What is this privacy policy about?
Trisa AG (hereinafter also «we», «us») obtains and processes personal data concerning you or other persons (so-called «third parties»). We use the term «data» here synonymously with «personal data» or «personal information».
In this Privacy Policy, we describe what we do with your data when you use www.trisa.ch or the domains (trisa.ch/en; trisa.ch/fr; trisa.hk; trisa.in; trisa.dk; trisa.nl) (hereinafter «Website»), purchase our services or products, are otherwise in contact with us under a contract, communicate with us or otherwise have dealings with us. If necessary, we will inform you of additional processing activities not mentioned in this Privacy Policy by means of a timely written notification.
If you transmit or disclose data about other persons to us, we assume that you are authorized to do so and that this data is correct. By transmitting data about third parties, you confirm this.
Please also ensure that these third parties have been informed of this privacy policy.
This Privacy Policy is designed to meet the requirements of the EU General Data Protection Regulation («DSGVO»), the Swiss Data Protection Act («DSG») and the revised Swiss Data Protection Act («revDSG»). However, whether and to what extent these laws are applicable depends on the individual case.
Who is responsible for processing your data?
Trisa AG, Triengen («Trisa»), is responsible under data protection law for the data processing activities of Trisa AG described in this data protection declaration, unless otherwise communicated in individual cases, e.g. in other data protection declarations, on forms or in contracts. However, unless otherwise communicated, this Privacy Policy also applies to cases in which not Trisa but a group company of the Trisa Group is the controller. This is particularly the case where your data is processed by such a group company in connection with its own legal obligations or contracts or where you share data with such a group company. In these cases, this group company is the controller and only if you share your data with other group companies for their own purposes (see «To whom do we disclose your data») do these other group companies also become controllers.
You can contact us for your data protection concerns and to exercise your rights under «What rights do you have» as follows:
Trisa AG
Kantonsstrasse 31
CH-6234 Triengen
We have appointed the following additional position:
Data Protection Officer pursuant to Art. 37 et seq. GDPR:
Trisa AG
Datenschutzbeauftragter
Kantonsstrasse 31
CH-6234 Triengen
You can also contact this office for data protection concerns.
What data do we process?
We process various categories of data about you. The most important categories are as follows:
Technical data: When you use our website or other electronic offers (e.g. free WLAN), we collect the IP address of your end device and other technical data to ensure the functionality and security of these offers. This data also includes logs in which the use of our systems is recorded. We generally store technical data for 12 months. To ensure the functionality of these offers, we can also assign you or your end device an individual code (e.g. in the form of a cookie, see «Technologies on our website»). The technical data itself does not allow any conclusions to be drawn about your identity. However, in the context of user accounts, registrations, access controls or the processing of contracts, they can be linked to other categories of data (and thus possibly to your person).
Registration data: Certain offers and services (e.g. login areas of our website, competitions, free WLAN access, etc.) can only be used with a user account or registration, which can be done directly with us or via our external login service providers. In doing so, you must provide us with certain data and we collect data on the use of the offer or service. If you redeem a Trisa voucher with us, we may request certain data from you when you redeem it. If we issue you with a voucher for one of our contractual partners, we may transmit or receive certain of your registration data to the respective contractual partner (see «To whom do we disclose your data»). Registration data may be collected during access controls to certain facilities; depending on the control system, biometric data may also be collected. As a rule, we retain registration data for 12 months after the end of use of the service or the termination of the user account.
Communication data: If you are in contact with us via the contact form, by e-mail, telephone, letter or other means of communication, we collect the data exchanged between you and us, including your contact details and the marginal data of the communication. If we record or listen in on telephone conversations or video conferences, e.g. for training and quality assurance purposes, we will make you aware of this. Such recordings may only be made and used in accordance with our internal guidelines. You will be informed if and when such recordings take place, e.g. by a display during the relevant video conference. If you do not wish to be recorded, please let us know or end your participation. If you simply do not wish your image to be recorded, please switch off your camera. If we want or need to establish your identity, e.g. if you request information, apply for media access, etc., we will collect data to identify you (e.g. a copy of your ID). We generally store this data for 12 months from the last exchange with you. This period may be longer if this is necessary for reasons of proof or to comply with legal or contractual requirements or for technical reasons. E-mails in personal mailboxes and written correspondence are generally stored for at least 10 years.
