1. What is this privacy policy about?


Code18 AG (hereinafter also "we", "us") obtains and processes personal data relating to you or also other persons (so-called "third parties"). We use the term "data" here synonymously with "personal data" or "personal data".

In this Privacy Policy, we describe what we do with your information when you use our website www.code18.team and its subdomains (hereinafter collectively " website "), obtain our services or products, otherwise interact with us under a contract, communicate with us or otherwise deal with us. Where appropriate, we will notify you by timely written notice of additional processing activities not mentioned in this Privacy Policy. In addition, we may inform you separately about the processing of your data, for example, in consent forms, contract terms, additional privacy statements, forms and notices.

 

This Privacy Policy is designed to meet the requirements of the EU General Data Protection Regulation ("GDPR"), the Swiss Data Protection Act ("DPA") and the revised Swiss Data Protection Act ("revDSG"). However, whether and to what extent these laws are applicable depends on the individual case.

2. Who is responsible for processing your data?


Code18 AG, Küsnacht, (the "Code18") is responsible for the data processing described in this privacy policy.

You can contact us for your data protection concerns and to exercise your rights under Section 10 as follows:

Code18 AG (CHE-270.848.545)
Mr. Patrick Tobler
Weinmanngasse 24
8700 Küsnacht
info@code18.team

3. What data do we process?

We process different categories of data about you. The main categories are the following:

  • Technical data: When you use our website or other electronic offerings, we collect the IP address of your terminal device and other technical data (e.g., browser type used, operating system, or date) to ensure the functionality and security of these offerings. This data also includes logs in which the use of our systems is recorded. We generally retain technical data for 6 months. In order to ensure the functionality of these offers, we may also assign an individual code to you or your end device (e.g. in the form of a cookie, see section 11). The technical data in itself does not allow any conclusions to be drawn about your identity. However, in the context of user accounts, registrations, access controls or the processing of contracts, they can be linked to other data categories (and thus possibly to your person).
  • Registration Data: Certain offers and services can only be used with a user account or registration, which can be done directly with us or through our external login service providers. In doing so, you must provide us with certain data (e.g. user name, password, name, e-mail) and we collect data about the use of the offer or service. We usually keep registration data for 24 months after the end of the use of the service or the termination of the user account.
  • Communication Data: If you are in contact with us via the contact form, by e-mail, telephone or chat, by letter or via other means of communication, we collect the data exchanged between you and us, including your contact data and the marginal data of the communication. If we want or need to establish your identity, for example in the case of a request for information made by you, we collect data to identify you (e.g. a copy of an identification document). We generally retain this data for 24 months from the last exchange with you. This period may be longer if this is necessary for reasons of evidence or to comply with legal or contractual requirements, or for technical reasons. E-mails in personal mailboxes and written correspondence are generally retained for at least 10 years.
  • Master Data: As master data we refer to the basic data that we need in addition to the contractual data (see below) for the processing of our contractual and other business relationships or for marketing and advertising purposes, such as name, contact details, payment details and possibly other information such as date of birth, gender, the customer history and consent forms. We process your master data if you are a customer or other business contact or work for one (e.g. as a contact person of the business partner), or because we want to address you for our own purposes or the purposes of a contractual partner (e.g. in the context of marketing and advertising, with coupons, with newsletters, etc.). We usually receive master data from you yourself (e.g. when placing an order or as part of a registration), from entities for which you work, or from third parties such as our contractual partners, associations and address dealers, and from publicly accessible sources such as public registers or the Internet (websites, social media, etc.). We generally retain this data for 10 years from the last exchange with you, but at least from the end of the contract. This period may be longer, insofar as this is necessary for reasons of proof or to comply with legal or contractual requirements or is technically required. For pure marketing and advertising contacts, the period is usually much shorter, usually no more than 2 years since the last contact.
  • Contract data: This is data that arises in connection with the conclusion or execution of a contract, e.g., information about contracts and the services to be provided or provided, as well as data from the run-up to the conclusion of a contract, the information required or used for processing and information about reactions (e.g., complaints or information about satisfaction, etc.). As a rule, we collect this data from you, from contractual partners and from third parties involved in the processing of the contract, but also from third party sources and from publicly available sources. We generally keep this data for 10 years from the last contractual activity, but at least from the end of the contract. This period may be longer, insofar as this is necessary for reasons of evidence or to comply with legal or contractual requirements or is technically required.
  • Survey data: We naturally also collect data from surveys physically or on our website. We use the first and last name and other data fields in free text format. This survey data is anonymized after 24 months. The anonymized evaluation data is used for research purposes or to calculate benchmarks. If you transmit or disclose data about other persons, such as team members, we assume that you are authorized to do so and that this data is correct. By submitting data about third parties, you confirm this. Please also ensure that these third parties have been informed about this privacy policy.
  • Other data: We also collect data from you in other situations. In connection with official or judicial proceedings, for example, data is collected (such as files, evidence, etc.) that may also relate to you. We may also collect data for health protection reasons (e.g. as part of protection concepts). We may collect data on who participates in actions (e.g. competitions) and when, or who uses our infrastructure and systems and when. Finally, we collect and process data about our shareholders and other investors; in addition to master data, this includes information for the relevant registers, regarding the exercise of their rights and the holding of events (e.g. general meetings). The retention period for this data depends on the purpose and is limited to what is necessary. Data about you as a shareholder or other investor will be retained in accordance with the requirements of company law, but in any case for as long as you are invested  .

