PRIVACY POLICY

HERESTA GmbH
Mrs. Patrizia Kraft
Schwertstrasse 4
8200 Schaffhausen

T +41 52 632 10 00
info@heresta.ch

Based on Article 13 of the Swiss Federal Constitution and the data protection provisions of the Swiss Confederation (Data Protection Act, DSG), every person has the right to protection of their privacy as well as protection against misuse of their personal data. The operators of these pages take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the legal data protection regulations as well as this data protection declaration.

In cooperation with our hosting providers, we endeavour to protect the databases as well as possible against unauthorised access, loss, misuse or falsification.

We would like to point out that data transmission on the Internet (e.g. communication by e-mail) can have security gaps. Complete protection of data against access by third parties is not possible.

By using this website, you consent to the collection, processing and use of data as described below. This website can generally be visited without registration. Data such as pages accessed or names of files accessed, date and time are stored on the server for statistical purposes without this data being directly related to your person. Insofar as personal data (e.g. name, address or e-mail addresses) is collected on our pages, this is always done, as far as possible, on a voluntary basis. This data will not be passed on to third parties without your express consent.

Processing of personal data

Personal data means any information relating to an identified or identifiable individual. A data subject is a person about whom personal data are processed. Processing includes any handling of personal data, regardless of the means and procedures used, in particular the storage, disclosure, acquisition, erasure, retention, alteration, destruction and use of personal data.

We process personal data in accordance with Swiss data protection law. If and to the extent that the EU GDPR is applicable, we also process personal data on the following legal bases in connection with Art. 6 (1) GDPR:

lit. a) Processing of personal data with the consent of the data subject.
lit. b) Processing of personal data for the performance of a contract with the data subject as well as for the implementation of corresponding pre-contractual measures.
lit. c) processing of personal data for compliance with a legal obligation to which we are subject under applicable EU law or under applicable law of a country where the GDPR applies in whole or in part.
(d) processing of personal data for the purpose of protecting the vital interests of the data subject or of another natural person.
lit. f) processing of personal data to safeguard the legitimate interests of us or of third parties, unless the fundamental freedoms and rights and interests of the data subject override these. The legitimate interests include, in particular, our business interest in being able to provide our website, information security, the enforcement of our own legal claims and compliance with Swiss law.

We process personal data for the duration required for the respective purpose or purposes. In the case of longer-term retention obligations due to legal and other obligations to which we are subject, we restrict processing accordingly.

Cookies

This website uses cookies. These are small text files that enable specific information related to the user to be stored on the user's terminal device while the user is using the website. Cookies make it possible, in particular, to determine the frequency of use and the number of users of the pages, to analyse behavioural patterns of page use, but also to make our offer more customer-friendly. Cookies remain stored beyond the end of a browser session and can be retrieved when you visit the site again. If you do not wish this, you should set your internet browser to refuse the acceptance of cookies.

A general objection to the use of cookies for online marketing purposes can be declared for a large number of the services, especially for tracking, via the US site http://www.aboutads.info/choices/ or the EU site http://www.youronlinechoices.com/. Furthermore, the storage of cookies can be achieved by deactivating them in the browser settings. Please note that in this case not all functions of this online offer can be used.

With SSL/TLS encryption

This website uses SSL/TLS encryption for security reasons and to protect the transmission of confidential content, such as enquiries that you send to us as the site operator. You can recognise an encrypted connection by the fact that the address line of the browser changes from "http://" to "https://" and by the lock symbol in your browser line.

If SSL or TLS encryption is activated, the data you transmit to us cannot be read by third parties.

Server log files

The provider of this website automatically collects and stores information in so-called server log files, which your browser automatically transmits to us. These are:

Browser type and version
Operating system used
Referrer URL
Host name of the accessing computer
Time of the server request

This data cannot be assigned to specific persons. This data is not merged with other data sources. We reserve the right to check this data retrospectively if we become aware of concrete indications of illegal use.

Third party services

This website may use Google Maps to embed maps, Google Invisible reCAPTCHA to protect against bots and spam, and YouTube to embed videos. These services of the American Google LLC use, among other things, cookies, whereby data is transferred to Google in the USA, whereby we assume that no personal tracking takes place in this context solely through the use of our website. Google has undertaken to ensure adequate data protection in accordance with the US-European and the US-Swiss Privacy Shield. For further information, please refer to Google's privacy policy.

