Data protection
In this privacy policy, you’ll find information about what personal data we process and for what purpose, how and where we process it – particularly in connection with our doma-tech.ch website and our other services. This privacy policy also contains information about the rights of data subjects whose data we process.
Special, supplementary or additional privacy policies, as well as other legal documents like general terms and conditions (GTCs), terms of use or conditions of participation, may apply to individual or additional websites and services.
Our website is subject to Swiss data protection law, as well as any applicable foreign data protection law, particularly that of the European Union (EU) with the General Data Protection Regulation (GDPR). The European Commission recognises that Swiss data protection law ensures adequate data protection.
1. Contact addresses
Controller responsible for personal data processing:
Doma-Tech Mainardi AG
Schmitterstrasse 7
9444 Diepoldsau
Switzerland
We will make you aware if there are other controllers responsible for personal data processing on a case-by-case basis.
2. Personal data processing
2.1 Terms and definitions
‘Personal data’ means all the information relating to an identified or identifiable person. A ‘data subject’ is a person about whom personal data is processed. ‘Processing’ includes any handling of personal data, regardless of the means and technologies used, particularly the storage, disclosure, acquisition, collection, erasure, storage, modification, destruction and use of personal data.
The ‘European Economic Area’ (EEA) consists of the European Union (EU) and the Principality of Liechtenstein, Iceland and Norway. The General Data Protection Regulation (GDPR) refers to the processing of personal data as ‘personal data processing’.
2.2 Legal bases
We process personal data in accordance with Swiss data protection law, particularly the Federal Act on Data Protection (FDAP) and the Ordinance to the Federal Act on Data Protection (DPO).
If and to the extent that the General Data Protection Regulation (GDPR) is applicable, we process personal data in accordance with at least one of the following legal bases:
- Art. 6 (1) (b) of the GDPR where personal data processing is necessary for the performance of a contract with the data subject, as well as for the implementation of pre-contractual measures.
- Art. 6 (1) (f) of the GDPR where personal data processing is necessary to protect the legitimate interests of third parties or ourselves, unless the data subject’s fundamental rights and freedoms take precedence. ‘Legitimate interests’ particularly include our interest in being able to continuously provide our website in a user-friendly, secure and reliable manner and being able to advertise it as required, as well as our interest in information security and protection against misuse and unauthorised use, the enforcement of our own legal claims and compliance with Swiss legislation.
- Art. 6 (1) (c) of the GDPR where personal data processing is necessary to comply with a legal obligation that we are subject to under any applicable law of member states in the European Economic Area (EEA).
- Art. 6 (1) (e) of the GDPR where personal data processing is necessary for the performance of a task carried out in the public interest.
- Art. 6 (1) (a) of the GDPR where personal data is processed with the data subject’s consent.
- Art. 6 (1) (d) of the GDPR where personal data processing is necessary to protect the vital interests of the data subject or of another natural person.
2.3 Nature, scope and purpose
We process the personal data necessary to continuously provide our website in a user-friendly, secure and reliable manner. Such personal data may particularly fall under the categories of inventory and contact data, browser and device data, content data, meta or marginal data and usage data, location data as well as sales, contract and payment data.
We process personal data for the period of time necessary for the relevant purpose or as required by law. Where personal data processing is no longer necessary, the personal data is anonymised or erased. Individuals whose data we process generally have the right to have their data erased.
As a matter of principle, we only process personal data with the data subject’s consent, unless processing is permissible on other legal grounds, such as performance of a contract with the data subject and to implement corresponding pre-contractual measures, to protect our overriding legitimate interests, because processing is evident from the circumstances or following prior information.
In this context, we particularly process information that a data subject voluntarily provides to us themselves when contacting us – e.g. by post, by email, using the contact form, over social media or over the phone – or when registering for a user account. For example, we may store such information in an address book or using similar means. If you transfer personal data to us through third parties, you are obligated to guarantee data protection vis-à-vis such third parties and to ensure the accuracy of such personal data.