You disclose much of the data mentioned in this Item 3 to us yourself (e.g. via forms, as part of communication with us, in connection with contracts, when using the website, etc.). You are not obliged to do so, subject to individual cases, e.g. in the context of binding protection concepts (legal obligations). If you wish to enter into contracts with us or claim services, you must also provide us with data, in particular master data, contract data and registration data, as part of your contractual obligation under the relevant contract. When using our website, the processing of technical data is unavoidable. However, in the case of behavioral and preference data, you generally have the option of objecting or not giving your consent.

4. For what purposes do we process your data?

We process your data for the purposes we explain below. You will find further information for the online area in sections 11 and 12. These purposes or the underlying objectives represent legitimate interests of us and, where applicable, of third parties. You will find further information on the legal basis for our processing in section 5.

We process your data for purposes related to the provision of our services, communication with you, in particular to respond to inquiries and assert your rights (section 10) and to contact you in case of queries. For this purpose, we use in particular communication data (e.g. e-mail, telephone, chat or social media) and master data and, in connection with offers and services used by you, registration data. We retain this data to document our communication with you, for training and research purposes, for quality assurance and for follow-up inquiries.

We process data for the purpose of entering into, managing and processing contractual relationships. We conclude contracts of various kinds with our business and private customers, with suppliers, subcontractors or other contractual partners such as partners in projects or with parties in legal disputes. In doing so, we process in particular master data, contract data and communication data and, depending on the circumstances, also registration data of the customer or of the persons to whom the customer provides a service. In the course of initiating business, personal data - in particular master data, contract data and communication data - is collected from potential customers or other contractual partners (e.g. in an order form or contract) or results from a communication. In the context of the processing of contractual relationships, we process data for the administration of the customer relationship, for the provision and collection of contractual services, for consulting and for customer support. The enforcement of legal claims arising from contracts (collection, legal proceedings, etc.) is also part of the processing, as are accounting, termination of contracts and public communication.

We process data for marketing purposes and to maintain relationships, e.g. to send our customers and other contractual partners personalized advertising on products and services from us and from third parties. This may take the form, for example, of newsletters and other regular contacts (electronically, by post, by telephone), via other channels for which we have contact information from you, but also as part of individual marketing campaigns (e.g. events, competitions, etc.) and may also include free services (e.g. invitations, vouchers, etc.). You can refuse such contacts at any time (see at the end of this section 4) or refuse or revoke consent to be contacted for advertising purposes. With your consent, we can target our online advertising on the Internet more specifically to you (see section 11). In the context of relationship management, we may also operate a customer relationship management system ("CRM"), in which we store the data on customers, suppliers and other business partners necessary for the relationship management, e.g. on contact persons, on the relationship history (e.g. on products and services purchased or supplied, interactions, etc.), interests, wishes, marketing measures (newsletters, invitations to events, etc.) and other information.

We further process your data for market research, to improve our services and operations, and for product development.

We may also process your data for security purposes. We continuously review and improve the appropriate security of our IT and other infrastructure. Like all companies, we cannot rule out data security breaches with absolute certainty, but we do our best to reduce the risks.

We process personal data to comply with laws, directives and recommendations from authorities and internal regulations ("Compliance"). This includes, for example, the fulfillment of disclosure, information or reporting obligations, e.g. in connection with regulatory and tax obligations. Furthermore, we process data to serve our shareholders and other investors and to fulfill our obligations in this regard.

We also process data for the purposes of our risk management and as part of prudent corporate governance, including business organization and corporate development.

We may process your data for other purposes, e.g. as part of our internal processes and administration or for training and quality assurance purposes.

