Privacy Policy INFINIRI AG (INFINIRI LTD) (INFINIRI SA)

1. What does this Privacy Policy contain?

The protection of your personal data is very important to us. With this Privacy Policy, we inform you which personal data we process, how we process it and for what purpose we process it. We have aligned this Privacy Policy with both Swiss data protection legislation and the European General Data Protection Regulation.

In particular, you can find the following information in the Privacy Policy

1. Which personal data we process;
2. The purpose for which we process your personal data;
3. How long we process personal data;
4. What rights you have in relation to your personal data; and
5. Who you can contact if you have any concerns regarding your personal data.

2. Who is responsible and how can you contact us?

The following person ("we" or "us") is responsible for the processing of your personal data in accordance with this Privacy Policy:

If you have any questions about the processing of your personal data, please contact us at the following address:

3. Who is this Privacy Policy intended for?

This Privacy Policy applies to all persons ("you") whose personal data we process. It does not matter how you contact us. This can be via the website, by telephone, via social media, by email, etc. The Privacy Policy applies both to future personal data and to personal data that has already been collected. In addition to this Privacy Policy, other documents and guidelines from us may contain information on the processing of personal data (e.g. Cookie Policy, etc.).

4. What types of personal data do we process?

"Personal data" is all information that relates to an identified or identifiable person. We process the following types of personal data, among others:

1. "Master data" is basic personal data about you such as title, name, contact details, date of birth, interests, newsletter registration, etc.
2. "Contract data" is personal data that we process in the context of business initiation and contract processing. We mainly conclude contracts with our sales partners and direct customers. This may also involve transaction and payment data.
3. "Communication data" is personal data that is collected when we correspond or contact each other, including by email, chat and other means of communication.
4. "Behavioral data" is personal data that relates to statements about your behavior and activities in connection with our website. This includes, for example, information about behavior on websites or the use of electronic communications such as newsletters.
5. "Preference data" is personal data that contains your interests and preferences. We process such data in order to be able to provide you with suitable offers and services. We can link and evaluate behavioral data with other data and form groups of people who have certain similarities or overlaps with regard to certain characteristics.
6. "Technical data" is personal data that is collected when you use our website or our social media presence. In addition to small files that are stored when you access our website (e.g. cookies to recognize you or improve the services), this also includes data that logs the processes running on a computer or network system (e.g. log data and IP addresses and other connection and usage data).

5. Where does this personal data come from?

You often provide us with personal data yourself. This happens when you communicate with us, use our website or enter or wish to enter into a contractual relationship with us (e.g. purchase contract). The personal data provided includes, in particular, master data, communication data, contract data and technical data. If you provide us with personal data from third parties, we assume that you are authorized to do so and that you will inform the data subject in a general manner about the processing by us or other external service providers.

We may also receive your personal data from third parties. This happens, for example, when you communicate with us and an intermediary third-party provider discloses your personal data.

We may also collect your personal data or derive it from existing personal data. This happens, for example, when you use our website. Therefore, the personal data collected is often technical data and behavioral data and the personal data evaluated is often preference data.

6. For what purposes do we process personal data?

1. Contract processing

   We process personal data in connection with the offer, conclusion and execution of contracts. The purpose generally covers everything that is expedient and necessary to offer, conclude, execute, terminate and, if necessary, enforce contracts. This purpose may include master data, contract data, communication data, behavioral data and preference data.

   The following processing is part of contract processing:

   1. Providing contractual services;
   2. Deciding whether and under what modalities a contract is entered into;
   3. Terminating contracts;
   4. Correspondence with you and our third-party providers or other contact persons;
   5. Invoicing services, as well as dunning and accounting;
   6. Enforcing legal claims arising from contracts;
   7. Archiving contracts.

2. Communication

   We process personal data in connection with communication activities. The purpose generally covers everything that is appropriate and necessary to communicate with you. Master data, technical data, communication data, behavioral data and preference data may be used for this purpose.

   In particular, the following processing is part of communication:

   1. Customer care;
   2. Responding to inquiries;
   3. Communication in connection with contractual relationships.

3. Information and Marketing

   We process personal data for marketing and information purposes. Master data, contract data, technical data, communication data, behavioral data and preference data may be used for this purpose. We may personalize our communications. Further information on profiling can be found in section 11.

