SWISS ROCKETS is committed to respecting and safeguarding your privacy by handling your personal data in accordance with applicable data protection laws. This Privacy Notice describes how SWISS ROCKETS (hereinafter "SWISS ROCKETS", us", or "we") collects and processes personal data about you that identifies you directly or indirectly, through interaction with us via our websites and other channels, including e-mail, telephone, both online and offline, and your privacy rights. 

Controller: Swiss Rockets AG, Lautengartenstrasse 6, 4052 Basel (dpo@swissrockets.com)

Legal representative in the EEA: We have appointed a GDPR representative in accordance with Art. 27 GDPR: Data Protection Partners Germany, dpo@swissrockets.com. The Data Protection Representation serves as an additional point of contact for data subjects and authorities in the European Union (EU) and the rest of the European Economic Area (EEA) for inquiries related to the GDPR.

SWISS ROCKETS decides why and how your personal data is processed and is, therefore, the controller of your personal data.

This Privacy Notice informs how we process personal data about our website users, customers, suppliers, job candidates and other stakeholders.

For individual or additional activities and services, further data protection declarations as well as other legal documents such as general terms and conditions (GTC), terms of use or conditions of participation may apply. Our employees are subject to our employee privacy notice.  

We are subject to Swiss data protection law (FADP and DPO) as well as any applicable foreign data protection law, in particular that of the European Union (EU) with the General Data Protection Regulation (GDPR). The European Commission recognizes that Swiss data protection law guarantees adequate data protection.
This website is intended for adults only, respectively for users over the age of sixteen (16). We do not knowingly collect personal data on this website from anyone under the age of sixteen without the prior, verifiable consent of a parent or guardian. You have the right to request to view the information provided by your child and require it be deleted.

We may change or update this Privacy Notice from time to time in response to changing legal, regulatory, or operational requirements and post a new Privacy Notice on this website.
By continuing interacting with us via our website or other channels as described above, you agree with the terms of this Privacy Notice. We invite you to carefully read this Privacy Notice. 
If you have any questions regarding the processing of your personal data or this Privacy Notice, please contact us as described in section 12.

1. What personal data do we collect about you, why, and why is it justified?
2. Who might SWISS ROCKETS share your personal data with?
3. Who do we secure your personal data?
4. How long do we store your personal data?
5. Cookies and tracking technologies, social networks
6. Notification and Communications
7. Third-party services
8. Extensions for the website
9. Measuring success and reach
10. Links to other websites
11. What are your rights and how can you exercise them?
12. How can you contact us?

1. What personal data do we collect about you, why, and why is it justified?

Most of our services do not require any form of registration, allowing you to visit our website without telling us who you are. However, some services and communications may require you to voluntarily provide us with personal data, which may include identification data and contact details, professional data in the context of a job application, and website usage data, which is collected automatically, when you visit our website. If you do not provide such data, we may not be able to provide services or information to you or enter into commercial engagements with you.

SWISS ROCKETS processes the personal data it collects depending on the relationship that you have with us. Unless the processing of your personal data is required or permitted by applicable law, for example the obligation to provide information to authorities in case of adverse events related to our products, or explicitly authorized by you, SWISS ROCKETS may process your personal data only as far as necessary to fulfill a contractual relationship with you, and for its legitimate business interests, such as responding to your requests and inquiries, running and maintaining our website, conducting analysis on the usage of our website, preserving our economic interests, and ensuring compliance with internal policies and applicable laws. 

1.1. Personal data that is automatically collected when you visit our website

SWISS ROCKETS uses common, automated data collection technologies, such as cookies or internet tags, to assess how our website is used, to personalize your experience, and to deliver content tailored to your interests. Through these technologies, some information may be collected automatically, when you visit our website, including:

• Usage data, such as your device ID, including your IP address, which is a unique number assigned to your computer; your login information, browser and devise information, including the operating system and platform, time zone setting, browser plug-in types and versions; information about your visit and online activities, such as page response times, download errors, length of visits of certain pages, page interaction information.
• Geolocation data and other information collected through cookies and other tracking technologies, subject to your explicit consent and as described in section 5.

We process this information for the following purposes and based on the following legal bases:

To run and maintain our website

We process usage data in our legitimate interest to enable the use of our website (connection establishment), to maintain our website, permanently ensure system security and stability, to fix technical problems, defend against attacks on the infrastructure, to perform analyses in the case of cyber attacks, audits, fraud monitoring and prevention, and to compile aggregated visitor statistics.

