Website Data Protection Notice

This Website Data Protection Notice describes how Polypag AG, Tiefenackerstrasse 52, 9450 Altstätten, Schweiz  ("Polypag" or "we" or "us" or "our") as the legal entity responsible for the use of your personal data (Data Controller) processes the personal data and other information of the users ("you" or "your") in particular within the meaning of the Swiss Federal Data Protection Act ("FDPA") when using the website https://www.polypag.ch/ ("Website").

 

Categories of personal data, processing purposes, legal basis and source

a. Personal Data actively provided by you:

If you create a user account on our Website, you will be asked to provide the following personal data about you: Name, postal address, email address, selected password. Polypag processes such personal data for the purpose of providing our services to you. Providing such personal data is voluntary. However, without providing such personal data, you will not be able to create a user account. The legal basis for the processing of such personal data is Polypag’s legitimate interest in relation to the conclusion and performance of a contract (Art. 31 (2) lit. a FDPA).

If you register for the newsletter and consent to the receipt of newsletters and the processing of your email address for this purpose, you will be asked to provide your email address. We will use your email address for regularly sending you newsletters. Providing your email address is voluntary. However, without providing your email address you will not receive newsletters. The legal basis for the processing of your personal data for sending newsletters is your voluntary given consent.

b. Other passively collected information:

In addition to the personal data that you actively provide, the Website may automatically collect, process and store certain information on a pseudonymous basis from your computer or other electronic device:

• Device and usage information – that may include (i) information specific to the used device to access the Website (including, but not limited to, model, operating system, IP address, language, carrier and similar information) and (ii) information about the use of features, functions, or notifications on the device, to recognize you and to analyze trends. The legal basis for this data processing is our legitimate interest, in particular monitoring and maintenance of the Website performance;
• Website analytics – such as how often a user uses the Website, aggregated usage, performance data. We use Website analytics to allow us to better understand the functionality and use of our Website. The legal basis for this data processing is our legitimate interest, in particular analysis of trends, usage and activities in connection with our Website,

We also use cookies on the Website. For more information about cookies, please read our Cookie Notice available under the Cookie Preference Center at the bottom of our website page.

 

Sale of Personal Data

Polypag does not sell any personal data.

 

Recipients

a. Transfer to service providers

Polypag may engage external service providers, who act as a data processor of Polypag, to provide certain services to Polypag such as website service providers, marketing service providers or IT support service providers. When providing such services, the external service providers may have access to and/or may process your personal data.

Those external service providers will be subject to contractual obligations to implement appropriate technical and organizational security measures to safeguard the personal data and to process the personal data only as instructed and in accordance with applicable data protection law.

 b. Other recipients

Some of our colleagues administering the Website and providing IT services may be employees of our group companies. When administering the Website our colleagues may have access to and/or may process your personal data. The respective transfer of your personal data is based on our legitimate interests. Our legitimate interests are the transmission of personal data within the group of companies for internal administrative and support purposes. The access is limited to colleagues on a need-to-know basis.

Polypag may also transfer your personal data to law enforcement agencies, governmental authorities, legal counsel and external consultants in compliance with applicable data protection law. The legal basis for such processing is compliance with a legal obligation to which the Polypag is subject to or are legitimate interests, such as exercise or defense of legal claims.

The updated list of data processors and third parties that we share data with is available upon request to the Company at the contact details below specified.

 

International transfers of Personal Data

The personal data that we collect or receive about you may be transferred to and processed by recipients which are located outside Switzerland in a country that is not recognized by the Swiss Federal Data Protection and Information Commissioner (FDPIC) as providing an adequate level of data protection. The access is limited to recipients with a need to know. To the extent your personal data are transferred to countries that do not provide for an adequate level of data protection from a Swiss law perspective, we will base the respective transfer on appropriate safeguards, such as standard data protection clauses adopted by the FDPIC. You can ask for a copy of such appropriate safeguards by contacting us as set out in Sec. 5 (Contact us) below.

 

What rights do you have and how can you assert your rights?

If you have declared your consent for any personal data processing activities, you can withdraw this consent at any time with future effect. Such a withdrawal will not affect the lawfulness of the processing prior to the consent withdrawal.

Pursuant to applicable data protection law you may have the right to request access to your personal data, rectification of your personal data, erasure of your personal data, restriction of processing of your personal data, data portability, and the right to object to the processing of your personal data. Please note that these aforementioned rights might be limited under the applicable national data protection law. For further information on these rights please refer to Appendix “Your Rights”.

You also have the right to lodge a complaint with the competent data protection supervisory authority. To exercise your rights please contact us as stated in section (5.) below or use the specific web-form “Exercise Your Privacy Rights” available on the Company’s Website.

 

How long do we keep your Personal Data?

Your personal data will be retained as long as necessary to provide you with the services requested. When Polypag no longer needs to use your personal data to comply with contractual or statutory obligations or the data is no longer necessary for our legitimate interests and no other legal basis for processing the data applies, we will remove it from our systems and records and/or take steps to properly anonymize it so that you can no longer be identified from it, unless we have to keep your information, including personal data, to comply with legal or regulatory obligations to which Polypag is subject, e.g. statutory retention periods.