   In particular, the following processing is part of information and marketing:

   1. Newsletters and promotional email;
   2. Printed matter such as advertising brochures etc.;
   3. Invitations to events.

4. Market Research, Sales and Service Development

   We process the personal data described in the Cookie Policy in order to continuously improve our website and offers and process such personal data for the purpose of market research. For this purpose, we use technical data, behavioral data and preference data in particular.

   In particular, the following processing in particular is part of market research and service development:

   1. Improving the user-friendliness of the website;
   2. Improvement and further development of our sales and related services.

5. Security and Prevention

   We process the personal data described in the Cookie Policy in order to protect our website and IT systems from misuse and to ensure security. To this end, we use master data, technical data and behavioral data in particular.

   In particular, the purpose of security and prevention includes:

   1. Defense against and investigation of malware and cyberattacks;
   2. Controlling access to our website and IT systems;
   3. Creating backup copies;
   4. Testing and analyzing our networks, IT systems and website.

6. Protection of rights

   We process personal data in order to comply with our legal obligations and enforce our rights. This means that we use personal data, subject to other mandatory legal norms or contractual agreements, to enforce our claims in court and to comply with orders from authorities and courts. For this purpose, we use in particular master data, contract data, technical data and behavioral data.

   In particular, the purpose of enforcing rights includes:

   1. Clarification, enforcement and defense of claims;
   2. Receipt and processing of complaints;
   3. Disclosure to authorities if we are legally obliged to do so or have an objective reason to do so.

7. Administration

   We process personal data for business operations, processing contractual relationships and administration. For this purpose, we use in particular master data, contract data, technical data, communication data and behavioral data.

   In particular, the purpose of administration includes:

   1. Analysis and improvement of processes;
   2. Administration wie Buchhaltung und IT;
   3. Archiving of data.

7. On what legal basis do we process personal data?

Our processing of personal data is based on various legal bases, depending on the purpose on which the processing is based.

Processing may be necessary to protect our own legitimate interests or those of third parties. In addition to the purposes described in section 6 and the disclosure pursuant to section 8, legitimate own interests may also include, for example, advertising and marketing activities. Legitimate interests may also include the interests of third parties, e.g. in the context of a collaboration based on the division of labor.

Furthermore, processing may also be necessary to comply with applicable legal provisions and thus include, for example, archiving and disclosure obligations.

Processing may also be based on consent. This is the case, for example, if we receive personal data as part of the conclusion of a contract.

In addition, the processing of personal data may be necessary in order to initiate the conclusion of contracts, e.g. in connection with the offer of products on our websites.

8. To whom do we disclose personal data?

Subject to deviating mandatory legal provisions or contractual agreements, we may use the services of third parties and pass on your personal data to such third parties. Such third parties generally process your personal data on our behalf. As such a "processor", the third party is obliged to process the personal data exclusively in accordance with our instructions and to take appropriate data security measures. By means of contractual regulations, we ensure that data protection is guaranteed throughout the processing of your personal data.

Personal data may be passed on to third parties and external service providers for the following services, among others:

1. IT services such as website hosting, use of cloud services, sending newsletters by email, IT support;
2. Payment services;
3. Shipping, transportation and consulting services.

Subject to mandatory legal provisions to the contrary, we may also pass on personal data to third parties for their purposes if, for example, you have given us your consent to do so or we are legally obliged or entitled to do so.

This may occur in the following cases, for example

1. Official or court order to disclose personal data;
2. Assertion of legal claims or defense against legal claims.

Further information on the independent collection of personal data by third-party providers on our website can be found in our Cookie Policy.

9. Do we disclose personal data abroad?

We usually store and process your personal data in Switzerland, the United Kingdom and the European Union. However, we may also process or have your personal data processed outside this area.

If the respective recipient country does not have an adequate legal level of data protection, we will transfer the personal data either on the basis of consent or standard contractual clauses, or if it is necessary for the fulfillment or execution of a contract or for the enforcement of legal claims. Despite all precautions, there is still a residual risk when data is transferred abroad, e.g. that the foreign state may still gain access.

