Privacy Policy of AssetOS AG

About Us

This Privacy Policy ("Privacy Policy") explains how we process and protect your personal data when you use this website https://assetos.ch/ ("Website") and our services (together the "Services").

These Services are operated by AssetOS AG, Stadthausstrasse 14, 8400 Winterthur, Switzerland ("AssetOS", "we", "our" or "us"). AssetOS is the controller for the data processing described below.

Unless otherwise defined in this Privacy Policy, the definitions used in this Privacy Policy have the same meaning as in the Swiss Federal Data Protection Act ("DPA") or the EU General Data Protection Regulation ("GDPR").

In Germany, we have appointed an EU representative in accordance with Article 27 GDPR. If you are visiting us from the EU, you can also contact LEXR Germany Rechtsanwalts GmbH:

• by email at: contact@lexr.com
• by mail at: Friedrichstrasse 68, 10117 Berlin, Deutschland
• or by phone at: +49 30 46 777 29 80

1. Personal data we collect

When you use our Services, we may collect or receive personal data for a number of purposes related to our business operations, namely

• Usage and analytics data (e.g., identifiers, number of clicks, tracking data)
• Personal details (e.g., first and last name, image, date of birth)
• Contact information (e.g., address, phone number, email address)
• Login data (e.g., session)
• Payment data (e.g., billing information, credit card data)
• Request details (e.g., details and content of your requests)
• Website visitor information (e.g., IP address, log files, terminal ID)
• Social media information (e.g., LinkedIn information)
• Survey and feedback information (e.g., survey responses, ratings, reviews)

There is no obligation to provide your personal data. However, please note that our Services cannot be provided if you do not provide the required data that are absolutely necessary for the fulfillment of the contract between you and us.

2. How we collect personal data

We collect information about our users when they use our Services, including certain actions within the Services.

Directly

• Through our website and electronic communications
• When you use our Services
• When you provide services to us
• When you fill out forms that we provide as part of delivering our Services
• When you submit your requests or feedback through our contact forms
• When you complete surveys and other questionnaires in which you provide us with your feedback
• When you provide us with your payment data during transactions
• When we communicate with you to support you

Indirectly

• Through public sources
• From public registers (e.g., commercial registers), newspaper articles, and internet research
• From external service providers (see Section 5)

3. Legal basis and purpose

Our legal basis for collecting and using the personal data described in this Privacy Policy depends on the personal data we collect and the specific purposes for which we collect it.

Contract

To fulfill our contractual obligations or to carry out measures in connection with a contract with you. In particular:

• To provide you with customer service and process your requests
• To provide our Services and send related information, updates, and alerts

Consent

We may rely on your consent voluntarily given at the time of submitting your personal data. This applies in particular:

• To analyze, improve, personalize, and monitor the use of our Services and communications
• Placing non-essential cookies and other tools in your browser
• To provide users with news, special offers, newsletters, and general information about the goods and services we offer

Legitimate interests

We rely on legitimate interests based on our assessment that the processing is fair and reasonable and does not override your interests or fundamental rights and freedoms. In particular:

• To place essential cookies and other tools in your browser that are technically necessary for our Services
• Development of new services
• To maintain and improve our Services and to detect, prevent, and combat security threats

Necessity to fulfill legal obligations

To fulfill legal obligations and obligations in the public interest. In particular:

• To inform you about changes to our Services and our Privacy Policy
• Compliance with applicable regulations and laws
• For legal enforcement of claims and rights

4. Storage of data

We retain personal data for as long as they are needed for the purposes for which they were collected and in accordance with legal and regulatory requirements or contractual agreements. After this period, we delete your personal data or anonymize them completely.

5. Recipients of data

We engage third-party companies ("Service Providers") to facilitate the operation of our Services, help analyze the use of the Services, or provide necessary services such as payments and the provision of IT services. These third parties have access to your personal data only to the extent necessary to perform these tasks.

