Privacy Policy

Thank you for visiting our website schmutzundhartmann.ch and for your interest in our company.

The protection of your personal data, such as date of birth, name, telephone number, address, etc., is an important concern for us.

The purpose of this privacy policy is to inform you about the processing of your personal data that we collect from you when you visit a page of our website. Our data protection practice is in accordance with the legal provisions of the Swiss Federal Act on Data Protection (FADP) and the EU General Data Protection Regulation (GDPR). The following data privacy policy serves to fulfil the information obligations under the FADP and the GDPR. These can be found, for example, in Art. 19 et seq. FADP and Art. 13 et seq. of the GDPR.

Owner or controller

The controller within the meaning of Art. 5 (j) DSG or Art. 4 para. 7 GDPR is the person who, alone or jointly with others, decides on the purposes and means of the processing of personal data. The controller pursuant to Art. 4 para. 7 GDPR is also the recipient of the personal data within the meaning of Art. 4 para. 9 GDPR. Any third-party recipient will be specified separately.

With regard to our website, the owner and/or controller is:

Schmutz + Hartmann AG
Hemmikerstrasse 59
4466 Ormalingen
Switzerland
Email: info@sh-ag.ch
Phone: +41 (0)71 626 20 70

Provision of the website and creation of log files

Every time our website is accessed, our system automatically collects data and information from the respective device (e.g. computer, mobile phone, tablet, etc.).

What personal data is collected and to what extent is it processed?

(1) Information about the browser type and version used;
(2) The operating system of the respective device used;
(3) Host name of the accessing computer;
(4) The IP address of the device used;
(5) The date and time of access;
(6) Websites and resources (images, files, other page content) accessed on our website;
(7) Websites from which the user’s system reached our website (referrer tracking);
(8) Notification of whether access was successful;
(9) Amount of data transferred

This data is stored in the log files of our system. This data is not stored together with personal data of a specific user, meaning that individual site visitors are not identified.

Legal basis for processing personal data

The processing of personal data is carried out in accordance with the principle of lawfulness (Art. 6 para. 1 FADP) and in accordance with the requirement of good faith (Art. 6 para. 2 FADP or Art. 2 ZGB) as well as Art. 6 para. 1 (f) GDPR (legitimate interest).

Purpose of data processing

The temporary (automated) storage of the data is necessary for the course of a website visit in order to enable the provision of the website. The storage and processing of personal data is also carried out in order to maintain the compatibility of our website for as many visitors as possible and to combat abuse and eliminate faults. For this purpose, it is necessary to log the technical data of the accessing computer in order to be able to react as early as possible to display errors, attacks on our IT systems and/or errors in the functionality of our website. In addition, the data is used to optimise the website and to ensure the general security of our information technology systems.

Duration of storage

The aforementioned technical data will be erased as soon as they are no longer needed to ensure the compatibility of the website for all visitors, but no later than 3 months after the accessing of our website.

Possibility of restriction, objection, correction and deletion

You can request the restriction of processing in accordance with Art. 18 GDPR or object to processing in accordance with Art. 21 GDPR at any time, as well as request correction or deletion of the data in accordance with Art. 16 or 17 GDPR. You can find out what rights you are entitled to and how to assert them further down in this privacy policy.

Special functions of the website

Our site offers you various functions, during the use of which we collect, process and store personal data. Below we explain what happens to this data:

Newsletter registration form

• What personal data is collected and to what extent is it processed?

  By registering for the newsletter on our website, we receive the email address entered by you in the registration field and, if applicable, other contact details, if you provide them to us via the newsletter registration form.

• Legal basis for processing personal data

  The processing of personal data is carried out in accordance with the principle of lawfulness (Art. 6 para. 1 FADP) and in accordance with the requirement of good faith (Art. 6 para. 2 FADP or Art. 2 ZGB) as well as Art. 6 para. 1 (a) GDPR or Art. 9 para. 2 (a) GDPR (consent by clear affirmative action or conduct or explicit consent).