To perform website analytics and tracking

We process geolocation data and other information subject to your explicit consent together with usage data to better understand how our products and services impact you, to track and respond to safety concerns and to further develop and improve the quality and functionality of our products and services, identify usage trends and determine the effectiveness of our promotional campaigns, conduct surveys, improve the contents of our website, and to compile aggregated statistics about the usage or our website. For further information on how we use cookies and tracking technologies, please read section 5 of this Privacy Notice.

1.2. Personal data provided by you

SWISS ROCKETS collects personal data directly from you when you sign up for a service, subscribe for a newsletter, enter into a contract with us, submit an application to us, send us a question, make a product and/or services complaint, or otherwise interact with us. The type of personal data we collect depends on the interactions you have with us and the SWISS ROCKETS services you use, and may include information, such as:

• Identification data and contact details, such as name, first name, last name, gender, business email and/or postal address, fixed and/or mobile phone number, age, date of birth, country of origin or residence, username, passwords and other information used for authentication.
• Information regarding your utilization, responses and preferences, such as communication preferences, channels, preferred languages.
• Financial or payment data, such as credit card details, bank account details, VAT or other tax identification number, dates and amounts of payments made or received.
• Other personal data necessary to administer certain online services, such as login ID, security questions and answers, or encrypted passwords; or provided by you, for example through our contact forms, including the content of your message when you make an inquiry, report an adverse event or product and/or services complaint, respond to a survey, or when you subscribe to one of our mailing lists (your interests).
• Special categories of data, such as data relating to your health, proceedings and sanctions or religion, are generally not collected by SWISS ROCKETS. However, in some circumstances the provision of special categories of data may be necessary, for example, health related information in cases of product claims or proceedings/sanctions related information when applying for a job where such information is required to comply with applicable laws, such as labor laws, or subject to your explicit consent.

We process this information for the following purposes and based on the following legal bases:

Responding to your requests and inquires, and complaints

We process the data you submit to us via our contact forms to respond to your requests and inquires via mail, email, telephone, SMS, text messaging or other channels, for example when you have a question or complaint related to a product, service or application, submit a medical information request or a safety concern, or would like to request samples, a quote or demo, or subscribe to our marketing communications mailing list. 
We process your personal data for these purposes based on our legitimate interest, or, if applicable, contractual obligation, to respond to your request and get in touch with you. If you submit special categories of data with your request, we process this information based on your explicit consent. In case of an adverse event reporting or complaint, we process your personal data to comply with our legal reporting obligations.

Delivering products and services

We process your personal data provided when placing an order to provide you with the products and services ordered and for billing you for these products and services, based on the contractual relationship with you. We further use this data (including information on order history), based on our legitimate interest to improve our products and services by conducting surveys, increase customer satisfaction and our reputation by understanding your preferences and interests, and for marketing purposes.

Preserving our economic interests

We process your personal data, as necessary and based on our legitimate interest, to preserve the company's economic interests, remain competitive in the market, and ensure compliance and reporting, such as (a) complying with our policies, legal and regulatory requirements, including money laundering, anti-bribery, and anti-corruption laws and regulations, (b) enforcing our terms and conditions, (c) protecting our operations or those of any of our affiliates, (d) protecting our rights, privacy, safety, or property, and that of our affiliates, you, or others, (e) preventing, monitoring and managing cases of alleged misconduct or fraud, misuse of IT systems, physical security, data loss, IT and network security, (f) conducting internal investigations, audits, and (g) defending litigation.

Performing marketing activities/newsletters

We process your personal data, including your identification data and contact details as well as information about your utilization, responses and preferences, and other personal data you submit to us, as necessary and based on your consent, to market products and services which we think may be of interest to you or to communicate with you for other purposes about which we inform you when we collect your personal data. When subscribing to our marketing communications you must  expressly consent to the use of your e-mail address and your other contact addresses, unless the use is permitted for other legal reasons. If possible, we use the "double opt-in" procedure for any consent (section 6.2).

Managing job applications

We process your personal data that you submit when applying for a position at SWISS ROCKETS to take steps at your request prior to entering into a potential contract with you and based on your consent, to administer your job application and assess your suitability for the relevant position for which you applied. For further information on how we process your personal data in relation to your job application, please see section 1.6.