We also process personal data that we receive from third parties, obtain from publicly accessible sources or collect in the course of providing our website, if and to the extent that such processing is permitted on legal grounds.
2.4 Personal data processing by third parties (including abroad)
We may have personal data processed by third parties we engage or process the same jointly with or with the help of third parties, or transfer it to third parties. Such third parties particularly include providers whose services we use. We also ensure appropriate data protection for such third parties.
Such third parties are generally located in Switzerland and in the European Economic Area (EEA). However, such third parties may also be located in other states and territories around the world, and elsewhere in the universe, provided that their data protection law ensures adequate data protection in the opinion of the Federal Data Protection and Information Commissioner (FDPIC) and – if and to the extent that the General Data Protection Regulation (GDPR) is applicable – in the opinion of the European Commission, or if adequate data protection is guaranteed on other grounds, e.g. due to a corresponding contractual agreement, particularly based on the standard contractual clauses, or due to corresponding certification. Such a third party may exceptionally be located in a country that does not offer adequate data protection, provided that the prerequisites under data protection law (such as the data subject’s explicit consent) are met.
3. Rights of data subjects
Data subjects whose personal data we process have the rights outlined under Swiss data protection law. This includes the right of access, as well as the right to have the processed personal data rectified, erased or blocked.
Data subjects whose personal data we process may – if and to the extent that the General Data Protection Regulation (GDPR) is applicable – request confirmation free of charge as to whether we are processing their personal data and, if so, request information about the processing of their personal data, have the processing of their personal data restricted, exercise their right to data portability and have their personal data rectified, erased (‘right to be forgotten’), blocked or completed.
Data subjects whose personal data we process may – if and to the extent that the GDPR is applicable – revoke consent given at any time with effect for the future and object to the processing of their personal data at any time.
Data subjects whose personal data we process have a right to lodge a complaint with a competent supervisory authority. The supervisory authority for data protection in Switzerland is the Federal Data Protection and Information Commissioner (FDPIC).
4. Data security
We implement appropriate and suitable technical and organisational measures to ensure data protection and, in particular, data security. However, despite us taking such measures, online personal data processing may always be subject to security vulnerabilities. As a result, we cannot guarantee absolute data security.
Access to our website takes place by means of transport encryption (SSL/TLS, particularly with Hypertext Transfer Protocol Secure, known as ‘HTTPS’ for short). Most browsers indicate transport encryption by means of a padlock in the address bar.
Just like any use of the Internet, access to our website is subject to mass surveillance without cause and without suspicion, as well as other surveillance by security authorities in Switzerland, the European Union (EU), the United States of America (USA) and other countries. We cannot directly influence the corresponding personal data processing by secret services, police agencies and other security authorities.
5. Using the website
5.1 Cookies
We may use cookies for our website. Cookies – both our own cookies (‘first-party cookies’) and cookies from third parties whose services we use (‘third-party cookies’) – are data that is stored in your browser. Such stored data does not need to be limited to traditional textual cookies. Cookies cannot run any programs or transfer malware like trojans and viruses.
When you visit our website, cookies can be stored in your browser temporarily as ‘session cookies’ or for a certain period of time as ‘permanent cookies’. Session cookies are automatically deleted when you close your browser. Permanent cookies have a specific storage period. In particular, they enable us to recognise your browser the next time you visit our website and therefore to measure our website’s reach, for example. Permanent cookies can also be used for online marketing purposes, for example.
You can completely or partially disable or delete cookies in your browser settings at any time. Our website may no longer be fully available without cookies. We actively seek your explicit consent for the use of cookies, if and when required.
In the case of cookies used to measure performance and reach, or for advertising purposes, a general objection (‘opt-out’) is possible for numerous services through the Network Advertising Initiative (NAI), YourAdChoices (Digital Advertising Alliance) or Your Online Choices (European Interactive Digital Advertising Alliance, EDAA).