 

Contact us

If you have concerns or questions regarding this Website Data Protection Notice, please contact us as follows:

Polypag AG
Tiefenackerstrasse 52
9450 Altstätten
Tel: +41 71 757 64 11
Fax: +41 71 757 64 98

The contact details of our data protection officer are as follows:

OBSECOM GmbH Stuttgart, Zweigniederlassung Schweiz in Préverenges
c/o RAin Carolin Alvermann
Chemin Neuf 24
1028 Préverenges (VD)
Telefon: +41 215 881 597
E-Mail: datenschutz@obsecom.ch

 

Appendix I: Your Rights

• Right of access: You may have the right to obtain from us confirmation as to whether or not personal data concerning you is processed, and, where that is the case, to request access to the personal data. The access information includes – inter alia – provision of the information about the purposes of the processing, the categories of personal data concerned, and the recipients or categories of recipients to whom the personal data have been or will be disclosed. However, this is not an absolute right and the interests of other individuals may restrict your right of access.
• You may have the right to obtain a copy of the personal data undergoing processing.
• Your requests are generally free of charge. We may charge a reasonable fee based on administrative costs in case your request is manifestly unfounded or excessive, in particular because of its repetitive character.
• Right to rectification: You may have the right to obtain from us the rectification of inaccurate personal data concerning you. Depending on the purposes of the processing, you may have the right to have incomplete personal data completed, including by means of providing a supplementary statement.
• Right to erasure ("right to be forgotten"): Under certain circumstances, you may have the right to obtain from us the erasure of personal data concerning you and we may be obliged to erase such personal data.
• Right to restriction of processing: Under certain circumstances, you may have the right to restrict processing of your personal data. In this case, the respective data will be marked and may be processed by us only for certain purposes.
• Right to data portability: Under certain circumstances, you may have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format and you may have the right to transmit those data to another entity without hindrance from us.
• Right to object: Under certain circumstances, you may have the right to object, on grounds relating to your particular situation, to the processing of your personal data by us and we can be required to no longer process your personal data.
• Moreover, if your personal data is processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for such marketing, which includes profiling to the extent that it is related to such direct marketing. In this case your personal data will no longer be processed by us for such purposes.

 

Appendix II: External web services

We deploy links to the various social media channels on our website to promote our business and advertise our products.

Depending on the social media channel and services used, we might have access to personal data you provided, such as personal information available at your social media profile.

 

Google Services

Provider of the Google services below is:

• Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, for users with their residence in the European Economic Area or Switzerland or
• Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA, 94043, USA

The information collected by Google in connection with the provision of the respective services may be transferred to and processed by Google servers in the USA. Please also note our information on data transfer to third countries, see above.

For more information about how Google handles personal data, please refer to Google's Privacy Policy: https://www.google.com/intl/de/policies/privacy/. For information on the use of data for advertising purposes by Google, settings and your right to object please refer to: https://www.google.de/policies/privacy/partners/  

https://www.google.de/policies/technologies/ads/   

https://adssettings.google.com/

 

Google services for which your consent is required

The legal basis for the use of the following services is your voluntarily given consent. The legal basis for data transfer to the USA is also your voluntarily given consent under Art. 17 (1) lit. a FDPA.

 

Google Analytics

This Website uses Google Analytics. Google Analytics collects information about the visits of web site users and analyses their behavior. This data serves the purpose of developing a user-friendly web site design, the continuous optimisation of our services and offers, to measure the success of marketing activities, and to create statistical analysis. In this context, pseudonymised user profiles are created and cookies are used. Google Analytics collects information such as browser type / version, operating system, referrer URL (the previously visited page), host name of the accessing computer (IP address), time of server request.  The information generated is transferred to the US and stored on servers owned by Google. The collected user data and event data will be deleted after 2 years. Information may also be transferred to third parties if required by law or if third parties process this data on behalf of us or Google. Under no circumstances will your IP address be merged with any other data that is kept by Google. The IP address will be anonymised so that assignment is impossible. You can prevent the local storage of cookies by configuring your browser software accordingly. However, be advised that in this case you may not be able to use all the features of this web site to the full extent possible. Additionally, in order to prevent Google from collecting and processing the data generated in relation to your use of the web site you may download and install the browser plug-in available under the following link: https://tools.google.com/dlpage/gaoptout?hl=en.

 

Google Maps

This Website uses Google Maps to display site maps, maps, terrain data, or geographic maps. This service collects your IP address, which web pages you have visited and, if necessary, other data required by Google for the provision of the maps (such as location data). The information is stored on servers in the USA. This information may also be transferred to third parties if required by law or if third parties process this data on behalf of us or Google. The Google Maps terms of service can be found at: https://www.google.com/intl/en_uk/help/terms_maps.html

 

Other Google services

The legal basis for the use of the following services is Polypag’s legitimate interests. The legitimate interests are listed below for each service individually.

 

Google Hosted Libraries

This Website uses Google Hosted Libraries for dynamic presentation of website content. To do this, your browser loads the required JavaScript-Libraries into your browser cache when you visit the web page. If your browser does not support this feature, your computer will use alternative means to display the web page. This service collects your IP address, which web pages you have visited and, if necessary, other data required by Google for the provision of the hosted libraries. The generated information about your use of this Website is stored on servers in the USA. This information may also be transferred to third parties if required by law or if third parties process this data on behalf of us or Google.