Complying with legal obligations applicable to SWISS ROCKETS

We process your personal data, as necessary, to comply with legal obligations applicable to us, such as labor laws requirements, transparency requirements, or adverse event reporting requirements.

1.3. Personal Data we collect from other sources

To the extent permitted by applicable law, and as necessary for fulfilling our legitimate business interest, we may collect or receive additional information about you from publicly available sources, such as the Internet, or third parties. 
For example, we may receive background check information when you apply for a position at SWISS ROCKETS (only with your explicit consent, see section "Managing job applications and job applicants data"), or fraud warnings from service providers to fulfill our legitimate interest in fraud prevention. We may also monitor conversations on public social media platforms about our products, activities and services, and collect information, such as comments, photos, videos, blogs, etc, to the extent necessary to better understand how customers experience our products and services, and SWISS ROCKETS's reputation, and to identify social media influencers. We may further combine the information collected from various sources to better understand interests and needs of our stakeholders.

1.4. Customer data

SWISS ROCKETS may collect and process personal data about you in accordance with applicable laws and to the extent permitted or required, either from you or certain third parties (e.g., your employer or the healthcare institution you work for, or other business contacts) or through trusted publicly available sources (collectively, "personal data"). Such data may include business-related information about you, such as your identification and professional data, data relating to SWISS ROCKETS products, activitiesand services, financial or payment data as well as special categories of data, such as patient data or health-related data, only if permitted or required by applicable law or with your consent, to comply with transparency, anti-bribery and anti-corruption laws and regulations, and/or applicable industry codes of practice.

If you intend to provide us with personal data belonging to other individuals (e.g., your colleagues), you must provide a copy of this Privacy Notice to the relevant individuals, directly or through their employer, and get the other individual's consent to share the data. 
Unless the processing of your personal data is required or permitted by applicable law, or explicitly authorized by you, SWISS ROCKETS may process your personal data only as far as necessary to perform the contract with you, to comply with a legal obligation and otherwise for its legitimate business interests, such as managing marketing and customer relationship activities, preserving the company's economic interests, ensuring compliance with internal policies, reporting and improving SWISS ROCKETS' products, activities and services.

We may collect your personal data directly from you, via our contractual relationship, at congresses or via our contact forms or indirectly from public sources or third parties, such as address brokers.  
The provision of personal data as described in this Privacy Notice is necessary for the processing purposes described herein. While the provision of your personal data is generally voluntary, you may not be able to benefit from the processing purposes if you do not provide the personal data.

1.5. Supplier data

SWISS ROCKETS may collect and process personal data about you in accordance with applicable laws and to the extent permitted or required, either from you or certain third parties (e.g., the company you work for, or other business contacts) or through trusted publicly available sources (collectively, "personal data"). Such data may include your identification data and contact details, professional data, financial and transactional information, electronic identification data needed to deliver products or services, such as login, passwords, access rights, IP address, and business relationship and communication details.

Unless processing of your personal data is required or permitted by applicable law or expressly authorized by you, we may process your personal data only to the extent necessary to perform our contractual obligations to you or to take pre-contractual steps, such as collecting information as part of our due diligence process, to comply with our legal or regulatory obligations, or to protect our legitimate interests, while protecting your privacy by keeping your data secure and limiting the amount of data and the duration of processing to what is strictly necessary. We process your personal data based on our legitimate interests for building a business relationship with you, providing our products and services to our customers, innovating, and improving our products, preventing fraud and criminal activity, ensuring the security of our IT systems and networks, and complying with internal policies.

You may refuse to provide your personal data or opt out from processing. In this case, however, we will not be able to enter into a contract with you (or the entity you work for) and keep a relationship with you.

1.6. Job applicants data

To support the recruitment and, where applicable, the employment process, SWISS ROCKETS may collect, process, and use personal data, as described above and in this section. Such data is either obtained from you when you apply for a job or from certain third parties (e.g., recruiters) or from trusted public sources (collectively, "personal data"). Please note that where your personal data is processed by external companies over which SWISS ROCKETS has no control, the privacy notices of such companies apply. Following applicable laws and to the extent possible, the information we collect may include general information, identification and contact information that you voluntarily provide, information from your interviews, and information from reviews or background checks. Special categories of data will only be collected to a limited extent and only if required by applicable local laws and if the processing of such data is relevant for the purposes intended.