Type(s) of service providers who may access your personal data:

• Professional advisors we engage, such as auditors and lawyers
• Third parties engaged in connection with your matter, such as lawyers, banks and other payment service providers, and postal or courier service providers
• Insurers
• Third parties providing IT and software services, including video call software
• Third parties who help us with customer insights and marketing

6. Data transfers

We and/or our Service Providers may transfer and process your personal data in the following countries:

We and/or our Service Providers may transfer and process your personal data in the following countries:

• EU and EEA
• UK
• USA

We may use service providers that are partly based in so-called third countries (outside the European Union or the European Economic Area or Switzerland) or process personal data there, i.e., in countries whose level of data protection does not correspond to that of the EU or Switzerland.

We protect your personal data in accordance with our contractual obligations and applicable data protection laws when we transfer data abroad.

These protective measures may include:

• Transfer to countries that, in the opinion of the Federal Council, offer an adequate level of protection, as well as to countries for which an adequacy decision of the European Commission exists;
• Application of standard data protection model clauses, binding corporate rules, or other standard contractual obligations that ensure adequate data protection.

If a transfer to a third country takes place and no adequacy decision or appropriate safeguards are in place, there is the possibility and risk that authorities in the third country (e.g., intelligence services) may gain access to the transferred data and the enforceability of the data subject's rights cannot be guaranteed.

7. Disclosure of data

We may disclose your personal data if we believe in good faith that such action is necessary:

• To comply with a legal obligation (i.e., when required by law or in response to legitimate requests from authorities, such as a court or government agency)
• To protect the security of our Services and defend our rights or property
• To prevent or investigate possible misconduct in connection with us

8. Security of data

We implement appropriate technical and organizational security measures to protect your stored data from manipulation, loss, or unauthorized access by third parties. Our security measures are continuously adapted in line with technological developments.

We also take internal data protection very seriously. Our employees and the service providers we engage are bound to confidentiality and to comply with applicable data protection laws. In addition, they only have access to personal data to the extent necessary for the performance of their respective tasks or assignment.

The security of your personal data is important to us, but remember that no method of transmission over the Internet or electronic storage is 100% secure. While we strive to protect your personal data using commercially reasonable means, we cannot guarantee its absolute security. We recommend using anti-virus software, a firewall, and other similar software to protect your system.

9. Your Rights

You have the following data protection rights. To exercise these rights, you can contact the address mentioned above or send an email to: info@assetos.ch. Please note that we may ask you to verify your identity before responding to such requests.

• Right to Access: You have the right to request a copy of your personal data, which we will provide to you in electronic form.
• Right to Amendment: You have the right to ask us to correct our records if you believe they contain incorrect or incomplete information about you.
• Right to Withdraw Consent: If you have consented to the processing of your personal data, you have the right to withdraw this consent at any time with effect for the future. This also applies if you wish to unsubscribe from marketing communications. Once we have received notification that you have withdrawn your consent, we will no longer process your data for the purpose(s) to which you originally agreed, unless there is another legal basis for the processing. If you no longer wish to receive emails from us, please click on the "Unsubscribe" link in the email you received or contact us at info@assetos.ch.
• Right to Deletion: You have the right to request that we delete your personal data if it is no longer necessary for the purposes for which it was collected or if it has been unlawfully processed.
• Right to Restriction of Processing: You have the right to request the restriction of processing of your personal data if you believe the data is inaccurate, the processing is unlawful, or we no longer need to process the data for the original purpose, but we cannot delete it due to a legal obligation or because you do not wish us to do so.
• Right to Portability: You have the right to request that we transfer your personal data in a standard format such as Excel to another data controller if it is data that you have provided to us and if we process it on the legal basis of your consent or to fulfill our contractual obligations.
• Right to Object to Processing: If the legal basis for processing your personal data is our legitimate interest, you have the right to object to such processing on grounds relating to your particular situation. We will comply with your request unless we have a compelling legal basis for the processing that overrides your interests, or we need to continue processing the personal data for the establishment, exercise, or defense of legal claims.
• Right to Complain to a Supervisory Authority: You have the right to complain to a data protection supervisory authority if you believe that the processing of your personal data violates data protection law. The competent data protection authority in Switzerland is the Federal Data Protection and Information Commissioner (www.edoeb.admin.ch/edoeb/en/home.html). In the EU and EEA, you can exercise this right, for example, with a supervisory authority in the Member State of your residence, your place of work, or the place of the alleged violation. A list of the competent authorities can be found here: https://edpb.europa.eu/about-edpb/board/members_en.