Contact form

If you send us enquiries via the contact form, your details from the enquiry form, including the contact details you provide there, will be stored by us for the purpose of processing the enquiry and in the event of follow-up questions. We do not pass on this data without your consent.

Rights of the data subject

Right to confirmation
Every data subject has the right to request confirmation from the website operator as to whether personal data concerning him or her are being processed. If you wish to exercise this right of confirmation, you may contact the data protection officer at any time.

Right to information
Every person affected by the processing of personal data has the right to receive information about the data stored about him or her and a copy of this information from the operator of this website at any time and free of charge. In addition, information may be provided about the following, if applicable:

• Purposes of the processing
• Categories of personal data processed
• Recipients to whom the personal data have been or will be disclosed
• if possible, the planned duration of the storage of the personal data or, if this is not possible, the criteria for determining this duration
• The existence of a right to rectification or erasure of personal data concerning them or to restriction of processing by the controller or a right to object to such processing
• the existence of a right of appeal to a supervisory authority
• if the personal data are not collected from the data subject: All available information about the origin of the data.

In addition, the data subject has the right to be informed whether personal data have been transferred to a third country or to an international organisation. If this is the case, the data subject also has the right to receive information about the appropriate safeguards in connection with the transfer.
If you wish to make use of this right to information, you can contact our data protection officer at any time.

Right of rectification
Any person concerned by the processing of personal data has the right to obtain the rectification without delay of inaccurate personal data relating to him or her. In addition, the data subject has the right to request the completion of incomplete personal data, including by means of a supplementary declaration, taking into account the purposes of the processing.
If you wish to exercise this right of rectification, you can contact our data protection officer at any time.

Right to erasure (right to be forgotten)
Any person concerned by the processing of personal data has the right to obtain from the controller of this website the erasure without delay of personal data concerning him or her, where one of the following grounds applies and where the processing is no longer necessary:

• The personal data were collected or otherwise processed for purposes for which they are no longer necessary.
• The data subject withdraws the consent on which the processing was based and there is no other legal basis for the processing
• The data subject objects to the processing on grounds relating to his or her particular situation and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing in the case of direct marketing and related profiling
• The personal data have been processed unlawfully
• The erasure of the personal data is necessary for compliance with a legal obligation under Union or Member State law to which the controller is subject
• The personal data have been collected in relation to information society services offered directly to a child

If one of the above reasons applies and you wish to arrange for the deletion of personal data stored by the operator of this website, you can contact our data protection officer at any time. The data protection officer of this website will arrange for the deletion request to be complied with immediately.

Right to restrict processing
Any person concerned by the processing of personal data has the right to obtain from the controller of this website the restriction of processing if one of the following conditions is met:

• The accuracy of the personal data is contested by the data subject for a period enabling the controller to verify the accuracy of the personal data
• The processing is unlawful, the data subject objects to the erasure of the personal data and requests instead the restriction of the use of the personal data
• The controller no longer needs the personal data for the purposes of processing, but the data subject needs them for the purposes of asserting, The data subject has objected to the processing on grounds relating to his or her particular situation and it is not yet clear whether the legitimate interests of the controller override those of the data subject

If one of the aforementioned conditions is met, you can contact our data protection officer at any time to request the restriction of the processing of personal data from the operator of this website. The data protection officer of this website will arrange the restriction of the processing.

Right to data portability
Any person concerned by the processing of personal data has the right to receive the personal data relating to him or her in a structured, commonly used and machine-readable format. In addition, the data subject has the right to obtain the direct transfer of personal data from one controller to another controller, where technically feasible and provided that this does not adversely affect the rights and freedoms of other individuals.
To exercise the right to data portability, you may at any time contact the data protection officer designated by the operator of this website.

A right of objection
Any person concerned by the processing of personal data has the right, on grounds relating to his or her particular situation, to object at any time to processing of personal data concerning him or her.
The operator of this website will no longer process the personal data in the event of the objection, unless we can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or for the assertion, exercise or defence of legal claims.
To exercise your right to object, you can contact the data protection officer of this website directly.

Right to revoke consent under data protection law
Every person affected by the processing of personal data has the right to revoke a given consent to the processing of personal data at any time.
If you wish to exercise your right to withdraw consent, you can contact our data protection officer at any time.