If you are a SWISS ROCKETS employee, we may gather further information about you via our internal HR management systems, including your personnel number, current position and performance details.

The provision of personal data as described in this Privacy Notice is necessary for the processing purposes described above. While the provision of your personal data is generally voluntary, you may not be able to benefit from the processing purposes if you do not provide the personal data.

By submitting your application via our website, by email, by post or by any other means, you give your consent to the processing of your personal data to the extent necessary to manage your application. If applicable, we may further process your personal data as far as necessary to potentially carry out the recruitment process and conclude an employment contract. In addition, SWISS ROCKETS may process your personal data only if required or permitted by law or if the processing is justified by legitimate business interests. The data collected will be processed for managing your application and recruitment process, assessing your professional competences for the job, and ensuring compliance with applicable laws and regulations.

In the event of a successful application, we store your personal data for as long as the employment relationship lasts and beyond that for as long as provided by law (generally no longer than 10 years). If your application is not successful, we will delete your data within six m onths.

2. Who might SWISS ROCKETS share your personal data with?

In the course of our activities and for the same purposes as those listed in this Privacy Notice, your personal data, as listed in section 1, may be accessed by or transferred to other parties, including:

• SWISS ROCKETS Group companies: SWISS ROCKETS may share your personal data with SWISS ROCKETS Group affiliates as necessary for the processing purposes as described in this Privacy Notice. Any access to your personal data within the SWISS ROCKETS Group is restricted to those individuals who have a need-to-know authorization in order to fulfill their professional responsibilities.
• Certain acquiring or acquired entities: If SWISS ROCKETS is sold or transferred in whole or in part, or if another entity is being acquired by or integrated into SWISS ROCKETS (or any similar transaction is being contemplated), your personal data may be transferred, based on our legitimate interest in participating in such transactions, to the other entity prior to or after the transaction, subject to any rights provided by applicable law, including in jurisdictions where the other entity is located.
• Data processors: Certain service providers such as IT support, recuriters, logistics and marketing providers  ("processors") may receive personal data based on our legitimate interest to process such data on our behalf and under appropriate instructions to the extent necessary for the processing purposes described in this Privacy Notice, in particular for technical maintenance of our website and products and other administrative support, assistance in complying with applicable laws, recruitment purposes, handling of product/services complaints, and marketing and other activities. Processors are contractually obligated to implement appropriate technical and organizational security measures to safeguard your personal data and to process personal data only on our instructions. For more information about our service providers, please contact us as described in section 12.
• Certain other third parties: Your personal data may need to be shared with professional advisors, regulators, governmental authorities and other similar bodies, for example in cases where we are required by applicable law, court order or government regulation, or as necessary for corporate audits or to investigate or respond to a complaint or security threat.  

As a matter of principle, we process personal data in Switzerland and the European Economic Area (EEA). However, some of the recipients with whom we may share your personal data may be located in countries that do not ensure the same level of data protection like in your country, including Serbia, and, via our suppliers, to the US any other country in the world . Any such transfer will be conducted in compliance with applicable law.

Before disclosing your personal data to persons in those countries, we take appropriate safeguards to ensure that your data is protected to the same standards as in your country, either by relying on an adequacy decision by the EU Commission (https://ec.europa.eu/adequacy-decisions_en) and/or the Swiss Federal Council, by entering into Standard Contractual Clauses as approved by the EU Commission or the Swiss Federal Data Protection and Information Commissioner respectively, or in some limited cases, based on your explicit consent. For further information about these safeguards or to receive a copy, please contact us as described in section 12.

3. Who do we secure your personal data?

We take appropriate technical and organizational measures to secure your personal data from unauthorized access, loss and misuse. These measures include instructions to employees, access regulations and restrictions as well as the encryption of data carriers.

Access to our website is via transport encryption (SSL / TLS, in particular with the Hypertext Transfer Protocol Secure, abbreviated HTTPS). Most browsers mark transport encryption with a padlock in the address bar.

4. How long do we store your personal data?

We will only retain personal data for as long as necessary to fulfill the purpose for which it was collected or to comply with legal or regulatory requirements, but not longer than 10 years. 
When we no longer need to use your personal data, we will remove it from our systems and records and/or take steps to anonymize it so that you can no longer be identified from it (unless we need to keep your data in order to comply with legal or regulatory obligations to which SWISS ROCKETS is subject). If we anonymize data, we may use such data without further notice.