• Purpose of data processing

  The data recorded in the registration form for our newsletter will be used by us exclusively for sending our newsletter, in which we inform you about all our services and our news. After you have registered, we will send you a confirmation email containing a link that you must click to complete the subscription to our newsletter (double opt-in). By doing so, you give your consent to data processing in accordance with Art. 6 para. 6 FADP.

• Duration of storage

  You can unsubscribe from our newsletter at any time by clicking on the unsubscribe link, which is also included in each newsletter. Your data will be deleted by us immediately after you have unsubscribed, provided that there no statutory retention obligations exist. Likewise, your data will be deleted by us immediately in the event of an incomplete registration. We reserve the right to delete without giving reasons and without prior or subsequent information.

• Possibility of restriction, objection, correction and deletion

  You can request the restriction of processing in accordance with Art. 18 GDPR or object to processing in accordance with Art. 21 GDPR at any time, as well as request correction or deletion of the data in accordance with Art. 16 or 17 GDPR. You can find out what rights you are entitled to and how to assert them further below in this privacy policy.

• Necessity of providing personal data

  If you would like to use our newsletter, you must fill in the fields marked as mandatory information and confirm your email address by clicking on the double opt-in link. The newsletter registration information is necessary in order to be able to make use of the newsletter offer. The information provided is used exclusively to send our newsletter. If you do not fill in the mandatory fields, we will not be able to provide you with our newsletter service.

Disclosure of information to third parties

The processing of personal data is carried out in accordance with the principle of lawfulness (Art. 6 para. 1 FADP) and in accordance with the requirement of good faith (Art. 6 para. 2 FADP or Art. 2 ZGB).

The disclosure of information to third parties depends on the scope of the activities or offers of our website or our business model described below.

As a matter of principle, we only retain your information for as long as necessary and treat it confidentially. Excluded from this are the transfer of personal data to debt collection service providers, to public bodies and authorities as well as to private individuals who are entitled to it on the basis of legal provisions, court decisions or official orders, as well as the transfer to authorities for the purpose of initiating legal proceedings or for law enforcement purposes if our legally protected rights are attacked.

Statistical analysis of visits to this website - Webtracker

When you access this website or individual files on the website, we collect, process and store the following data: IP address, webpage from which the file was accessed, name of the file, date and time of access, amount of data transferred and notification of the success of the access (so-called web log). We use this access data exclusively in non-personalised form for the continuous improvement of our Internet presence and for statistical purposes.

The processing of any personal data is carried out in accordance with the principle of lawfulness (Art. 6 para. 1 FADP) and in accordance with the requirement of good faith (Art. 6 para. 2 FADP or Art. 2 ZGB). We also use the following web trackers to evaluate the visits to this website:

• Google

  We use the Google service of the company Google Ireland Limited, Gordon House, Barrow Street, 4 Dublin, Ireland, email: support-deutschland@google.com, website: https://www.google.com/ According to the assessment of Swiss authorities, the processing takes place in safe third countries. Switzerland’s list of countries and further information can be found under the following link: https://www.edoeb.admin.ch/edoeb/de/home/datenschutz/handel-und-wirtschaft/uebermittlung-ins-ausland.html. Personal data is also transferred to the USA. With regard to the transfer of personal data to the USA, there is an adequacy decision on the EU-US Data Privacy Framework of the EU Commission within the meaning of Art. 45 GDPR (hereinafter: DPF - https://commission.europa.eu/document/fa09cbad-dd7d-4684-ae60-be03fcb0fddf_en ). The operator of the service is certified under the DPF, meaning that the usual level of protection of the GDPR applies to the transfer of data.

  The legal basis for the transfer of personal data is your consent in accordance with Art. 6 para. 6 FADP or Art. 31 para. 2 FADP and Art. 6 para. 1 (a) GDPR or Art. 9 para. 2 (a) GDPR, which you have given on our website.

  We use Google to be able to download further Google services on the website. The service is used to provide other Google services, such as the data processing required for the provision of streams and fonts and relevant content of Google Search. It is technically required in order to be able to exchange the information of the site visitor already available to Google between the Google services and to be able to provide the site visitor with individual content adapted to his/her Google account.

