STUDIOSOFT
Privacy

Data protection and privacy

This Data Protection and Data Processing Notice of the website studiosoft.ch, of our software, and of the databases of customers, suppliers and users archived and managed by Studiosoft Sagl (hereinafter also "we/us" or "STUDIOSOFT") informs customers, suppliers and users (hereinafter "you" or "users") of our services, our offers and our products (hereinafter "services") regarding the collection and processing of their data (personal data as well as non-personal data; hereinafter "data").

1. Introduction

Below we inform you, inter alia, of who the controller of your data is, what data we collect in connection with your use of our services, for what purposes we process such data, and to whom we may disclose it. Furthermore, we inform you of the duration of the processing of your data, the legal basis for processing (should one be required), as well as what rights you have vis-à-vis us with regard to the processing of your data. This Data Protection Notice applies to all your data already in our possession or that will be in our possession in the future. Please note that this Data Protection Notice may be amended from time to time. The current updated version published on www.studiosoft.ch applies.

Personal data means any information relating to an identified or identifiable person (hereinafter "personal data"). This includes, in particular, information such as name, address, telephone number, email address, and potentially also IP addresses and device identifiers. In this Data Protection Notice, the generic term "data" encompasses, in addition to personal data, non-personal data and anonymised data. Processing means any handling of data, regardless of the means and procedures applied, in particular the collection, storage, use, modification, disclosure, archiving, or deletion of data (hereinafter "processing"). If you provide us with personal data of other individuals, please ensure that such individuals are aware of this Data Protection Notice, and only provide us with their data if you are authorised to do so under applicable data protection law.

2. Controller

The controller of data processing within the meaning of this Data Protection Notice is STUDIOSOFT Sagl, Chiasso, Corso San Gottardo 73, Switzerland. For matters and questions relating to data protection, please contact our data protection department (reachable at info@studiosoft.ch).

3. Categories of Processed Data

We collect certain data during the use of our services, our software, and in contact with STUDIOSOFT (e.g. when visiting our websites, during the use of one of our mobile apps or another of our digital services, upon conclusion of a contract, during registration, or when logging into the user account, or in contact with our employees). As a rule, we collect such data directly from you. In certain cases, we may receive data from other persons (e.g. if a third party submits a rating or comment referring to you, if your employer provides us with your contact details, or if a company with which you maintain a contractual relationship transmits your data to us).

The personal data we process may include the following data:

  • Data communicated to us upon registration for one of our services (e.g. name, contact details, sex, marital status, date of birth, professional title, photos, relatives, employees, language, payment information, access credentials, etc.).
  • Data relating to offers and concluded contracts (e.g. date, type, content, product, parties, duration, value, contract adjustments, payment information, contact details, contact persons, billing and correspondence addresses, customer feedback, terminations, disputes, etc.).
  • Data identified or communicated during the use of our services by registered and unregistered users. This includes, inter alia, IP and MAC address or device ID used, cookies, pages accessed by users and search terms entered by them, text field entries, bookings, ratings, time and duration of visits, clicks, reactions to offers from STUDIOSOFT and third parties, referring/exit URLs, information regarding the time of use, browser and device type, operating system and Internet service provider used, as well as the volume of data transmitted. This also includes data published or communicated via our services (including any integrated third-party services) (e.g. images, texts, comments, reviews, bookings, videos, etc.). We may link personal data relating to one of our services with data originating from another service.
  • Data exchanged during or in connection with contacts with us (e.g. communication via letter, telephone, fax, email, text and multimedia messages (SMS/MMS), video messages or instant messaging, reactions to communications and offers from STUDIOSOFT, preferred communication channels, etc.).
  • Data that you or third parties provide during participation in competitions, surveys and similar activities.
  • Certain services of STUDIOSOFT may collect and store location data if the geolocation function of the device used is activated.
  • Data provided to us by third parties with whom we maintain business relationships (e.g. directory entries, address databases, modifications of database entries, creditworthiness data, information regarding company-internal contact persons, etc.).
  • Data obtained from public sources (e.g. commercial register entries, other directories, etc.).