5. Cookies and tracking technologies, social networks

When you access our website, we ask you to consent (opt-in) to the collection and use of cookies (other than strictly necessary cookies for the website to function) and tracking technologies, such as Google Analytics.

5.1. Cookies

Cookies are small text files placed on your computer. We collect this information, either directly or through third parties, to provide our services and store your preferences and settings, enable you to sign in to websites or applications, provide interest-based marketing, combat fraud, and analyze how our services are performing.

In the case of cookies that are used to measure success and reach or for advertising, a general objection ("opt-out") is possible for numerous services via AdChoices  (Digital Advertising Alliance of Canada), the  Network Advertising Initiative (NAI),  YourAd-Choices (Digital Advertising Alliance) or  Your Online  Choices (European Interactive Digital Advertising Alliance, EDAA).

5.2. Google Analytics

We use web analytics services, such as Google Analytics to collect website analytics. Google Analytics uses cookies and similar technologies to analyze how users use the domains and provide other services related to the website and internet use. The information generated about your website usage, including your anonymized IP address, is transmitted to Google Analytics and stored on servers in the US. Google will use this information to evaluate your use of the website (without knowing who you are), to compile statistical reports on website activity, and to provide other services related to the website and the internet use activity. Google may also transfer this information to third parties where required to do so by law, or where such third parties process the information on Google's behalf.

As with all our cookies, Google Analytics is only activated with your consent. You may give or withdraw your consent at any time by using the Cookie Settings on the SWISS ROCKETS website. You may also deactivate Google Analytics by following the instructions provided at https://tools.google.com/dlpage/gaoptout.  

For general information about managing cookies, please go to http://www.allaboutcookies.org/manage-cookies/index.html .

Besides Google Analytics, we may use a number of technologies offered by different providers to support website analytics and user tracking, including technologies offered by the providers listed below.

5.3. Social Networks

We maintain SWISS ROCKETS pages in the social networks Facebook, LinkedIn and Instagram to inform about our services, activities and news and to communicate with active customers and/or other stakeholders. The respective social network collects your personal data, especially by means of cookies, which are usually used for market research and advertising purposes. The processing may take place outside the European Union.

If you visit one of our social media sites, we are jointly responsible with the operator of the social media platform for the data processing. You can assert your rights as defined in section 10 both against us and/or against the operator of the respective social media portal. If you contact us and not the social media portal, we will inform the relevant portal about your question or complaint and provide them with the required information to respond to your request. Please note that despite the joint responsibility, we do not have any influence on the data processing procedures of the social media portals. For further information, please refer to the terms of use and privacy policies of the respective social media portals. We do not know how the platforms use the data from visits to the website for their own purposes or how long the data is stored by the platforms or passed on to third parties. The primary responsibility for the processing of the data lies by the responsible social media portal which complies with the obligations under applicable data protection law.

For further information, please refer to the terms of use and privacy policies of the respective social media portals:

Facebook:

We have a profile on Facebook. The provider is Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. You can adjust your advertising settings independently in your user account by the following link: https://www.facebook.com/settings?tab=ads. Details on how Facebook processes personal data, including the legal basis as well as your rights, can be found in the privacy notice of Facebook: https://www.facebook.com/about/privacy/.

For our social media presence on Facebook, where the GDPR is applicable, we are jointly responsible with Meta Platforms Ireland Limited (Meta), including the so-called page insights. Meta Platforms Ireland Limited is part of  the Meta companies  (including in the USA). The page insights provide information on how visitors interact with our Facebook presence. We use Page Insights to provide our social media presence on Facebook in an effective and user-friendly way.

Further information on the type, scope and purpose of data processing, information on the rights of data subjects and the contact details of Facebook and Facebook's data protection officer can be found in Facebook's privacy policy. We have entered into the so-called  "Controller Addendum"  with Facebook, agreeing in particular that Facebook is responsible for safeguarding certain rights of data subjects. For the so-called Page Insights, the corresponding information can be found on the page  "Information on Page Insights", including "Information on Page Data".

Instagram:

We have a profile on Instagram. The provider is Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. You can adjust your advertising settings independently in your user account by this link. Details on how Instagram processes personal data, including the legal basis as well as your rights, can be found in the privacy notice of Instagram.