10. How do we process particularly sensitive personal data?

Certain personal data is classified as "particularly sensitive" under data protection legislation. This includes, for example, data about a person's state of health or biometric characteristics. As a rule, we only process particularly sensitive personal data if this is necessary for our services, if the data subject has consented to the processing or if the data subject has disclosed the particularly sensitive personal data of their own accord. In addition, we may process personal data requiring special protection if the applicable rights permit processing, processing is necessary to safeguard the law or the data requiring special protection has obviously been made public by the data subject.

We may process particularly sensitive personal data in the following cases, for example:

1. In connection with a contractual relationship with you;
2. You apply for a job with us and provide us with information about the existence or non-existence of a criminal record.

11. How do we use profiling?

The term "profiling" means

the automated processing of personal data in order to make predictions or analyze personal aspects, e.g. about expected behavior or personal preferences and interests. Profiling can be used, for example, in the following automated processing activities:

1. Processing of communication data, e.g. analyzing the response to receiving newsletters;
2. Processing of master data, behavioral data and technical data, e.g. to analyze search queries on our website.

We use profiling in connection with our newsletter, as described in the Cookie Policy.

12. How is personal data protected?

We protect your personal data with proportionate and reasonable technical and organizational precautions and take measures to protect your personal data from unauthorized or unlawful processing and unintentional disclosure and to counteract the risk of loss, unintentional modification and unauthorized access.

The organizational security measures include, among other things, instructions to our employees, training and controls. Technical security measures include encryption and pseudonymization, access control and logging.

13. How long is personal data processed?

The storage and processing of your personal data can take different lengths of time and depends on how long we have a legitimate interest in storing and processing your personal data, how long the statutory retention obligations last and how long it is necessary to fulfill the purpose for which we received your personal data.

In particular, for the retention of personal data, we are guided by the following periods:

1. The retention of Technical Data usually lasts a few days but can last up to 2 years. Certain technical data is deleted after the end of the session or use of the service.
2. Contract data is generally stored by us for 10 years after the end of the contract. Longer retention periods may apply for reasons of proof, for technical reasons and for reasons of contractual or legal requirements.
3. Communication data such as written correspondence, contact via contact forms and e-mail are generally stored for 10 years.
4. Master data is stored for the duration of the user account, provided that no other services are or have been obtained or longer retention periods apply due to other contractual or legal requirements.
5. We generally delete personal data from job applications 6 months after completion of the application process, unless otherwise agreed.
6. Your personal data will be deleted or anonymized after the aforementioned periods have expired.

14. What rights do you have in connection with the processing of your personal data?

You have the right to object to the processing of your personal data. Provided that no legal exceptions apply, and the applicable requirements are met, you can therefore exercise the following rights in connection with your personal data:

1. Correction of incorrect or incomplete personal data;
2. Deletion or anonymization of your personal data;
3. Restriction of the processing of your personal data;
4. Information about the personal data we have stored about you;
5. Revocation of consent to the processing of your personal data for the future, insofar as the processing is based on consent;
6. Provision of certain of your personal data in a machine-readable, commonly used and structured format.

The above-mentioned rights may be restricted or excluded in individual cases, e.g. to comply with legal obligations or to protect legitimate interests. It is therefore possible that we may or must retain or otherwise continue to process personal data for legal reasons despite a request to erase or restrict processing.

You can unsubscribe from newsletters using the corresponding third-party provider function or by clicking on the link provided in the email. You can also contact us directly (see section 2).

You also have the legal right to lodge a complaint with the competent state supervisory authorities if you have concerns as to whether our processing of your personal data complies with the law.

15. Changes to this Privacy Policy and Language

The version of the Privacy Policy valid at the time data processing begins shall apply. The Privacy Policy may be amended from time to time, e.g. if the applicable laws or our data processing changes.

In the event of a discrepancy between the German and English versions of this Privacy Policy, the German version shall take precedence.

Version: January 1st, 2024

INFINIRI AG (INFINIRI LTD) (INFINIRI SA)