  For the processing itself, the service and/or we collect the following data: background data stored in the Google user account or other Google services about the site visitor, background data for the provision of Google services such as streaming data or advertising data, data about the site user’s use of Google search, information regarding the end-device used, the user’s IP address and browser, and other data from Google services for the provision of Google services related to our website.

  If the service is active on our website, our website establishes a connection to the servers of the company Google Ireland Limited and transmits the required data. As part of the order processing, personal data may also be transmitted to the servers of the company Google LLC, 1600 Amphitheatre Parkway, 94043 Mountain View, United States. When using the Google service on our website, Google may transmit and process information from other Google services in order to provide background services for the display and data processing of the services provided by Google. For this purpose, data may also be transferred to the Google services Google Apis, Doubleclick, Google Cloud, and Google Ads and Google Fonts in accordance with the Google Privacy Policy. You can access the provider’s certification under the EU-US Data Privacy Framework at https://www.dataprivacyframework.gov/list.

  You can revoke your consent at any time. You can find more information on how to withdraw your consent either at the time of consent itself or at the end of this privacy policy.

  Further information on the handling of the transmitted data can be found in the provider’s privacy policy under https://policies.google.com/privacy.

  The provider also provides an opt-out option under https://support.google.com/My-Ad-Center-Help/answer/12155451?hl=de.

• Google-Analytics

  • Scope of personal data processing

    On our website, we use the web tracking service of the company Google Ireland Ltd., Gordon House, Barrow Street, 4 Dublin, Ireland, email: support-deutschland@google.com, website: https://www.google.com/ (hereinafter: Google Analytics). As part of web tracking, Google Analytics uses cookies that are stored on your computer and enable an analysis of the use of our website and your surfing behaviour (so-called tracking). We carry out this analysis on the basis of the Google Analytics tracking service in order to constantly optimise our website and make it more accessible. As part of the use of our website, data, such as your IP address and your user activities, are transmitted to servers of the company Google Ireland Limited. We carry out this analysis on the basis of Google’s tracking service in order to constantly optimise our Internet offer and make it more available. We also need web tracking for security reasons. Web tracking allows us to track whether third parties attack our website. The information provided by the web tracker allows us to take effective countermeasures and protect the personal data we process from these cyberattacks. By activating IP anonymisation within the Google Analytics tracking code of this website, your IP address will be anonymised by Google Analytics before transmission. This website uses a Google Analytics tracking code that is extended by the operator gat._anonymizeIp(); to enable only anonymised collection of IP addresses (so-called IP masking).

  • Legal basis for processing personal data

    In accordance with Art. 13 para. 1 FADP and Art. 6 para. 1 (a) GDPR, the legal basis for data processing is your consent in our notification banner regarding the use of cookies and web tracking (consent by clear affirmative action or behaviour).

  • Purpose of data processing

    On our behalf, Google will use this information to evaluate your visit to this website, to compile reports on website activity and to provide us with other services related to website and internet usage. We also need web tracking for security reasons. Web tracking allows us to track whether third parties attack our website. The information provided by the web tracker allows us to take effective countermeasures and protect the personal data we process from these cyberattacks.

  • Duration of storage

    Google will store the data relevant to the provision of web tracking for as long as it is necessary to fulfil the booked web service. The data collection and storage is anonymised. If personal reference should indeed exist, the data will be deleted immediately, provided that it is not subject to statutory retention obligations. In any case, deletion will take place after the expiry of the retention obligation.

  • Objection and deletion options

    You can prevent the collection and forwarding of personal data to Google (in particular your IP address) and the processing of this data by Google by deactivating the execution of script code in your browser or by activating the “Do Not Track” setting in your browser. You can also prevent the collection of the data generated by the Google cookie and related to your use of the website (including your IP address) for Google and the processing of this data by Google by downloading and installing the browser plug-in available at the following link (http://tools.google.com/dlpage/gaoptout?hl=de). Google’s security and privacy principles can be found at https://policies.google.com/privacy.

• Google Tag Manager

  • What personal data is collected and to what extent is it processed?