For our social media presence on Instagram, where the GDPR is applicable, we are jointly responsible with Meta Platforms Ireland Limited (Meta), including the so-called page insights. Meta Platforms Ireland Limited is part of  the Meta companies  (including in the USA). The page insights provide information on how visitors interact with our Instagram presence. We use Page Insights to provide our social media presence on Instagram in an effective and user-friendly way.

Further information on the type, scope and purpose of data processing, information on the rights of data subjects and the contact details of Instagram and Instagram's data protection officer can be found in Instagrams' privacy policy. The above mentioned  "Controller Addendum" is also applicable for our Instagram presence and states that certain rights of data subjects are safeguarded by Instagram respectively Meta Platforms Ireland Ltd.

LinkedIn:

We use the employment-oriented service LinkedIn. The provider is in the EEA or the UK: LinkedIn Ireland Unlimited Company, Gardner House, 2 Wilton Pl, Dublin 2, D02 CA30, Ireland, and outside the EEA and the UK: LinkedIn Inc, 1000 W. Maude Avenue Sunnyvale, CA 94085, USA. You can adjust your LinkedIn privacy settings independently in your user account by following this link.

Details can be found in the privacy policy of LinkedIn.

For our social media presence on LinkedIn, where the GDPR is applicable, we are jointly responsible with LinkedIn Ireland. LinkedIn shall be responsible for ensuring the rights of data subjects. If you contact us to exercise your rights as defined in section 10 concerning the processing of your personal data by LinkedIn, we will inform and cooperate with LinkedIn to enable LinkedIn to respond to your request. The applicable "Controller Addendum" with LinkedIn can be found by following the link: https://legal.linkedin.com/pages-joint-controller-addendum.

5.4. Social Plug-ins

Our website incorporates social plug-ins, button from the social media network LinkedIn that allows you to share information with your contacts and directly access our social media platforms.

To ensure that you have full data control, the button used establish direct contact between the respective social network and the visitor only when you actively click on the button.

By activating the social media plug-in, you consent to the transmission of the following data to the social media operators: IP address, browser information, operating system, screen resolution, installed browser plug-ins such as Adobe Flash Player, previous website if you followed a link (referrer), the URL of the current website, etc. You further explicitly consent to the transmission of your data cross-border, including to the US.

The next time you visit the website, the social media plug-ins are again provided in the preset inactive mode, so that it is ensured that no data is transmitted without your consent.

5.5. Server log files

We may collect the following information for each access to our website, provided that this information is transmitted by your browser to our server infrastructure or can be determined by our web server: Date and time including time zone, IP Address, access status (HTTP status code), operating system including user interface and version, browser including language and version, individual sub-page of our website accessed including amount of data transferred, last accessed in the same browser window (referrer or referrer).
We store such information, which may also constitute personal data, in server log files. We collect and process such data due to legitimate interests. The information is required in order to provide our website in a permanent, user-friendly and reliable manner and to ensure data security and thus in particular the protection of personal data -- also by third parties or with the help of third parties.

5.6. Tracking pixels

We may use web beacons on our website and out E-Mail News Letters/Investor E-Mail Alerts. Tracking pixels are also known as web beacons. Tracking pixels -- also from third parties whose services we use -- are small, usually invisible images that are automatically removed when you visit our website. Tracking pixels can be used to collect the same information as in server log files (see above).

6. Notification and Communications

We send notifications and communications by e-mail and other communication channels such as instant messaging or SMS.

6.1. Measuring success and reach

Notifications and messages may contain web links or tracking pixels that record whether an individual message has been opened and which web links have been clicked on. Such web links and tracking pixels can also record the use of notifications and messages on a personal basis. We need this statistical recording of usage to measure success and reach in order to be able to send notifications and messages based on the needs and reading habits of the recipients in an effective and user-friendly manner as well as permanently, securely and reliably.

6.2. Consent and objection

As a matter of principle, you must  expressly consent to the use of your e-mail address and your other contact addresses, unless the use is permitted for other legal reasons. If possible, we use the "double opt-in" procedure for any consent, i.e. you will receive an e-mail with a web link that you must click to confirm so that no misuse by unauthorized third parties can take place. We may log such consents, including IP address  and date and time, for evidentiary and security reasons.

You can object to receiving notifications and communications such as newsletters at any time. With such an objection, you can at the same time object to the statistical recording of usage for the measurement of success and reach. We reserve the right to make necessary notifications and communications in connection with our activities and services.

6.3. Service providers for notification

We send notifications and messages with the help of specialized service providers.

