE, Suite 5000 Atlanta, GA 30308, USA (“Mailchimp”). Users of our website can register for the newsletter list via our newsletter form or when placing an order.
2. According to its own statements, Mailchimp complies with European data protection law.
3. When a user subscribes to the newsletter via the form or during the ordering process by checking the box, their email address and name are transmitted to Mailchimp. If a user loads images or the web display of a newsletter email, their device establishes a direct connection with Mailchimp’s servers. Usage profiles of users may be created from the processed data. We therefore have no influence on the scope of data collected by Mailchimp through newsletter tracking and inform users according to our knowledge.
Facebook marketing, re-marketing and social plugins
1. Based on our legitimate interests (i.e., interest in analyzing, optimizing, and economically operating our website in accordance with Art. 6(1)(f) GDPR), we use social plugins (“Plugins”) from the social network facebook.com, operated by Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (“Facebook”). The plugins may represent interactive elements or content (e.g., videos, graphics, or text posts) and can be identified by one of the Facebook logos (a white “f” on a blue tile, the terms “Like”, “Gefällt mir”, or a thumbs-up symbol) or are labeled with “Facebook Social Plugin”. The list and appearance of Facebook Social Plugins can be viewed here: https://developers.facebook.com/docs/plugins/ .
2. Facebook is certified under the Privacy Shield framework and thereby guarantees compliance with European data protection law (https://www.privacyshield.gov/participant?id=a2zt0000000GnywAAC&status=Active )
3. When a user accesses a feature of this website that contains such a plugin, their device establishes a direct connection with Facebook’s servers. The plugin content is transmitted directly by Facebook to the user’s device and integrated into the website. Usage profiles of users may be created from the processed data. We therefore have no influence on the scope of data collected by Facebook through this plugin and inform users according to our knowledge.
4. By integrating the plugins, Facebook receives information that a user has accessed the corresponding page of the website. If the user is logged into Facebook, Facebook can associate the visit with their Facebook account. When users interact with the plugins, for example by clicking the Like button or posting a comment, the corresponding information is transmitted directly from their device to Facebook and stored there. If a user is not a Facebook member, it is still possible for Facebook to determine and store their IP address. According to Facebook, only an anonymized IP address is stored in Germany.
5. The purpose and scope of data collection, as well as the further processing and use of the data by Facebook, and the relevant rights and settings for protecting users’ privacy, can be found in Facebook’s privacy policy: https://www.facebook.com/about/privacy/ .
6. If a user is a Facebook member and does not want Facebook to collect data about them via this website and link it to their Facebook account data, they must log out of Facebook and delete their cookies before using our website. Further settings and objections to the use of data for advertising purposes are available in the Facebook profile settings: https://www.facebook.com/settings?tab=ads or via the US website http://www.aboutads.info/choices/ or the EU website http://www.youronlinechoices.com/ . The settings are platform-independent, meaning they apply to all devices, such as desktop computers or mobile devices.
Hotjar
1. We use Hotjar to better understand our users’ needs and to optimize the offering and experience on this website. With Hotjar’s technology, we gain a better understanding of users’ experiences (e.g., how much time they spend on which pages, which links they click, what they like and dislike, etc.) and this helps us align our offering with user feedback.
2. Hotjar uses cookies and other technologies to collect data about our users’ behavior and their devices, particularly the device’s IP address (recorded and stored only in anonymized form during website use), screen size, device type (unique device identifiers), information about the browser used, location (country only), and preferred language for displaying our website. Hotjar stores this information on our behalf in a pseudonymized user profile.
3. Hotjar is contractually prohibited from selling the data collected on our behalf.
Integration of services and content from third-party functional providers
1. Within our online offering, based on our legitimate interests (i.e., interest in analyzing, optimizing, and economically operating our online offering in accordance with Art. 6(1)(f) GDPR), we use content or service offerings from third-party providers to embed their content and services, such as videos or map views (hereinafter collectively referred to as “content”). This always requires that the third-party providers of this content know the users’ IP addresses, because without the IP address they could not send the content to the user’s browser. The IP address is thus required for displaying this content. We strive to use only content whose providers use the IP address solely for delivering the content. The pseudonymized information may also be stored in cookies on the users’ devices and may contain, among other things, technical information about the browser and operating system, referring websites, visit times, as well as further information about the use of our online offering, and may be combined with such information from other sources.
2. The following overview provides a list of third-party providers and their content, along with links to their privacy policies, which contain additional information on data processing and, in some cases already mentioned here, options to opt out (so-called Opt-Out):
  1. External maps from Google, LLC., https://maps.google.com ("Google Maps"). The integration of Google Fonts is done via a server call to Google (usually in the USA). Privacy Policy: https://policies.google.com/privacy , Opt-Out: https://adssettings.google.com/authenticated .
  2. Videos from the "YouTube" platform of the third-party provider Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Privacy Policy: https://policies.google.com/privacy , Opt-Out: Within our website, features of the Twitter service or platform may be integrated (hereinafter referred to as "Twitter"). Twitter is provided by Twitter Inc., 1355 Market Street, Suite 900, San Francisco, CA 94103, USA. Features include displaying our posts on Twitter within our website, linking to our Twitter profile, interacting with posts and Twitter features, and measuring whether users access our website via ads we have placed on Twitter (so-called conversion tracking). Twitter is certified under the Privacy Shield and thereby guarantees compliance with European data protection law (https://www.privacyshield.gov/participant?id=a2zt0000000TORzAAO&status=Active ). Privacy Policy: https://twitter.com/de/privacy , Opt-Out: https://twitter.com/personalization .
Payrexx
1. Based on our legitimate interests (i.e., interest in optimizing and economically operating our online offering pursuant to Art. 6 Abs. 1 lit. f GDPR), we use the external payment service provider Payrexx, operated by Payrexx AG, Burgstrasse 18, 3600 Thun, Switzerland ("Payrexx"). Users of our webshop can pay for their orders via Payrexx.
2. According to Payrexx’s own statements, it complies with European data protection law.
3. When a user places an order, their email address, name, and payment details are transmitted to Payrexx.
WooCommerce
1. On the basis of our legitimate interests (i.e., interest in optimizing and economically operating our online offering pursuant to Art. 6(1)(f) GDPR), we use the external webshop service provider WooCommerce, operated by WooCommerce, 60 29th St #343, San Francisco, United States ("WooCommerce"). WooCommerce provides users with an integrated webshop on our website.
2. WooCommerce complies, according to its own statements, with European data protection law.
3. When a user places an order, the address, email, and name of the user are transmitted to WooCommerce.
4. When a user loads images or the display of a webshop email, their device establishes a direct connection with WooCommerce’s servers. From the processed data, user profiles may be created. We therefore have no influence on the scope of data WooCommerce collects via email tracking and inform users to the best of our knowledge.
flink think
1. Based on our legitimate interests (i.e., interest in analyzing, optimizing, and economically operating our online offering pursuant to Art. 6(1)(f) GDPR), we use the services of flink think GmbH, Gallenweg 8, CH-4133 Pratteln (“flink think”) to provide our online offering via servers. Data used for the functioning of our online offering, the provision of contractual services, service, customer care, marketing, advertising, and market research, as well as access data and log files, are hosted on servers managed by us at flink think.
2. For the security of our legitimate interests, a functional, encrypted backup of the data sets is created daily and deleted after 90 days. Access to the backups is only granted in the event of an IT failure by the IT officer of Siglis AG.