5.2 Server log files
We may collect the following information each time you access our website, provided that this information is transferred by your browser to our server infrastructure or can be determined by our web server: date and time including time zone, Internet Protocol (IP) address, access status (HTTP status code), operating system including user interface and version, browser including language and version, individual sub-page of our website accessed including amount of data transferred, website last accessed in the same browser window (referrer).
We store such information, which may also constitute personal data, in server log files. The information is necessary to continuously provide our website in a user-friendly and reliable manner, as well as to be able to ensure data security and thus, in particular, personal data protection – also by or with the help of third parties.
5.3 Tracking pixels
We may use tracking pixels on our website. Tracking pixels are also known as ‘web beacons’. Tracking pixels – also from third parties whose services we use – are small, usually invisible images that are automatically retrieved when you visit our website. Tracking pixels can be used to collect the same information as server log files.
6. Social media
We have a presence on social media and other online platforms to communicate with interested individuals and provide information about the products and services we offer. Personal data may also be processed outside Switzerland and the European Economic Area (EEA).
The General Terms and Conditions (GTCs) and terms of use, as well as privacy policies and other provisions set out by the individual operators of such online platforms, also apply in each case. These provisions provide information particularly about the rights of data subjects, which include the right of access in particular.
7. Measuring performance and reach
We use services and programs to determine how our website is used. In this context, we can, for example, measure our website’s performance and reach, as well as the effect of third-party links to our website. However, we can also, for example, test and compare how different versions of our website or parts of our website are used (‘A/B test’ method). The results of the performance and reach measurement allow us to, in particular, correct errors, strengthen particularly popular content or make improvements to our website.
Individual users’ Internet Protocol (IP) addresses must be stored when using services and programs to measure performance and reach. IP addresses are generally truncated to follow the principle of data economy through corresponding pseudonymisation and to improve the data protection of visitors to our website (‘IP masking’).
Cookies may be used and user profiles created when we use services and programs that are designed to measure performance and reach. User profiles include, for example, the pages visited or content viewed on our website, information about the size of the screen or browser window and the – at least approximate – location. In principle, user profiles are created exclusively on a pseudonymous basis. We do not use user profiles to identify individual visitors to our website. Individual services that you are signed into as a user may assign the use of our website to your profile with the service in question, whereby you usually have to give your consent to this assignment in advance.
In particular, we use:
- Google Analytics:
Performance and reach measurement; providers: Google LLC (USA)/Google Ireland Limited (Ireland) for users in the European Economic Area (EEA) and Switzerland; data protection information: measurement also across different browsers and devices (cross-device tracking), as well as with pseudonymised Internet Protocol (IP) addresses, which are only transferred in full to Google in the USA in exceptional cases, ‘Privacy and security principles’, Privacy policy, ‘A guide to data protection in Google products’ (including Google Analytics), ‘How we use websites or apps that our services are used on or in’ (information from Google), ‘How Google uses cookies’, ‘Browser add-on for disabling Google Analytics’, ‘Personalised advertising’ (activation/deactivation/settings).
- Google Tag Manager:
Integration and management of services for measuring performance and reach, as well as other services from Google and third parties; provider: Google LLC (USA)/Google Ireland Limited (Ireland) for users in the European Economic Area (EEA) and Switzerland; data protection information can be found in connection with the integrated and managed services.
- Hotjar:
Recording of user behaviour; provider: Hotjar Ltd. (Malta); data protection information: recording without reference to individual website visitors, e.g. in relation to movements and clicks with a mouse or with any other input device, ‘Your Privacy & Hotjar’, Privacy policy, ‘Hotjar Cookie Information’, ‘Do Not Track: Do you want to tell Hotjar not to collect your data?’.
- WordPress.com Stats:
Performance and reach measurement; providers: Automattic Inc. (USA)/Aut O’Mattic A8C Ireland Ltd. (Ireland) for users in Europe, among other countries; data protection information: Jetpack extension module for the free blog software WordPress, ‘Privacy Notice for Visitors to Our Users’ Sites’, Privacy policy (Automattic), ‘Jetpack Privacy Center’, Cookie policy.