Paid services

For the provision of chargeable services, we request further data, such as payment data, in order to be able to execute your order. We store this data in our systems until the statutory retention periods have expired.

Copyright

The copyright and all other rights to the content, images, photos or other files on the website belong exclusively to the operator of this website or the named rights holders. The prior written consent of the copyright holders must be obtained for the reproduction of all files.
Anyone who commits a copyright infringement without the consent of the respective copyright holder may be liable to prosecution and, under certain circumstances, to claims for damages.

Disclaimer

All information on our website has been carefully checked. We make every effort to ensure that the information we provide is up-to-date, correct and complete. Nevertheless, the occurrence of errors cannot be completely ruled out, so that we cannot accept any liability for the completeness, correctness and up-to-dateness of the information, including journalistic and editorial information. Liability claims regarding damage caused by the use of any information provided, including any kind of information which is incomplete or incorrect, will therefore be rejected.
The publisher may change or delete texts at its own discretion and without prior notice and is not obliged to update the contents of this website. The use of or access to this website is at the visitor's own risk. The publisher, its customers or partners are not responsible for damages, such as direct, indirect, incidental or consequential damages, allegedly caused by visiting this website and consequently assume no liability for such damages.
The publisher also accepts no responsibility or liability for the content and availability of third-party websites that can be accessed via external links from this website. The operators of the linked sites are solely responsible for their content. The publisher therefore expressly distances itself from all third-party content that may be relevant under criminal or liability law or that may offend common decency.

Advertising

We use the possibility of displaying targeted advertising for our activities and operations on third parties such as social media platforms and search engines.

With such advertising, we would like to reach in particular people who are already interested in our activities and operations or who might be interested in them (remarketing and targeting). For this purpose, we may transmit corresponding - possibly also personal - information to third parties that enable such advertising. We can also determine whether our advertising is successful, i.e. in particular whether it leads to visits to our website (conversion tracking).

Third parties with whom we advertise and where you are registered as a user may be able to assign the use of our online offer to your profile there.

We use in particular:

Google Ads
This website uses Google Conversion Tracking. If you have reached our website via an ad placed by Google, a cookie will be set on your computer by Google Ads. The conversion tracking cookie is set when a user clicks on an ad placed by Google. These cookies expire after 30 days and are not used for personal identification. If the user visits certain pages of our website and the cookie has not yet expired, we and Google can recognise that the user clicked on the ad and was redirected to that page. Each Google Ads customer receives a different cookie. Cookies cannot therefore be tracked across Ads clients' websites. The information obtained using the conversion cookie is used to generate conversion statistics for Ads customers who have opted in to conversion tracking. Clients learn the total number of users who clicked on their ad and were redirected to a page tagged with a conversion tracking tag. However, they do not receive any information that can be used to personally identify users.
If you do not wish to participate in tracking, you can refuse the setting of a cookie required for this - for example, by a browser setting that generally deactivates the automatic setting of cookies or by setting your browser to block cookies from the domain "googleleadservices.com".
Please note that you must not delete the opt-out cookies as long as you do not want measurement data to be collected. If you have deleted all your cookies in the browser, you must set the respective opt-out cookie again.

This website uses the Google Maps service. This allows us to display interactive maps directly on the website and to enable you to use the map function conveniently. By visiting the website, Google receives the information that you have called up the corresponding sub-page of our website. This happens regardless of whether Google provides a user account via which you are logged in or whether there is no user account. If you are logged in to Google, your data will be directly assigned to your account. If you do not want your data to be associated with your Google profile, you must log out before activating the button. Google stores your data as usage profiles and uses them for the purposes of advertising, market research and/or demand-oriented design of its website. Such an evaluation is carried out in particular (also for users who are not logged in) to provide needs-based advertising and to inform other users of the social network about your activities on our website. You have the right to object to the creation of these user profiles, and you must contact Google to exercise this right. For more information on the purpose and scope of data collection and processing by Google, as well as further information on your rights in this regard and settings options for protecting your privacy, please visit: www.google.de/intl/de/policies/privacy.