The aforementioned data does not always constitute personal data. As a rule, we are unable to assign data generated during the use of our services without registration (e.g. via a user account) to nominally identified individuals. In specific cases, however, this may occur in combination with other data.

In order to use our services, you may need to provide certain personal data that are required or prescribed by law for the initiation and administration of the contractual relationship and for the performance of the related contractual obligations. Without such personal data, we will, in principle, not be able to enter into and execute the contract or provide a specific service.

The logging of access to our digital services and the associated collection of connection data (such as the IP address) are also necessary; this function is activated automatically upon use and cannot be deactivated for individual users. Therefore, if you do not agree to the collection of such data, you must refrain from using our services.

4. Purposes of Processing and Legal Bases

The processing of personal data, to the extent permitted by applicable law, is carried out in particular for the following purposes:

  • initiation, conclusion, performance and execution of contracts;
  • offering, further development and improvement of our services, development of new services, operation, maintenance, optimization and ensuring the security of our services and our infrastructure;
  • user management of our services, identity checks, logins and other authentications;
  • maintenance, administration and development of our customer relationships, communication with customers and third parties, customer service and support, promotions, advertising and marketing, creation of user profiles, offering personalized services and relevant content;
  • management and publication of directories (in print, on data media and/or on the Internet), management, matching and updating of databases, including central directories of addresses and contact details relating to our company and to companies with which we maintain a contractual relationship;
  • protection of users, our employees and third parties, as well as protection of our data, trade secrets and assets, security of our systems, buildings and other infrastructure;
  • quality control, market research, compilation of statistics, preparation of reports, development of management-relevant information, administration and development of the company, our offering and our activities, acquisition and disposal of business units, companies and parts thereof;
  • compliance with legal and regulatory obligations and internal rules, law enforcement, civil, administrative and criminal proceedings, complaints, combatting abuse, investigations and responding to inquiries from authorities and administrative bodies.

Furthermore, we may also process personal data for other purposes to the extent that a legal obligation requires such processing, or we provide information thereon elsewhere, or where the processing was apparent from the circumstances at the time the data were collected.

We use personal data for the aforementioned purposes on the basis of the following legal bases, to the extent required under applicable data protection law:

  • performance of a contract;
  • compliance with legal obligations;
  • consent granted to us or to third parties;
  • our legitimate interests and those of third parties, in particular:
  • offering and providing services;
  • advertising and marketing;
  • maintaining contacts and communication with users and third parties;
  • traceability of user behavior, preferences and needs, market research;
  • further development and improvement of our services, development of new services;
  • user management, identity checks, logins, authentications;
  • protection of users, our employees and third parties, our data, trade secrets, infrastructure and assets;
  • maintenance and security, efficiency and effectiveness of business management organization, including secure, efficient and effective operation as well as further development of digital services and other IT systems, troubleshooting;
  • appropriate business management and development, sale or acquisition of business units, companies or parts of companies and other commercial law transactions;
  • compliance with legal and regulatory obligations and internal rules, law enforcement, civil, administrative and criminal proceedings, complaints, combatting abuse, investigations and responding to inquiries from authorities.

5. Publication and Disclosure of Data

We may publish and disclose data as set out below:

Publication

Certain of our services provide for the publication of data. As a rule, published data can be accessed from anywhere, including outside Switzerland. For example, published directory data are publicly accessible (e.g. on Facebook.com, on Linkedin.com, etc.). Data published via the relevant features of our services (e.g. posts, images, texts, videos, comments, ratings, etc.) may also be publicly accessible. The same applies to the username used in this context. Published data may also be published by us or by third parties on other platforms and in other media (e.g. print media), if applicable with the appropriate adaptations. Data published on our services are also likely to be indexed by search engines (e.g. Google) or disseminated further by third parties, over which we have no influence; consequently, such data may continue to be publicly available in any country in the world even after they have possibly been deleted from our systems.