10. Cookies

Our Services use cookies and similar technologies (collectively "Tools") that are provided either by us or by third parties.

A cookie is a small text file that is stored by the browser on your device. Comparable technologies are web storage (local/session storage), fingerprints, tags, or pixels. Most browsers are set by default to accept cookies and similar technologies. However, you can usually configure your browser to reject cookies or similar technologies or to store them only with your prior consent. If you reject cookies or similar technologies, you may not be able to use all of our Services without problems.

The tools we use are listed below by category, with information about the providers of the tools, the storage period, and their purpose. If personal data is transferred to third countries, we refer to Section 6 of our Privacy Policy, including with regard to the associated risks.

We use tools that are necessary for the operation of the website based on our legitimate interest in providing you with a more comfortable and personalized use of our Services and making them as time-saving as possible. In certain cases, these tools may also be necessary for the performance of a contract or to carry out pre-contractual measures. In these cases, access to and storage of information on the terminal device is absolutely necessary and takes place on the basis of the implementation laws of the EU Member States' ePrivacy Directive.

All other tools, especially those for marketing purposes, are used on the basis of your consent. In these cases, access to and storage of information on the terminal device is subject to consent and takes place on the basis of the implementation laws of the EU Member States' ePrivacy Directive. If you have given your consent to the use of certain tools, we will transfer the data processed when using the tools on the basis of this consent (also) to third countries. You can withdraw your consent for certain tools at any time in the settings of our cookie banner solution. Alternatively, you can also assert your withdrawal for certain tools directly with the provider.

10.1 Essential Tools

Currently, no cookies are used by essential tools.

10.2 Non-essential Tools

Currently, no cookies are used by non-essential tools.

11. Social Media and Links to Third-Party Applications and Websites

Our Services contain links to websites or apps that are not operated by us. If you click on a third-party link, you will be redirected to that third party's website or app. We have no control over the content, privacy policies, or practices of third-party websites or services.

We maintain online presences in social networks to, among other things, communicate with customers and interested parties and provide information about our products and services. If you have an account with the same network, it is possible that your information and media made available there can be seen by us, for example, when we access your profile. In addition, the social network may give us the opportunity to contact you. Once we transfer personal data to our own system, we are responsible for it ourselves. This is then done for the purpose of carrying out pre-contractual measures and fulfilling a contract. Please refer to the privacy policies of the social networks for the legal basis for data processing by the social networks on their own responsibility. Below is a list of social networks where we maintain an online presence:

• LinkedIn: Privacy Policies

12. Newsletter

We send newsletters and other notifications by email and through other communication channels and may deliver these with the help of third parties.

In principle, you must expressly consent to receiving newsletters and other notifications from us, unless this is permitted for other legal reasons. For emails, we use the "double opt-in" procedure for each consent, i.e., you receive an email with a web link that you must confirm by clicking on it, so that no misuse can take place by unauthorized third parties. We may log such consents including Internet Protocol address (IP), date, and time.

Newsletters and other notifications may contain web links or counting pixels that record whether an individual newsletter or notification has been opened and which web links have been clicked (performance measurement). Such web links and counting pixels record the use of newsletters and other notifications. We use this statistical recording of usage, including success and reach measurement, to offer newsletters and other notifications effectively and in a user-friendly manner, as well as permanently, securely, and reliably based on the reading habits of the recipients.

You can unsubscribe from newsletters and other notifications at any time and thereby object to the aforementioned usage recording in particular. You can do this by contacting us directly or by following the link in the footer of each newsletter we send you.

13. Changes to this Privacy Policy

We may update our Privacy Policy from time to time. We therefore recommend that you regularly check this Privacy Policy for changes.

Changes to this Privacy Policy take effect when they are published on this page.

14. Contact

If you have any questions about this Privacy Policy, please do not hesitate to contact us:

AssetOS AG

Stadthausstrasse 14, 8400 Winterthur

info@assetos.ch