8. Third-party services
We use third-party services so we can continuously provide our website in a user-friendly, secure and reliable manner. Services such as these are also used to embed content in our website. Such services – e.g. hosting and storage services, video services and payment services – require your Internet Protocol (IP) address, otherwise they cannot transfer the relevant content. Such services may be located outside of Switzerland and the European Economic Area (EEA), provided that adequate data protection is guaranteed.
For their own security-related, statistical and technical purposes, third parties whose services we use may also process data in connection with our website and from other sources – including cookies, log files and tracking pixels – in aggregated, anonymised or pseudonymous form.
8.1 Digital infrastructure
We use third-party services so we can make use of the required digital infrastructure for our website. These include, for example, hosting and storage services from specialist providers.
In particular, we use:
- Hoststar:
Hosting; provider: Multimedia Networks AG (Switzerland); data protection information: Privacy policy.
- WordPress.com:
Blog hosting and website builder; providers: Automattic Inc. (USA)/Aut O’Mattic A8C Ireland Ltd. (Ireland) for users in Europe, among other countries; data protection information: Privacy policy, ‘Automattic and the General Data Protection Regulation (GDPR)’, Cookie policy.
8.2 Map material
We use third-party services to embed maps in our website.
In particular, we use:
- Google Maps, including Google Maps Platform:
Maps service; providers: Google LLC (USA)/Google Ireland Limited (Ireland) for users in the European Economic Area (EEA) and Switzerland; data protection information: ‘Privacy and security principles’, Privacy policy, ‘A guide to data protection in Google products’ (including Google Maps), ‘How we use websites or apps that our services are used on or in’ (information from Google), ‘How Google uses cookies’, ‘Personalised advertising’ (activation/deactivation/settings).
8.3 Audiovisual media
We use third-party services to enable the direct playback of audiovisual media such as music or videos on our website.
In particular, we use:
- YouTube:
Videos; providers: Google LLC (USA)/Google Ireland Limited (Ireland) for users in the European Economic Area (EEA) and Switzerland; data protection information: ‘Privacy and security principles’, Privacy policy, ‘A guide to data protection in Google products’ (including YouTube), ‘How Google uses cookies’, ‘Personalised advertising’ (activation/deactivation/settings).
8.4 Fonts
We use third-party services to embed selected fonts, icons, logos and symbols on our website.
In particular, we use:
- Font Awesome:
Icons and logos; provider: Fonticons Inc. (USA); data protection information: Privacy policy.
- Google Fonts:
Fonts; providers: Google LLC (USA)/Google Ireland Limited (Ireland) for users in the European Economic Area (EEA) and Switzerland; data protection information: ‘What does using the Google Fonts API mean for the privacy of my users?’, ‘Privacy and security principles’, Privacy policy.
8.5 Advertising
8.5.1 Facebook Ads
We use Facebook Ads so we can specifically advertise our website on Facebook. Facebook Ads is a service provided by Facebook Ireland Ltd. in Ireland or Facebook Inc. in the USA. Cookies are also used in Facebook Ads.
By way of such advertising, we would like to reach people who are interested in or already use our website in particular. For this purpose, we transfer relevant information that may also be personal to Facebook (Custom Audiences including Lookalike Audiences), particularly with what is known as the ‘Facebook pixel’. We can also determine whether our advertising is successful, i.e. whether it leads to visits to our website (conversion tracking).
For more information about the nature, scope and purpose of data processing, please refer to Facebook’s privacy policy (‘Data Policy’). In addition, Facebook users can use advertising preferences to influence what ads they see on Facebook and what ads they will see on Facebook in the future.