Contract data (see below) for the processing of our contractual and other business relationships or for marketing and advertising purposes, such as name, contact details and information e.g. about your role and function, your bank account(s), your date of birth, customer history, powers of attorney, signature authorizations and declarations of consent. We process your master data if you are a customer or other business contact or work for one (e.g. as a contact person of the business partner), or because we want to contact you for our own purposes or the purposes of a contractual partner (e.g. as part of marketing and advertising, with invitations to events, with vouchers or gifts, with newsletters, etc.). We receive master data from you (e.g. when you make a purchase or register), from bodies for which you work or from third parties such as our contractual partners, associations and address dealers and from publicly accessible sources such as public registers or the internet (websites, social media, etc.). We may also process information about third parties as part of master data. We generally store this data for 10 years from the last exchange with you, but at least from the end of the contract. This period may be longer if this is necessary for reasons of proof or to comply with legal or contractual requirements or for technical reasons. In the case of pure marketing and advertising contacts, the period is normally much shorter, usually no more than 2 years from the last contact.
This is data that arises in connection with the conclusion or execution of a contract, e.g. information on contracts and the services to be provided or provided, as well as data from the run-up to the conclusion of a contract, the information required or used for processing and information on reactions (e.g. complaints or information on satisfaction, etc.). We generally collect this data from you, from contractual partners and from third parties involved in the execution of the contract, but also from third-party sources (e.g. providers of credit rating data) and from publicly accessible sources. As a rule, we store this data for 10 years from the last contractual activity, but at least from the end of the contract. This period may be longer if this is necessary for reasons of proof or to comply with legal or contractual requirements or for technical reasons.
Behavioral and preference data: Depending on the relationship we have with you, we try to get to know you and better tailor our products, services and offers to you. To do this, we collect and use data about your behavior and preferences. We do this by evaluating information about your behavior in our area, and we may also supplement this information with information from third parties, including from publicly accessible sources. Based on this, we can, for example, calculate the probability that you will use certain services or behave in a certain way. Some of the data processed for this purpose is already known to us (e.g. when you use our services), or we obtain this data by recording your behavior (e.g. how you navigate our website). We anonymize or delete this data when it is no longer meaningful for the purposes pursued, which can be between 2-3 weeks (for movement profiles) and 24 months (for product and service preferences), depending on the type of data. This period may be longer if this is necessary for reasons of proof or to comply with legal or contractual requirements or for technical reasons. We describe how tracking works on our website in the section “Technologies on our website”.
Other data: We also collect data from you in other situations. In connection with official or court proceedings, for example, data is collected (such as files, evidence, etc.) that may also relate to you. We may also collect data for health protection reasons (e.g. as part of protection concepts). We may receive or produce photos, videos and audio recordings in which you may be recognizable (e.g. at events, through security cameras, etc.). We may also collect data about who enters certain buildings or has access rights to them and when (including access controls, based on registration data or visitor lists, etc.), who takes part in events or campaigns and when, or who uses our infrastructure and systems and when. The retention period for this data depends on the purpose and is limited to what is necessary. This ranges from a few days for many of the security cameras and usually a few weeks for contact tracing data to visitor data, which is usually stored for 3 months, to reports on events with images, which can be stored for several years or longer.
You provide us with much of the data listed under «What data do we process» yourself (e.g. via forms, as part of communication with us, in connection with contracts, when using the website, etc.). You are not obliged to do so, subject to individual cases, e.g. as part of binding protection concepts (legal obligations). If you wish to conclude contracts with us or make use of services, you must also provide us with data as part of your contractual obligation in accordance with the relevant contract, in particular master data, contract data and registration data. When using our website, the processing of technical data is unavoidable. If you wish to gain access to certain systems or buildings, you must provide us with registration data.
Insofar as this is not prohibited, we also obtain data from publicly accessible sources (e.g. debt collection registers, land registers, commercial registers, media or the internet, including social media) or receive data from other companies within our group, from authorities and from other third parties (such as credit agencies, address dealers, associations, contractual partners, internet analysis services, etc.).
For what purposes do we process your data?
We process your data for the purposes explained below. Further information for the online area can be found in sections 12 and 13. These purposes and the underlying objectives represent legitimate interests on our part and, where applicable, on the part of third parties. You will find further information on the legal basis of our processing in section 5.