    On our website, we use the Google Tag Manager service of the company Google Ireland Ltd., Gordon House, Barrow Street, 4 Dublin, Ireland, email: support-deutschland@google.com, website: https://www.google.com/ (hereinafter: Google Tag Manager). Google Tag Manager offers a technical platform to execute other web services and web tracking programs by means of so-called “tags” and to be able to control them in a bundled manner. In this context, Google Tag Manager stores cookies on your computer and, if web tracking tools are executed using Google Tag Manager, analyses your surfing behaviour (so-called “tracking”). This data, sent by individual tags integrated in Google Tag Manager, is merged, stored, and edited by Google Tag Manager under a unified user interface. All integrated “tags” are listed separately in this privacy policy. For more information about the privacy of the tools embedded in Google Tag Manager, please refer to the relevant section of this privacy policy. In the context of use of our website when the integration of tags from Google Tag Manager is activated, data such as your IP address and your user activities are transmitted to servers of Google Ireland Limited. With regard to web services integrated via Google Tag Manager, the regulations in the respective section of this privacy policy apply. The tracking tools used in Google Tag Manager ensure that the IP address is anonymised by Google Tag Manager before transmission by means of the IP anonymisation of the source code. Google Tag Manager is then only able to collect IP addresses anonymously (so-called IP masking).

  • Legal basis for processing personal data

    In accordance with Art. 13 para. 1 FADP and Art. 6 para. 1 (a) GDPR, the legal basis for data processing is your consent in our notification banner regarding the use of cookies and web tracking (consent by clear affirmative action or behaviour).

  • Purpose of the data processing

    On our behalf, Google will use the information obtained via Google Tag Manager to evaluate your visit to this website, to compile reports on website activity and to provide us with other services related to website and internet usage.

  • Duration of storage

    Google will store the data relevant to the function of Google Tag Manager for as long as it is necessary to fulfil the booked web service. The data collection and storage is anonymised. If personal reference should indeed exist, the data will be deleted immediately, provided that it is not subject to statutory retention obligations. In any case, deletion will take place after the expiry of the retention obligation.

  • Objection and deletion option

    You can prevent the collection and forwarding of personal data to Google (in particular your IP address) and the processing of this data by Google by deactivating the execution of script code in your browser or by activating the “Do Not Track” setting in your browser. You can also prevent the collection of the data generated by the Google cookie and related to your use of the website (including your IP address) for Google and the processing of this data by Google by downloading and installing the browser plug-in available at the following link (http://tools.google.com/dlpage/gaoptout?hl=de). Google’s security and privacy principles can be found at https://policies.google.com/privacy.

• Cookies

  To manage the cookies and similar technologies used (tracking pixels, web beacons, etc.) and the corresponding consents, we use the consent tool “Real Cookie Banner”. For details on how Real Cookie Banner works, see https://devowl.io/de/rcb/datenverarbeitung/. The legal basis for the processing of personal data in this context is Art. 6 para. 1 (c) GDPR and Art. 6 para. 1 (f) GDPR. Our legitimate interest is to manage the cookies and similar technologies used and the consents in this regard. The provision of personal data is neither contractually required nor necessary for the conclusion of a contract. You are not obliged to provide the personal data. If you do not provide the personal data, we will not be able to manage your consents.

Integration of external web services and processing of data outside the EU

On our website, we use active content from external providers, so-called web services. By accessing our website, these external providers may receive personal information about your visit to our website. In this case, it may be possible that data is processed outside Switzerland and the EU. You can prevent this by installing a corresponding browser plugin or deactivating the execution of scripts in your browser. This may lead to functional restrictions on websites that you visit.

We use the following external web services:

• Legally ok legal text snippet and modules

  On our website, we use the Legally ok legal text snippet and modules service of the company Legally ok GmbH, Schochenmühlestrasse 6, 6340 Baar, Switzerland, email: hello@legally-ok.com, website: https://www.legally-ok.com/. The processing takes place exclusively in Switzerland in accordance with the data protection legislation applicable there. The processing also takes place in a third country outside the EU. The Commission has taken an adequacy decision for this third country. On the website of the EU Commission (Link: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_de) you will find an up-to-date list of all adequacy decisions.

  The legal basis for the transfer and processing is Art. 31 para. 1 FADP and Art. 6 para. 1 © GDPR. The use of the service helps us to meet our legal obligations.