5. On what basis do we process your data?

Insofar as we ask for your consent for certain processing, we will inform you separately about the corresponding purposes of the processing. You can revoke consent at any time with future effect by notifying us in writing (by post) or, where not otherwise specified or agreed, by e-mail; you will find our contact details in section 2. For revocation of your consent for online tracking, see section 11. Where you have a user account, revocation or contact with us can also be carried out via the relevant website or other service, if applicable. Once we have received notification of the withdrawal of your consent, we will no longer process your data for the purposes to which you originally consented, unless we have another legal basis for doing so. The revocation of your consent does not affect the lawfulness of the processing carried out on the basis of the consent until the revocation.

Where we do not ask you for your consent for processing, we base the processing of your personal data on the fact that the processing is necessary for the initiation or execution of a contract with you (or the entity you represent) or that we or third parties have a legitimate interest in doing so, so in particular in order to pursue the purposes and related objectives described above under section 4 and to be able to implement appropriate measures. Our legitimate interests also include compliance with legal requirements, insofar as this is not already recognized as a legal basis by the applicable data protection law in each case (e.g. in the case of the GDPR, the law in the EEA and Switzerland).

6. Who do we disclose your information to?


In connection with our contracts, the Website, our services and products, our legal obligations or otherwise to protect our legitimate interests and the other purposes listed in Section 4, we also transfer your personal data to third parties, in particular to the following categories of recipients:

  • Service providers : We work with service providers in Germany and abroad who process data about you on our behalf or under joint responsibility with us, or who receive data about you from us under their own responsibility  .

We disclose to these service providers in each case the data required for their services, which may also concern you. These service providers may also use such data for their own purposes. In addition, we enter into contracts with these service providers that include provisions for the protection of data, to the extent that such protection does not result from the law. Our service providers may also process data on how their services are used and other data that arise in the course of using their service under certain circumstances as independent data controllers for their own legitimate interests (e.g., for statistical analysis or billing purposes). Service providers provide information about their independent data processing in their own data privacy statements.

The website uses the software HubSpot, a software of HubSpot Inc, USA. This software is used in the so-called area of inbound marketing and helps us, among other things, by means of statistical analyses and evaluation of logged user behavior, to better coordinate and optimize the marketing strategy. Cookies are used (see section 11. below). You can prevent the storage of cookies at any time by setting your browser software accordingly or delete the cookies already stored. Please note that if cookies are blocked, you may not be able to make full use of the services provided on our website. For more information, please refer to the Terms of Use and Privacy Policy of HubSpot Inc. accordingly at http://www.hubspot.com/terms-of-service and at http://www.hubspot.com/privacy-policy. All information collected by the Company is subject to this Privacy Policy. HubSpot is subject to TRUSTe's Privacy Seal and the U.S. - EU Safe Harbor Framework and the U.S. - Swiss Safe Harbor Framework. Contact: HubSpot, 2nd Floor 30 North Wall Quay, Dublin 1, Ireland, Phone: +353 1 5187500.

We use the software module Auth0 from Okta, Inc. (San Francisco, CA 94105, USA) for your login. For this purpose, the user's e-mail address and password are transmitted to Auth0. The user expressly consents to the transmission of his/her personal data to the external identity providers mentioned in this point, whose servers are located in the USA, or in another EU country. For more information, please visit https://auth0.com/privacy and https://auth0.com/terms.

 

  • Cloud service provider: For the purpose of storing and processing your personal data, we use the services of the following external cloud service provider. Microsoft 365 (incl. Exchange, SharePoint, Teams, OneDrive) and Microsoft Azure: The provider of these services is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland ("Microsoft"). According to Microsoft, data storage on Microsoft Azure (file data) is carried out exclusively on servers located in Switzerland, while Microsoft Exchange, SharePoint, Teams and OneDrive are stored in Europe (see here). In addition to the information provided here, you will find further information on data protection in the Microsoft data protection declaration: https://privacy.microsoft.com/de-de/privacystatement.

  • Authorities: We may disclose personal data to offices, courts and other authorities in Germany and abroad if we are legally obliged or entitled to do so or if this appears necessary to protect our interests. The authorities process data about you that they receive from us on their own responsibility.

  • Other persons: This refers to other cases where the inclusion of third parties arises from the purposes under item 4.

All these categories of recipients may in turn involve third parties, so that your data may also become accessible to them. We can restrict processing by certain third parties (e.g. IT providers), but not by other third parties (e.g. authorities, banks, etc.).

7. Does your personal data also end up abroad?


As explained in Section 6, we also disclose data to other entities. These are not only located in Switzerland. Your data may therefore be processed both in Europe and in the USA; in exceptional cases, however, in any country in the world.