Processors

We may engage third parties to perform certain services (e.g., in IT, application management, administration, printing, shipping, etc.) and to process and store data (so-called "processors"). Processors may have access to personal data and process it on our behalf. In this regard, we obligate processors to comply with data protection law and to process data only in the same manner as we do ourselves. Processors who may receive personal data may be located in any country, in particular in Switzerland, in EU and EEA countries, and in the United States.

Contractual Partners

We may disclose data to contractual partners (for example, sales partners, service providers, customers, suppliers, financial institutions, etc.). This is done, for example, to fulfill contractual obligations, to offer specific services, for matching, validating, and updating databases (including central address and contact directories of ours and our contractual partners), for debt collection and marketing purposes, for usage analysis and management of our services, systems, and infrastructure, as well as for payment processing. Potential recipients may also include purchasers or parties interested in acquiring business units, companies, or parts thereof. Contractual partners may obtain access to personal data and process it for their own purposes (for example, to fulfill contracts or their own legal obligations). In doing so, they are required to comply with applicable data protection legislation. Contractual partners who may receive personal data may be located in any country, in particular in Switzerland, in EU and EEA countries, and in the United States.

Disclosure to Authorities and Other Disclosures for Legal Reasons

In certain situations, we may disclose data to authorities, official agencies, and other third parties (e.g., in connection with official or regulatory requests, inquiries and investigations, administrative proceedings, criminal proceedings, civil litigation, and/or criminal trials). We do so in cases where we are officially or legally required to do so, where we consider ourselves obligated to do so, or where we can investigate cases of fraud or security flaws or protect the rights and property of STUDIOSOFT. If data that is not already publicly available is transferred to a country without adequate data protection, we ensure adequate data protection by implementing sufficient contractual safeguards, in particular on the basis of EU standard contractual clauses or Binding Corporate Rules, or by relying on statutory exceptions such as consent, performance of a contract, the establishment, exercise, or enforcement of legal claims, overriding public interests, or because it is necessary to protect the life or physical integrity of a data subject. Where provided for by applicable data protection law, you may obtain a copy of the contractual safeguards regarding your personal data from our data protection department or find out where such a copy can be obtained. We reserve the right to redact such copies for reasons of data protection legislation or confidentiality.

6. Retention Period

We store personal data for as long as necessary for the purposes for which it was collected. Furthermore, certain personal data is subject to legally binding retention obligations of ten or more years, which we comply with. We may also store personal data at least for the duration of the applicable limitation periods, which in many cases amount to five or ten years. Personal data generated in connection with the use of our services (e.g., protocols, logs, analyses, etc.) and not subject to such retention or limitation periods is generally deleted sooner, as soon as the interest in its processing ceases to apply. Data may also be retained for a longer period in anonymized form. Subject to an express contractual agreement, we are under no obligation to you to retain data for a specific duration.

7. Cookies, Web Analysis and Tracking Tools, and Other Technologies

We use various standard technologies to collect, store, and analyze data when you use our services.

These technologies include, in particular, cookies through which your browser or end device can be identified. A cookie is a small file that is sent to your computer or automatically stored by the browser used on your computer or mobile device when you access one of our services. If you access a service again, that service can recognize your browser or end device by means of the cookie. Cookies can store user settings and other information. In addition to so-called session cookies, which are automatically deleted again after a visit to our services, we also use temporary and permanent cookies that remain stored on your computer or mobile device for a longer period. The cookies used primarily serve to provide you with the functionalities of the various services in a simpler and more secure manner (such as logging into the user account).

Furthermore, the information collected via cookies enables us to improve our services in line with customer preferences and to display tailored offers and advertisements to you. We assume that by using our services and the corresponding functions (e.g., language selection, automatic login), you consent to the use of such cookies. You can block the use of cookies or delete them in your browser settings. Please note that if you do not accept cookies, you may not be able to use all functions of a service to their full extent, and that deleting cookies will also delete any opt-out cookies you may have set. Such opt-out cookies would then have to be reactivated upon a new visit to the respective service. Otherwise, you will be recognized as a new user and your data will need to be collected again.