  With the help of the service, content of our legal texts is loaded on our website. The current legal texts are loaded via the integration on our website. This integration can also be used to load further technical modules with regard to the legal texts or legally necessary elements.

  You can find out what rights you have with regard to processing at the end of this privacy policy.

  Further information on the handling of the transmitted data can be found in the provider’s privacy policy under https://www.legally-ok.com/datenschutz/.

• Klaviyo

  We use the klaviyo service of the company Klaviyo, Inc., 125 Summer St Floor 7, 02110 Boston, United States, email: privacy@klaviyo.com, website: https://www.klaviyo.com/. Your personal data will be transferred to so-called unsafe third countries, which do not guarantee sufficient data protection through their legislation. Your data will only be passed on if suitable data protection is guaranteed. This can be guaranteed in particular by:

  international treaties
  data protection clauses in a contract between the controller or processor and its contractual partner, which have been notified to the FDPIC in advance
  specific safeguards drawn up by the competent federal body and notified to the FDPIC in advance
  standard data protection clauses that the FDPIC has approved, issued
  or recognised in advance, or binding corporate data protection rules that have been approved in advance by the FDPIC or by an authority responsible for data protection in a country that ensures adequate protection
  
  If such guarantees are not in place, your data may only be disclosed if you have given your consent to this, if the disclosure is directly related to the conclusion or execution of a contract, or if the disclosure is necessary in the context of the enforcement of claims before courts and authorities or for the protection of public interests. The legal basis for the transfer of personal data is your consent in accordance with Art. 6 para. 6 FADP or Art. 31 para. 1 FADP, which you have given on our website. The service allows us to collect, analyse and use customer data to engage with our customers in a targeted manner, so that we can send emails about discounts, email updates on how to ship ordered goods, or abandoned cart emails, etc. You can access the provider’s certification under the EU-US Data Privacy Framework at https://www.dataprivacyframework.gov/list. You can revoke the processing of your data at any time. You can find more information on how to withdraw your consent either at the time of consent itself or at the end of this privacy policy. Further information on the handling of the transmitted data can be found in the provider’s privacy policy under https://www.klaviyo.com/legal/privacy-notice.

Data security and data protection, communication by email

Your personal data is protected by technical and organisational measures during collection, storage and processing in such a way that they are not accessible to third parties. In the case of unencrypted communication by email, we cannot guarantee complete data security on the transmission path to our IT systems, so we recommend encrypted communication or postal means for information with a high need for confidentiality.

Duration of data storage and data subject rights

Duration of storage

We store the personal data only to the extent and for as long as this is necessary for the fulfilment of the purposes for which the personal data was collected, we have a legitimate overriding interest in storing it or we are legally obliged to do so.

Right to information

You have the right to request confirmation as to whether we are processing any of your personal data. If this is the case, you have a right to information about the data specified in Art. 25 et seq. FADP or Art. 15 para. 1 GDPR, insofar as the provision of this information cannot be refused, restricted or postponed by the owner of the data collection (cf. Art. 26 et seq. FADP or Art. 15 para. 4 GDPR). We will also be happy to provide you with a copy of the data.

Right to correction

In accordance with Art. 32 para. 1 FADP or Art. 16 GDPR, you have the right to demand that incorrectly stored personal data (such as address, name, etc.) be corrected, provided that this claim does not conflict with a legal obligation. You can also request that incomplete data stored by us be completed at any time. A corresponding adjustment will be made immediately.

Right to erasure

In accordance with Art. 17 para. 1 GDPR, you have the right to have us erase the personal data collected about you if:

• the data is either no longer needed;
• due to the revocation of your consent, the legal basis for the processing has ceased to exist without replacement;
• there are no longer any legitimate reasons for the processing;
• your data is being processed unlawfully;
• a legal obligation requires this erasure.

According to Art. 17 para. 3 GDPR, this right does not exist if:

• the processing is necessary for the exercise of the right to freedom of expression and information;
• your data has been collected on the basis of a legal obligation;
• the processing is necessary for reasons of public interest;
• the data is necessary for the assertion, exercise or defence of legal claims.