If a recipient is located in a country without adequate legal data protection, we contractually oblige the recipient to comply with the applicable data protection (for this purpose, we use the revised standard contractual clauses of the European Commission, which can be accessed here: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?), unless the recipient is already subject to a legally recognized set of rules to ensure data protection and we cannot rely on an exception provision. An exception may apply in particular in the case of legal proceedings abroad, but also in cases of overriding public interests or if the performance of a contract requires such disclosure, if you have consented or if it is a matter of data made generally available by you, the processing of which you have not objected to.

Please also note that data exchanged via the Internet is often routed via third countries. Your data may therefore end up abroad even if the sender and recipient are in the same country.

8. How long do we process your data?


We process your data for as long as our processing purposes, the statutory retention periods and our legitimate interests in processing for documentation and evidence purposes require or storage is technically necessary. You will find further information on the respective storage and processing periods for the individual data categories in section 3 and for the cookie categories in section 11. If there are no legal or contractual obligations to the contrary, we will delete or anonymize your data after the storage or processing period has expired as part of our normal processes.

Documentation and evidence purposes include our interest in documenting processes, interactions and other facts in case of legal claims, discrepancies, IT and infrastructure security purposes and evidence of good corporate governance and compliance. Retention may be technically necessary if certain data cannot be separated from other data and we therefore need to retain it with them (e.g., in the case of backups or document management systems).

9. How do we protect your data?


We take reasonable security measures to maintain the confidentiality, integrity and availability of your personal information, to protect it against unauthorized or unlawful processing, and to protect against the risks of loss, accidental alteration, unauthorized disclosure or access.

Security measures of a technical nature and of an organizational nature may include, for example, measures such as the encryption and pseudonymization of data, logging, access restrictions, the storage of backup copies, instructions to our employees, confidentiality agreements and controls. We protect your data transmitted via our website in transit using appropriate encryption mechanisms. However, we can only secure areas that we control. We also require our contractors to take appropriate security measures. However, security risks cannot generally be completely ruled out; residual risks are unavoidable.

10. What rights do you have?


Applicable data protection law grants you the right to object to the processing of your data in certain circumstances, in particular that for direct marketing purposes, profiling used for direct marketing and other legitimate interests in processing.

To help you control the processing of your personal data, you also have the following rights in connection with our data processing, depending on the applicable data protection law:

  • The right to request information from us as to whether and what data we process from you;

  • the right to have us correct data if it is inaccurate;

  • the right to request the deletion of data;

  • the right to request that we provide certain personal data in a commonly used electronic format or transfer it to another controller;

  • the right to withdraw consent, insofar as our processing is based on your consent;

  • the right to receive, upon request, further information necessary for the exercise of these rights;

If you wish to exercise the above rights against us, please contact us in writing, at our premises or, unless otherwise stated or agreed, by e-mail; you will find our contact details in section 2. In order for us to be able to rule out any misuse, we must identify you (e.g. by means of a copy of your ID card, unless otherwise possible).

You also have these rights vis-à-vis other entities that cooperate with us on their own responsibility - please contact them directly if you wish to exercise rights in connection with their processing. You will find information on our important cooperation partners and service providers in section 7, further information in section 11.

Please note that conditions, exceptions or restrictions apply to these rights under applicable data protection law (e.g., to protect third parties or trade secrets). We will inform you accordingly if necessary.

If you do not agree with our handling of your rights or data protection, please let us know (section 2). In particular, if you are located in the EEA, the United Kingdom or Switzerland, you also have the right to complain to the data protection supervisory authority in your country. A list of authorities in the EEA can be found here: https://edpb.europa.eu/about-edpb/board/members_de. The UK supervisory authority can be reached here: https://ico.org.uk/global/contact-us/. You can reach the Swiss supervisory authority here: https://www.edoeb.admin.ch/edoeb/de/home/der-edoeb/kontakt/adresse.html.

11. Do we use online tracking techniques?

On our website, we use various techniques with which we and third parties engaged by us can recognize you during your use and possibly also track you over several visits. In this section we inform you about it.

In essence, this is so that we can distinguish accesses by you (via your system) from accesses by other users, so that we can ensure the functionality of the website and carry out evaluations and personalizations. In doing so, we do not want to infer your identity, even if we can do so to the extent that we or third parties engaged by us can identify you through a combination with registration data. Even without registration data, however, the technologies used are designed in such a way that you are recognized as an individual visitor each time you access the site, for example by our server (or the servers of third parties) assigning you or your browser a specific recognition number (so-called "cookie").