We process your data for purposes related to communication with you, in particular to respond to inquiries and assert your rights (section «What rights do you have») and to contact you in the event of queries. In particular, we use communication data and master data for this purpose. We retain this data in order to document our communication with you, for training purposes, for quality assurance and for follow-up questions.
We process data for the establishment, administration and processing of contractual relationships.
We process data for marketing purposes and to maintain relationships, e.g. to send our customers and other contractual partners personalized advertising about our products and services and those of third parties. This may, for example, take the form of newsletters and other regular contacts (electronically, by post, by telephone), via other channels for which we have contact information from you, but also as part of individual marketing campaigns (e.g. events, competitions, etc.) and may also include free services (e.g. invitations, vouchers, gifts, etc.). You can refuse such contacts at any time (see at the end of this section) or refuse or revoke your consent to being contacted for advertising purposes. With your consent, we can target our online advertising on the Internet more specifically to you (see «Technologies on our website»).
- We continue to process your data for market research, to improve our services and operations and for product development.
- We may also process your data for security purposes and for access control.
- We process personal data to comply with laws, instructions and recommendations from authorities and internal regulations («compliance»).
- We also process data for the purposes of our risk management and in the context of prudent corporate governance, including business organization and corporate development.
- We may process your data for other purposes, e.g. as part of our internal processes and administration.
On what basis do we process your data?
If we ask for your consent for certain processing, we will inform you separately about the corresponding purposes of the processing. You can withdraw your consent at any time with effect for the future by sending us written notification (by post) or, unless otherwise stated or agreed, by email; you will find our contact details under “Who is responsible for processing your data”.) To withdraw your consent to online tracking, see the section “Technologies on our website”. If you have a user account, you may also be able to withdraw your consent or contact us via the relevant website or other service. Once we have received notification of the withdrawal of your consent, we will no longer process your data for the purposes to which you originally consented, unless we have another legal basis for doing so. The withdrawal of your consent does not affect the lawfulness of processing based on consent before its withdrawal.
Where we do not ask for your consent for processing, we base the processing of your personal data on the fact that the processing is necessary for the initiation or execution of a contract with you (or the entity you represent) or that we or third parties have a legitimate interest in it, in particular in order to pursue the purposes and associated objectives described above under “For what purposes do we process your data” and to be able to take appropriate measures. Our legitimate interests also include compliance with statutory provisions, insofar as this is not already recognized as a legal basis by the applicable data protection law (e.g. in the case of the GDPR, the law in the EEA and Switzerland). If we receive sensitive data (e.g. health data, information on political, religious or ideological views or biometric data for identification purposes), we may also process your data based on other legal bases, e.g. in the event of disputes due to the necessity of processing for any litigation or the enforcement or defense of legal claims. In individual cases, other legal grounds may apply, which we will communicate to you separately if necessary.
What applies to profiling and automated individual decisions?
We may automatically evaluate certain of your personal characteristics for the purposes stated in the section “For what purposes do we process your data” using your data (“What data do we process”) (“profiling”) if we want to determine preference data, but also to determine abuse and security risks, carry out statistical evaluations or for operational planning purposes. For the same purposes, we can also create profiles, i.e. we can combine behavioral and preference data, but also master and contract data and technical data assigned to you in order to better understand you as a person with your different interests and other characteristics.
In this case, we pay attention to the proportionality and reliability of the results and take measures to prevent misuse of these profiles or profiling. If these can have legal consequences or significant disadvantages for you, we always provide for a manual review.
Who do we disclose your data to?
In connection with our contracts, the website, our services and products, our legal obligations or otherwise to protect our legitimate interests and the other purposes listed under “For what purposes do we process your data”, we also transfer your personal data to third parties, in particular to the following categories of recipients:
Group companies: A list of our group companies can be found here [https://trisa.ch/de/trisa/trisa-gruppe]. The group companies may use the data in accordance with this privacy policy for the same purposes as we do (see “For what purposes do we process your data”).
Service providers: We work with service providers in Switzerland and abroad who process data about you on our behalf or under joint responsibility with us or who receive data about you from us under their own responsibility.