In addition to cookies, we may also use other technologies (e.g. pixels, web beacons, tags, advertising IDs) to analyze the use of our services, personalize them, and show you personalized offers and advertisements. When sending newsletters and emails, we may, for example, use technologies that allow us to analyze which content interests users and whether, when, and how they respond to our offers (e.g. by downloading images in an email, clicking on URLs contained in an email or on a website, filling out form data, etc.). We consider that by using such features, the user consents to the use of the relevant technologies.

Finally, we use standard web analytics and tracking tools to evaluate and analyze the use of our services. These tools, mostly provided by third parties, provide us with information and statistics on the use of our services, helping us to better understand it and to adapt our services accordingly to user needs. Google servers in the United States and stored there. For Google Analytics, IP address anonymization has been activated on our services. Your IP address is therefore first shortened by Google within Member States of the European Union or in other contracting states to the EEA. The full IP address is transmitted to a Google server in the United States and shortened there only in exceptional cases. Google uses this information to analyze the use of the respective website, to compile reports on website activity, and to provide the website operator with other services related to website and internet use.

Please note that selected third parties (e.g. advertising partners) may also use cookies and other technologies on our services to analyze the use of the services, personalize the services themselves, and display personalized offers and advertisements to you. You can find an overview of the third parties with whom we collaborate in this context here. The processing of data by such third parties is governed by their own terms of use and data protection provisions.

8. Social media plugins and integration of third-party offers

We integrate social network plugins (e.g. Facebook, Linkedin, Twitter, etc.) into our services. These plugins facilitate the sharing of content on these platforms.

When visiting our services that contain such plugins, a connection to the respective provider's server may be established automatically. In this context, certain data (such as the time of the visit to the service, browser type, IP address) are collected and stored by this server. If you have a user account with one of these providers, that provider may assign this information to your profile. If you also interact with these plugins (e.g. by clicking the "like" button or leaving a comment), this information is also transmitted to the provider, stored by it, and potentially published. If a social login service is used (e.g. Facebook Connect), the provider may transmit personal data to us, such as your name, email address, and profile picture, held in the provider's records.

We also integrate third-party services into our services that allow you to interact with clients and other users of STUDIOSOFT and with third parties (for example, to make a booking via a booking service or to submit ratings and comments). In this regard, any data provided are transmitted to such third parties for the processing and performance of the respective service, or are processed directly by such third parties.

Please note that the processing of data by such third parties is governed by their own terms of use and data protection provisions.

9. Rights of data subjects

Every data subject has a right of access regarding the personal data concerning them. The data subject also has the right to demand from us the rectification, erasure, and restriction of the processing of data concerning them, as well as to object to such processing of personal data. The exercise of such rights usually requires that the data subject can unequivocally verify their identity. Where the processing of personal data is based on consent, such consent may be revoked at any time by the data subject. In EU or EEA Member States, the data subject has the right, in certain cases, to receive data generated during the use of online services in a structured, commonly used, and machine-readable format that allows for further use and transmission. Requests relating to these rights should be addressed to the data protection office (cf. Section 2 above). We reserve the right to restrict the rights of the data subject within the framework of applicable law and, for example, not to provide complete information or not to erase data. We also draw your attention to the fact that upon erasure of your personal data, part or all of the services may no longer be usable or available.

If we make an automated individual decision that has legal consequences for the data subject or significantly affects them in a similar way, the data subject may speak with a competent person from our company to request that said automated decision be reconsidered or request the assessment of a human being from the outset, to the extent provided by applicable law. In such case, the data subject may possibly no longer be able to use certain automated services. The person will be informed separately.

Every data subject has the right to lodge a complaint with the competent data protection authority. In the case of a controller in Switzerland, this is the Federal Data Protection and Information Commissioner (http://www.edoeb.admin.ch).