We use such techniques on our website and allow certain third parties to do so as well. However, depending on the purpose of these techniques, we may ask for your consent before they are used. You can program your browser to block or deceive certain cookies or alternative techniques, or to delete existing cookies. You can also enhance your browser with software that blocks tracking by certain third parties. You can find more information about this on the help pages of your browser (usually under the keyword "Privacy") or on the websites of the third parties that we list below.

The following cookies (techniques with comparable functionalities such as fingerprinting are included here) are used:

  • Necessary cookies: Some cookies are necessary for the functioning of the website as such or certain functions. For example, they ensure that you can switch between pages without losing information entered in a form. They also ensure that you remain logged in. These cookies only exist temporarily ("session cookies"). If you block them, the website may not work. Other cookies are necessary so that the server can store decisions or entries made by you beyond one session (i.e. one visit to the website), if you request this function (e.g. selected language, given consent, the function for an automatic login, etc.). These cookies have an expiration date of up to 24 months.

We may also integrate further third-party offers on our website, in particular from social media providers. These offers are deactivated by default. As soon as you activate them (e.g. by clicking a button), the corresponding providers can determine that you are on our website. If you have an account with the social media provider, it can assign this information to you and thus track your use of online offers. These social media providers process this data under their own responsibility.

We currently use offers from the following service providers and advertising contract partners (insofar as they use data from you or cookies set on your computer for advertising purposes):

  • Google Analytics: Google Ireland (based in Ireland) is the provider of the "Google Analytics" service and acts as our order processor. Google Ireland relies on Google LLC (based in the USA) as its order processor (both "Google") for this purpose. Google thereby tracks the behavior of visitors to our website (duration, frequency of pages viewed, geographic origin of access, etc.) through performance cookies (see above) and creates reports for us on the use of our website on this basis. We have configured the service so that the IP addresses of visitors are shortened by Google in Europe before being forwarded to the USA and thus cannot be traced. We have turned off the "Data Forwarding" and "Signals" settings. Although we can assume that the information we share with Google is not personal data for Google, it is possible that Google can draw conclusions about the identity of visitors from this data for its own purposes, create personal profiles and link this data to the Google accounts of these individuals. If you consent to the use of Google Analytics, you explicitly agree to such processing, which also includes the transfer of personal data (in particular usage data about the website and app, device information and individual IDs) to the USA and other countries. Information on the data protection of Google Analytics can be found here https://support.google.com/analytics/answer/6004245 and if you have a Google account, you can find further details on processing by Google here https://policies.google.com/technologies/partner-sites?hl=de.

  • Google Fonts: We use this service, also offered by Google Ireland (and Google LLC), for the technically secure and efficient integration of fonts and symbols. It also enables short loading times and a uniform presentation. The provider of the fonts is informed of the user's IP address so that the fonts can be made available in the user's browser. In addition, technical data (language settings, screen resolution, operating system, hardware used) that are necessary for the provision of the fonts are transmitted. This data may be processed on a server of the provider of the fonts in the USA. Information on the data protection of Google Fonts can be found here: https://policies.google.com/privacy.

12. What data do we process on our pages in social networks?


We may operate pages and other online presences ("fan pages", "channels", "profiles" etc.) on social networks and other platforms operated by third parties and collect the data about you described in section 3 and below there. We receive this data from you and the platforms when you come into contact with us via our online presence (e.g., when you communicate with us, comment on our content or visit our presence). At the same time, the platforms evaluate your use of our online presences and link this data with other data about you known to the platforms (e.g., about your behavior and preferences). They also process this data for their own purposes under their own responsibility, in particular for marketing and market research purposes (e.g. to personalize advertising) and to control their platforms (e.g. which content they show you).

We process this data for the purposes described in section 4, in particular for communication, marketing purposes (including advertising on these platforms, see section 11 and section 12) and market research. You will find information on the relevant legal basis in section 5. We may ourselves disseminate content published by you (e.g. comments on an announcement) (e.g. in our advertising on the platform or elsewhere). We or the operators of the platforms may also delete or restrict content from or about you in accordance with the usage guidelines (e.g. inappropriate comments).

For further information on the processing of the platform operators, please refer to the data protection notices of the platforms. There you can also find out in which countries they process your data, which rights of access, deletion and other data subjects you have and how you can exercise these or obtain further information. We currently use the following platforms :

13. Can this privacy policy be changed?

This privacy policy is not part of any contract with you. We may amend this privacy policy at any time. The version published on this website is the current version.

Last updated: May 30, 2023