Right to restriction of processing

In accordance with Art. 18 para. 1 GDPR, you have the right to request the restriction of the processing of your personal data in individual cases.

This is the case if:

• you contest the accuracy of the personal data pertaining to you;
• the processing is unlawful and you do not consent to its deletion;
• the data is no longer required for the purpose of processing, but the data collected serves to assert, exercise or defend legal claims;
• an objection has been lodged against the processing in accordance with Art. 21 (1) GDPR and it is still unclear which interests prevail.

Right of revocation

If you have given us explicit consent to the processing of your personal data (Art. 6 para. 6 FADP and Art. 31 para. 1 FADP; Art. 6 para. 1 (a) GDPR or Art. 9 para. 2 (a) GDPR), you can revoke this consent at any time. Please note that this does not affect the lawfulness of the processing carried out on the basis of the consent before the revocation. Information that we are legally obliged to retain will be deleted after the expiry of the retention period.

Right to object

In accordance with Art. 21 GDPR, you have the right to object at any time to the processing of personal data concerning you that has been collected on the basis of Art. 6 para. 1 (f) GDPR (within the scope of a legitimate interest). If you have given us explicit consent to the processing of your personal data (Art. 6 para. 6 FADP and Art. 31 para. 1 FADP), you can revoke this consent at any time. Please note that this does not affect the lawfulness of the processing carried out on the basis of the consent before the revocation. You are only entitled to this right if special circumstances speak against the storage and processing. Information that we are legally obliged to retain will be deleted after the expiry of the retention period.

How do you exercise your rights?

You can exercise your rights at any time by using the contact details below:

Schmutz + Hartmann AG
Hemmikerstrasse 59
4466 Ormalingen
Switzerland
Email: info@sh-ag.ch
Phone: +41 (0)71 626 20 70

Right to data portability

In accordance with Art. 20 GDPR, you have a right to the transfer of personal data concerning you. We provide the data in a structured, commonly used and machine-readable format. The data can be sent either to yourself or to a controller designated by you.

We will provide you with the following data on request:

• Data collected on the basis of consent (Art. 31 para. 1 FADP and Art. 6 para. 1 (a) GDPR);
• Data that we have received from you within the framework of existing contracts (Art. 31 para. 2 (a) FADP as well as Art. 6 para. 1 (b) GDPR and Art. 9 para. 2 (a) GDPR);
• Data that has been processed as part of an automated process.

We will transfer the personal data directly to a controller of your choice, insofar as this is technically feasible. Please note that we are not permitted to transmit data that interferes with the overriding interests of third parties in accordance with Article 26 para. 1 (b) FADP or Article 20 para. 4 GDPR, or may only do so to a limited extent.

Notifications to the FDPIC and possibility of complaint

According to Art. 49 FADP, data subjects can file a complaint with the supervisory authority if there are sufficient indications that data processing could violate data protection regulations. The supervisory authority for data protection in Switzerland is the Federal Data Protection and Information Commissioner (FDPIC).

For more information, please refer to the FDPIC contact form: https://www.edoeb.admin.ch/edoeb/de/home/deredoeb/kontakt.html

If you suspect that your data is being processed unlawfully on our site, you can bring about a judicial clarification of the issue in accordance with Art. 32 FADP. As a rule, an action under Art. 28 et seq. ZGB is to be sought for this purpose. If you are affected by the processing of the data by federal bodies, the procedure is based on Art. 41 FADP. You can also contact the FDPIC in this case (see reference to the contact form above).

Right to lodge a complaint with the supervisory authority pursuant to Art. 77 para. 1 GDPR

If you suspect that your data is being processed unlawfully on our website, you can of course bring about a judicial clarification of the issue at any time. In addition, any other legal option is open to you. Irrespective of this, you have the option of contacting a supervisory authority in accordance with Art. 77 para. 1 GDPR. You have the right to lodge a complaint in accordance with Art. 77 GDPR in the EU member state of your place of residence, your place of work and/or the place of the alleged infringement, i.e. you can choose the supervisory authority that you contact from the above locations. The supervisory authority with which the complaint was lodged will then inform you of the status and results of your submission, including the possibility of a judicial remedy pursuant to Art. 78 GDPR.