In particular, we use with prior written consent:

• Mailchimp: Communication platform; Provider: The Rocket Science Group LLC DBA Mailchimp (USA) as a subsidiary of Intuit Inc. (USA); Data protection information:  Privacy Policy (Intuit)  including "Country and Region-Specific Terms", "Mailchimp Data Protection FAQs", "Mailchimp and European Data Transfers", "Security", Cookie Policy, "Privacy Rights Requests" , "Legal  Provisions".

7. Third-party services

We use the services of specialized third parties in order to be able to carry out our activities and services in a continuous, user-friendly, secure and reliable manner. With such services, we can, among other things, embed functions and content into our website. In the case of such embedding, the services used record  the IP addresses of the users at least temporarily for technically compelling reasons.

For necessary security-related, statistical and technical purposes, third parties whose services we use may process data in connection with our activities and services in an aggregated, anonymized or pseudonymized manner. It is, for example, performance or usage data in order to be able to offer the respective service.

In particular, we use due to legitimate interests:

• Google services:  Google LLC (USA) / Google Ireland Limited (Ireland) for users in the European Economic Area (EEA) and Switzerland; General  information on data protection: «Privacy and security principles», data protection declaration, «Google is committed  to complying with applicable data protection laws», «Guide to data protection in Google products»   , «How we use  data from websites or  apps on or in which our services are used» (information from Google), «Types of cookies and other technologies used by Google», «Personalized  advertising» (activation / deactivation / settings).
• Services provided by Microsoft:  Microsoft Corporation (USA) / Microsoft Ireland Operations Limited (Ireland) for users in the European Economic Area (EEA), the United Kingdom and Switzerland; General information on data protection: «Data protection at Microsoft», «Data protection and privacy (Trust Center)», Privacy policy,  Privacy dashboard (data and privacy settings). 

7.1. Digital infrastructure

We use the services of specialized third parties in order to be able to make use of the necessary digital infrastructure in connection with the fulfillment of our activities and services. These include, for example, hosting and storage services from selected providers.

In particular, we use due to legitimate interests:

• Amazon Web Services (AWS):  storage and other infrastructure; Providers: Amazon Web Services Inc. (USA) for users in Switzerland / Amazon Web Services EMEA SARL (Luxembourg) for users in the European Economic Area (EEA); Information on  data protection: Privacy Policy, «Data Protection Centre», «Frequently asked questions about data protection», «General Data Protection Regulation (GDPR) Centre» .
• Digital Ocean: Digital infrastructure; Provider: DigitalOcean LLC (USA); Information on data protection: Privacy Policy, «Trust Platform».

7.2. Scheduling

We use the services of specialized third parties to make appointments online, for example for meetings. In addition to this data protection declaration, any directly visible terms and conditions of the services used, such as terms of use or data protection declarations, shall also apply in each case.

In particular, we use due to legitimate interests:

• Doodle: Online scheduling; Provider: Doodle AG (Switzerland) as a subsidiary of TX Group AG (Switzerland); Information on data protection: Privacy Policy, "General  Terms and Conditions of the Process-sing of  Personal Data".
• Microsoft Bookings: Online Scheduling; Provider: Microsoft; Microsoft Bookings- specific information: «Microsoft Bookings: frequently asked questions».

7.3. Audio and video conferencing

We use specialized services for audio and video conferencing to communicate online. For example, we can use it to hold virtual meetings or conduct online lessons and webinars. For participation in audio and video conferences, the legal texts of the individual services, such as data protection declarations and terms of use, also apply.

Depending on your life situation, we recommend muting the microphone by default when participating in audio or video conferences, as well as blurring the background or displaying a virtual background.

In particular, we use due to legitimate interests:

• Microsoft Teams:  Platform for audio and video conferencing, among other things; Provider: Microsoft; Teams-specific information: "Data protection and Microsoft Teams".
• Zoom: Video conferencing; Provider: Zoom Video Communications Inc. (USA); Information on data protection: Privacy Policy,  "Data Protection at Zoom", "Legal Compliance  Center".

7.4. Online Collaboration

We use third-party services to enable online collaboration. In addition to this data protection declaration, any directly visible terms and conditions of the services used, such as terms of use or data protection declarations, also apply.

In particular, we use due to legitimate interests:

• Miro: Whiteboard platform; Provider: RealtimeBoard Inc. (USA); Information on data protection: Privacy Policy,  "Trust in Miro" ("Miro Trust Center").