8.5.2 Google Ads
We use Google Ads (formerly AdWords) to specifically advertise our website on the Google search engine and elsewhere on the Internet, e.g. on other websites, based on search queries among other things. Google Ads is a service provided by the American company Google LLC. The Irish company Google Ireland Limited is responsible for users in the European Economic Area (EEA) and Switzerland. Cookies are also used in Google Ads. Google uses various domain names – notably doubleclick.net, googleadservices.com and googlesyndication.com – for Google Ads.
By way of such advertising, we would like to reach people who are interested in or already use our website in particular. For this purpose, we transfer relevant information that may also be personal to Google (remarketing). We can also determine whether our advertising is successful, i.e. whether it leads to visits to our website (conversion tracking).
For more information about the nature, scope and purpose of data processing, please refer to Google’s privacy and security principles, privacy policy, information about how Google uses data from websites that Google services are used on and information about how Google uses cookies. You can also object to personalised advertising.
8.5.3 Instagram Ads
We use Instagram Ads so we can specifically advertise our website on Instagram. Instagram Ads is a service provided by Facebook Ireland Limited in Ireland and Facebook Inc. in the USA. Cookies may also be used during this process.
By way of such advertising, we would like to reach people who are interested in or already use our website in particular. For this purpose, we transfer relevant information that may also be personal to Facebook (Custom Audiences including Lookalike Audiences), particularly with what is known as the ‘Facebook pixel’. We can also determine whether our advertising is successful, i.e. whether it leads to visits to our website (conversion tracking).
For more information about the nature, scope and purpose of data processing, please refer to Instagram’s privacy policy and Facebook’s privacy policy (‘Data Policy’). Users can also check what interests the advertising relates to using the Instagram advertising preferences and influence what advertising is shown to them using the Facebook advertising preferences.
8.5.4 LinkedIn Ads
We use LinkedIn Marketing Solutions so we can specifically advertise our website on LinkedIn (LinkedIn Ads). This is a service provided by LinkedIn Ireland Unlimited Company in Ireland or LinkedIn Corporation in the USA. Cookies are also used during this process.
By way of such advertising, we would like to reach people who are interested in or already use our website in particular. For this purpose, we transfer relevant information that may also be personal to LinkedIn, particularly with what is known as the ‘LinkedIn Insight Tag’ (retargeting). We can also determine whether our advertising is successful, i.e. whether it leads to visits to our website (conversion tracking). If you are logged into LinkedIn as a user, LinkedIn can assign your use of our website to your profile.
For more information about the nature, scope and purpose of data processing, please refer to LinkedIn’s privacy policy, cookie policy and privacy portal. You can also object to personalised advertising.
9. Extensions for the website
We use extensions for our website so we can use additional functions.
In particular, we use:
- Akismet:
Spam protection (distinction between desirable comments made by humans and undesirable ones made by bots and spam); providers: Automattic Inc. (USA)/Aut O’Mattic A8C Ireland Ltd. (Ireland) for users in Europe, among other countries; data protection information: ‘Privacy Notice for Visitors to Our Users’ Sites’, Privacy policy (Automattic), Cookie policy.
- Google reCAPTCHA:
Spam protection (distinction between desirable comments made by humans and undesirable ones made by bots and spam); providers: Google LLC (USA)/Google Ireland Limited (Ireland) for users in the European Economic Area (EEA) and Switzerland; data protection information: ‘What is reCAPTCHA?’, ‘Privacy and security principles’, Privacy policy, ‘How Google uses cookies’.
- Jetpack:
Various functions for the free blog software WordPress in the form of modules; providers: Automattic Inc. (USA)/Aut O’Mattic A8C Ireland Ltd. (Ireland) for users in Europe, among other countries; data protection information: ‘Privacy Notice for Visitors to Our Users’ Sites’, Privacy policy (Automattic), ‘Jetpack Privacy Center’, Cookie policy (Jetpack), Cookie policy (Automattic).
10. Final provisions
We created this privacy policy with the Datenschutzpartner privacy policy generator.
We may adapt and amend this privacy policy at any time. We will provide information about such adaptations and amendments in an appropriate form, particularly by publishing the current privacy policy on our website.