This website uses so-called web fonts provided by Google for the uniform display of fonts. When you call up a page, your browser loads the required web fonts into its browser cache in order to display texts and fonts correctly. If your browser does not support web fonts, a standard font from your computer will be used.
You can find more information on Google Web Fonts at https://developers.google.com/fonts/faq and in Google's privacy policy: https://www.google.com/policies/privacy/

Google reCAPTCHA

This website uses the reCAPTCHA service of Google Ireland Limited (Gordon House, Barrow Street Dublin 4, Ireland "Google"). The query is used to distinguish whether the input is made by a human or by automated, machine processing. The query includes the transmission of the IP address and, if applicable, further data required by Google for the reCAPTCHA service to Google. For this purpose, your input is transmitted to Google and used there. However, your IP address will be shortened beforehand by Google within member states of the European Union or in other contracting states of the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and shortened there. On behalf of the operator of this website, Google will use this information to evaluate your use of this service. The IP address transmitted by your browser as part of reCaptcha will not be merged with other Google data. Your data may also be transferred to the USA. For data transfers to the USA, there is an adequacy decision of the European Commission, the "Privacy Shield". Google participates in the "Privacy Shield" and has submitted to the requirements. By pressing the query, you consent to the processing of your data. The processing is based on Art. 6 (1) lit. a DSGVO with your consent. You can revoke your consent at any time without affecting the lawfulness of the processing carried out on the basis of the consent until revocation.
Further information on Google reCAPTCHA and the associated data protection provisions can be found at: https://policies.google.com/privacy?hl=de

Google TagManager

The Google Tag Manager is a solution with which we can manage so-called website tags via an interface and thus integrate e.g. Google Analytics and other Google marketing services into our online offer. The Tag Manager itself, which implements the tags, does not process any personal data of the users. With regard to the processing of users' personal data, we refer to the following information on Google services. Usage guidelines: https://www.google.com/intl/de/tagmanager/use-policy.html.

Success and reach measurement

We use services and programmes to determine how our online offering is used. For example, we may measure the success and reach of our activities and operations and the impact of third party links to our website. However, we can also, for example, test and compare how different versions of our online offer or parts of our online offer are used ("A/B test" method). Based on the results of the success and reach measurement, we can in particular correct errors, strengthen popular content or make improvements to our online offer.

When using services and programmes for performance and reach measurement, the Internet Protocol (IP) addresses of individual users must be stored. IP addresses are always shortened ("IP masking") in order to follow the principle of data economy through the corresponding pseudonymisation and thus to improve the data protection of users.

When using services and programmes for performance and reach measurement, cookies may be used and user profiles may be created. User profiles include, for example, the pages visited or content viewed on our website, information on the size of the screen or browser window and the - at least approximate - location. As a matter of principle, user profiles are only created pseudonymously. We do not use user profiles to identify individual users. Individual services of third parties with which users are registered may be able to assign the use of our online services to the user account or user profile of the respective service.

Google Analytics

This website uses Google Analytics, a web analytics service provided by Google Ireland Limited. If the data controller on this website is located outside the European Economic Area or Switzerland, the Google Analytics data processing will be carried out by Google LLC. Google LLC and Google Ireland Limited are hereinafter referred to as "Google".
The statistics obtained enable us to improve our offer and make it more interesting for you as a user. This website also uses Google Analytics for a cross-device analysis of visitor flows, which is carried out via a user ID. If you have a Google user account, you can deactivate the cross-device analysis of your usage in the settings there under "My data", "Personal data".
The legal basis for the use of Google Analytics is Art. 6 para. 1 p. 1 lit. f DS-GVO. The IP address transmitted by your browser as part of Google Analytics will not be merged with other Google data. We would like to point out that on this website Google Analytics has been extended by the code "_anonymizeIp();" in order to ensure anonymised collection of IP addresses. This means that IP addresses are processed in shortened form so that they cannot be associated with a specific person. If the data collected about you can be assigned to a person, this is immediately ruled out and the personal data is deleted immediately.
Only in exceptional cases will the full IP address be transferred to a Google server in the USA and shortened there. On behalf of the operator of this website, Google will use this information for the purpose of evaluating your use of the website, compiling reports on website activity and providing other services relating to website activity and internet usage to the website operator. For the exceptional cases in which personal data is transferred to the USA, Google has submitted to the EU-US Privacy Shield, https://www.privacyshield.gov/EU-US-Framework.
Google Analytics uses cookies. The information generated by the cookie about your use of this website is generally transmitted to a Google server in the USA and stored there. You may refuse the use of cookies by selecting the appropriate settings on your browser, however please note that if you do this you may not be able to use the full functionality of this website. In addition, you can prevent the collection of data generated by the cookie and related to your use of the website (incl. your IP address) to Google as well as the processing of this data by Google by downloading and installing the browser plugin available under the following link: Deactivate Google Analytics.
In addition, you can also prevent the use of Google Analytics by clicking on this link: Deactivate Google Analytics. This will save a so-called opt-out cookie on your data carrier, which prevents the processing of personal data by Google Analytics. Please note that when you delete all cookies on your terminal device, these opt-out cookies will also be deleted, i.e. you must set the opt-out cookies again if you wish to continue to prevent this form of data collection. The opt-out cookies are set per browser and computer/end device and must therefore be activated separately for each browser, computer or other end device.