Contractual partners including customers: This initially refers to our customers and other contractual partners because this data transfer arises from these contracts. If you work for such a contractual partner yourself, we may also transfer data about you to them in this context. The recipients also include contractual partners with whom we cooperate or who advertise for us and to whom we therefore transmit data about you for analysis and marketing purposes (these may in turn be service recipients, but also sponsors and providers of online advertising, for example). We require these partners to only send you advertising or display it based on your data if you have consented to this (for the online area, see “Technologies on our website”). Our central cooperation partners and online advertising contract partners are listed in the aforementioned section.
Public authorities: We may disclose personal data to offices, courts and other authorities in Switzerland and abroad if we are legally obliged or entitled to do so or if this appears necessary to protect our interests. The authorities process data about you that they receive from us under their own responsibility.
Other persons: This refers to other cases where the involvement of third parties arises from the purposes set out under “For what purposes do we process your data”, e.g. service recipients, media and associations in which we participate or if you are part of one of our publications.
All these categories of recipients may in turn involve third parties, so that your data may also become accessible to them. We can restrict processing by certain third parties (e.g. IT providers), but not by other third parties (e.g. authorities, banks, etc.).
Is your personal data also transferred abroad?
As explained in the section “Who we disclose your data to”, we also disclose data to other bodies. These are not only located in Switzerland. Your data may therefore also be processed in Europe, but in exceptional cases in any country in the world.
If a recipient is located in a country without adequate statutory data protection, we contractually oblige the recipient to comply with the applicable data protection regulations (we use the revised standard contractual clauses of the European Commission, which are available here: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?), unless the recipient is already subject to a legally recognized set of rules to ensure data protection and we cannot rely on an exception. An exception may apply in particular in the case of legal proceedings abroad, but also in cases of overriding public interests or if the performance of a contract requires such disclosure, if you have given your consent or if the data in question has been made generally accessible by you and you have not objected to its processing.
How long do we process your data for?
We process your data for as long as required by our processing purposes, the statutory retention periods and our legitimate interests in processing for documentation and evidence purposes or if storage is technically necessary. Further information on the respective storage and processing duration can be found in the individual data categories under “What data do we process” or in the cookie categories under “Technologies on our website”. If there are no legal or contractual obligations to the contrary, we delete or anonymize your data after the storage or processing period has expired as part of our usual processes.
How do we protect your data?
We take appropriate security measures to maintain the confidentiality, integrity and availability of your personal data, to protect it against unauthorized or unlawful processing and to counteract the risks of loss, accidental alteration, unwanted disclosure or unauthorized access.
What rights do you have?
Under certain circumstances, the applicable data protection law grants you the right to object to the processing of your data, in particular for the purposes of direct marketing, profiling for direct advertising and other legitimate interests in processing.
To make it easier for you to control the processing of your personal data, you also have the following rights in connection with our data processing, depending on the applicable data protection law:
- the right to request information from us as to whether we are processing data about you and, if so, which data;
- the right to have us correct data if it is incorrect;
- the right to request the deletion of data;
- the right to request that we provide you with certain personal data in a commonly used electronic format or transfer it to another controller
- the right to withdraw consent where our processing is based on your consent
- the right to request further information necessary to exercise these rights;
If you wish to exercise the above rights against us (or against one of our group companies), please contact us in writing, at our premises or, unless otherwise stated or agreed, by e-mail; our contact details can be found under “Who is responsible for processing your data”. So that we can rule out misuse, we must identify you (e.g. with a copy of your ID, if this is not otherwise possible).
Please note that these rights are subject to conditions, exceptions or restrictions under the applicable data protection law (e.g. to protect third parties or business secrets). We will inform you accordingly if necessary.
If you do not agree with our handling of your rights or data protection, please let us or our data protection officer know (point “Who is responsible for processing your data”). In particular, if you are located in the EEA, the United Kingdom or Switzerland, you also have the right to lodge a complaint with the data protection supervisory authority in your country. A list of authorities in the EEA can be found here: https://edpb.europa.eu/about-edpb/board/members_de. You can contact the UK supervisory authority here: https://ico.org.uk/global/contact-us/. You can contact the Swiss supervisory authority here: https://www.edoeb.admin.ch/edoeb/de/home/deredoeb/kontakt.html.
Can this privacy policy be amended?
This privacy policy is not part of any contract with you. We may amend this privacy policy at any time. The version published on this website is the current version.