7.5. Maps

Our website uses the map service Google Maps via an API. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. In order to use the functions of Google Maps, it is necessary to save your IP address. This information is usually transferred to a Google server in the USA and stored there. Before you access Google Maps from our website, you will be asked to consent to the transfer of your personal data to the USA. After you have closed the Google Maps page, your personal data will no longer be transferred.  Please note that we have no control over how Google processes your personal data. To learn more about this, please read Google's privacy policy: https://policies.google.com/privacy?hl=en-US.  

8. Extensions for the website

We use extensions for our website in order to be able to use additional functions.

9. Measuring success and reach

We try to determine how our online offer is used. In this context, we can, for example, measure the success and reach of our activities and services as well as the effect of third-party links to our website. However, we can also try out and compare how different parts or versions of our online offer are used ("A/B test" method). Based on the results of the success and reach measurement, we can in particular correct errors, strengthen popular content or make improvements to our online offering.

In most cases, the IP addresses of individual users are stored to measure success and reach. In this case, IP addresses are generally shortened ("IP masking") in order to follow the principle of data economy through the appropriate pseudonymization.
Cookies can be used to measure success and reach and user profiles can be created. Any user profiles created include, for example, the individual pages visited or content viewed on our website, information on the size of the screen or browser window and the -- at least approximate -- location. As a matter of principle, any user profiles are created exclusively pseudonymously and are not used to identify individual users. Individual third-party services to which users are logged in may assign the use of our online offer to the user account or user profile of the respective service.

In particular, we currently use with your prior consent: Google Analytics (see Section 5.2).

10. Links to other websites

Our website may feature links to third-party websites that we believe are useful and informative. However, we are not responsible for the privacy practices of the operators of these other websites. If you access any third-party link on our website, we encourage you to read the privacy notices of each website you visit.

11. What are your rights and how can you exercise them?

According to applicable data protection law and under the conditions and within the limits set forth in law, you may exercise the following rights:

• the right to withdraw your consent: if, in accordance with applicable law, you have declared your consent regarding certain types of processing activities (in particular regarding the receipt of direct marketing communications via email, SMS/MMS, fax, and telephone), you can withdraw this consent at any time with respect to future processing by using the methods mentioned in the original or any related communication (e.g. for newsletters by clicking on the link "Unsubscribe" at the bottom of a marketing email or otherwise by contacting our Data Protection Officer via email, mail or phone as described in section 12 of this Privacy Notice). Such a withdrawal will not affect the lawfulness of the processing prior to the consent withdrawal. You can also withdraw your consent by contacting us as set out below;
• the right to request access to your personal data, respectively to obtain from us confirmation as to whether or not personal data concerning you is processed, and, where that is the case, to request access to the personal data;
• the right to request rectification of inaccurate personal data concerning you;
• the right to request erasure of your personal data, under certain conditions;
• the right to request restriction of processing, under certain conditions. In this case, the respective data will be marked and may only be processed for specific purposes as defined by law;
• the right to request data portability: As provided by applicable data protection law, you may -- in cases where processing is based on consent or the performance of a contract, and the processing is carried out through automated means -- have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format and you may have the right to transmit those data to another entity without hindrance from us;
• the right to object: Under certain circumstances, you have the right to object, on grounds relating to your particular situation, at any time to the processing of your personal data by us and in such circumstances, we are required to cease processing your personal data. If you have a right to object and if you exercise this right, your personal data will no longer be processed for such purposes by us.

To exercise your rights, please contact us as described in section 12 below.

You also have the right to enforce your data protection claims by legal means or to lodge a complaint with a competent data protection supervisory authority.

The data protection supervisory authority for private controllers and federal bodies in Switzerland is the Federal Data Protection and Information Commissioner  (FDPIC).

If and to the extent that the General Data Protection Regulation (GDPR) is applicable, data subjects have the right to lodge a complaint with a competent European data protection supervisory  authority.

12. How can you contact us?

If you have any questions about this Privacy Notice, please reach out to us via dpo@swissrockets.com, or if you are in the EEA, via our representative based in Germany at contact@swissrockets.com.

We may amend and supplement this privacy policy at any time in order to comply with latest data protection regulation. We will inform you about such adjustments and additions in an appropriate form, in particular by publishing the current data protection declaration on our website.