Smartsupp

This website offers the use of the chat software Smartsupp. The service provider is the Czech company Smartsupp.com, s.r.o., Šumavská 31, 602 00 Brno, Czech Republic. For more information about the data processed through the use of Smartsupp, please see the Privacy Policy at https://www.smartsupp.com/help/privacy-policy/.

Contractual services

We process the data of our contractual partners and interested parties as well as other clients, customers, clients or contractual partners (uniformly referred to as "contractual partners") in accordance with the data protection provisions of the Federal Data Protection Act (DSG) and the EU-DSGVO pursuant to Art. 6 para. 1 lit. b. DSGVO, in order to provide them with our contractual or pre-contractual services. The data processed in this context, the type, scope and purpose as well as the necessity of their processing result from the underlying contractual relationship.The data processed includes the master data of our contractual partners (e.g. names and addresses), contact data (e.g. e-mail addresses and telephone numbers) as well as contractual data (e.g. services used, contract content, contractual communication, names of contact persons) and payment data (e.g. We generally do not process any special categories of personal data unless these are part of an order or contract processing.
We process data that are necessary for the justification and fulfilment of the contractual services and point out the necessity of their disclosure, unless this is obvious to the contractual partners. Data is only passed on to external persons or companies if this is necessary within the framework of a contract. When processing the data provided to us within the scope of an order, we act in accordance with the instructions of the client as well as the statutory provisions.
As part of the use of our online services, we may store the IP address and the time of the respective user action. The storage is based on our legitimate interests as well as the interests of the users in protection against misuse and other unauthorised use. As a matter of principle, this data is not passed on to third parties unless it is necessary for the prosecution of our claims pursuant to Art. 6 para. 1 lit. f. DSGVO or there is a legal obligation to do so pursuant to Art. 6 para. 1 lit. c. DSGVO.
The deletion of the data takes place when the data is no longer required for the fulfilment of contractual or legal due diligence obligations as well as for the processing of any warranty and comparable obligations, whereby the necessity of the retention of the data is reviewed at irregular intervals. In all other respects, the statutory retention obligations shall apply.

Data transfer to the USA

Among other things, tools from companies based in the USA are integrated on our website. If these tools are active, your personal data may be transferred to the US servers of the respective companies. We would like to point out that the USA is not a safe third country in the sense of EU data protection law. US companies are obliged to hand over personal data to security authorities without you as a data subject being able to take legal action against this. It can therefore not be ruled out that US authorities (e.g. intelligence services) process, evaluate and permanently store your data located on US servers for monitoring purposes. We have no influence on these processing operations.

Changes

We may change this privacy policy at any time without prior notice. The most current version published on our website will apply. Where the privacy policy forms part of an agreement with you, we will notify you of the change by email or other appropriate means in the event of an update.

Disclaimer

The text was created using a generator, which creates the privacy policy on the basis of the DSG and the DSGVO, so that the privacy policy is also fair for visitors from the EU. The author assumes no liability for the correctness, accuracy, up-to-dateness, reliability and completeness of the information.
Liability claims regarding damage caused by the use of any information provided, including any kind of information which is incomplete or incorrect, will therefore be rejected.

All offers are subject to change. The author expressly reserves the right to change, supplement or delete parts of the pages or the entire offer without separate announcement or to cease publication temporarily or permanently.

Final provisions

We have created this data protection declaration with a data protection generator and adapted or extended it independently.
We can adapt and supplement this data protection declaration at any time. We will inform about such adjustments and additions in an appropriate form, in particular by publishing the respective current data protection declaration on our website.

zuletzt geändert: 31.08.23